ConnectOnion 1.9.2b14 (beta)

Install this preview

Stable remains 1.9.1. Install this opt-in beta by exact pin:

python -m pip install --upgrade 'connectonion==1.9.2b14'

See what your agent did, and for whom

Your agent now keeps a record of everything it does for anyone: every tool call in a turn, every request another agent sends straight to a tool, every Remote Browser request, and every change to who may reach it.

co approvals                       # the newest 50 entries
co approvals --who 0x3f5a...c9e1   # one requester, or provider:sender for chat
co approvals --class money         # one kind of sensitive action

• One line per event in .co/approvals.jsonl, saying who asked, what ran, and whether it was done or declined. co ai keeps its record in ~/.co, and co approvals finds it.
• The agent cannot edit it. Like host.yaml, it is a control file, so its own write tools refuse it.
• No secrets in it. Arguments are cut short, and tokens and …KEY= values are replaced before anything is written.

Three things wait for the owner

Everything else is done and recorded. Three kinds of action stop when someone other than you asked and nobody is connected to ask: credentials and money, anything that cannot be undone, and acting as you in your own accounts.

• Code decides the kind, from the tool and its arguments, so a conversation cannot argue an action out of it.
• A chat message or an unattended run that reaches one of them is declined and told it needs you, at your own terminal.
• Direct tool requests from other agents stop there unless they come from an admin.
• When you are connected, for example in co ai in the browser, you are asked as before.
• Mail from the agent's own address is not one of them.

Verification and limits

• 14,201 unit tests pass locally; all CI jobs pass, including Windows and macOS end to end. Each new test failed first on the code before it.
• Two independent reviews were run on the record and the gate. They found that the first version refused the owner in the browser, and that co ai listen ran the first turn of each chat with no requester. Both are fixed and tested.
• Schedules and sub-agents have no requester yet, so they count as you.
• Every rm counts as irreversible for now, even of a file git could restore.
• Asking you by email when nobody is connected is the next step (#2408).