ConnectOnion 1.9.2b31 (beta)

Install this preview

Stable remains 1.9.1. Install this opt-in beta by exact pin:

python -m pip install --upgrade 'connectonion==1.9.2b31'

Nobody gets more than the handoff

An audit of what a handoff lets each side do to the other found that whoever accepted became a full contact of the sender's agent. Under the default careful trust a contact can drive that agent and approve its own tool calls, and the acceptor is whoever opened the page link first.

• Both sides hold each other at handoffs. They exchange messages about that handoff (accept, questions, answers, the result) and nothing else. To let someone use your agent, add them yourself: co trust add <address>. co handoff status --verbose prints the line.
• A host refuses a handoffs peer without asking a model.
• Replies through the agent inbox count only from who really sent them. The backend's authenticated sender must be the address the reply claims; the handoff's secret is in its public page, so it proves nothing on its own.
• The sender's code stays in the handoff folder. A patch's folder name is kept to one plain name, so ../ or a dot folder such as .claude cannot be written.
• co handoff open works inside the folder. Your Codex runs in its workspace sandbox (with network, to send the result) and Claude Code with file edits plus co handoff only. --full-access gives it the whole machine, as before.
• Trust starts from cost (design decision 078): what someone may do follows from what abusing it would cost them, which we only know once co rem tells us who they are. Until a Trust Agent judges that (#2407), a handoff counterpart is held at the stranger tier.

The result applies where it came from

• The sender's uncommitted changes arrive as their own commit. Accepting rebuilt them as edits in the working tree, so the recipient's git diff sent them back too, and the sender's git apply failed on lines already there (found in a real Codex-to-Codex run on 1.9.2b30). Now the recipient's diff is only their work.

Verification and limits

• Each change has a test that failed first; the handoff and trust tests pass.
• Not changed here, and tracked separately: what a full contact may run through a host's shipped Bash(co *) whitelist.
• The install floor stays 1.9.2b27.