@tencent-ai/codebuddy-code 2.95.0 → 2.95.1-next.bd7ff53.20260508

package/dist/web-ui/docs/en/cli/release-notes/README.md

@@ -17,6 +17,12 @@ Difference from CHANGELOG.md:
 
 <!-- New versions are automatically added here -->
 
+- [v2.95.0](./v2.95.0.md) - 2026-05-01
+- [v2.94.4](./v2.94.4.md) - 2026-05-01
+- [v2.94.3](./v2.94.3.md) - 2026-04-29
+- [v2.94.2](./v2.94.2.md) - 2026-04-28
+- [v2.94.1](./v2.94.1.md) - 2026-04-28
+- [v2.94.0](./v2.94.0.md) - 2026-04-28
 - [v2.93.7](./v2.93.7.md) - 2026-04-26
 - [v2.93.6](./v2.93.6.md) - 2026-04-25
 - [v2.93.5](./v2.93.5.md) - 2026-04-23

package/dist/web-ui/docs/en/cli/release-notes/v2.94.0.md

@@ -0,0 +1,23 @@
+# 🚀 CodeBuddy Code v2.94.0 Release
+
+## ✨ New Features
+
+### ComputerUse Tool (Experimental)
+
+Adds macOS desktop control capabilities, letting CodeBuddy Code directly "see" the screen and "click" on UI elements:
+
+- Supports 14 actions: screenshot, mouse click / double-click / right-click, drag, scroll, keyboard input, key combinations, wait for window to appear, etc.
+- Screenshots are returned directly to the model as images, no need to read the file separately
+- Disabled by default; set the environment variable `CODEBUDDY_COMPUTER_USE_ENABLED=1` before use
+- The first time you use mouse/keyboard actions, you need to grant the terminal "Accessibility" and "Screen Recording" permissions in System Settings → Privacy & Security
+
+## 🔧 Improvements
+
+- **WeCom Group Bot Voice-to-Text**: Voice messages from WeCom group bots can now automatically read the transcribed text delivered by the server and pass it to the model for understanding — users no longer need to repeat manually. When no transcription is available, an explicit prompt guides the user to send text instead
+- **WeCom Group Bot Image + Text Combined Sending**: When users send both an image and text in a WeCom group, the message is no longer silently dropped; even if the message structure is abnormal, a placeholder fallback ensures it still enters the conversation
+- **AskUserQuestion Multi-Question Fix**: When the model asks multiple questions, the stability of option display and selection has been greatly improved. Issues like "missing one question" or options leaking into another question no longer occur
+
+## 🐛 Bug Fixes
+
+- **Hook Script Calling Service Proxy**: Fixed an issue where hook scripts calling the local service proxy interface via tools like curl were rejected due to missing custom request headers
+- **WeCom Self-Built App Concurrent Messages**: Fixed an issue where two messages arriving concurrently in image + text combined sending scenarios overrode each other, leaving the CLI side unaware of the messages

package/dist/web-ui/docs/en/cli/release-notes/v2.94.1.md

@@ -0,0 +1,6 @@
+# 🚀 CodeBuddy Code v2.94.1 Release
+
+## 🐛 Bug Fixes
+
+- **DeepSeek V4+ Thinking Mode Compatibility**: Fixed an issue where continuing a conversation with history while using thinking mode on DeepSeek V4+ models would return `invalid_request_error`. This is now handled automatically
+- **Custom Model Authentication**: Fixed an authentication issue with custom models

package/dist/web-ui/docs/en/cli/release-notes/v2.94.2.md

@@ -0,0 +1,5 @@
+# 🚀 CodeBuddy Code v2.94.2 Release
+
+## 🐛 Bug Fixes
+
+- **Self-Hosted Deployment Detection**: Removed the logic that inferred the Self-Hosted deployment type from enterprise endpoint configuration, to avoid incorrectly marking the deployment type as Self-Hosted when an enterprise endpoint is configured but the actual environment is cloud-hosted

package/dist/web-ui/docs/en/cli/release-notes/v2.94.3.md

@@ -0,0 +1,10 @@
+# 🚀 CodeBuddy Code v2.94.3 Release
+
+## 🔧 Improvements
+
+- **Enhanced Model Compatibility Adaptation**: The model compatibility adapter adds a "segment-boundary substring" matching fallback rule, which better supports custom model IDs with namespace prefixes like `org/xxx-model` while preserving the priority of exact / prefix matching to avoid false matches on short identifiers
+
+## 🐛 Bug Fixes
+
+- **DeepSeek V4+ Thinking Mode Compatibility**: Fixed an issue where custom DeepSeek V4 models (such as `deepseek-v4-flash`) would return `The reasoning_content in the thinking mode must be passed back to the API` 400 errors in multi-turn conversations. Now, even if thinking mode is not explicitly enabled in the current turn, the reasoning fields are correctly populated based on history messages
+- **Upstream Error Message Readability**: Now compatible with OpenAI-format upstream error responses (`{error: {message, code, type}}`), allowing specific error messages returned by custom models to be displayed in the UI instead of being uniformly replaced by the generic "Server error" placeholder

