Upstream changes detected: ACP spec, Gemini CLI, Codex CLI (App Server Protocol), GitHub Copilot CLI, Qwen Code

[github-actions]

This issue was opened automatically by upstream-watch.yml on 2026-05-25 because at least one upstream project this plugin depends on shipped a new release.

Detected changes

ACP spec — v0.13.2 → v0.13.3

• Release: v0.13.3 (published 2026-05-22)
• Why this matters for the plugin: Defines the JSON-RPC methods the plugin's acp-client.mjs implements. Spec changes can introduce new methods we should handle (e.g. terminal/*, session/request_permission, cursor/ask_question).

Release notes excerpt

Added

• Stabilize logout method (#1273)

Fixed

• (unstable) Rename provider method types to singular (#1272)

Other

• (rfd) Move additional directories RFD to Preview (#1276)
• Add schema download note to schema page (#1269)
• (deps) bump num-conv from 0.2.1 to 0.2.2 in the minor group (#1244)
• Set minimum supported Rust version (#1232)
• Document ACP versioning semantics (#1229)

Gemini CLI — v0.42.0 → v0.43.0

• Release: Release v0.43.0 (published 2026-05-22)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/gemini.mjs. Watch for changes to ACP handshake, model alias resolution, MCP support, or new approval modes.

Release notes excerpt

What's Changed

• feat(core): steer model to use edit tool for surgical edits, fix a typo by @aishaneeshah in feat(core): steer model to use edit tool for surgical edits, fix a typo google-gemini/gemini-cli#26480
• docs: clarify Auto Memory proposes memory updates and skills by @SandyTao520 in docs: clarify Auto Memory proposes memory updates and skills google-gemini/gemini-cli#26527
• fix(core): reject numeric project IDs in GOOGLE_CLOUD_PROJECT (#24695) by @Abhijit-2592 in fix(core): reject numeric project IDs in GOOGLE_CLOUD_PROJECT (#24695) google-gemini/gemini-cli#26532
• fix(core): remove unsafe type assertion suppressions in error utils by @himanshu748 in fix(core): remove unsafe type assertion suppressions in error utils google-gemini/gemini-cli#19881
• fix(core): allow redirection in YOLO and AUTO_EDIT modes without sandboxing by @galz10 in fix(core): allow redirection in YOLO and AUTO_EDIT modes without sandboxing google-gemini/gemini-cli#26542
• ci(release): build and attach unsigned macOS binaries to releases by @ruomengz in ci(release): build and attach unsigned macOS binaries to releases google-gemini/gemini-cli#26462
• fix(core): Fix chat corruption bug in context manager. by @joshualitt in fix(core): Fix chat corruption bug in context manager. google-gemini/gemini-cli#26534
• fix(cli): provide JSON output for AgentExecutionStopped in non-interactive mode by @cynthialong0-0 in fix(cli): provide JSON output for AgentExecutionStopped in non-interactive mode google-gemini/gemini-cli#26504
• feat(evals): add shell command safety evals by @akh64bit in feat(evals): add shell command safety evals google-gemini/gemini-cli#26528
• fix(core): handle invalid custom plans directory gracefully by @cynthialong0-0 in fix(core): handle invalid custom plans directory gracefully google-gemini/gemini-cli#26560
• fix(acp): move tool explanation from thought stream to tool call content by @sripasg in fix(acp): move tool explanation from thought stream to tool call content google-gemini/gemini-cli#26554
• fix(a2a-server): Resolve race condition in tool completion waiting by @kschaab in fix(a2a-server): Resolve race condition in tool completion waiting google-gemini/gemini-cli#26568
• fix(cli): randomize sandbox container names by @Kkartik14 in fix(cli): randomize sandbox container names google-gemini/gemini-cli#26014
• fix(core): Fix hysteresis in async context management pipelines. by @joshualitt in fix(core): Fix hysteresis in async context management pipelines. google-gemini/gemini-cli#26452
• Tighten private Auto Memory patch allowlist by @SandyTao520 in Tighten private Auto Memory patch allowlist google-gemini/gemini-cli#26535
• fix(cli): hide read-only settings scopes by @cvan20191 in fix(cli): hide read-only settings scopes google-gemini/gemini-cli#26249
• fix(ci): preserve executable bit for mac binaries by @ruomengz in fix(ci): preserve executable bit for mac binaries google-gemini/gemini-cli#26600
• fix(cli): improve mcp list UX in untrusted folders by @Adib234 in fix(cli): improve mcp list UX in untrusted folders google-gemini/gemini-cli#26457
• fix(core): prevent silent hang during OAuth auth on headless Linux by @RhysSullivan in fix(core): prevent silent hang during OAuth auth on headless Linux google-gemini/gemini-cli#26571
• Changelog for v0.42.0-preview.0 by @gemini-cli-robot in Changelog for v0.42.0-preview.0 google-gemini/gemini-cli#26537
• ci: fix Argument list too long in triage workflows by @cocosheng-g in ci: fix Argument list too long in triage workflows google-gemini/gemini-cli#26603
• refactor(cli): migrate core tools to native ToolDisplay property and fix UI rendering by @mbleigh in refactor(cli): migrate core tools to native ToolDisplay property and fix UI rendering google-gemini/gemini-cli#25186
• don't wrap args unnecessarily by @scidomino in don't wrap args unnecessarily google-gemini/gemini-cli#26599
• fix(core): preserve system PATH in Git environment to fix ENOENT (#25034) by @cocosheng-g in fix(core): preserve system PATH in Git environment to fix ENOENT (#25034) google-gemini/gemini-cli#26587
• fix(routing): fix resolveClassifierModel argument mismatch in ApprovalModeStrategy by @danielweis in fix(routing): fix resolveClassifierModel argument mismatch in ApprovalModeStrategy google-gemini/gemini-cli#26658
• docs: add vi mode shortcuts and clarify MCP/custom sandbox setup by @chrisjcthomas in docs: add vi mode shortcuts and clarify MCP/custom sandbox setup google-gemini/gemini-cli#23853
• fix(ux): fixed issue with transcribed text not showing after releasing space by @devr0306 in fix(ux): fixed issue with transcribed text not showing after releasing space google-gemini/gemini-cli#26609
• ci: fix json parsing in scheduled triage workflow by @cocosheng-g in ci: fix json parsing in scheduled triage workflow google-gemini/gemini-cli#26656
• fix(cli): hide /memory add subcommand when memoryV2 is enabled by @SandyTao520 in fix(cli): hide /memory add subcommand when memoryV2 is enabled google-gemini/gemini-cli#26605

