@tencent-ai/codebuddy-code 2.109.0 → 2.109.1

package/dist/web-ui/docs/en/cli/permissions.md

@@ -4,22 +4,43 @@
 
 ## Permission System Overview
 
-CodeBuddy Code uses a layered evaluation mechanism to balance capability and security. Before each tool call, the following eight phases are evaluated in order:
+CodeBuddy Code's permission system is not just "look at the current mode" — it is a layered evaluation chain. For each tool call, the determination roughly follows this order:
 
 | Phase | Check | Behavior on match |
-| :---- | :---- | :---------------- |
-| 1 | **Deny rules** | Reject immediately, with the highest priority |
-| 2 | **Trusted Allow rules** (user / cli / flag / session / policy / project under a trusted directory / `--allowedTools`) | Allow immediately, and **can bypass command safety checks** |
-| 3 | **Command safety check** (interactive only) | Force confirmation for high-risk / dangerous commands |
-| 4 | **Ask rules** | Force confirmation |
-| 5 | **Bypass mode short-circuit** | Allow directly in `bypassPermissions` mode; downgrade to default when `disableBypassPermissionsMode` is enabled |
-| 6 | **Untrusted Allow rules** (project / local outside trusted directories, plus command / sandbox sources) | Allow, but **cannot bypass command safety checks** |
-| 7 | **Permission Mode strategy** | Decide whether approval is required based on the current [Permission Mode](permission-modes.md) |
-| 8 | dontAsk / async agent fallback | Convert `ask` to `deny` in print / async agent scenarios to avoid deadlock |
+| :--- | :--- | :--- |
+| 0 | **Hooks / interactive tool exceptions** | `PreToolUse` can directly allow / deny / ask; tools like `AskUserQuestion` inherently require interaction |
+| 1 | **Deny rules** | Reject immediately, highest priority |
+| 2 | **Trusted Allow rules** (user / CLI / session / policy / trusted project rules / `--allowedTools`) | Allow immediately, and **can bypass command safety checks** |
+| 3 | **Command safety check** (interactive only) | Force confirmation for high-risk Bash commands |
+| 4 | **Ask rules** | Force ask |
+| 5 | **Bypass mode short-circuit** | `bypassPermissions` allows most actions here; if disabled, it degrades |
+| 6 | **Untrusted Allow rules** (untrusted project rules, command / sandbox sources) | Can allow, but **cannot** bypass command safety checks from the previous step |
+| 7 | **Permission Mode baseline strategy** | The current [Permission Mode](permission-modes.md) decides whether the default is allow or ask |
+| 8 | **Non-interactive fallback** | When no approval dialog can be shown, converts unresolved `ask` to `deny` |
+| 9 | **`dontAsk` / `auto` final catch** | `dontAsk` rewrites ask to deny; `auto` only handles ask and delegates to the classifier |
 
-> **Key point**: deny always takes precedence, and allow is split into two layers: "trusted" and "untrusted". Before the project root is listed as a trusted directory, allow rules in `.codebuddy/settings.json` **cannot bypass the command safety gate**. This is designed to prevent malicious repositories from bypassing local safety protections by pushing their own settings into team PRs.
+> **Key point 1**: `deny` always takes precedence.
+>
+> **Key point 2**: CodeBuddy splits `allow` into "trusted allow" and "untrusted allow" layers. Before you explicitly trust a project directory, `allow` rules in the repository's `.codebuddy/settings.json` / `.codebuddy/settings.local.json` **cannot bypass command safety checks**. This prevents malicious repositories from silently widening local security boundaries by committing their own settings.
+>
+> **Key point 3**: `auto` is not a replacement for the entire chain — it only handles "actions that would still result in ask at the end"; explicit `ask` rules do not enter the classifier.
 