package/dist/web-ui/docs/en/cli/release-notes/v2.94.4.md

@@ -0,0 +1,5 @@
+# 🚀 CodeBuddy Code v2.94.4 Release
+
+## 🐛 Bug Fixes
+
+- **Custom Model Compatibility**: Fixed an issue where custom models (such as `custom-local:xxx`), when invoked through third-party OpenAI-compatible interfaces, would return 400 errors due to leftover Anthropic-style fields (`verbosity`, `reasoning_summary`, `reasoning_effort`) in the request body. Custom models now work correctly

package/dist/web-ui/docs/en/cli/release-notes/v2.95.0.md

@@ -0,0 +1,43 @@
+# 🚀 CodeBuddy Code v2.95.0 Release
+
+## ✨ New Features
+
+### Agent Team Capability Alignment
+
+Team collaboration capabilities have been significantly enhanced, making multi-agent collaboration more stable and controllable:
+
+- **Teammate Idle Awareness**: The team lead can now precisely query the real-time status of each teammate, wait for a specific teammate to become idle (with timeout and abort signal support), or register a "callback once idle" hook. UI display, task scheduling, graceful shutdown, and other scenarios no longer need to subscribe to a complex stream — a single API call reveals teammate status
+- **Plan Approval UX Alignment**: When a teammate ends a plan in Plan mode, the approval dialog automatically appears in the lead's terminal, with the teammate's color badge, offering three options: "Approve / Continue Planning / Exit Plan Mode" (clearly distinguished from the regular tool-approval semantics of "Approve / Always Approve / Reject")
+- **Graceful Shutdown Handshake + Timeout Fallback**: On `TeamDelete` / manual teammate shutdown, the lead sends a shutdown request and waits for the teammate's response; if the teammate does not respond within the default 15 seconds, the process is automatically force-terminated, preventing stuck teammates from hanging the cleanup flow indefinitely
+- **Teammate Progress Snapshots**: Real-time tracking of how many tool-call rounds each teammate has run, the cumulative text generated, and the most recent 10 tool activity summaries — laying the groundwork for "what is the teammate doing" displays in TUI/Web UI
+
+### New Environment Variables
+
+- `CODEBUDDY_TEAM_IDLE_DETECTION_DISABLED`: Disable teammate idle awareness
+- `CODEBUDDY_TEAM_SHUTDOWN_GRACEFUL_TIMEOUT_MS`: Shutdown fallback timeout in milliseconds (default 15000, set to 0 to disable)
+- `CODEBUDDY_BASH_ASSISTANT_BUDGET_MS`: Main conversation response budget (shared by Bash/PowerShell)
+- `CODEBUDDY_BASH_AUTO_BACKGROUND_DISABLED`: Disable auto-backgrounding on timeout
+
+## 🔧 Improvements
+
+### Bash Tool
+
+- **Auto-Backgrounding on Timeout**: When a foreground command hits `timeout`, the child process is no longer killed directly — it is automatically converted into a background task that keeps running, returning a `task_id` you can use with TaskOutput (compatible with the legacy name BashOutput) to fetch subsequent progress/results. Long cold-start commands like `yarn install` / `docker build` / `cargo build` / `make` that far exceed the default timeout are no longer wrongly killed by the tool layer
+- **Updated Long-Command Guidance**: The description template guides you to explicitly pass `run_in_background: true` for long commands and explains the new semantics where timeout is no longer "kill" but "auto-background"
+
+### PowerShell Tool
+
+- **Auto-Backgrounding on Timeout**: Aligned with the Bash tool — large file downloads via `Invoke-WebRequest`, long `Copy-Item -Recurse`, builds invoked through PowerShell, and other cold-start timeouts are no longer wrongly killed by the tool layer
+- **Background Task Status Query**: Background commands explicitly passed with `run_in_background: true` now fully support TaskOutput querying — you can pull stdout/stderr/status the same way as Bash
+- **Ctrl+B to Background**: Upgraded from a "not implemented" placeholder to a real feature
+- **Main Conversation Response Budget**: Shares `CODEBUDDY_BASH_ASSISTANT_BUDGET_MS` with Bash; commands exceeding the budget are automatically backgrounded to keep the conversation responsive
+
+### Session Interruption Semantics
+
+- Both Bash and PowerShell tools now distinguish between "user-initiated cancellation" and "internal flow switch" interruption signals. On internal flow switches, the running command is no longer killed — instead the tool tries to convert it to a background task to keep running, avoiding wrongly killing long commands due to concurrent calls or turn switching
+
+## 🐛 Bug Fixes
+
+- **PowerShell Background Task Status Update**: After backgrounding, task status now updates to `completed`/`failed` based on the actual exit code (previously it stayed at `running` forever, so TaskOutput queries never saw the final status)
+- **PowerShell Background Task Exception Backfill**: After backgrounding, if the command later terminates abnormally, it no longer bubbles up as a Node `unhandledRejection` warning — the error details are backfilled into the task's stderr output for TaskOutput querying and display
+- **PowerShell Background Wording Accuracy**: The returned messages now accurately distinguish among the five sources: timeout / main conversation budget / Ctrl+B / explicit background / internal interruption, no longer reusing similar wording that caused semantic pollution