…(release notes truncated; click the link above for the full text)

Codex CLI (App Server Protocol) — rust-v0.130.0 → rust-v0.133.0

• Release: 0.133.0 (published 2026-05-21)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/codex.mjs and app-server.mjs. Watch for sandbox mode changes, new approval policies, or app-server protocol updates.

Release notes excerpt

New Features

• Goals are now enabled by default, backed by dedicated storage, and track progress across active turns. (#23300, #23685, #23696, #23732)
• codex remote-control now runs like a foreground command, waits for readiness, reports machine status, and keeps explicit daemon-style start/stop commands. (#22878)
• Permission profiles gained list APIs, inheritance, managed requirements.toml support, runtime refresh behavior, and stronger Windows sandbox integration. (#22928, #23412, #22270, #23433, #22931, #23715)
• Plugin discovery is easier to inspect, with marketplace-aware list output, installed versions, visible marketplace roots, and remote collection support. (#23372, #23584, #23727, #23730)
• Extensions can observe more lifecycle events, including subagent start/stop, tool execution, turn metadata, and async approval/turn processing. (#22782, #22873, #23309, #23688, #23690, #23692)

Bug Fixes

• Fixed TUI startup choosing the wrong working directory when reusing a local app-server socket. (#23538)
• Fixed plan-mode free-form answers so modified Enter keys, like Shift+Enter, no longer submit unexpectedly. (#23536)
• Removed stale background terminal poll events after a process exits. (#23231)
• Preserved raw code-mode exec output unless an explicit output token limit is requested. (#23564)
• Made AGENTS instruction loading more reliable, including local global reads and warnings for invalid UTF-8 instead of silent drops. (#23343, #23232)
• Fixed app-server startup/shutdown races, empty resume/fork paths, plugin upgrade failures, and realtime v1 websocket compatibility. (#23516, #23578, #23400, #23356, #23771)

Documentation

• Added clearer plugin-creator guidance for updating and reinstalling local personal plugins. (#23542)
• Expanded app-server/API docs and schema coverage around managed permission profile requirements. (#23433, #23555)

Chores

• Added a canonical Codex package archive pipeline and moved installers, npm packages, DotSlash, and SDK runtimes toward that shared layout. (#23513, #23582, #23586, #23596, #23635, #23636, #23637, #23638, #23786)
• Fixed Linux Python runtime wheel tags so glibc-based systems can install the runtime artifacts. (#21812)
• Improved release and CI reliability with package-builder tests, prebuilt resource packaging, DotSlash zstd handling, platform-sharded Rust tests, and Codex Linux release runners. (#23760, #23759, #23752, #23358, #23761)

Changelog

Full Changelog: openai/codex@rust-v0.132.0...rust-v0.133.0

• #23343 codex: route global AGENTS reads through LOCAL_FS @starr-openai
• #22380 fix: default unknown tool schemas to empty schemas @celia-oai
• #23309 Add tool lifecycle extension contributor @jif-oai
• #23253 Reduce rust-ci-full Windows nextest timeout flakes @starr-openai
• #22878 Improve codex remote-control CLI UX @owenlin0
• #21812 Publish Linux runtime wheels with glibc-compatible tags @aibrahim-oai
• #22709 [codex] Trim unused TurnContextItem fields @pakrym-oai
• #23353 Include plugin id in plugin MCP tool metadata @mzeng-openai

…(release notes truncated; click the link above for the full text)

GitHub Copilot CLI — v1.0.48 → v1.0.54

• Release: 1.0.54 (published 2026-05-24)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/copilot.mjs. Watch for ACP changes, slash-command additions/removals, or auth flow changes.