-Read-only tools (Read / Grep / Glob, etc.) do not prompt for approval by default inside trusted directories. Editing tools and Bash always go through the full phase chain.
+Read-only tools (Read / Grep / Glob, etc.) do not prompt for approval by default inside trusted directories. Edit, Bash, and most side-effect tools go through the full evaluation chain.
+
+### Which Takes Precedence: Permission Modes or Rules?
+
+The permission system can be understood as two layers:
+
+- **Rule layer**: `deny` / `ask` / `allow`
+- **Mode layer**: `default` / `acceptEdits` / `auto` / `dontAsk` / ...
+
+In CodeBuddy, **rules typically take precedence over modes**. The most important examples:
+
+- `deny` takes effect before any mode
+- Explicit `ask` rules take effect before `auto`, so manual confirmation is still required
+- `dontAsk` does not bypass rules; it only rewrites the final `ask` result to `deny`
+- `bypassPermissions` does not erase preceding rules; `deny` / `ask` can still block it
+- In interactive sessions, dangerous Bash commands may still enter ask due to safety checks, even under `bypassPermissions`
 
 ## Three Rule Behaviors
 
@@ -50,7 +71,7 @@ When **"Yes, don't ask again"** is selected in the dialog, CodeBuddy writes the
 ### CLI Startup Arguments
 
 | Argument | Purpose |
-| :------- | :------ |
+| :--- | :--- |
 | `--allowedTools <tools...>` | Process-level temporary allow rules. Separated by spaces or commas. Example: `--allowedTools "Bash(git:*) Edit"` |
 | `--disallowedTools <tools...>` | Process-level temporary deny rules. Same as above |
 | `--add-dir <path>` | Add an extra directory to the trusted directory scope (affects whether Read requires confirmation) |
@@ -58,10 +79,10 @@ When **"Yes, don't ask again"** is selected in the dialog, CodeBuddy writes the
 
 ### Configuration Files
 
-See [Settings Configuration](settings.md) for details. CodeBuddy merges these four scopes:
+See [Settings Configuration](settings.md) for details. CodeBuddy merges these 4 scopes:
 
 | Scope | Path |
-| :---- | :--- |
+| :----- | :--- |
 | user | `~/.codebuddy/settings.json` |
 | project | `<repo>/.codebuddy/settings.json` (committed to git) |
 | project-local | `<repo>/.codebuddy/settings.local.json` (not committed to git, local override) |
@@ -76,7 +97,7 @@ Rule form: `Tool` or `Tool(specifier)`.
 Remove the parentheses to match all calls to a tool:
 
 | Rule | Meaning |
-| :--- | :------ |
+| :--- | :--- |
 | `Bash` | All Bash commands |
 | `WebFetch` | All web fetches |
 | `Read` | All file reads |
@@ -89,7 +110,7 @@ Remove the parentheses to match all calls to a tool:
 Write arguments inside the parentheses:
 
 | Rule | Matches |
-| :--- | :------ |
+| :--- | :--- |
 | `Bash(npm run build)` | Exact match for `npm run build` |
 | `Bash(npm:*)` or `Bash(npm *)` | All commands starting with `npm` |
 | `Read(./.env)` | `.env` in the current directory |
@@ -107,7 +128,7 @@ Write arguments inside the parentheses:
 Bash rules support three syntax forms:
 
 | Syntax | Meaning | Example |
-| :----- | :------ | :------ |
+| :--- | :--- | :--- |
 | Exact match | The pattern is exactly equal to the command | `Bash(npm run build)` only matches `npm run build` |
 | `:*` prefix | The pattern ends with `:*` → matches the first word / multi-word prefix of the command | `Bash(git:*)` matches `git status` / `git push origin main` |
 | Wildcard | When the pattern contains `*`, matches as a bash glob pattern (**`*` can cross `/`**) | `Bash(npm run *)` matches `npm run build`; `Bash(ls *)` matches `ls -al /tmp/x` |
@@ -140,7 +161,7 @@ Commands containing `>` / `<` / `>>` / `<<` / `&>` require an **exact match** un
 File rules use glob matching and perform three layers of path normalization:
 
 | pattern | Explanation | Example |
-| :------ | :---------- | :------ |
+| :------ | :--- | :--- |
 | `//path` | Absolute filesystem path | `Read(//etc/hosts)` |
 | `~/path` | Starting from the user's home directory | `Read(~/.zshrc)` |
 | `/path` | Starting from the project root | `Edit(/src/**/*.ts)` |
@@ -167,7 +188,7 @@ Supports the `domain:` prefix for hostname matching (including subdomains).
 MCP tools are named in the format `mcp__<server>__<tool>`. Rules support three granularities:
 
 | Rule | Matches |
-| :--- | :------ |
+| :--- | :--- |
 | `mcp__puppeteer` | All tools of the entire puppeteer server |
 | `mcp__puppeteer__*` | Same as above (wildcard form) |
 | `mcp__puppeteer__navigate` | Only the navigate tool |
@@ -211,7 +232,7 @@ By default, CodeBuddy only considers the **current working directory** trusted.
 Several ways to expand the trusted scope:
 
