Upstream changes detected: ACP spec, Gemini CLI, Codex CLI (App Server Protocol), GitHub Copilot CLI, Qwen Code

[github-actions]

This issue was opened automatically by upstream-watch.yml on 2026-06-29 because at least one upstream project this plugin depends on shipped a new release.

Detected changes

ACP spec — schema-v1.14.0 → schema-v1.17.0

• Release: Schema v1.17.0 (published 2026-06-29)
• Why this matters for the plugin: Defines the JSON-RPC methods the plugin's acp-client.mjs implements. Spec changes can introduce new methods we should handle (e.g. terminal/*, session/request_permission, cursor/ask_question).

Release notes excerpt

Added

• (schema) Stabilize request cancellation (#1549)

Fixed

• Deserialization leniency part 2 (#1526)
• (unstable-v2) make mcpServers optional in new sessions (#1523)

Other

• (unstable-v2) Clean up client schema types (#1540)
• (schema) correct Implementation description (#1518)

Gemini CLI — v0.47.0 → v0.49.0

• Release: Release v0.49.0 (published 2026-06-25)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/gemini.mjs. Watch for changes to ACP handshake, model alias resolution, MCP support, or new approval modes.

Release notes excerpt

What's Changed

• chore(release): bump version to 0.48.0-nightly.20260609.g3a13b8eeb by @gemini-cli-robot in chore(release): bump version to 0.48.0-nightly.20260609.g3a13b8eeb google-gemini/gemini-cli#27779
• ci(dependabot): enable cooldown period for npm packages by @ruomengz in ci(dependabot): enable cooldown period for npm packages google-gemini/gemini-cli#27743
• refactor(core): standardize tool output formatting by @galz10 in refactor(core): standardize tool output formatting google-gemini/gemini-cli#27772
• ci: update workflow logging and policy configurations by @galz10 in ci: update workflow logging and policy configurations google-gemini/gemini-cli#27853
• fix(core): Ensure zero-quota limits fail fast to prevent retry loop hang by @luisfelipe-alt in fix(core): Ensure zero-quota limits fail fast to prevent retry loop hang google-gemini/gemini-cli#27698
• fix(core): handle multi-line escaped quotes in stripShellWrapper by @sanchezcoraspe in fix(core): handle multi-line escaped quotes in stripShellWrapper google-gemini/gemini-cli#27467
• fix(cli): prevent path traversal vulnerabilities during skill install… by @ompatel-aiml in fix(cli): prevent path traversal vulnerabilities during skill install… google-gemini/gemini-cli#27767
• Fix/pending tools and trust overrides by @jvargassanchez-dot in Fix/pending tools and trust overrides google-gemini/gemini-cli#27854
• ci: use internal environment for scheduled nightly releases (#27865) by @rmedranollamas in ci: use internal environment for scheduled nightly releases (#27865) google-gemini/gemini-cli#27939
• feat(core): Support GDC air-gapped Service Identity after auth library update by @sidhantgoyal-droid in feat(core): Support GDC air-gapped Service Identity after auth library update google-gemini/gemini-cli#27956
• fix(cli): handle tmux false positive background detection by @amelidev in fix(cli): handle tmux false positive background detection google-gemini/gemini-cli#27572
• Add static eval source analyzer by @ved015 in Add static eval source analyzer google-gemini/gemini-cli#27631
• fix(config): migrate coreTools setting to tools.core by @galz10 in fix(config): migrate coreTools setting to tools.core google-gemini/gemini-cli#27947
• fix(core-tools): resolve defensive path resolution for at-reference files by @luisfelipe-alt in fix(core-tools): resolve defensive path resolution for at-reference files google-gemini/gemini-cli#27943
• Revert "fix(core-tools): resolve defensive path resolution for at-reference files" by @galz10 in Revert "fix(core-tools): resolve defensive path resolution for at-reference files" google-gemini/gemini-cli#27992
• chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 by @gemini-cli-robot in chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 google-gemini/gemini-cli#28003
• Changelog for v0.48.0-preview.0 by @gemini-cli-robot in Changelog for v0.48.0-preview.0 google-gemini/gemini-cli#27999
• fix(ci): provide fallbacks for package variables in nightly release by @galz10 in fix(ci): provide fallbacks for package variables in nightly release google-gemini/gemini-cli#28016
• chore(deps): pin dependencies and enforce 14-day update cooldown by @galz10 in chore(deps): pin dependencies and enforce 14-day update cooldown google-gemini/gemini-cli#27948
• fix(ci): append trailing slash to registry url in npmrc by @rmedranollamas in fix(ci): append trailing slash to registry url in npmrc google-gemini/gemini-cli#28038
• feat: add eval:inventory CLI command and reporting logic by @ved015 in feat: add eval:inventory CLI command and reporting logic google-gemini/gemini-cli#28009
• fix: resolve workspace publish failures and scheduler event loop starvation by @rmedranollamas in fix: resolve workspace publish failures and scheduler event loop starvation google-gemini/gemini-cli#28063
• fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH by @rmedranollamas in fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH google-gemini/gemini-cli#28104
• Add JSON output for eval inventory by @ved015 in Add JSON output for eval inventory google-gemini/gemini-cli#28058

