oacp-cli 0.3.2__tar.gz → 0.3.4__tar.gz

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.4] - 2026-06-11
+
+### Fixed
+
+- Receiver autonomy Gate 1 now performs real message schema validation, expiry
+  comparison, SHA-256 hash recording, and same-receiver replay detection before
+  auto-accepting work.
+- Receiver autonomy Gate 3 now pauses on credentials, pricing, commercial
+  content, and anchored config-sensitive scope, and evaluates external
+  side-effect hard stops before sensitive-scope hard stops to match the
+  protocol.
+
+## [0.3.3] - 2026-06-11
+
+### Added
+
+- `oacp watch --state-id <id>` for per-subscriber cursor files, allowing
+  concurrent watchers of the same agent inbox to receive the same new-message
+  events without sharing a cursor.
+
+### Changed
+
+- Docs: refreshed the runtime capability matrix and prompt-caching guidance
+  for current runtime releases.
+
+### Fixed
+
+- `oacp send --oacp-dir` and `oacp inbox --oacp-dir` now expand `~` through the
+  shared OACP home resolver instead of treating it as a literal path component.
+- Inbox and outbox delivery writes now use same-directory temp files plus
+  atomic replace so readers do not observe partial `.yaml` messages.
+- Memory archive tests now isolate git config while preserving test identities,
+  so local commit-signing settings do not break the suite.
+
 ## [0.3.2] - 2026-05-26
 
 ### Added
@@ -158,6 +192,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.3.4]: https://github.com/kiloloop/oacp/compare/v0.3.3...v0.3.4
+[0.3.3]: https://github.com/kiloloop/oacp/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/kiloloop/oacp/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/kiloloop/oacp/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/kiloloop/oacp/compare/v0.2.3...v0.3.0

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oacp-cli
-Version: 0.3.2
+Version: 0.3.4
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp
@@ -270,7 +270,7 @@ uv tool install .
 
 **`oacp send`**: `--in-reply-to`, `--expires`, `--body-file`, `--channel`, `--dry-run`, `--json`, `--quiet`
 
-**`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--show-archived`
+**`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--state-id <id>` for per-subscriber cursors, `--show-archived`
 
 **`oacp doctor`**: `--fix` (auto-fix safe issues), `--memory`, `--json`, `-o/--output`
 

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/QUICKSTART.md

@@ -157,11 +157,14 @@ body: |
 
 To watch for new messages from a standing runtime or Monitor, use `oacp watch`.
 A single `oacp watch` run scans once and exits, so keep re-running it when you
-want a persistent worker:
+want a persistent worker. If more than one watcher follows the same agent
+inbox, give each watcher a stable `--state-id` so each subscriber has its own
+cursor:
 
 ```bash
+OACP_WATCH_STATE_ID="${OACP_WATCH_STATE_ID:-$(uuidgen 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')}"
 while true; do
-  oacp watch --project my-first-project --agent codex || true
+  oacp watch --project my-first-project --agent codex --state-id "$OACP_WATCH_STATE_ID" || true
   sleep 120
 done
 ```

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/README.md

@@ -244,7 +244,7 @@ uv tool install .
 
 **`oacp send`**: `--in-reply-to`, `--expires`, `--body-file`, `--channel`, `--dry-run`, `--json`, `--quiet`
 
-**`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--show-archived`
+**`oacp watch`**: `--agent`, repeatable `--project`, `--all-projects`, `--json`, `--since` (default `now`), `--state-id <id>` for per-subscriber cursors, `--show-archived`
 
 **`oacp doctor`**: `--fix` (auto-fix safe issues), `--memory`, `--json`, `-o/--output`
 

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/from-claude-p.md

@@ -79,10 +79,9 @@ Set me up as an async OACP worker for this repo.
    --project form checks this workspace's inbox, schema, and status.
 6. Start a Monitor that keeps oacp watch re-running for the claude
    agent on this project. A single oacp watch does one scan and exits,
-   so it has to run on a loop — while true; do oacp watch --project
-   <project> --agent claude || true; sleep 120; done — otherwise you
-   only pick up tasks that happened to be there at setup time. Then
-   tell me the exact oacp send command I use to dispatch a task to you.
+   so it has to run on a loop. Use a stable --state-id for that Monitor
+   so concurrent watchers each keep their own cursor. Then tell me the
+   exact oacp send command I use to dispatch a task to you.
 