Release notes excerpt

2026-05-24
Fixes and changes

Qwen Code — v0.15.11 → v0.16.1

• Release: Release v0.16.1 (published 2026-05-23)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/qwen.mjs. Watch for ACP support changes (the --acp flag graduated from --experimental-acp recently).

Release notes excerpt

What's Changed

• chore(release): v0.16.0 by @yiliang114 in chore(release): v0.16.0 QwenLM/qwen-code#4404
• fix(core,cli): close tool_use↔tool_result invariant across all failure paths by @wenshao in fix(core,cli): close tool_use↔tool_result invariant across all failure paths QwenLM/qwen-code#4176
• fix(vscode): skip redundant tsc build in prepackage to prevent TS5055 by @yiliang114 in fix(vscode): skip redundant tsc build in prepackage to prevent TS5055 QwenLM/qwen-code#4401
• fix(core): preserve tab-indented notebook formatting by @zhangxy-zju in fix(core): preserve tab-indented notebook formatting QwenLM/qwen-code#4373
• feat(telemetry): Phase 4a — TTFT capture + GenAI semconv dual-emit (#3731) by @doudouOUC in feat(telemetry): Phase 4a — TTFT capture + GenAI semconv dual-emit (#3731) QwenLM/qwen-code#4417
• fix(scripts): renormalize CRLF storage for install-qwen-standalone.bat by @wenshao in fix(scripts): renormalize CRLF storage for install-qwen-standalone.bat QwenLM/qwen-code#4427
• fix(build): tree-shake React reconciler dev build to prevent PerformanceMeasure leak by @huww98 in fix(build): tree-shake React reconciler dev build to prevent PerformanceMeasure leak QwenLM/qwen-code#4462
• chore(deps): update express from 4.21.2 to 5.2.1 by @yiliang114 in chore(deps): update express from 4.21.2 to 5.2.1 QwenLM/qwen-code#4458
• fix(cli): stabilize flaky sticky-todo remeasure test by @pomelo-nwu in fix(cli): stabilize flaky sticky-todo remeasure test QwenLM/qwen-code#4416
• fix(cli): gate mintty OSC 8 detection on TERM_PROGRAM_VERSION ≥ 3.3 (#4420) by @wenshao in fix(cli): gate mintty OSC 8 detection on TERM_PROGRAM_VERSION ≥ 3.3 (#4420) QwenLM/qwen-code#4451
• fix(release): move constants above entry point to avoid TDZ error by @yiliang114 in fix(release): move constants above entry point to avoid TDZ error QwenLM/qwen-code#4398
  Full Changelog: QwenLM/qwen-code@v0.16.0...v0.16.1

Also worth checking (manual — Copilot, please research these too)

• Cursor agent CLI — changelog: https://cursor.com/changelog · forum (bug reports): https://forum.cursor.com/c/bug-report/6
  • Drives plugins/multi/scripts/lib/adapters/cursor.mjs. The plugin currently works around the 2026.04.17-787b533 ACP regression (see maybeWarnAboutCursorVersion and ensureCursorAllowlist). When Cursor ships a fix, both workarounds can likely be simplified or removed.

Plugin files most likely to need updates

• plugins/multi/scripts/lib/acp-client.mjs (shared ACP JSON-RPC client; buildAutoApproveRequestHandler)
• plugins/multi/scripts/lib/acp-terminals.mjs (client-side terminal services)
• plugins/multi/scripts/lib/mcp-servers.mjs (MCP wiring for ACP session/new)
• plugins/multi/scripts/lib/adapters/{codex,gemini,cursor,copilot,qwen}.mjs (per-CLI adapters)
• plugins/multi/scripts/multi-cli-companion.mjs (companion runtime + dispatch)

What I'd like you to do, @copilot

1. Read the linked release notes for each detected change above, plus the manual-reference changelogs.
2. Compare what changed against the relevant adapter / shared code in this repo. Look specifically for:
   • New ACP methods we should handle in acp-client.mjs's buildAutoApproveRequestHandler
   • Renamed / deprecated CLI flags or model IDs hardcoded in any adapter
   • New CLI capabilities that obsolete a workaround we currently ship (e.g., the Cursor 2026.04.17 regression workaround in cursor.mjs — check if a newer Cursor release fixes it, and if so, propose removing maybeWarnAboutCursorVersion and the allowlist-injection or scoping it tighter)
   • Breaking changes that would silently break the plugin
3. For each change that warrants action, open a focused PR against master with the minimal fix. Reference the upstream release / commit / forum thread in the PR description.
4. If a detected change does NOT need any plugin update, reply on this issue with a short note saying "no plugin updates needed for X — reason: …" and close it.
5. If something is ambiguous (you can't tell from release notes whether the plugin is affected), ask in a comment rather than guessing.

You may use ACP_TRACE=1 and the rest of the diagnostic patterns documented in plugins/multi/skills/customize/SKILL.md if you want to verify behavior empirically.

---

State tracked in .github/upstream-state.json — bumped by this same workflow. If you want to suppress a noisy upstream from this watch, edit .github/scripts/upstream-watch.mjs.