# ConnectOnion 1.9.2b31 (beta)

## Install this preview

Stable remains 1.9.1. Install this opt-in beta by exact pin:

```bash
python -m pip install --upgrade 'connectonion==1.9.2b31'
```

## Nobody gets more than the handoff

An audit of what a handoff lets each side do to the other found that whoever
accepted became a full contact of the sender's agent. Under the default
`careful` trust a contact can drive that agent and approve its own tool calls,
and the acceptor is whoever opened the page link first.

- **Both sides hold each other at `handoffs`.** They exchange messages about
  that handoff (accept, questions, answers, the result) and nothing else. To let
  someone use your agent, add them yourself: `co trust add <address>`.
  `co handoff status --verbose` prints the line.
- **A host refuses a `handoffs` peer without asking a model.**
- **Replies through the agent inbox count only from who really sent them.** The
  backend's authenticated sender must be the address the reply claims; the
  handoff's secret is in its public page, so it proves nothing on its own.
- **The sender's code stays in the handoff folder.** A patch's folder name is
  kept to one plain name, so `../` or a dot folder such as `.claude` cannot be
  written.
- **`co handoff open` works inside the folder.** Your Codex runs in its
  workspace sandbox (with network, to send the result) and Claude Code with
  file edits plus `co handoff` only. `--full-access` gives it the whole machine,
  as before.
- **Trust starts from cost** (design decision 078):
  what someone may do follows from what abusing it would cost them, which we
  only know once co rem tells us who they are. Until a Trust Agent judges that
  (#2407), a handoff counterpart is held at the stranger tier.

## The result applies where it came from

- **The sender's uncommitted changes arrive as their own commit.** Accepting
  rebuilt them as edits in the working tree, so the recipient's `git diff` sent
  them back too, and the sender's `git apply` failed on lines already there
  (found in a real Codex-to-Codex run on 1.9.2b30). Now the recipient's diff is
  only their work.

## Verification and limits

- Each change has a test that failed first; the handoff and trust tests pass.
- Not changed here, and tracked separately: what a full contact may run through
  a host's shipped `Bash(co *)` whitelist.
- The install floor stays 1.9.2b27.