 Protocol reference: https://github.com/kiloloop/oacp/blob/main/QUICKSTART.md
 ~~~
@@ -116,8 +115,9 @@ oacp doctor --project my-project
 Then, in a Claude Code session, arm the watcher in a Monitor. `oacp watch` does one scan and exits, so it has to run on a loop:
 
 ```
+OACP_WATCH_STATE_ID="${OACP_WATCH_STATE_ID:-$(uuidgen 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')}"
 while true; do
-  oacp watch --project my-project --agent claude || true
+  oacp watch --project my-project --agent claude --state-id "$OACP_WATCH_STATE_ID" || true
   sleep 120
 done
 ```

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/guides/prompt_caching.md

@@ -5,8 +5,8 @@ How to maximize prompt cache hits across Claude, Codex, and Gemini to reduce cos
 ## Why It Matters
 
 Prompt caching avoids reprocessing static context (system prompts, CLAUDE.md, project facts) on every turn. In practice:
-- **Cache read**: 10x cheaper than uncached input ($1.50/MTok vs $15/MTok for Opus)
-- **Cache write**: 1.25x input price (one-time cost, amortized over subsequent reads)
+- **Cache read**: 10x cheaper than uncached input ($0.50/MTok vs $5.00/MTok for Opus 4.8)
+- **Cache write**: 1.25x input price for the default 5-minute TTL, 2x for the 1-hour TTL (one-time cost, amortized over subsequent reads)
 - **Observed savings**: 83-95% cost reduction on cached input in multi-turn agent sessions
 
 ## Claude
@@ -127,13 +127,14 @@ Gemini supports implicit context caching for large prompts. The API automaticall
 
 ## Cost Comparison
 
-Approximate pricing as of early 2026 (per million tokens). Check each provider's current pricing page for up-to-date rates:
+Approximate pricing as of June 2026 (per million tokens). Cache read is 0.1x input; cache write is shown at the default 5-minute TTL (1.25x input) — the 1-hour TTL costs 2x input. Check each provider's current pricing page for up-to-date rates:
 
 | Runtime | Input | Cached Read | Cache Write | Output |
 |---------|------:|------------:|------------:|-------:|
-| Claude Opus | $15.00 | $1.50 | $18.75 | $75.00 |
-| Claude Sonnet | $3.00 | $0.30 | $3.75 | $15.00 |
-| Claude Haiku | $0.80 | $0.08 | $1.00 | $4.00 |
+| Claude Fable 5 | $10.00 | $1.00 | $12.50 | $50.00 |
+| Claude Opus (4.6/4.7/4.8) | $5.00 | $0.50 | $6.25 | $25.00 |
+| Claude Sonnet 4.6 | $3.00 | $0.30 | $3.75 | $15.00 |
+| Claude Haiku 4.5 | $1.00 | $0.10 | $1.25 | $5.00 |
 | Codex | varies | N/A | N/A | varies |
 | Gemini Pro | $1.25 | $0.31 | — | $10.00 |
 
@@ -146,3 +147,4 @@ Approximate pricing as of early 2026 (per million tokens). Check each provider's
    - Injecting timestamps or random IDs into system prompts
    - Reordering tool definitions between turns
    - Changing the user message prefix frequently
+5. **Mind the minimum cacheable prefix** — prefixes below the model minimum silently don't cache (no error; `cache_creation_input_tokens` stays 0). The minimum is 2,048 tokens on Fable 5 and Sonnet 4.6, and 4,096 tokens on Opus 4.8/4.7/4.6 and Haiku 4.5.

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/guides/runtime_capability_matrix.md

@@ -1,12 +1,12 @@
 # Cross-Runtime Parity Matrix
 
-**Date**: 2026-04-29
+**Date**: 2026-06-09
 
 This is a capability comparison across the currently profiled agent runtimes (Claude Code, Codex, Gemini), compiled from each runtime's self-report and current runtime changelogs. Cursor support is scaffold-only until Cursor-owned onboarding lands, so Cursor is intentionally excluded from this comparison table; see `docs/protocol/runtime_capabilities.md` for its conservative scaffold defaults.
 
-Claude was last checked against Claude Code `v2.1.123`.
+Claude was last checked against Claude Code `v2.1.170` with Claude Fable 5 (`claude-fable-5`, serving model verified in-session on the 1M-context variant). Fable 5 (released 2026-06-09, first Mythos-class model) is included at no extra cost on Pro/Max/Team/Enterprise plans Jun 9–22, 2026, with usage credits required after; Opus 4.8 remains available and serves as Fable 5's safeguard-fallback model.
 
-Codex was last checked against app update `26.415`, CLI `0.123.0`, and OpenAI's GPT-5.5 launch note from 2026-04-23.
+Codex was last checked against app update `26.602`, CLI `0.137.0`, OpenAI's GPT-5.5 launch note from 2026-04-23, and the June 2026 Codex/API entries for Sites and Amazon Bedrock.
 
 ---
 
@@ -15,19 +15,19 @@ Codex was last checked against app update `26.415`, CLI `0.123.0`, and OpenAI's
 | Capability             | Claude (Claude Code CLI)                                                   | Codex (Desktop App)                                                                            | Gemini                                                                |
 | ---------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
 | Spawn background tasks | Yes — Task tool + Bash `run_in_background`                                 | Yes — shell background processes                                                               | Yes — `run_command` async mode                                        |
-| Spawn subagents        | Yes — typed agents (Explore, Plan, general-purpose, code-reviewer, etc.)   | Yes — native `spawn_agent` lifecycle with `default`, `explorer`, and `worker` agents          | Partial — `browser_subagent` only                                     |
+| Spawn subagents        | Yes — typed agents (Explore, Plan, general-purpose, code-reviewer, etc.)   | Yes — native multi-agent lifecycle with runtime metadata and follow-up defaults                | Partial — `browser_subagent` only                                     |
