Upstream changes detected: Gemini CLI, Codex CLI (App Server Protocol), GitHub Copilot CLI, Qwen Code

[github-actions]

This issue was opened automatically by upstream-watch.yml on 2026-07-13 because at least one upstream project this plugin depends on shipped a new release.

Detected changes

Gemini CLI — v0.49.0 → v0.50.0

• Release: Release v0.50.0 (published 2026-07-08)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/gemini.mjs. Watch for changes to ACP handshake, model alias resolution, MCP support, or new approval modes.

Release notes excerpt

What's Changed

• fix/verify release npm ci ignore scripts by @rmedranollamas in fix/verify release npm ci ignore scripts google-gemini/gemini-cli#28116
• fix(ci): prevent workspace binary shadowing in release verification by @galdawave in fix(ci): prevent workspace binary shadowing in release verification google-gemini/gemini-cli#28132
• Feat/tool registry discovery by @ved015 in Feat/tool registry discovery google-gemini/gemini-cli#28113
• fix(ci): prevent bad NPM releases and promote job crashes by @galdawave in fix(ci): prevent bad NPM releases and promote job crashes google-gemini/gemini-cli#28147
  Full Changelog: google-gemini/gemini-cli@v0.49.0...v0.50.0

Codex CLI (App Server Protocol) — rust-v0.142.5 → rust-v0.144.3

• Release: 0.144.3 (published 2026-07-13)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/codex.mjs and app-server.mjs. Watch for sandbox mode changes, new approval policies, or app-server protocol updates.

Release notes excerpt

Chores

• Published a version-only release with no merged pull request changes since rust-v0.144.2.

Changelog

Full Changelog: openai/codex@rust-v0.144.2...rust-v0.144.3

GitHub Copilot CLI — v1.0.68 → v1.0.70

• Release: 1.0.70 (published 2026-07-10)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/copilot.mjs. Watch for ACP changes, slash-command additions/removals, or auth flow changes.

Release notes excerpt

2026-07-09

• Add GPT-5.6 model support
• Show a single Error prefix for mcp and skill command failures
• Show the real parse error when --agent selects a malformed custom agent
• web_fetch works through mandatory HTTPS proxies
• Hide / search on the Gists tab
• Treat superseded subagent runs as cancellations instead of failures
• Add paginated session.mcp.resources read/list/listTemplates RPCs for MCP server resources
• preToolUse hooks that exit with code 2 deny tool calls
• Create draft skills when Forge finds a clear workflow pattern
• Hide the GitHub App install nudge in remote terminals
• Pin plugins to an exact commit SHA using the sha field in plugin source configuration
• Add --sandbox and --no-sandbox flags to turn the OS-level shell sandbox on or off for the current session only, without changing your saved sandbox setting (useful with -p)
• Add /refine to rewrite a rough, stream-of-consciousness prompt into a clear one
• Add --repo and --local flags to /settings and /model
• Add a setting to show or hide timeline timestamps
• Let a trusted repository pin the model, effort level, and context tier and extend the URL/MCP/skill deny lists via .github/copilot/settings.json
• Expose SDK APIs to manage live MCP servers in running sessions
• Show the active user's models after /user switch
• Declining an extension's permission prompt no longer disables tool approvals for the rest of the session
• Avoid redundant background agent notifications after a blocking read_agent returns its result
• Startup auth errors recommend the real copilot login command
• Keep merge-semantics settings editable in /settings
• Re-sync managed plugins when their cache is missing or empty
• Copy the last assistant response even after command echoes
• Persist the last-logged-in user on every login so a restarted runtime client stays authenticated
• Hide /agent picker navigation hints when there is nothing to select
• Open the plan file or research report with Ctrl+Y in any mode
• Keep terminal color scheme changes in sync over SSH and remote shells
• Prefill /chronicle search so it can accept a query

…(release notes truncated; click the link above for the full text)

Qwen Code — v0.19.6 → v0.19.9

• Release: Release v0.19.9 (published 2026-07-10)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/qwen.mjs. Watch for ACP support changes (the --acp flag graduated from --experimental-acp recently).