New Contributors

• @sanchezcoraspe made their first contribution in fix(core): handle multi-line escaped quotes in stripShellWrapper google-gemini/gemini-cli#27467
• @sidhantgoyal-droid made their first contribution in feat(core): Support GDC air-gapped Service Identity after auth library update google-gemini/gemini-cli#27956
• @amelidev made their first contribution in fix(cli): handle tmux false positive background detection google-gemini/gemini-cli#27572
  Full Changelog: google-gemini/gemini-cli@v0.47.0...v0.49.0

Codex CLI (App Server Protocol) — rust-v0.141.0 → rust-v0.142.4

• Release: 0.142.4 (published 2026-06-29)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/codex.mjs and app-server.mjs. Watch for sandbox mode changes, new approval policies, or app-server protocol updates.

Release notes excerpt

Chores

• No user-facing changes were identified for this release.

Changelog

Full Changelog: openai/codex@rust-v0.142.3...rust-v0.142.4

GitHub Copilot CLI — v1.0.63 → v1.0.65

• Release: 1.0.65 (published 2026-06-24)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/copilot.mjs. Watch for ACP changes, slash-command additions/removals, or auth flow changes.

Release notes excerpt

2026-06-24

• /cd now persists the working directory so resuming a session returns to it, and discovers custom agents in the new directory
• Commands with slash-prefixed string arguments (e.g. --body "/azp run") no longer trigger spurious filesystem permission prompts
• Fullscreen timeline stays anchored when older content is trimmed
• Resume open canvases automatically after restarting the CLI
• Add an opt-in status bar item showing CI check status (passing/running/failing) for the current branch
• Add a copilot skill subcommand (and a /skill alias for /skills) to list, add, and remove skills from a file, URL, or directory
• Prevent the GitHub background from flashing on startup with non-GitHub themes
• Prevent brief console windows from flashing on Windows when the agent runs hook commands or resolves command paths
• Include userPromptSubmitted hook additionalContext in the model-facing prompt
• Keep Windows paths intact when adding stdio MCP servers
• Stop MCP shutdown from waiting on in-flight server connects
• Restart the CLI without shutdown timeouts
• Remove syntax highlighting from shell commands in the timeline
• Keep custom-agent subagent model selections when using BYOK providers
• Parse /every schedules on the session's main model
• Render inline images reliably in tmux
• The ask_user freeform option wraps text and keeps the cursor aligned
• Save custom status line commands in /settings
• Show the streaming byte count separately from the cancel hint
• Handle wakeup misfires with a graceful message when no self-paced schedule is active
• Silent MCP OAuth refresh reuses the granted scope so reconnects stay signed in
• Up/down history and Ctrl+R reverse search now include past shell commands while in normal mode, so you can recall and re-run a shell command without first typing ! to enter shell mode

Qwen Code — v0.18.5 → v0.19.3

• Release: Release v0.19.3 (published 2026-06-28)
• Why this matters for the plugin: Drives plugins/multi/scripts/lib/adapters/qwen.mjs. Watch for ACP support changes (the --acp flag graduated from --experimental-acp recently).