 | Parallel agent teams   | Yes — TeamCreate, task lists, SendMessage, broadcast                       | Partial — parallel spawned agents are supported, but there is no team/task-list primitive      | No — parallel tool calls but no independent agent instances           |
-| MCP tools              | Yes — extensible via MCP servers                                           | Yes — MCP/plugin support with `/mcp verbose` diagnostics; configuration-dependent             | Yes — MCP server support                                              |
-| Web search             | Yes — native WebSearch tool                                                | Yes — web search/fetch tools                                                                   | Yes — native `search_web` tool                                        |
-| Browser interaction    | Partial — WebFetch (read-only, HTML→markdown)                              | Partial — web tools plus early in-app browser for local/public pages without sign-in           | Yes — full browser control (click, type, navigate, screenshot, video) |
-| File system access     | Sandboxed — configurable read/write allowlists                             | Policy-dependent per session; sandbox profiles can include deny-read rules                     | Full — unrestricted                                                   |
+| MCP tools              | Yes — extensible via MCP servers                                           | Yes — MCP/plugin support with `/mcp verbose`, per-server environment targeting, read-only MCP parallelism, and scriptable plugin inventory | Yes — MCP server support                                              |
+| Web search             | Yes — native WebSearch tool                                                | Yes — web search/fetch tools; hosted web tools are expanding in code-mode flows                | Yes — native `search_web` tool                                        |
+| Browser interaction    | Partial — WebFetch (read-only, HTML→markdown)                              | Partial — in-app browser and Chrome extension can inspect local/public and approved browser contexts, with faster asset extraction and read-only JS structured-data extraction; not full browser automation | Yes — full browser control (click, type, navigate, screenshot, video) |
+| File system access     | Sandboxed — configurable read/write allowlists                             | Policy-dependent per session; named permission profiles can include deny-read rules and managed requirements | Full — unrestricted                                                   |
 | Git operations         | Yes — via Bash (may need sandbox configuration)                            | Yes — native                                                                                   | Yes — via shell                                                       |
 | GitHub CLI (gh)        | Yes — via Bash (may need sandbox configuration)                            | Yes — authenticated                                                                            | Yes — native                                                          |
 | Session memory         | Strong — auto-loaded MEMORY.md + optional MCP memory                       | Partial — app memories where available plus OACP file memory; app memories are not protocol SSOT | Partial — Knowledge Items (not directly writable), conversation logs  |
-| Interactive mode       | Yes — CLI chat with permissions, plan mode                                 | Yes — desktop app and CLI/TUI, including Plan Mode and side conversations                      | Yes — chat with task UI, artifacts                                    |
-| Context window         | ~1M with Opus 4.7 (auto-compaction extends indefinitely)                   | Model-dependent; GPT-5.5 in Codex is documented at 400K, with no auto-compaction guarantee      | ~1M tokens                                                            |
-| Cost model             | Token-based, visible in statusline                                         | Not surfaced per session; GPT-5.5 Fast mode trades 2.5x cost for 1.5x token generation speed   | Token-based                                                           |
-| Sandbox restrictions   | Yes — configurable allowlists                                              | Session-dependent; supports deny-read policies, isolated `codex exec`, and remote sandbox requirements | None — full system access                                             |
+| Interactive mode       | Yes — CLI chat with permissions, plan mode                                 | Yes — desktop app and CLI/TUI, including Plan Mode, Goal mode, side conversations, and archive/unarchive flows | Yes — chat with task UI, artifacts                                    |
+| Context window         | ~1M with Fable 5 or Opus 4.8 (auto-compaction extends indefinitely)        | Model-dependent; GPT-5.5 in Codex is documented at 400K, with no auto-compaction guarantee      | ~1M tokens                                                            |
+| Cost model             | Token-based, visible in statusline; Fable 5 API rate is $10/$50 per MTok (2× Opus 4.8's $5/$25) | Not surfaced per session; GPT-5.5 Fast mode trades 2.5x cost for 1.5x token generation speed   | Token-based                                                           |
+| Sandbox restrictions   | Yes — configurable allowlists                                              | Session-dependent; supports deny-read policies, isolated `codex exec`, named permission profiles, managed requirements, and explicit approval policies | None — full system access                                             |
 
 ---
 
@@ -37,6 +37,7 @@ Codex was last checked against app update `26.415`, CLI `0.123.0`, and OpenAI's