 | Method | Persistence |
-| :----- | :---------- |
+| :--- | :--- |
 | `--add-dir <path>` startup argument | Process-level |
 | `/add-dir` command within a session | Session-level |
 | `permissions.additionalDirectories` setting | Persistent |
@@ -263,15 +284,16 @@ The `PreToolUse` hook in the [Hooks system](hooks-guide.md) runs before permissi
 Hook exit code semantics:
 
 | Exit code | Behavior |
-| :-------- | :------- |
+| :----- | :--- |
 | `0` + JSON decision | Execute according to `permissionDecision` (allow / ask / deny) in the JSON |
 | `2` | Block (stderr content is passed back to the model) |
 | Other non-0 | Non-blocking error (shown but allowed) |
 
 Notes:
 
-- **deny / ask rules always take effect before hooks**. A hook returning `"allow"` cannot bypass deny in settings
-- However, **blocking hooks** (exit code 2) can short-circuit allow rules before Phase 1, so you can "allow all Bash first, but use hooks to separately block a few specific commands"
+- The structured `permissionDecision` from `PreToolUse` takes effect before regular permission rules: `allow` / `deny` / `ask` directly allows, rejects, or forces confirmation respectively
+- Blocking hooks (exit code 2) can also short-circuit before regular allow rules, so you can "allow all Bash first, but use hooks to separately block a few specific commands"
+- If you need unconditional hard boundaries, it is still recommended to prioritize `permissions.deny` for unified auditing in `/permissions` and settings
 