Release notes excerpt

What's Changed

• fix(core): allow web_fetch JSON fallback by @tt-a1i in fix(core): allow web_fetch JSON fallback QwenLM/qwen-code#5660
• chore(release): v0.19.2 by @qwen-code-ci-bot in chore(release): v0.19.2 QwenLM/qwen-code#5830
• ci: split platform test matrix into named jobs so PRs can enter the merge queue by @yiliang114 in ci: split platform test matrix into named jobs so PRs can enter the merge queue QwenLM/qwen-code#5833
• fix(ide): validate QWEN_CODE_IDE_SERVER_PORT before reading lock file by @mvanhorn in fix(ide): validate QWEN_CODE_IDE_SERVER_PORT before reading lock file QwenLM/qwen-code#5805
• fix(core): add streaming inactivity timeout to the OpenAI pipeline by @doudouOUC in fix(core): add streaming inactivity timeout to the OpenAI pipeline QwenLM/qwen-code#5827
• fix(cli): prevent scroll snap-back and flicker in non-VP mode during multi-agent runs by @chiga0 in fix(cli): prevent scroll snap-back and flicker in non-VP mode during multi-agent runs QwenLM/qwen-code#5799
• feat(serve): Add daemon workspace voice and control APIs by @doudouOUC in feat(serve): Add daemon workspace voice and control APIs QwenLM/qwen-code#5765
• feat(cli): Add skill usage stats by @doudouOUC in feat(cli): Add skill usage stats QwenLM/qwen-code#5826
• feat(memory): confirm auto-generated skills before persisting by @LaZzyMan in feat(memory): confirm auto-generated skills before persisting QwenLM/qwen-code#5616
• fix(cli): cancel pending self-paced loop wakeups on user abort by @qqqys in fix(cli): cancel pending self-paced loop wakeups on user abort QwenLM/qwen-code#5808
• fix(core): preserve reasoning_content when merging assistant turns by @he-yufeng in fix(core): preserve reasoning_content when merging assistant turns QwenLM/qwen-code#5815
• feat(cli): Show model thinking intent in loading indicator by @pomelo-nwu in feat(cli): Show model thinking intent in loading indicator QwenLM/qwen-code#5668
• ci: give each CI job one home in the merge-queue flow by @yiliang114 in ci: give each CI job one home in the merge-queue flow QwenLM/qwen-code#5842
• fix(web-shell): stabilize active prompt loading state by @ytahdn in fix(web-shell): stabilize active prompt loading state QwenLM/qwen-code#5818
• Revert "feat(cli): Show model thinking intent in loading indicator" by @pomelo-nwu in Revert "feat(cli): Show model thinking intent in loading indicator" QwenLM/qwen-code#5846
• ci(release): make release flow merge-queue-safe and keep release PRs out of notes by @yiliang114 in ci(release): make release flow merge-queue-safe and keep release PRs out of notes QwenLM/qwen-code#5832
• ci: add @qwen-code /resolve by @yiliang114 in ci: add @qwen-code /resolve QwenLM/qwen-code#5779
• fix(cli): stop repeated duplicate provider responses by @tt-a1i in fix(cli): stop repeated duplicate provider responses QwenLM/qwen-code#5657
• test(cli): add daemon startup benchmark by @doudouOUC in test(cli): add daemon startup benchmark QwenLM/qwen-code#5825
• docs: add vertex-ai auth, missing commands, and qc-helper index entries by @DragonnZhang in docs: add vertex-ai auth, missing commands, and qc-helper index entries QwenLM/qwen-code#5727
• feat(core): decouple /remember from auto-extract, stop writing to QWEN.md by @callmeYe in feat(core): decouple /remember from auto-extract, stop writing to QWEN.md QwenLM/qwen-code#5814
• fix(web-shell): defer transcript-appending local commands while a turn streams by @carffuca in fix(web-shell): defer transcript-appending local commands while a turn streams QwenLM/qwen-code#5822
• feat(web-shell): enhance assistant markdown tables with Excel-style interactions by @jifeng in feat(web-shell): enhance assistant markdown tables with Excel-style interactions QwenLM/qwen-code#5650
• ci(triage): run triage on the self-hosted ECS pool instead of GitHub-hosted by @wenshao in ci(triage): run triage on the self-hosted ECS pool instead of GitHub-hosted QwenLM/qwen-code#5851
• feat(cli): enable built-in status line preset by default for new users by @pomelo-nwu in feat(cli): enable built-in status line preset by default for new users QwenLM/qwen-code#5792
• feat(config): map provider id to SDK protocol via providerProtocol (#5758) by @qqqys in feat(config): map provider id to SDK protocol via providerProtocol (#5758) QwenLM/qwen-code#5793
• feat(telemetry): Make sensitive span attribute limit configurable by @doudouOUC in feat(telemetry): Make sensitive span attribute limit configurable QwenLM/qwen-code#5804
• fix(packaging): bundle audio capture for mirror installs by @qqqys in fix(packaging): bundle audio capture for mirror installs QwenLM/qwen-code#5747

