ConnectOnion 1.9.2

Install

python -m pip install --upgrade 'connectonion==1.9.2'

Hand a session to someone else's agent

You spent the afternoon getting somewhere with your coding agent, and now someone else should carry it on. co handoff sends them the session itself: every message you wrote, your agent's replies, and where the code is. Their agent picks up exactly where yours stopped.

• Say it in your agent. "Hand this to Bob" in Codex or Claude Code (the handoff skill), or co handoff send bob "<what>" in a terminal. A handoff is drafted from a Codex, Claude Code, Gemini CLI, opencode, droid, Cursor or Grok session.
• You see exactly what leaves. The preview is the whole message and every byte that would go; nothing is sent until you say yes. Credentials refuse the send. Other people's email addresses, phone numbers and the names from your co rem notebook are masked.
• Private sentences are taken out first, by your own agent. Your Codex or Claude Code reads every sentence that would go and replaces each one about health, family, personal travel, money, visas or a third party's affairs with [removed: <why>]; the preview lists where, and --edit puts any back.
• They paste one line. The note arrives from your own Gmail or Outlook with a page that shows what you shared and one line to paste into Codex or Claude Code. Their agent installs co if it needs to, accepts, and gets to work.
• Questions answer themselves. What the session does not say, their agent asks yours; your agent answers from a copy of the conversation you approved, never commands or their output.
• The work comes back. co handoff done sends a patch; co handoff status says where it stands and gives you the git apply to run. Nothing is applied for you.
• Neither side gets more than the handoff. Each holds the other at handoffs: messages about that handoff and nothing else. Letting someone use your agent is your own co trust add. Trust starts from cost: what someone may do follows from what abusing it would cost them, which only co rem can tell us (design decision 078).
• One person picks it up, and you can take it back. The first agent to accept holds it; a forwarded link is told it is taken. Unaccepted handoffs expire after a week; co handoff withdraw <id> removes one at once.

How it was checked

1.9.2b31 was run as two people would use it, in the real Codex and Claude Code apps with fresh identities on each side and the shipped skill: Claude Code to Codex and Codex to Claude Code, and Codex to Codex on 1.9.2b30. Each time the sender asked for the handoff and approved the preview, the recipient pasted one line, and the patch that came back applied cleanly on the sender's side; no other step needed a person. The private-sentence pass was measured on two real sessions: across three runs it removed every private detail listed by hand and kept every technical thread it had to. The 1.9.2rc1 wheel was installed from PyPI into a clean environment before this release.

Limits

• The sender's Codex does not notice by itself when the recipient finishes; ask it, or run co handoff status (#2507).
• A host's shipped Bash(co *) whitelist lets a full contact run mail and browser commands; handoffs no longer make anyone a contact (#2506).
• The private-sentence pass is a model's judgement: it can miss a sentence or remove one you wanted. Read the preview.
• Copilot's CLI and Warp sessions are not read yet.

The previews that built it: 1.9.2b1 to b31 and rc1. See the release channels.