 ## Working with Sandboxing
 

package/dist/web-ui/docs/en/cli/prewarm.md

@@ -0,0 +1,125 @@
+# Prewarm Process Usage Guide
+
+> Applicable to: `@tencent-ai/codebuddy-code` (`cbc` / `codebuddy`)
+
+The prewarm process lets `cbc` **complete cold startup and suspend** (load bundle → container initialization → authentication → product configuration → MCP discovery), so that when awakened via local IPC it only needs to bind a working directory and can immediately serve. This is ideal for scenarios requiring "sub-second session startup" (e.g., serve/acp gateways, session pools, scheduler pre-launch).
+
+**Benefit**: Local benchmarks show single-session startup wait reduced from approximately **3.7s** to **~1ms**.
+
+> Disabled by default. Only enabled when `--prewarm` is explicitly passed; does not affect any existing usage.
+
+## Quick Start
+
+### 1. Start a Prewarmed Process (Standby)
+
+```bash
+cbc --prewarm --prewarm-id pool1
+```
+
+The process will complete cold startup, then suspend at a local IPC endpoint in standby (without binding a working directory):
+- macOS / Linux: unix socket `/tmp/codebuddy-prewarm-pool1.sock` (permission `0600`, current user only)
+- Windows: named pipe `\\.\pipe\codebuddy-prewarm-pool1`
+
+`--prewarm-id` can be omitted; defaults to using the process PID as the identifier.
+
+### 2. List / Activate (Lightweight Management Command `cbc-prewarm`)
+
+`cbc-prewarm` is a pure Node zero-dependency lightweight command that does not load the main program bundle and returns in milliseconds.
+
+```bash
+# List prewarmed processes discovered on the current machine
+cbc-prewarm list
+
+# Health check
+cbc-prewarm ping pool1
+
+# Query status (idle / activating / active)
+cbc-prewarm status pool1
+
+# Activate: bind to target working directory and start serving
+cbc-prewarm activate pool1 --cwd /path/to/project -- --serve
+```
+
+Arguments after `--` in `activate` are passed through to the awakened process (equivalent to normal `cbc <args>`).
+After activation, the process `chdir`s to `--cwd`, enters the corresponding mode based on the passed-through arguments (e.g., `--serve` / `--acp`), and proactively closes the IPC socket (one-time activation; afterwards it communicates through its own service port).
+
+> **`--cwd` is optional**: When omitted, the prewarmed process retains the working directory from cold startup (no `chdir`, no cwd change broadcast). This is suitable for callers that don't need to switch directories and just want to reuse the prewarmed container. Only pass `--cwd` when you need to bind to a specific project directory.
+
+> **Mode is unrestricted**: The passed-through arguments can be any normal `cbc` arguments. Persistent modes like `--serve`, `--acp`, etc. all take effect as-is — the prewarmed process has no restrictions or rewrites on modes. Pass `--serve` / `--acp` for persistent services; without a persistent mode flag, it takes the one-shot command path, exiting after execution (headless with no TTY).
+
+## External Program Integration (IPC Protocol)
+
+To activate a prewarmed process from your own program, connect to the local socket / pipe and send one line of JSON (NDJSON, one message per line), then read one line of JSON response.
+
+### Address Convention
+
+```
+macOS/Linux : /tmp/codebuddy-prewarm-<id>.sock
+Windows     : \\.\pipe\codebuddy-prewarm-<id>
+```
+
+### Messages
+
+```jsonc
+// Health check
+{ "cmd": "ping" }
+// → { "ok": true, "cmd": "ping", "status": "idle", "pid": 12345 }
+
+// Query status
+{ "cmd": "status" }
+// → { "ok": true, "status": "idle"|"activating"|"active", "cwd": "...", "endpoint": "..." }
+
+// Activate (cwd is optional — omit to retain cold-start cwd; args are passed through to cbc)
+{ "cmd": "activate", "cwd": "/path/to/project", "args": ["--serve"], "sessionId": "optional" }
+// → { "ok": true, "cmd": "activate", "status": "activating", "cwd": "..." }
+```
+
+`activate` can only succeed once; repeated activations return `{ ok: false, error: "already activated" }`.
+
+### Node.js Example
+
+```js
+const net = require('net');
+
+function prewarmAddr(id) {
+  return process.platform === 'win32'
+    ? `\\\\.\\pipe\\codebuddy-prewarm-${id}`
+    : `/tmp/codebuddy-prewarm-${id}.sock`;
+}
+
+function activate(id, { cwd, args = [] }) {
+  return new Promise((resolve, reject) => {
+    const sock = net.connect(prewarmAddr(id), () => {
+      sock.write(JSON.stringify({ cmd: 'activate', cwd, args }) + '\n');
+    });
+    let buf = '';
+    sock.on('data', d => {
+      buf += d;
+      const nl = buf.indexOf('\n');
+      if (nl >= 0) { sock.end(); resolve(JSON.parse(buf.slice(0, nl))); }
+    });
+    sock.on('error', reject);
+  });
+}
+
+// Activate pool1, bind to target directory and start in serve mode
+const res = await activate('pool1', { cwd: '/Users/me/project-A', args: ['--serve'] });
+console.log(res); // { ok: true, cmd: 'activate', status: 'activating', cwd: '...' }
+```
+
+## Behavior and Constraints
+
+- **One process, one session**: Each prewarmed process binds to a working directory only once in its lifetime (at the moment of activation), then is discarded. To serve multiple directories, prewarm multiple processes (with different `--prewarm-id` values), each independent and non-interfering.
+- **Working directory isolation**: After activation, the process `chdir`s and broadcasts a cwd change. File watchers automatically rebind, and project-level caches (settings / memory / skills / plugins / product configuration) are automatically invalidated and rescanned, ensuring no stale configuration from the temporary prewarm directory is read.
+- **USER-level configuration sharing**: User-level settings / authentication / MCP under `~/.codebuddy/` are naturally shared across all prewarmed processes.
+- **Security**: Unix socket permissions are tightened to `0600` (owner only), preventing other users on the same machine from connecting and hijacking.
+- **Exit cleanup**: Graceful exit (SIGINT/SIGTERM) or completion of activation automatically cleans up the socket; sockets left behind by SIGKILL are automatically overwritten on the next startup with the same id.
+
+## Configuration
+
+Prewarm-related parameters can only be configured via CLI flags: `--prewarm` / `--prewarm-id <id>` / `--prewarm-force`.
+
+## Related
+
+- Benchmark and performance data: [scripts/benchmark/README.md](../../scripts/benchmark/README.md)
+- CLI parameter reference: [cli-reference.md](cli-reference.md)

package/dist/web-ui/docs/en/cli/release-notes/README.md

@@ -17,6 +17,20 @@ Difference from CHANGELOG.md:
 
