Changelog

Full history with every commit: CHANGELOG.md in the main repo.

Note for maintainers: this page should mirror CHANGELOG.md from the main repo. Manual duplication guarantees drift. Ideally regenerate at build time from the main repo’s changelog.

The current published build is v4.4.x. Highlights below track the notable entries; the repo changelog has the per-PR detail.

v4.4.0 (2026-08-08)

Observability, agent capabilities, and a conversational chat surface.

Added

Agent capability tools — four editor-aware tools: get_active_editor (active file / cursor / selection / dirty state), lsp_query (hover / definition / references / signature), ast_edit (tree-sitter named-node body replace, routed through diff review), and find_files (fuzzy finder honoring .gitignore / .codebuddyignore)
Per-model capability map — adaptive model compatibility (fixes the 404 fallback id and the 400-on-thinking-param quirk) so provider differences no longer break agent turns
Langfuse observability — OTLP telemetry export with SSRF-guarded, IP-pinned outbound; anonymous user-id consent; user-feedback scoring and post-session derived scores
OpenTelemetry instrumentation — idempotent OTel setup with teardown, async context propagation, and cost-attribute sanitization
Conversational chat UI — bot turns render as one flowing message (streamed prose with tool calls folded into a single collapsed group, ConversationTurn), replacing the stacked activity ledger; approvals moved to an explicit Approve/Deny row
Deterministic eval gate — opt-in, hermetic agent regression gate (npm run test:eval) driving the real agent over a golden set; excluded from the everyday suite

Changed

Hardened numeric config coercion (extracted parseNumber utility)
Classified failover failure reasons (auth / rate-limit / format / …) now drive actionable recovery messages instead of a generic “all providers unavailable”
User messages are no longer JSON.stringify-wrapped before reaching the agent — stops quoted, escaped text from leaking into the LangGraph checkpointer
Default cost-threshold raised so routine tasks aren’t interrupted by the “continue?” prompt (still user-configurable)

v4.3.0 (2026-07-13)

Security-audit remediation, a sandboxed code-execution runtime, and the multi-provider agent architecture.

Added

QuickJS sandbox — sandboxed guest runtime with audited host bindings and OTel tracing; the only path for running untrusted/model-authored code
Dynamic sub-agents — REPL fan-out that can dispatch concurrent task() sub-agents, with per-role write-permission scoping
Multi-provider registry — PROVIDER_REGISTRY with compile-time exhaustiveness across 9 LLM providers
Secondary LLM service — extracted secondary-model path for cheaper auxiliary calls
Skill loader — skill-manifest discovery and modal-gated installation
Async agents — concurrent agent operations
Plan actions — Plan → Execute UI with explicit user approval
Timeline snapshot — the agent activity timeline is persisted onto the completed bot message so reasoning stays anchored to its answer
Friendly tool names — per-tool friendly labels + descriptive detail lines in the activity timeline

Security & Access Control

Security audit & remediation — threat model plus fixes for 6 Critical and the High/Medium findings
SSRF protection — validateOutboundUrlAsync (DNS-resolve + private/reserved-IP block) plus an IP-pinning variant for outbound MCP / telemetry / browser traffic
First-install hardening — fixes the placeholder-key “Groq trap”, adds the onboarding-only fallback provider, and tightens .codebuddy/ to 0700 / DBs to 0600

Changed

Restructured the developer agent and its prompt assembly
Centralized configuration handling
CI: typecheck + lint + webview build as a fast check job, vscode-test gated behind it

v4.2.0 (2026-03-22)

Added

Multi-language support (i18n) — internationalization with 7 languages and curated RSS feeds
MCP Playwright integration — browser automation via Model Context Protocol
Browser Automation Tool — built-in browser control for agent tasks
Onboarding wizard — guided first-run setup experience
Team graph & standup intelligence — team collaboration graph and standup report generation
Doctor command — diagnostic health-check command
Cost tracking — LLM token usage and estimated cost tracking
Model failover — automatic provider failover for both Agent and Ask modes
Inline review — in-editor code review experience
Architecture sub-agent — dedicated agent for architectural analysis
Context window compaction — intelligent context trimming for long conversations
Hybrid memory search — combined vector + keyword memory retrieval
Concurrency queue — task queue for managing parallel agent operations
Research notes — research note-taking and aggregation

Security & Access Control

External security config — JSON-based security configuration (.codebuddy/security.json)
Credential proxy — secure credential-management proxy
Permission system — granular permission controls
Access control — role-based access control framework
Context isolation — sandboxed context for secure multi-tenant use
Terminal security — hardened terminal command execution

v4.1.0 (2026-02-23)

Added

Session management — persistent session state across restarts
Connector system — external service connector framework
Notification system — in-extension notification panel
Enhanced context — richer context delivery to AI models
News feed — save/delete functionality and daily cleanup for curated news
Telemetry — usage analytics and performance telemetry
Google Gemini provider support in the developer agent

v4.0.0 (2026-02-05)

Major release — MCP, local models, and worker-thread infrastructure.

Added

MCP (Model Context Protocol) — gateway for unlimited tool extensibility
Sidebar settings panel — full settings panel integrated into the sidebar
Local LLMs — Docker/Ollama-based local model support
Project rules — project-specific instruction files for AI behavior
Skill Manager — integrated GitHub, Jira, and other skills
Scheduled tasks & news — daily news fetch and task scheduler
Task & memory tools — task management and memory tools with scheduler service
Agent Timeline — visual agent activity tracking component
Diff review — pending-change tracking and diff review
AST indexing — worker-thread-based AST indexing service with caching

v3.7.x and earlier

Maintenance releases, the React webview rewrite (v2.0.0), the AI agent system, RAG/vector-DB indexing, and the original providers. See the GitHub Releases page for the full history.

Staying up to date

CodeBuddy updates automatically through the extension marketplace. You can also update manually:

Extensions: Check for Extension Updates

Or install a specific version from a .vsix file:

code --install-extension ola-code-buddy-4.4.3.vsix