# ConnectOnion 1.9.2b14 (beta)

## Install this preview

Stable remains 1.9.1. Install this opt-in beta by exact pin:

```bash
python -m pip install --upgrade 'connectonion==1.9.2b14'
```

## See what your agent did, and for whom

Your agent now keeps a record of everything it does for anyone: every tool
call in a turn, every request another agent sends straight to a tool, every
Remote Browser request, and every change to who may reach it.

```bash
co approvals                       # the newest 50 entries
co approvals --who 0x3f5a...c9e1   # one requester, or provider:sender for chat
co approvals --class money         # one kind of sensitive action
```

- **One line per event** in `.co/approvals.jsonl`, saying who asked, what ran,
  and whether it was done or declined. `co ai` keeps its record in `~/.co`,
  and `co approvals` finds it.
- **The agent cannot edit it.** Like `host.yaml`, it is a control file, so its
  own write tools refuse it.
- **No secrets in it.** Arguments are cut short, and tokens and `…KEY=` values
  are replaced before anything is written.

## Three things wait for the owner

Everything else is done and recorded. Three kinds of action stop when someone
other than you asked and nobody is connected to ask: credentials and money,
anything that cannot be undone, and acting as you in your own accounts.

- **Code decides the kind**, from the tool and its arguments, so a
  conversation cannot argue an action out of it.
- **A chat message or an unattended run** that reaches one of them is declined
  and told it needs you, at your own terminal.
- **Direct tool requests from other agents** stop there unless they come from
  an admin.
- **When you are connected**, for example in `co ai` in the browser, you are
  asked as before.
- **Mail from the agent's own address** is not one of them.

## Verification and limits

- 14,201 unit tests pass locally; all CI jobs pass, including Windows and
  macOS end to end. Each new test failed first on the code before it.
- Two independent reviews were run on the record and the gate. They found that
  the first version refused the owner in the browser, and that `co ai listen`
  ran the first turn of each chat with no requester. Both are fixed and tested.
- Schedules and sub-agents have no requester yet, so they count as you.
- Every `rm` counts as irreversible for now, even of a file git could restore.
- Asking you by email when nobody is connected is the next step (#2408).