 <!-- New versions are automatically added here -->
 
+- [v2.109.0](./v2.109.0.md) - 2026-06-19
+
+- [v2.108.2](./v2.108.2.md) - 2026-06-18
+- [v2.108.1](./v2.108.1.md) - 2026-06-18
+- [v2.108.0](./v2.108.0.md) - 2026-06-18
+- [v2.107.0](./v2.107.0.md) - 2026-06-17
+- [v2.106.7](./v2.106.7.md) - 2026-06-16
+- [v2.106.6](./v2.106.6.md) - 2026-06-16
+- [v2.106.5](./v2.106.5.md) - 2026-06-16
+- [v2.106.4](./v2.106.4.md) - 2026-06-15
+- [v2.106.3](./v2.106.3.md) - 2026-06-13
+- [v2.106.2](./v2.106.2.md) - 2026-06-13
+- [v2.106.1](./v2.106.1.md) - 2026-06-12
+- [v2.106.0](./v2.106.0.md) - 2026-06-12
 - [v2.105.2](./v2.105.2.md) - 2026-06-10
 - [v2.105.1](./v2.105.1.md) - 2026-06-10
 

package/dist/web-ui/docs/en/cli/release-notes/v2.106.0.md

@@ -0,0 +1,48 @@
+# 🚀 CodeBuddy Code v2.106.0 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|-----------|---------|
+| CodeBuddy Code CLI | v2.106.0 |
+| Agent SDK JS | v0.3.174 |
+| Agent SDK Python | v0.3.173 |
+
+## ✨ New Features
+
+### MCP Apps Interactive Interface
+
+CodeBuddy Code now supports MCP servers declaring interactive HTML tool interfaces, rendered in the Web UI as secure sandboxed iframes. Tool results are no longer limited to displaying text — this is ideal for forms, charts, visual configuration, and other rich interactive scenarios.
+
+### MCP Apps Bidirectional Interaction
+
+MCP Apps can now collaborate bidirectionally with CodeBuddy Code:
+
+- UI can write content back to the conversation, supporting both direct sending and filling into the input box for further editing
+- UI can inject model context for the next conversation turn
+- UI can request display mode switching, trigger file downloads, and notify resource destruction
+- Reverse tool invocations from within the iframe require user authorization first, ensuring security and control
+
+### Tool Defer Loading Override
+
+The `--tools` parameter and custom agent frontmatter `tools` field now support `Defer(...)` / `NoDefer(...)` modifiers. Users can temporarily adjust whether tools are lazily loaded at the session or agent level without modifying global configuration.
+
+## 🔧 Improvements
+
+- **MCP Apps display experience**: Interactive interfaces are now persistently displayed below tool cards, no longer requiring expansion of tool call details to see the main content
+- **Authorization experience optimization**: After selecting "Always Allow" for the same server / tool, no repeated prompts appear within the session; auto-approve mode automatically grants permission
+- **Loading experience optimization**: During history replay, loading states are only shown when resource retrieval exceeds 200ms, reducing flickering
+- **Reverse invocation stability**: Reverse tool calls from the same session / server are queued for sequential execution, preventing concurrent overload from blocking the approval flow
+- **MCP Apps logging**: iframe logs can be synced to the console by level; warning and above levels display deduplicated bottom-right notifications
+- **Prompt suggestion cost optimization**: Next-turn prompt suggestions now use a lightweight model and condensed context for generation, reducing token costs
+
+## 🐛 Bug Fixes
+
+- **MCP tool description drift**: Fixed an issue where prompts retained filtered tools when MCP server connection state changed, reducing model mis-invocations of non-existent tools
+- **Team credit double counting**: Fixed an issue where multiple usage updates for the same message caused credits to be accumulated repeatedly
+- **Cross-version upgrade configuration anomaly**: Fixed an issue where old version product configuration cache polluted new version configuration, reducing post-upgrade configuration behavior anomalies
+- **Trace ID drift**: Fixed an issue where subagent / team agent inherited incorrect rootRequestId in multi-turn conversations, ensuring consistent end-to-end tracing IDs within a single conversation
+- **Team credit statistics accuracy**: Fixed inaccurate statistics caused by requestId tampering in Team scenarios and usage not being correctly forwarded in detached mode
+- **Request cancellation error display**: Cancelling a request now shows a more user-friendly "cancelled" message instead of exposing underlying JSON-RPC structure
+- **MCP Apps history restoration**: Fixed an issue where interactive interfaces no longer displayed after refreshing the Web UI
+- **MCP Apps authorization race condition**: Fixed an authorization matching error where `No active interruption to resolve` could occur during reverse tool invocations