…(release notes truncated; click the link above for the full text)

Also worth checking (manual — Copilot, please research these too)

• Cursor agent CLI — changelog: https://cursor.com/changelog · forum (bug reports): https://forum.cursor.com/c/bug-report/6
  • Drives plugins/multi/scripts/lib/adapters/cursor.mjs. The plugin currently works around the 2026.04.17-787b533 ACP regression (see maybeWarnAboutCursorVersion and ensureCursorAllowlist). When Cursor ships a fix, both workarounds can likely be simplified or removed.

Plugin files most likely to need updates

• plugins/multi/scripts/lib/acp-client.mjs (shared ACP JSON-RPC client; buildAutoApproveRequestHandler)
• plugins/multi/scripts/lib/acp-terminals.mjs (client-side terminal services)
• plugins/multi/scripts/lib/mcp-servers.mjs (MCP wiring for ACP session/new)
• plugins/multi/scripts/lib/adapters/{codex,gemini,cursor,copilot,qwen}.mjs (per-CLI adapters)
• plugins/multi/scripts/multi-cli-companion.mjs (companion runtime + dispatch)

What I'd like you to do, @copilot

1. Read the linked release notes for each detected change above, plus the manual-reference changelogs.
2. Compare what changed against the relevant adapter / shared code in this repo. Look specifically for:
   • New ACP methods we should handle in acp-client.mjs's buildAutoApproveRequestHandler
   • Renamed / deprecated CLI flags or model IDs hardcoded in any adapter
   • New CLI capabilities that obsolete a workaround we currently ship (e.g., the Cursor 2026.04.17 regression workaround in cursor.mjs — check if a newer Cursor release fixes it, and if so, propose removing maybeWarnAboutCursorVersion and the allowlist-injection or scoping it tighter)
   • Breaking changes that would silently break the plugin
3. For each change that warrants action, open a focused PR against master with the minimal fix. Reference the upstream release / commit / forum thread in the PR description.
4. If a detected change does NOT need any plugin update, reply on this issue with a short note saying "no plugin updates needed for X — reason: …" and close it.
5. If something is ambiguous (you can't tell from release notes whether the plugin is affected), ask in a comment rather than guessing.

You may use ACP_TRACE=1 and the rest of the diagnostic patterns documented in plugins/multi/skills/customize/SKILL.md if you want to verify behavior empirically.

---

State tracked in .github/upstream-state.json — bumped by this same workflow. If you want to suppress a noisy upstream from this watch, edit .github/scripts/upstream-watch.mjs.