 | -------------------------------- | ------------- | ---------------------------------------------------------------------------- |
 | Typed subagent orchestration     | Claude        | Multiple agent types with scoped tools and model selection                   |
 | Team coordination primitive      | Claude        | TeamCreate + task lists + assignment + broadcast + shutdown                  |
+| Dynamic multi-agent workflows    | Claude        | Workflow tool orchestrates tens–hundreds of agents; `/workflows` to view     |
 | Plan mode                        | Claude, Codex | Claude has structured explore → plan → approve → implement; Codex CLI can move from planning into fresh-context implementation |
 | Auto-compaction                  | Claude        | Context auto-compresses, enabling unlimited session length                   |
 | Cross-session semantic search    | Claude        | MCP-based searchable memory (optional)                                       |
@@ -48,8 +49,14 @@ Codex was last checked against app update `26.415`, CLI `0.123.0`, and OpenAI's
 | PTY / terminal stdin             | Codex, Gemini | Codex: native PTY; Gemini: `send_command_input` (Claude lacks stdin support) |
 | `apply_patch` editing            | Codex         | Grammar-based file edits                                                     |
 | App-level computer use           | Codex         | macOS app, simulator, and GUI-only workflows; unavailable in EEA, UK, and Switzerland at launch |
+| Windows computer use             | Codex         | Codex app can operate Windows desktop apps in the foreground when available                    |
+| Remote host control              | Codex         | Mobile or desktop remote control can run work on connected Mac or Windows hosts with host-local files, credentials, plugins, skills, and config |
 | App-level artifact review        | Codex         | Sidebar preview for generated PDFs, spreadsheets, documents, and presentations |
 | App-level PR review              | Codex         | PR sidebar can inspect changed files, review comments, and follow-up fixes   |
+| App-server automation            | Codex         | JSON-RPC app-server, SDK, schema generation, thread APIs, and websocket/Unix-socket transports for custom clients |
+| Hosted site deployment           | Codex         | Sites preview can create, deploy, inspect, and manage hosted websites or internal tools through the Codex app |
+| Plugin marketplace inventory     | Codex         | Plugin directory plus `codex plugin list --json` for installed plugin inventory and marketplace-aware diagnostics |
+| Goal mode                        | Codex         | Stable long-running objective mode with dedicated state; candidate for OACP wait/review-loop experiments |
 
 ---
 
@@ -71,9 +78,9 @@ Scope: skills shipped in [`kiloloop/oacp-skills`](https://github.com/kiloloop/oa
 
 | Dimension       | Claude                                                                 | Codex                                                                   | Gemini                                                               |
 | --------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------- |
-| Best at         | Orchestration, multi-agent teams, persistent memory, plan-then-execute | Terminal-native execution, GPT-5.5 agentic coding, fast iterative patching, plan-to-implementation handoff, app-assisted PR/artifact review, protocol discipline | Web research, browser automation, visual verification, large context |
-| Ideal task type | Team coordination, complex multi-file refactors, long-running sessions | Shell-heavy workflows, long-horizon coding, targeted file edits, deterministic scripts, PR follow-up, artifact review, CLI planning passes | External research, UI testing, document review, MCP integrations     |
-| Cost profile    | Flexible (haiku subagents for cheap tasks, opus for complex)           | Per-session cost not visible; GPT-5.5 is described as more token-efficient than GPT-5.4 for Codex tasks | Token-based, web search has additional costs                         |
+| Best at         | Orchestration, multi-agent teams, persistent memory, plan-then-execute | Terminal-native execution, GPT-5.5 agentic coding, fast iterative patching, plan-to-implementation handoff, app-assisted PR/artifact review, app-server automation, protocol discipline | Web research, browser automation, visual verification, large context |
+| Ideal task type | Team coordination, complex multi-file refactors, long-running sessions | Shell-heavy workflows, long-horizon coding, targeted file edits, deterministic scripts, PR follow-up, artifact review, CLI planning passes, plugin/app-server automation prototypes | External research, UI testing, document review, MCP integrations     |
+| Cost profile    | Flexible (haiku subagents for cheap tasks, opus for complex, Fable 5 at 2× Opus API rates for the hardest work) | Per-session cost not visible; GPT-5.5 is described as more token-efficient than GPT-5.4 for Codex tasks | Token-based, web search has additional costs                         |
 
 ---
 
@@ -82,7 +89,7 @@ Scope: skills shipped in [`kiloloop/oacp-skills`](https://github.com/kiloloop/oa
 | Limitation                    | Claude                        | Codex                                                          | Gemini                 |
 | ----------------------------- | ----------------------------- | -------------------------------------------------------------- | ---------------------- |
 | No subagents                  | —                             | Yes                                                            | Partial (browser only) |