package/dist/web-ui/docs/en/cli/release-notes/v2.106.1.md

@@ -0,0 +1,13 @@
+# 🚀 CodeBuddy Code v2.106.1 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|-----------|---------|
+| CodeBuddy Code CLI | v2.106.1 |
+| Agent SDK JS | v0.3.175 |
+| Agent SDK Python | v0.3.174 |
+
+## 🐛 Bug Fixes
+
+- **Delete key not working (iTerm2 Natural Text Editing preset)**: Fixed an issue where pressing the Forward Delete key (⌦) on an external keyboard had no effect in the input box when iTerm2 loaded the "Natural Text Editing" preset. This preset remaps the physical Delete key to send the Ctrl-D code point. It is now handled according to common editor conventions: when the input is non-empty and there are characters after the cursor, the character after the cursor is deleted; when the input is empty, the "double-press Ctrl-D to exit" interaction is preserved.

package/dist/web-ui/docs/en/cli/release-notes/v2.106.2.md

@@ -0,0 +1,24 @@
+# CodeBuddy Code v2.106.2 Release
+
+## Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.2 |
+| Agent SDK JS | v0.3.176 |
+| Agent SDK Python | v0.3.175 |
+
+## New Features
+
+### Stop Hook Prompt Type Support
+
+Added E2E test coverage for the prompt-type Stop hook lifecycle and robustness validation, ensuring correct Stop hook behavior when triggered by prompt events.
+
+## Improvements
+
+- **Prompt Hook Diagnostics Enhancement**: Improved log output when prompt hook execution fails, now including the event name and specific error details to facilitate troubleshooting Stop hook issues
+- **DeferExecuteTool Image Support**: When MCP tools return image content, it is now automatically converted to a structured format for the downstream processing pipeline
+
+## Bug Fixes
+
+None

package/dist/web-ui/docs/en/cli/release-notes/v2.106.3.md

@@ -0,0 +1,14 @@
+# 🚀 CodeBuddy Code v2.106.3 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.3 |
+| Agent SDK JS | v0.3.177 |
+| Agent SDK Python | v0.3.176 |
+
+## 🐛 Bug Fixes
+
+- **Duplicate Session Title Generation**: Fixed an issue where session titles were generated repeatedly when user messages were in array form (e.g., containing images or multi-segment content). The title determination logic now correctly handles array message content and only triggers generation when visible text exists and is not a system reminder.
+- **Duplicate Context Injection on Compressed Continuation**: Fixed an issue where user context was repeatedly injected into history when continuing a conversation after history compression, avoiding context redundancy and improving continuation accuracy.

package/dist/web-ui/docs/en/cli/release-notes/v2.106.4.md

@@ -0,0 +1,24 @@
+# 🚀 CodeBuddy Code v2.106.4 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.4 |
+| Agent SDK JS | v0.3.178 |
+| Agent SDK Python | v0.3.177 |
+
+## ✨ New Features
+
+### WeChat Pay Authorization Card
+
+Added client-side payment authorization card capability. When a tool execution requires user payment confirmation, CodeBuddy Code can display a payment card on the client, allowing users to authorize, cancel, or view payment results, with the response sent back to the executing task.
+
+## 🔧 Improvements
+
+- **Sandbox Runtime Distribution**: Upgraded the built-in sandbox platform package version and improved platform artifact collection during the release packaging phase, enhancing sandbox runtime distribution consistency.
+- **Payment Card Status Display**: Optimized payment final state feedback, providing more accurate display for payment success, incomplete, or timeout scenarios.
+
+## 🐛 Bug Fixes
+
+- **MCP Dynamic Authorization State**: Fixed an issue where overly broad matching in MCP validation logic caused dynamic authorization states to be incorrectly cleared, preventing abnormal MCP configuration or authorization state issues.

package/dist/web-ui/docs/en/cli/release-notes/v2.106.5.md

@@ -0,0 +1,18 @@
+# 🚀 CodeBuddy Code v2.106.5 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.5 |
+| Agent SDK JS | v0.3.179 |
+| Agent SDK Python | v0.3.178 |
+
+## 🐛 Bug Fixes
+
+- **--help mode hanging**: Fixed an issue where the process could not exit when running `--help` due to async initialization blocking. Added timeout protection and interrupt support.
+- **MCP server wait blocking**: Fixed an issue where MCP server startup wait blocked output in `--help` mode.
+- **Outdated error recovery prompts**: Fixed an issue where the tool name list in system prompts was not updated to reflect current actual tool names after a tool call failure.
+- **State stuck after main conversation ends**: Fixed an issue in interactive mode where the bottom loading status occasionally got stuck on "waiting for model" after the main task ended, with ESC unresponsive. Background auxiliary calls no longer incorrectly occupy the main session running state.
+- **Glob search tool hanging**: Fixed an issue where the Glob tool could hang permanently in parallel search scenarios. Refactored the underlying search flow's completion determination and timeout control to ensure normal return even when hitting very large directories.
+- **Multi-expert collaboration stuck**: Fixed an issue in multi-member collaboration scenarios where the lead could get stuck on "thinking" with no output when the last member completed. Ensures completion notifications are reliably delivered.

