🚀 CodeBuddy Code v2.140.0 Release

📦 Version Information

Component	Version
CodeBuddy Code CLI	v2.140.0
Agent SDK JS	v0.3.247
Agent SDK Python	v0.3.246

✨ New Features

Group Chat Bubbles for Team Conversations in Web UI

The CBC Web UI message queue now parses the sender, summary, and body of member messages and displays them as group chat bubbles that clearly distinguish each member. Messages retain the same style after entering the conversation stream. Additional space has also been added below the conversation input for a more comfortable typing experience.

New steer Control Signal in stream-json Mode

With --input-format=stream-json, a control_request with the steer subtype can now inject a user message into an Agent turn in progress. Its semantics align with ACP session/steer, enabling future integration by SDK and gateway clients such as the Cloud Assistant sandbox-proxy.

🔧 Improvements

• Improved Web UI conversation layout: Message content, thinking, and tool groups are now interleaved along a continuous timeline, and user message bubbles use a neutral gray. Collapsed REPL tools focus on execution intent, while expanded tools separate Code and Output into distinct sections and support JavaScript syntax highlighting
• Large REPL output no longer overwhelms the context: Tool results larger than 30 KB are automatically truncated and saved to disk. The model receives a placeholder and can read the full content when needed. Older REPL results are also collapsed when long conversations are compacted
• Improved Web UI project directory menu: The directory menu now opens upward by default, and the new-agent menu uses a page-level overlay, preventing the input field from obscuring search results
• Improved recipient search in Web UI: Removed the distracting focus outline. Candidate results now appear in an overlay instead of expanding the page layout
• Enhanced Security Center rules: Rules for file, command, and network capabilities now run in a consistent list order and support hot updates within a session. The resolved target path is revalidated before files are written, and read rules are applied before Grep searches run

🐛 Bug Fixes

• Background task notification exit codes: Completion notifications now include reliable exit codes. When an exit code is unknown, the notification clearly states that the command output is authoritative instead of incorrectly reporting success or failure
• Missing AI responses in mount-point and symlink environments: Fixed an issue where a single conversation could be split across two directories when using virtual disk mounts or symlinks. Existing history is restored without manual migration
• Team Stop button silently failing: Fixed an issue where clicking Stop was ignored after the main team Agent finished its turn while members were still running. Cancelling one session no longer affects team members in other sessions
• No response after cancelling in a cloud sandbox: Fixed a state-machine deadlock after cancellation that caused all subsequent messages to receive no response
• Lost subagent results after compaction: Fixed an issue where the parent agent could not receive the actual result after automatic context compaction and had to repeat expensive work
• Lost team member model and tool settings: Fixed an issue where reawakened team members fell back to the main conversation model and ignored disabled-tool settings. Background task agents are fixed as well
• REPL interactive tools incorrectly blocked: Fixed an issue where interactive tools such as AskUserQuestion and ExitPlanMode could not open their question panels or plan approval dialogs in REPL or sandbox mode
• Visible <system-reminder> leakage: Fixed an issue where malformed closing tags in injected content such as memory notes could leak residual content into the user message area
• Notepad failing to open with Ctrl+G on Windows: Fixed an issue where Notepad did not come to the foreground and the UI waited indefinitely when neither $VISUAL nor $EDITOR was set
• WebFetch routing for images and binary files: Image and file URLs are no longer sent through AI summarization; users are instead prompted to download and then read them
• Background task lookup: TaskStop and TaskOutput now report a clear error for nonexistent task_id values and list currently running tasks
• Other fixes: Compilation failure in the stream-json steer handler, repeated outbound-access approval prompts for Miora credentials, marketplace updates blocked by local installation state, authentication failures for the Web UI PWA manifest, pyenv environment compatibility, Monitor WebSocket rule execution, and more

📝 Documentation Updates

• Risk guidance for -y and CODEBUDDY_IS_SANDBOX: The -y description in codebuddy -h has been updated. HIGH and CRITICAL operations still require confirmation by default; full pass-through in an isolated sandbox requires the CODEBUDDY_IS_SANDBOX=1 process environment variable. A high-risk warning has also been added