package/dist/web-ui/docs/en/cli/settings.md

@@ -62,6 +62,7 @@ The `settings.json` file is the official mechanism for configuring CodeBuddy Cod
 | `permissions` | Permission configuration, see table below | |
 | `hooks` | Configure custom commands to run before and after tool execution. See [hooks documentation](hooks.md) | `{"PreToolUse": {"Bash": "echo 'Running command...'"}}` |
 | `disableAllHooks` | Disable all [hooks](hooks.md) | `true` |
+| `allowUntrustedFrontmatterHooks` | Whether to allow execution of frontmatter `hooks` fields from agents/skills with **non-product-builtin** sources (including local user `.codebuddy/agents\|skills/*.md` and the plugin marketplace). Defaults to `false` to prevent untrusted md files from silently launching shell commands; only product-builtin agents/skills are unaffected. | `true` |
 | `model` | Override the default model used by CodeBuddy Code | `"gpt-5"` |
 | `agent` | Override the agent name used by the main thread (built-in or custom agent), applying that agent's system prompt, tool restrictions, and model configuration. Priority: `product.json default` → `plugin agent` → `settings.json agent` → `CLI --agent` | `"my-reviewer"` |
 | `statusLine` | Configure a custom status line to display context. See [statusLine documentation](#status-line-configuration) | `{"type": "command", "command": "~/.codebuddy/statusline.sh"}` |
@@ -80,6 +81,8 @@ The `settings.json` file is the official mechanism for configuring CodeBuddy Cod
 | `memory` | [Experimental] Memory feature configuration, see [Memory Configuration](#memory-configuration-experimental) | `{"enabled": true}` |
 | `trustedDirectories` | List of working directories that have already been trusted. Matching directories will not trigger the "trust this directory" authorization prompt at startup. Usually populated automatically by the first-run popup, but can also be edited manually | `["~/workspace/myproj"]` |
 | `trustAll` | Trust all working directories, so the "trust this directory" authorization prompt no longer appears at startup. **Only exempts directory trust authorization — does not skip tool execution approval.** Whether tool approval is prompted is still governed by `permissions.defaultMode` / `bypassPermissions` mode and is independent from this field | `true` |
+| `gateway` | Remote Gateway configuration, see [Gateway Configuration](#gateway-configuration) | `{"runTimeoutMs": 1800000}` |
+| `disableUEAutoExclude` | Disable Unreal Engine project auto-exclusion. Default `false`: when a `*.uproject` file exists at the top level of the cwd, the Grep/Glob tools automatically exclude the six UE compile-output and IDE cache directories `Intermediate/ DerivedDataCache/ Saved/ Binaries/ Build/ .vs/` from ripgrep searches. Set to `true` to disable this behavior so searches cover those directories | `true` |
 
 ### Permission Settings
 
@@ -233,6 +236,50 @@ To prevent CodeBuddy Code from accessing files containing sensitive information
 
 Files matching these patterns will be completely invisible to CodeBuddy Code, preventing any accidental exposure of sensitive data.
 
