Release version 0.25.0

This release is mostly about who is allowed to do what. Two ways a repository could act on your machine without ever asking are closed, an agent can now run its own files and commands so its own sandbox covers them, and OpenCode's permissions get a real editor. Approvals that arrive together no longer hang the agent, and a merge that finds the slot busy queues instead of failing.

New

• OpenCode permissions without the JSON. A Permissions card on OpenCode's settings page: auto-accept everything, set a global default, or pick Allow / Ask / Deny per tool, with pattern rules for the tools that support them. A rule order that would silently override your settings is flagged and fixed in place.
• Let an agent handle its own files and commands. codeg served file reads, writes and terminal commands for every agent, which meant they ran outside whatever sandbox the agent applies to itself. A toggle beside the environment editor (CODEG_ACP_HOST_TOOLS=agent) hands all three back. Off by default — codeg adds no sandbox of its own, so turn it on only for an agent that has one (#436).
• Merges queue instead of failing. Accepting a second reviewed to-do while the project was landing another one used to be refused outright. It now takes a place in line and starts on its own as soon as the slot frees; cards and rows show where it sits and let you leave the queue.
• The connection heart is a button. Click the status icon below the composer for the agent, its real state, working directory, session id and any error — plus a Reconnect that works in every state, including the stuck "connecting" you click it from precisely because it is stuck. It resumes the session rather than starting a new one.
• Live output speed. While an agent is replying, the turn row above the composer shows its output in tokens per second, beside elapsed time and files changed. It also appears in the read-only transcripts on To-dos and loop runs.
• See which agent is on a to-do. Board cards and list rows carry the agent's mark beside the title, resolved the same way the run itself resolves it — so a task inheriting its folder's default shows the agent that will actually run.
• Manage conversations across the whole workspace. The dialog is no longer locked to the folder that opened it: one search row over folder, branch, agent and status filters, with branches folded by prefix so task/49 and task/50 sit under one task/. Each row shows the branch it was started on.

Improved

• Updated bundled agents. OpenCode 1.18.18, Gemini 0.55.1, Cline 3.0.55, Hermes 0.20.1, CodeBuddy 2.136.0, Kimi Code 0.36.1, Grok 1.0.3 and Cursor 2026.08.11.
• The shell you pick applies to agent commands too. The shell setting in General said it covered terminal tabs only; it now also applies when an agent asks codeg to run a whole command line. Leaving it on System default keeps the previous behavior exactly. Agents emit POSIX syntax, so the setting warns that fish, nushell and Windows PowerShell 5.1 may reject it.
• Folder pickers search, and show the real folder name. To-dos, Automations and Token usage now use the same searchable list as the new-conversation composer, showing alias [ name ] over the full path and matching on all three. An alias used to replace the real name, so two folders aliased alike were indistinguishable.
• Worktrees say what they are and where they live. A worktree folder is labeled with the branch checked out there and reads task/49 [ codeg-task-49 ] in the sidebar. Existing worktrees are labeled on startup, and a name you chose yourself is never overwritten.
• The French interface is complete. 61 strings were still surfacing in English — 28 of them the entire Remote Workspace module — and are now translated and aligned to the glossary the rest of the locale uses.
• Release notes come in your language. Releases carry English and Chinese in one body; the settings page and the update popover now render only the half matching your interface language.