-| No browser automation         | Yes (read-only)               | Partial (in-app browser is not full automation and excludes sign-in flows) | —                      |
+| No browser automation         | Yes (read-only)               | Partial (in-app browser and Chrome extension are useful for review/verification, but not a general full-browser automation substitute) | —                      |
 | No image generation           | Yes                           | —                                                              | —                      |
 | No persistent writable memory | —                             | Partial (app memories are not a replacement for OACP durable memory) | Yes                    |
 | Sandbox friction              | Yes (configurable)            | Session-dependent                                              | —                      |
@@ -90,6 +97,7 @@ Scope: skills shipped in [`kiloloop/oacp-skills`](https://github.com/kiloloop/oa
 | Context limits                | Auto-compaction mitigates     | Model-dependent; GPT-5.5 in Codex is 400K, but there is no documented auto-compaction behavior | Large but finite       |
 | No terminal stdin             | Yes                           | —                                                              | —                      |
 | Cost not surfaced             | —                             | Yes                                                            | —                      |
+| Serving model can change mid-session | Yes (Fable 5 only — cyber/bio-chem/distillation classifiers fall back to Opus 4.8; default and non-configurable in Claude interfaces incl. Claude Code, with a session event emitted; <5% of sessions — system card §1.5) | — | — |
 
 ---
 
@@ -102,7 +110,7 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 | No team orchestration       | Codex, Gemini                      | Cannot run parallel agent teams                                    | Agent cards — let runtimes discover and delegate to capable peers              |
 | Memory asymmetry            | Codex (partial), Gemini (KIs only) | Cross-session context degrades without MEMORY.md equivalent        | Standardize memory protocol; each runtime implements its own persistence layer |
 | Sandbox blocks git/gh       | Claude                             | Every git/gh call needs sandbox configuration                      | Configure sandbox allowlists or disable sandbox for specific commands          |
-| Full browser automation gap | Claude, Codex                      | Claude is read-only; Codex has early browser review but not full automation or sign-in flows | Delegate full browser tasks to Gemini; use Codex in-app browser for local/public page review |
+| Full browser automation gap | Claude, Codex                      | Claude is read-only; Codex has stronger browser review and Chrome-extension support but not full autonomous browser automation | Delegate full browser tasks to Gemini; use Codex browser/Chrome workflows for local, public, or approved signed-in page review |
 | Reviewer cost               | All (especially Claude)            | High cost for single PR review with polling pattern                | Stateless reviewer rounds — one round per invocation                           |
 | Public skill coverage       | Gemini                             | `kiloloop/oacp-skills` ships `claude/` and `codex/` variants for all 5 public skills; no `gemini/` variants — Gemini users must rely on convention-based adoption | Add `gemini/` variants to each public skill, or document the convention-based pattern as a first-class install path |
 
@@ -114,25 +122,30 @@ These are the highest-impact gaps where one runtime's limitation blocks effectiv
 | ---------------------------- | -------------------------------- | ------------------------------------------ | --------------------------------------------- |
 | Max parallel tool calls      | ~10+                             | Yes (parallel independent calls)           | ~10 (practical)                               |
 | Side conversations           | No                               | Yes (`/side` in CLI/TUI)                   | No                                            |
-| Hooks system                 | Yes (pre/post tool call hooks)   | No                                         | No                                            |
-| Automation scheduling        | Yes (`CronCreate`, `ScheduleWakeup`, `/loop`, `/schedule` skills) | Yes (desktop app thread automations wake a thread on a schedule, with user request) | No                                            |
+| Hooks system                 | Yes (pre/post tool call hooks)   | Yes (stable hooks and extension lifecycle hooks; plugin-bundled hooks are configuration-dependent) | No                                            |
+| Automation scheduling        | Yes (`CronCreate`, `ScheduleWakeup`, `/loop`, `/schedule` skills) | Yes (desktop app thread automations, Goal mode, and app-server/SDK automation surfaces) | No                                            |
 | Notebook editing             | Yes (NotebookEdit tool)          | No                                         | No                                            |
 | PDF reading                  | Yes (max 20 pages/request)       | No native tool                             | Via `read_url_content`                        |
 | Image reading (multimodal)   | Yes                              | Yes (desktop app local image/view support) | Yes                                           |
 | Artifact system              | No                               | Yes (sidebar preview for generated files) | Yes (task.md, implementation plans)           |