+## Gateway Configuration
+
+The `gateway` field configures the behavior of the Remote Gateway (which exposes endpoints such as `/api/v1/runs` over HTTP/SSE in `--serve` mode).
+
+```json
+{
+  "gateway": {
+    "auth": "none",
+    "maxConnections": 5,
+    "tokenTtlMs": 86400000,
+    "runTimeoutMs": 1800000
+  }
+}
+```
+
+| Field | Description | Default |
+|:-----|:-----|:-----|
+| `auth` | Authentication mode. `"password"` requires the client to present a password; `"none"` performs no authentication (recommended only for loopback) | `"none"` |
+| `password` | The password used when `auth: "password"`. If empty, one is automatically generated and printed to the log on first launch | Auto-generated |
+| `corsOrigins` | Additional Origins allowed for cross-origin Gateway access (no need to include loopback, which is allowed automatically) | `[]` |
+| `maxConnections` | Maximum concurrent ACP protocol connections. The environment variable `CODEBUDDY_ACP_MAX_CONNECTIONS` takes higher priority | `5` |
+| `tokenTtlMs` | ACP session token lifetime (milliseconds). The environment variable `CODEBUDDY_ACP_TOKEN_TTL_MS` takes higher priority | `86400000` (24 hours) |
+| `runTimeoutMs` | Execution timeout for `/api/v1/runs` tasks (milliseconds). On timeout, returns `{code:'EXECUTION_ERROR', message:'Task timed out after Xmin'}` | `1800000` (30 minutes) |
+
+### `runTimeoutMs` Override Priority
+
+Long-running tasks (such as complex agent multi-round searches or large-file processing) may exceed the default 30 minutes. Two override mechanisms are supported:
+
+1. **HTTP request header `X-Codebuddy-Run-Timeout`** (in milliseconds) — **per-request override**, highest priority
+2. **`gateway.runTimeoutMs` in `settings.json`** — process-level default
+3. **Built-in default** — 30 minutes
+
+Example:
+
+```bash
+# Give a single request 60 minutes
+curl -X POST http://127.0.0.1:7890/api/v1/runs \
+  -H "Content-Type: application/json" \
+  -H "X-Codebuddy-Run-Timeout: 3600000" \
+  -d '{"id":"run-1","type":"message","payload":{"text":"..."}}'
+```
+
+Set to `0` or a negative value to disable timeout protection (not recommended; an unfinished long-running task will keep occupying the SSE long connection).
+
 ## Sub-Agent Configuration
 
 CodeBuddy Code supports custom AI sub-agents configurable at user and project levels. These sub-agents are stored as Markdown files with YAML frontmatter:

package/dist/web-ui/docs/en/cli/skills.md

@@ -80,6 +80,33 @@ Available tools:
 | `context` | No | When set to `fork`, the Skill executes in an isolated subagent context | `fork` |
 | `agent` | No | Specifies the subagent type, only effective when `context: fork` | `Explore` |
 
+## Variable Placeholders
+
+The content of SKILL.md supports the following placeholders, which are automatically substituted at load or execution time. The same placeholders also apply to custom slash commands and subagent definitions.
+
+| Placeholder | Replaced With | Applicable Sources |
+|------|------|------|
+| `${CODEBUDDY_PLUGIN_ROOT}` | Plugin installation root directory | Plugin-sourced skills only |
+| `${CODEBUDDY_SKILL_DIR}` | Absolute path of the directory containing the current SKILL.md | All sources |
+| `${CODEBUDDY_SESSION_ID}` | Current session ID (injected at runtime) | All sources |
+| `${MY_ENV_VAR}` and other uppercase environment variables | The value of `process.env.MY_ENV_VAR` | All sources |
+| `${MY_ENV_VAR:-default}` | The environment variable, or the default value when missing | All sources |
+
+For compatibility with Claude Code, `${CLAUDE_PLUGIN_ROOT}`, `${CLAUDE_SKILL_DIR}`, and `${CLAUDE_SESSION_ID}` are also recognized as equivalent aliases.
+
+Unset environment variable placeholders are left as-is rather than replaced with an empty string; in user- or project-sourced skills, `${CODEBUDDY_PLUGIN_ROOT}` is preserved literally (this variable applies only to plugin sources).
+
+**Example**:
+
+```markdown
+---
+description: Skill example with placeholders
+---
+
+Read the script @${CODEBUDDY_SKILL_DIR}/scripts/analyze.py and execute it using the secret ${MY_API_TOKEN:-dev-fallback}.
+Current session identifier: ${CODEBUDDY_SESSION_ID}
+```
+
 ## Execute Shell Commands
 
 Like [Slash Commands](slash-commands.md), Skills also support inline Shell command execution in SKILL.md using the `` !`command` `` syntax. When a Skill is triggered (whether automatically by AI or manually by the user via `/skill-name`), these commands are executed and their output replaces the command in the Skill content for subsequent AI analysis.