Fixed

• pi no longer trusts a repository just because you opened it (#446). codeg marked every folder it launched pi into as trusted in pi's own trust file, which let that repository's .pi/extensions — code that runs at pi startup with your permissions — execute as soon as a Pi conversation was created or restored, with nothing sent and nothing in the transcript. Trust is now an explicit per-workspace decision, prompted only when a repo actually ships such files. Grants written by the old behavior block the launch until you confirm them, and can be reviewed and revoked one by one in pi's settings.
• A symlinked folder is a folder again — and can't be used to reach outside the workspace (#430). A directory made with ln -s rendered as an unopenable file. It now expands through the link. Fixing that surfaced that delete, rename and move had no boundary check at all — with ln -s .. up in a workspace, deleting up/<root name> wiped the whole workspace. All three now require the target to resolve inside the workspace.
• Approvals that arrive together no longer hang the agent (#442). When an agent asked for several permissions at once, only the last one was reachable — the rest could never be answered, their tool calls waited forever, and to-dos sat at "awaiting input". Codex hit this routinely. Requests now queue and are answered in turn, with the number still waiting shown so a queue doesn't read as a hang.
• ~/.codex/config.toml sandbox and approval settings take effect. approval_policy and sandbox_mode were dead in every codeg session — worst case, an explicitly read-only sandbox was silently widened to workspace-write. The launch now derives its mode from your config and never widens the sandbox.
• A sub-agent waiting on you doesn't stall out of sight (#447). A delegated sub-agent stuck on a permission appeared nowhere but a badge inside its parent's transcript, so an unattended run could sit blocked indefinitely. It now reaches the pet badge and panel, where the permission is answered directly, and to-do rows say awaiting input instead of running.
• The reasoning picker sticks on pi's custom providers. It snapped back to Off the moment it was touched, because codeg never declared the model could think. Pi's settings page gains a Reasoning card to declare the levels a custom model supports and the value each is sent as, and editing a model now updates its existing entry instead of being skipped.
• When an agent turns down a setting, it says so. A model or option the agent refuses or downgrades used to look like the dropdown springing back for no reason. codeg now names what was adopted instead, and keeps your preference for the next session.
• Popovers inside dialogs scroll with the wheel. Long lists in a dialog — the folder and branch pickers above all — could only be moved by dragging the scrollbar, which read as broken.
• Toasts can't hide under a dialog. A message raised while a dialog was open painted behind it, so an action that failed inside a dialog looked like it had done nothing. This covers every dialog in the app.
• "Expand the details" now points at something real. The empty-turn errors told you to expand details that existed nowhere; the agent's output now sits behind a disclosure in the status bar's Alerts.
• The agent selector's marks line up. Every icon sat 2px above the center of its pill, and the bar stood 4px taller than it should.

Thanks to @pia, @doublecurry and @Charlie-1909 for contributing to this release.

发布版本 0.25.0

这一版主要在处理「谁有权做什么」。两条仓库可以不经询问就在你机器上动手的路径被堵上；智能体现在可以自己执行文件读写和命令，让它自己的沙箱重新管得住自己；OpenCode 的权限也有了真正的编辑器。同时到达的多个审批不会再把智能体挂死，合并时若通道被占用，也改为排队而不是直接失败。

新增

• OpenCode 权限不用再手写 JSON。 OpenCode 设置页新增「权限」卡片：可以一键全部自动允许、设置全局默认值，或为每个工具单独选择「允许 / 询问 / 拒绝」，支持规则的工具还能配置模式规则。若规则顺序会让你的设置被悄悄覆盖，codeg 会标出并一键修复。
• 让智能体自己处理文件和命令。 此前 codeg 替所有智能体代劳文件读写和终端命令，也就意味着这些操作跑在智能体自身沙箱之外。环境变量编辑器旁新增开关（CODEG_ACP_HOST_TOOLS=agent），把这三样交还给智能体。默认关闭——codeg 自身不提供沙箱，请仅在智能体确实配置了沙箱时开启（#436）。
• 合并改为排队，不再直接失败。 此前在项目正在合并另一个任务时验收第二个任务会被直接拒绝。现在它会排入队列，前一个合并结束后自行开始；卡片和列表行会显示排在第几位，也可随时退出队列。
• 连接指示灯变成了按钮。 点击输入框下方的状态图标，可查看智能体名称、真实状态、工作目录、会话 ID 和错误信息，并带一个在任何状态下都可用的「重连」——包括卡在「连接中」时（你点它正是因为它卡住了）。重连会恢复原会话，而不是新开一个。
• 实时输出速度。 智能体回复期间，输入框上方的回合信息行会显示每秒输出的 token 数，与耗时、改动文件数并列。待办任务和 loop 运行的只读记录中同样可见。
• 一眼看出待办任务由哪个智能体在跑。 看板卡片和列表行在标题旁显示智能体标记，取值方式与真正运行时完全一致——沿用文件夹默认值的任务，显示的也是届时真正会跑的那个。
• 会话管理支持整个工作区。 该对话框不再被打开它的那个文件夹锁死：一行搜索框，下面是文件夹、分支、智能体、状态四个筛选项；分支按前缀折叠，task/49 与 task/50 收进同一个 task/。每一行还会显示它启动时所在的分支。