 | Video recording              | No                               | No                                         | Yes (WebP via browser)                        |
 | Image generation             | No                               | Yes (enabled by default in CLI)            | Yes                                           |
-| MCP diagnostics              | Partial                          | Yes (`/mcp verbose`)                       | Partial                                       |
+| MCP diagnostics              | Partial                          | Yes (`/mcp verbose`, per-server environment targeting, read-only MCP parallelism, plugin JSON inventory) | Partial                                       |
 | Multi-file editing primitive | Edit tool (one file at a time)   | `apply_patch` (one file)                   | `multi_replace_file_content` (non-contiguous) |
 | Workflow file format         | SKILL.md with YAML frontmatter   | SKILL.md with YAML frontmatter             | Markdown with YAML frontmatter                |
-| Policy visibility at runtime | Partial (sandbox config visible) | Yes (session policy in system context)     | Yes (`SafeToAutoRun` flags)                   |
+| Policy visibility at runtime | Partial (sandbox config visible) | Yes (session policy, approval policy, sandbox, and named permission profiles) | Yes (`SafeToAutoRun` flags)                   |
 | Long-running shell sessions  | Bash tool (no stdin)             | Yes (PTY + stdin; multiple terminals in app) | Yes (`send_command_input`)                    |
+| App-server / SDK             | No                               | Yes (JSON-RPC app-server, Python SDK, archive/thread APIs, schema generation) | No                                            |
+| Hosted site deployment       | No                               | Yes (Sites preview, app-only/cloud-hosted with separate secret management) | No                                            |
 
 ---
 
 ## 8. Source Notes
 
 - GPT-5.5 Codex availability, 400K context, Fast mode, token-efficiency, and API timing come from OpenAI's 2026-04-23 release note: <https://openai.com/index/introducing-gpt-5-5/>.
+- Codex app/CLI capability changes through app `26.602` and CLI `0.137.0` come from OpenAI's Codex changelog: <https://developers.openai.com/codex/changelog>.
+- Sites, Amazon Bedrock, app-server, plugin, and permissions details come from the official Codex docs under <https://developers.openai.com/codex/>.
+- Claude Fable 5 release date, pricing, and plan-inclusion window come from Anthropic's 2026-06-09 announcement: <https://www.anthropic.com/news/claude-fable-5-mythos-5>. Safeguard-fallback behavior comes from the Fable 5 / Mythos 5 system card §1.5 ("Novel safeguards"): client apps and Claude interfaces auto-fall back to Opus 4.8 (default and non-configurable in interfaces, session event emitted), while the Messages API blocks by default with a structured refusal category and offers opt-in server-side fallback. The serving model in the header was verified in-session by the Claude runtime.
 
 ---
 

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/protocol/agent_safety_defaults.md

@@ -40,7 +40,7 @@ Regardless of autonomy mode, receivers must pause on actual requests for:
 
 - Destructive command tokens: `rm -rf`, `--force`, `--no-verify`, `--dangerously-skip-permissions`
 - External side effects: push, deploy, merge, publish, credential rotation, dependency install
-- Sensitive scope: auth, config, secrets, dependencies, public repos, pricing/commercial content, memory SSOT
+- Sensitive scope: auth, config, secrets, credentials, dependencies, public repos, pricing/commercial content, memory SSOT
 
 Profileless message types that are explicitly allowed for auto-review may log
 incidental side-effect verb mentions as notes instead of hard stops, but

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/protocol/autonomy.md

@@ -97,8 +97,8 @@ If any required gate is missing or uncertain, the receiver pauses.
      as deploy/publish/merge are logged as notes instead of hard stops.
      Destructive tokens still pause.
    - Path-like tokens such as `packets/deploy/` are not deploy verbs.
-   - Pause when the body touches auth, config, secrets, dependencies, public
-     repos, pricing/commercial content, or memory SSOT.
+   - Pause when the body touches auth, config, secrets, credentials,
+     dependencies, public repos, pricing/commercial content, or memory SSOT.
    - Pause when file scope is ambiguous or broader than the declared profile.
 4. **Runtime/workspace**
    - Worktree is clean or the task can be isolated to a fresh branch.
@@ -114,11 +114,12 @@ Regardless of autonomy mode, receivers must pause on any of: destructive command
 tokens (`rm -rf`, `--force`, `--no-verify`,
 `--dangerously-skip-permissions`), external side effects
 (push/deploy/merge/publish/rotate/install), or modifications to auth, config,
-secrets, dependencies, public repos, pricing/commercial content, or memory SSOT,
-unless explicitly authorized by a separate safety-default exception.
+secrets, credentials, dependencies, public repos, pricing/commercial content, or
+memory SSOT, unless explicitly authorized by a separate safety-default
+exception.
 
-Continuation grants do not override destructive tokens, auth/secrets,
-dependency, public-scope, pricing/commercial, or memory-SSOT hard stops.
+Continuation grants do not override destructive tokens, auth/secrets/credentials,
+dependency, public-scope, pricing/commercial, config, or memory-SSOT hard stops.
 When explicitly enabled, a valid continuation grant may cover declared external
 side effects only for the scoped PR, GitHub comment, or commit continuation
 fields that the grant marks true.
@@ -131,7 +132,7 @@ Every autonomy decision writes one YAML file:
 
