# 🚀 CodeBuddy Code v2.86.0 Release

## ✨ New Features

### Agent Team Multi-Backend Architecture

Team members now support three runtime backends: in-process (default), detached-process, and tmux visualization. Switch flexibly via the `--swarm` parameter or environment variables to meet collaboration needs across different scenarios.

- Detached-process teammates use dual-path SSE real-time event forwarding and file history replay; the Web UI automatically displays member conversations
- Tool approvals are routed back to the leader for unified handling via Permission Bridge
- The communication layer reserves distributed support — automatically selecting file Mailbox locally and switching to HTTP API for remote connections

## 🔧 Improvements

- **Gateway Security Hardening**: All API requests now require the `X-CodeBuddy-Request` custom header, effectively preventing cross-site request forgery; CORS policies are fully hardened with requests from unauthorized origins directly rejected; `/info` and `/health` endpoints now require authentication
- **OpenAPI Documentation Enhancement**: ACP protocol documentation significantly improved with complete parameter/response examples for 12 JSON-RPC methods, 13 SessionUpdate type definitions, and approximately 30 previously implemented but undocumented API endpoints
- **WebFetch Tool Upgrade**: HTML conversion library upgraded to turndown for higher-quality Markdown output; User-Agent changed to Chrome format, resolving fetch failures on sites with anti-crawling measures; timeout adjusted to 30s
- **Conversation History Button**: The StatusBar history button is now always visible, no longer requiring API polling to appear

## 🐛 Bug Fixes

- **ACP Thinking Format**: Thinking content corrected to the ACP standard `agent_thought_chunk` type, ensuring protocol compatibility
- **Tool Permission Security**: Fixed allow rules in compound commands unexpectedly permitting high-risk subcommands; fixed CRITICAL-level commands being auto-approved in BypassPermissions mode
- **Config Directory Consistency**: Fixed 7 hardcoded paths bypassing custom config directories
- **Shell Execution Stability**: Fixed foreground command status permanently showing "running" after execution; fixed file descriptor leaks in PTY mode
- **Web UI Link**: The Web UI link in the TUI Header now automatically includes the sessionId parameter
- **React Rendering Error**: Fixed React Hook ordering issue when all tool groups for team members are hidden
- **TUI Rendering Stability**: Added exception guards to code highlighting and table rendering to prevent crashes
- **Team Management**: TeamDelete now proactively reclaims lingering detached member processes