改进

• 内置智能体版本更新。 OpenCode 1.18.18、Gemini 0.55.1、Cline 3.0.55、Hermes 0.20.1、CodeBuddy 2.136.0、Kimi Code 0.36.1、Grok 1.0.3、Cursor 2026.08.11。
• 所选 shell 同样作用于智能体执行的命令。 「通用」设置里的 shell 选项此前写的是只影响终端标签页，现在智能体请求 codeg 执行整行命令时也会使用它；保持「系统默认」则与此前行为完全一致。智能体发出的是 POSIX 语法，因此设置项会提示 fish、nushell 和 Windows PowerShell 5.1 可能无法识别。
• 文件夹选择器可搜索，并显示真实名称。 待办任务、自动化、Token 用量三处改用与新建会话输入器相同的搜索列表，以 别名 [ 名称 ] 加完整路径显示，三者都能搜到。此前别名会直接替换真实名称，两个别名相同的文件夹因此无法区分。
• 工作树同时显示身份和位置。 工作树文件夹会以其检出的分支命名，在侧边栏显示为 task/49 [ codeg-task-49 ]。此前已注册的工作树在启动时补齐，你自己起过的名字绝不会被覆盖。
• 法语界面已补全。 尚有 61 条文案在界面上显示为英文（其中 28 条是整个「远程工作区」模块），现已全部翻译，并统一到该语言文件其余部分已在使用的术语表。
• 更新说明按界面语言显示。 发布内容把中英文放在同一篇里，现在设置页和状态栏的更新气泡只渲染与界面语言相符的那一半。

修复

• pi 不会再因为你打开了某个仓库就信任它（#446）。 codeg 此前会在 pi 自己的信任文件里把每个启动 pi 的文件夹标记为受信任，于是该仓库的 .pi/extensions——在 pi 启动时以你的权限执行的代码——只要创建或恢复一个 Pi 会话就会被执行，全程没有发送任何内容，会话记录里也不留痕迹。信任现在改为按工作区显式确认，且仅在仓库确实带有这类文件时才提示。旧行为写下的授权在你确认之前会阻止启动，并可在 pi 设置页中逐条查看和撤销。
• 符号链接目录重新变回目录，也不能再借它跑到工作区之外（#430）。 用 ln -s 创建的目录此前被当成打不开的文件，现在可以沿链接展开。修复过程中发现，删除、重命名、移动三个操作根本没有边界检查——工作区里存在 ln -s .. up 时，删除 up/<根目录名> 会抹掉整个工作区。三者现在都要求目标解析后仍位于工作区内。
• 同时到达的多个审批不会再把智能体挂死（#442）。 智能体一次请求多个权限时，只有最后一个是可点的——其余永远无法被回答，其工具调用会一直等下去，待办任务也卡在「等待输入」。Codex 会频繁触发这一情况。现在请求会排队并依次处理，并显示还有多少个在等，让排队不至于看起来像卡死。
• ~/.codex/config.toml 里的沙箱与审批配置真正生效了。 approval_policy 和 sandbox_mode 在 codeg 会话中此前形同虚设——最坏的情况下，你明确设为只读的沙箱会被悄悄放宽为可写工作区。现在启动时会依据你的配置推导运行模式，并且绝不放大沙箱权限。
• 等待你回应的子智能体不会再无声僵住（#447）。 被委托的子智能体遇到权限询问时，除了父会话记录里的一个角标之外无处可见，无人值守的运行可能因此无限期停摆。现在它会出现在宠物角标和面板中，权限可直接在面板里回答；待办任务行也会显示「等待输入」而非「运行中」。
• pi 自定义提供商的思考强度选项不会再弹回。 一碰就跳回「关闭」，原因是 codeg 从未声明该模型具备思考能力。pi 设置页新增「思考」卡片，用于声明自定义模型支持哪些强度、以及每一档实际发送的取值；编辑已有模型现在会更新原有条目，而不是被跳过。
• 智能体拒绝某项设置时会明说。 被智能体拒绝或降级的模型/选项，此前看起来就像下拉框莫名弹回。现在 codeg 会告知它实际采用了什么，并保留你的选择供下次会话使用。
• 弹窗内的浮层可以用滚轮滚动。 弹窗里的长列表（尤其是文件夹和分支选择器）此前只能拖动滚动条，看上去像是坏了。
• 提示消息不会再被弹窗盖住。 弹窗打开时出现的提示会被画在弹窗背后，于是在弹窗里失败的操作看起来就像什么都没发生。此次修复覆盖应用内所有弹窗。
• 「展开详情」现在真的有东西可展开。 空回合报错此前提示你展开详情，而那个展开区根本不存在；智能体的输出现在收在状态栏「提醒」里的折叠区中。
• 智能体选择器的图标对齐了。 每个图标都比所在药丸的中线高 2px，整条选择器也比应有高度多出 4px。

感谢 @pia、@doublecurry、@Charlie-1909 为本次发布做出的贡献。