 ```yaml
 schema_version: 1
-spec_version: "0.3.0"
+spec_version: "0.3.1"
 created_at_utc: "2026-05-12T13:23:25Z"
 receiver: codex
 sender: iris
@@ -176,6 +177,9 @@ result:
 
 `policy_path` and `policy_sha256` may be null when the pause is caused by
 missing or malformed config. `sender` is logged only for traceability.
+`spec_version: "0.3.1"` pins Gate 1 integrity enforcement: schema validation,
+expiry rejection, raw YAML SHA-256 recording, and same-receiver replay
+detection.
 
 ## State Transition Metadata
 

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/docs/protocol/task_negotiation.md

@@ -153,7 +153,10 @@ Agents that lack headless mode (e.g., Gemini in some configurations):
 
 ### Codex
 
-- Codex operates in `--full-auto` headless mode by default.
+- Codex can run interactively, from the desktop app or CLI, or through
+  explicit automation flows. Do not assume legacy `--full-auto` behavior;
+  set the intended approval policy, sandbox, and permission profile for the
+  receiving environment.
 - Codex can both propose and receive proposals.
 - When Codex receives a proposal, it processes the inbox at session start per the inbox/outbox polling convention.
 

{oacp_cli-0.3.2 → oacp_cli-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "oacp-cli"
-version = "0.3.2"
+version = "0.3.4"
 description = "Open Agent Coordination Protocol CLI for file-based multi-agent workflows"
 readme = "README.md"
 license = "Apache-2.0"