package/dist/web-ui/docs/en/cli/release-notes/v2.106.6.md

@@ -0,0 +1,15 @@
+# 🚀 CodeBuddy Code v2.106.6 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.6 |
+| Agent SDK JS | v0.3.180 |
+| Agent SDK Python | v0.3.179 |
+
+## 🐛 Bug Fixes
+
+- **Command execution compatibility**: Fixed an issue where command execution failed in non-POSIX login shells such as fish. Now automatically falls back to a compatible shell for command execution, avoiding direct errors caused by shell syntax incompatibility.
+- **Custom model tool call stability**: Fixed an issue where tool calls failed when some models repeatedly sent tool call IDs in streaming responses, improving tool call pipeline stability.
+- **Background task output reading**: Task output files are now written to temporary directories isolated by user and working directory, avoiding directory permission conflicts in shared environments that affected background task result reading.

package/dist/web-ui/docs/en/cli/release-notes/v2.106.7.md

@@ -0,0 +1,13 @@
+# 🚀 CodeBuddy Code v2.106.7 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.106.7 |
+| Agent SDK JS | v0.3.181 |
+| Agent SDK Python | v0.3.180 |
+
+## 🔧 Improvements
+
+- **Telemetry module maintenance**: Cleaned up telemetry-related code formatting to keep release build output stable and reduce irrelevant formatting differences in subsequent releases.

package/dist/web-ui/docs/en/cli/release-notes/v2.107.0.md

@@ -0,0 +1,30 @@
+# 🚀 CodeBuddy Code v2.107.0 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.107.0 |
+| Agent SDK JS | v0.3.182 |
+| Agent SDK Python | v0.3.181 |
+
+## ✨ New Features
+
+### Prewarm Process
+
+Added `--prewarm` standby mode, allowing CodeBuddy Code to complete startup initialization and suspend, then be awakened via local IPC and bound to a working directory when needed. A companion `cbc-prewarm` management command is provided, supporting listing, health checking, status querying, and activating prewarmed instances. This significantly reduces wait time in scenarios with frequent new session startups.
+
+## 🔧 Improvements
+
+- **More unified prewarm configuration**: Prewarm capabilities are now uniformly controlled through `--prewarm`, `--prewarm-id`, and `--prewarm-force` CLI parameters, reducing troubleshooting costs caused by mixing environment variables and command-line options.
+- **More reliable working directory switching**: Switching working directories now automatically refreshes file watchers and project-level caches, preventing settings, memories, skills, plugins, and product configurations from continuing to reference the old directory.
+- **Clearer prewarm instance management**: `cbc-prewarm list` can now correctly discover standby instances; instances with the same `prewarmId` no longer compete with each other by default — only when `--prewarm-force` is explicitly passed will the old instance be taken over.
+- **ZIP marketplace leftover cleanup**: After successful installation or update, orphaned temporary zip files and extracted directories older than 1 hour under `~/.codebuddy/plugins/marketplaces/` are automatically cleaned up, reducing disk residuals.
+
+## 🐛 Bug Fixes
+
+- **False idle notifications**: Fixed an issue where "waiting for input" notifications were repeatedly triggered while the agent was still outputting or executing tools, avoiding notification spam during busy periods.
+- **Sandbox approval timeout experience**: Extended the sandbox command approval wait time to 30 minutes, treating timeouts as "user canceled", and automatically closing residual approval dialogs.
+- **Workspace trust false error message**: Fixed an issue where `apiKeyHelper blocked` error messages persisted after workspace trust was completed, reducing the "already trusted but appears to have failed" confusion.
+- **Task numbering order**: Fixed an issue where task numbers were inconsistent with the planned order when creating multiple tasks concurrently, making the task list better reflect the actual creation order.
+- **fish shell safe-delete compatibility**: Fixed an issue where the safe-delete path restoration logic in fish and other non-POSIX shells would throw syntax errors before execution.

