# ConnectOnion 1.9.2

## Install

```bash
python -m pip install --upgrade 'connectonion==1.9.2'
```

## Hand a session to someone else's agent

You spent the afternoon getting somewhere with your coding agent, and now
someone else should carry it on. `co handoff` sends them the session itself:
every message you wrote, your agent's replies, and where the code is. Their
agent picks up exactly where yours stopped.

- **Say it in your agent.** "Hand this to Bob" in Codex or Claude Code (the
  `handoff` skill), or `co handoff send bob "<what>"` in a terminal. A handoff
  is drafted from a Codex, Claude Code, Gemini CLI, opencode, droid, Cursor or
  Grok session.
- **You see exactly what leaves.** The preview is the whole message and every
  byte that would go; nothing is sent until you say yes. Credentials refuse the
  send. Other people's email addresses, phone numbers and the names from your
  co rem notebook are masked.
- **Private sentences are taken out first, by your own agent.** Your Codex or
  Claude Code reads every sentence that would go and replaces each one about
  health, family, personal travel, money, visas or a third party's affairs with
  `[removed: <why>]`; the preview lists where, and `--edit` puts any back.
- **They paste one line.** The note arrives from your own Gmail or Outlook with
  a page that shows what you shared and one line to paste into Codex or Claude
  Code. Their agent installs co if it needs to, accepts, and gets to work.
- **Questions answer themselves.** What the session does not say, their agent
  asks yours; your agent answers from a copy of the conversation you approved,
  never commands or their output.
- **The work comes back.** `co handoff done` sends a patch; `co handoff status`
  says where it stands and gives you the `git apply` to run. Nothing is applied
  for you.
- **Neither side gets more than the handoff.** Each holds the other at
  `handoffs`: messages about that handoff and nothing else. Letting someone use
  your agent is your own `co trust add`. Trust starts from cost: what someone
  may do follows from what abusing it would cost them, which only co rem can
  tell us (design decision 078).
- **One person picks it up, and you can take it back.** The first agent to
  accept holds it; a forwarded link is told it is taken. Unaccepted handoffs
  expire after a week; `co handoff withdraw <id>` removes one at once.

## How it was checked

1.9.2b31 was run as two people would use it, in the real Codex and Claude Code
apps with fresh identities on each side and the shipped skill: Claude Code to
Codex and Codex to Claude Code, and Codex to Codex on 1.9.2b30. Each time the
sender asked for the handoff and approved the preview, the recipient pasted one
line, and the patch that came back applied cleanly on the sender's side; no
other step needed a person. The private-sentence pass was measured on two real
sessions: across three runs it removed every private detail listed by hand and
kept every technical thread it had to. The 1.9.2rc1 wheel was installed from
PyPI into a clean environment before this release.

## Limits

- The sender's Codex does not notice by itself when the recipient finishes;
  ask it, or run `co handoff status` (#2507).
- A host's shipped `Bash(co *)` whitelist lets a full contact run mail and
  browser commands; handoffs no longer make anyone a contact (#2506).
- The private-sentence pass is a model's judgement: it can miss a sentence or
  remove one you wanted. Read the preview.
- Copilot's CLI and Warp sessions are not read yet.

The previews that built it: 1.9.2b1 to b31 and rc1. See the
[release channels](../releases.md).