Release notes excerpt

What's Changed

• Stop repeated subagent tool-call loops by @yiliang114 in Stop repeated subagent tool-call loops QwenLM/qwen-code#6543
• fix(session): detect and mark broken history chains instead of silently truncating by @doudouOUC in fix(session): detect and mark broken history chains instead of silently truncating QwenLM/qwen-code#6502
• fix(cli): prefer command name match over alias match regardless of recentScore by @Alex-ai-future in fix(cli): prefer command name match over alias match regardless of recentScore QwenLM/qwen-code#6504
• feat(memory): make background memory agent timeouts configurable by @zjunothing in feat(memory): make background memory agent timeouts configurable QwenLM/qwen-code#6459
• feat(cli): Add session owner index for workspace runtimes by @doudouOUC in feat(cli): Add session owner index for workspace runtimes QwenLM/qwen-code#6540
• docs: fix model-provider config shape and refresh feature/setting drift by @DragonnZhang in docs: fix model-provider config shape and refresh feature/setting drift QwenLM/qwen-code#6552
• fix(channels): add chat payload diagnostics by @qqqys in fix(channels): add chat payload diagnostics QwenLM/qwen-code#6539
• fix(core): configurable vision bridge timeout + retry with fresh budget by @zjunothing in fix(core): configurable vision bridge timeout + retry with fresh budget QwenLM/qwen-code#6541
• fix(shell): avoid self-kill from pgrep selectors by @yiliang114 in fix(shell): avoid self-kill from pgrep selectors QwenLM/qwen-code#6544
• Gate browser automation MCP on external adapter by @yiliang114 in Gate browser automation MCP on external adapter QwenLM/qwen-code#6472
• perf(core): add pure-ASCII fast path to text token estimation by @dexhunter in perf(core): add pure-ASCII fast path to text token estimation QwenLM/qwen-code#6551
• fix(extension): clean tempDir before fallback git clone on Windows by @C0d3N1nja97342 in fix(extension): clean tempDir before fallback git clone on Windows QwenLM/qwen-code#6545
• chore(core): remove stale refreshStartupContextReminder mocks from tool-search tests by @Aleks-0 in chore(core): remove stale refreshStartupContextReminder mocks from tool-search tests QwenLM/qwen-code#6423
• fix(cli): align memory dialog with managed memory by @callmeYe in fix(cli): align memory dialog with managed memory QwenLM/qwen-code#6434
• ci(autofix): Add single-target scheduler by @yiliang114 in ci(autofix): Add single-target scheduler QwenLM/qwen-code#6547
• fix(daemon): surface workspace memory task error details by @callmeYe in fix(daemon): surface workspace memory task error details QwenLM/qwen-code#6431
• fix(serve): stop cdp-mcp-command reading process.env directly by @chinesepowered in fix(serve): stop cdp-mcp-command reading process.env directly QwenLM/qwen-code#6562
• fix(mobile-mcp): strip bounds from UI hierarchy dump by @LaZzyMan in fix(mobile-mcp): strip bounds from UI hierarchy dump QwenLM/qwen-code#6568
• fix(web-shell): make dialog backdrop z-index configurable by @cxruan in fix(web-shell): make dialog backdrop z-index configurable QwenLM/qwen-code#6572
• feat(web-shell): polish stats table layout and todo panel UI by @ytahdn in feat(web-shell): polish stats table layout and todo panel UI QwenLM/qwen-code#6559
• feat(cli): List persisted sessions for trusted workspaces by @doudouOUC in feat(cli): List persisted sessions for trusted workspaces QwenLM/qwen-code#6558
• Add harness infrastructure for web-shell package by @harbin1053020115 in Add harness infrastructure for web-shell package QwenLM/qwen-code#6517
• Fix workspace skills for disabled extensions and ACP preheat by @ytahdn in Fix workspace skills for disabled extensions and ACP preheat QwenLM/qwen-code#6534
• fix(ci): add retry logic to VSCode IDE Companion publish steps by @yiliang114 with @Copilot in fix(ci): add retry logic to VSCode IDE Companion publish steps QwenLM/qwen-code#6574
• feat(core): render PDF pages to images when text extraction overflows or fails by @doudouOUC in feat(core): render PDF pages to images when text extraction overflows or fails QwenLM/qwen-code#6585
• fix(ci): detect silent triage failures with empty-response check by @yiliang114 in fix(ci): detect silent triage failures with empty-response check QwenLM/qwen-code#6566
• Fix long session timeline scrolling by @callmeYe in Fix long session timeline scrolling QwenLM/qwen-code#6526
• feat(scheduled-tasks): add isolated run mode via create_sub_session tool by @wenshao in feat(scheduled-tasks): add isolated run mode via create_sub_session tool QwenLM/qwen-code#6535

…(release notes truncated; click the link above for the full text)

Also worth checking (manual — Copilot, please research these too)

• Cursor agent CLI — changelog: https://cursor.com/changelog · forum (bug reports): https://forum.cursor.com/c/bug-report/6
  • Drives plugins/multi/scripts/lib/adapters/cursor.mjs. The plugin currently works around the 2026.04.17-787b533 ACP regression (see maybeWarnAboutCursorVersion and ensureCursorAllowlist). When Cursor ships a fix, both workarounds can likely be simplified or removed.

Plugin files most likely to need updates

• plugins/multi/scripts/lib/acp-client.mjs (shared ACP JSON-RPC client; buildAutoApproveRequestHandler)
• plugins/multi/scripts/lib/acp-terminals.mjs (client-side terminal services)
• plugins/multi/scripts/lib/mcp-servers.mjs (MCP wiring for ACP session/new)
• plugins/multi/scripts/lib/adapters/{codex,gemini,cursor,copilot,qwen}.mjs (per-CLI adapters)
• plugins/multi/scripts/multi-cli-companion.mjs (companion runtime + dispatch)

What I'd like you to do, @copilot

1. Read the linked release notes for each detected change above, plus the manual-reference changelogs.
2. Compare what changed against the relevant adapter / shared code in this repo. Look specifically for:
   • New ACP methods we should handle in acp-client.mjs's buildAutoApproveRequestHandler
   • Renamed / deprecated CLI flags or model IDs hardcoded in any adapter
   • New CLI capabilities that obsolete a workaround we currently ship (e.g., the Cursor 2026.04.17 regression workaround in cursor.mjs — check if a newer Cursor release fixes it, and if so, propose removing maybeWarnAboutCursorVersion and the allowlist-injection or scoping it tighter)
   • Breaking changes that would silently break the plugin
3. For each change that warrants action, open a focused PR against master with the minimal fix. Reference the upstream release / commit / forum thread in the PR description.
4. If a detected change does NOT need any plugin update, reply on this issue with a short note saying "no plugin updates needed for X — reason: …" and close it.
5. If something is ambiguous (you can't tell from release notes whether the plugin is affected), ask in a comment rather than guessing.

You may use ACP_TRACE=1 and the rest of the diagnostic patterns documented in plugins/multi/skills/customize/SKILL.md if you want to verify behavior empirically.

---

State tracked in .github/upstream-state.json — bumped by this same workflow. If you want to suppress a noisy upstream from this watch, edit .github/scripts/upstream-watch.mjs.