package/dist/web-ui/docs/en/cli/release-notes/v2.108.0.md

@@ -0,0 +1,20 @@
+# 🚀 CodeBuddy Code v2.108.0 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.108.0 |
+| Agent SDK JS | v0.3.183 |
+| Agent SDK Python | v0.3.182 |
+
+## ✨ New Features
+
+### Model Switch Prompt
+
+When a model is manually pinned in the project configuration, after the user persistently switches models via `/model`, CodeBuddy Code now explicitly notifies that the project configuration will still override the current selection after restart, and suggests removing the model setting from the project configuration to truly persist the new default model.
+
+## 🐛 Bug Fixes
+
+- **More accurate request tracing**: Fixed an issue where multiple model requests in multi-turn conversations reused the same set of request identifiers. Now each HTTP request generates an independent `X-Request-ID`, making it easier to trace request chains.
+- **More stable custom Agent configuration generation**: Fixed an issue where AI-generated custom Agent configurations could produce unparseable frontmatter in scenarios with multi-line descriptions or inheriting all tools, reducing cases where the configuration fails to load after generation.

package/dist/web-ui/docs/en/cli/release-notes/v2.108.1.md

@@ -0,0 +1,15 @@
+# 🚀 CodeBuddy Code v2.108.1 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.108.1 |
+| Agent SDK JS | v0.3.184 |
+| Agent SDK Python | v0.3.183 |
+
+## 🐛 Bug Fixes
+
+- **Expert team content output display anomaly**: Fixed an issue in multi-agent collaboration scenarios where adjacent streaming output fragments had drifting message grouping identifiers, causing "deep thinking" content to be split into multiple messages. Also fixed an issue where the same session was triggered to run concurrently due to race conditions, causing interleaved model streaming fragments.
+- **Context summary sampling parameters aligned with main conversation**: Fixed an issue where summary requests bypassed the model configuration interceptor, resulting in missing sampling parameters such as temperature and reasoning. Summary requests now use the same model configuration as the main conversation.
+- **safe-delete syntax error in fish shell**: Fixed a syntax error caused by empty bootstrap being concatenated into the command chain in fish shell, ensuring both regular shell commands and sandbox commands execute correctly.

package/dist/web-ui/docs/en/cli/release-notes/v2.108.2.md

@@ -0,0 +1,13 @@
+# 🚀 CodeBuddy Code v2.108.2 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.108.2 |
+| Agent SDK JS | v0.3.185 |
+| Agent SDK Python | v0.3.184 |
+
+## 🐛 Bug Fixes
+
+- **Conversation credit attribution**: Fixed an issue where request identifiers were reused across multi-turn conversations, which could cause credit consumption to be incorrectly attributed to the previous message turn. Credits are now accurately attributed to each conversation turn.

package/dist/web-ui/docs/en/cli/release-notes/v2.109.0.md

@@ -0,0 +1,24 @@
+# 🚀 CodeBuddy Code v2.109.0 Release
+
+## 📦 Version Information
+
+| Component | Version |
+|------|------|
+| CodeBuddy Code CLI | v2.109.0 |
+| Agent SDK JS | v0.3.186 |
+| Agent SDK Python | v0.3.185 |
+
+## ✨ New Features
+
+### Auto Permission Mode
+
+Introducing the `auto` permission mode, which allows CodeBuddy Code to intelligently determine whether each tool invocation requires user approval while maintaining safe boundaries, reducing frequent confirmation prompts that interrupt continuous tasks.
+
+- **Smart classification and passthrough**: Dynamically decides whether the current tool invocation can be executed directly based on operation risk, contextual semantics, and historical rejection records.
+- **Secondary verification mechanism**: Adds a critique review step that double-checks classification results to reduce the probability of false approvals.
+- **In-session rejection memory**: Records tool invocations that the user has manually rejected, preventing repeated requests for the same operation within a session.
+- **Automatic permission context injection**: Automatically injects current permission constraints into the model, helping it more accurately understand the executable boundaries.
+
+## ⚠️ Upgrade Notes
+
+- **Hook permission mode output change**: `HookInput.permission_mode` now outputs the actual runtime permission mode, which may include new values such as `plan`, `auto`, and `bypassPermissions`. If your custom hooks only handle the `default`, `acceptEdits`, and `dontAsk` cases, please update your branch logic accordingly.