This release adds LaTeX rendering and a startup banner to the TUI, introduces a configurable request size limit for the API server, and includes security fixes for session working directory path traversal.

What's New

• Adds LaTeX-to-Unicode rendering for inline and display math in TUI markdown
• Adds a startup banner to the normal TUI, shown as a centered empty state when no welcome message is configured
• Adds a configurable --max-request-size flag to serve api, allowing the HTTP request size limit to be adjusted (default remains 1 MiB; requests exceeding the limit return HTTP 413)
• Adds concurrency-safe, namespaced string attributes to sessions, persisted in SQLite and preserved across JSON round trips, metadata updates, clones, branches, and derived sessions

Bug Fixes

• Fixes path traversal vulnerability in API session working directories by rejecting traversal, sibling-directory, and symlink escapes when a --session-workingdir-root boundary is configured
• Fixes startup banner display in small viewports by hiding it when the viewport is too small
• Fixes startup banner ordering to appear before startup info
• Fixes TUI markdown rendering to preserve content after unclosed math expressions
• Fixes TUI matrix rendering to display columns without separators
• Updates gopher example files to reference gemini-3.1-pro-preview after gemini-3-pro-preview was removed from the model catalog

Technical Changes

• Migrates Docker Hub push jobs in CI from PAT-based login to short-lived OIDC tokens
• Uses TypeScript types for codemode

What's Changed

• docs: update CHANGELOG.md for v1.123.0 by @docker-read-write[bot] in #3931
• ci: migrate Hub logins to OIDC by @ronan-thibaut-glitch in #3932
• feat(tui): render LaTeX in markdown by @rumpl in #3950
• feat: add startup banner to normal TUI by @rumpl in #3949
• docs: auto-update for merged PRs (2026-08-07) by @aheritier in #3953
• Use typescript types for codemode by @rumpl in #3956
• feat: persist generic session attributes by @rumpl in #3958
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #3954
• fix(server): contain API session working directories by @Sayt-0 in #3916
• feat(api): add configurable --max-request-size flag to serve api by @aheritier in #3938
• fix: update gopher examples to gemini-3.1-pro-preview (model removed from catalog) by @aheritier in #3961
• docs: clarify request-size limits and large input strategies by @aheritier in #3963

Full Changelog: v1.123.0...v1.124.0

This release adds Alt+Enter follow-up messaging in the TUI and session recovery error exports, along with several bug fixes for Windows reliability and context overflow messaging.

What's New

• Adds Alt+Enter keyboard shortcut to submit follow-up messages in both the full TUI and lean TUI, with attachment preservation and pending follow-up display
• Includes recorded errors in the session recovery export

Bug Fixes

• Fixes a status race condition and subprocess pipe hang in background jobs
• Fixes promote() retry on Windows when an ACCESS_DENIED error occurs during kit rename operations
• Makes the context overflow error message frontend-agnostic, removing references to /compact that are not applicable to all consumers

Technical Changes

• Updates test for torn-file concurrency to tolerate Windows file sharing violations
• Clarifies sandbox documentation to reflect sbx integration and removes references to the retired docker sandbox CLI path

What's Changed

• docs: update CHANGELOG.md for v1.122.0 by @docker-read-write[bot] in #3915
• fix(backgroundjobs): resolve status race condition and subprocess pipe hang by @Piyush0049 in #3833
• docs: auto-update for merged PRs (2026-08-06) by @aheritier in #3919
• fix(kit): retry promote() retire-rename on Windows ACCESS_DENIED by @aheritier in #3917
• feat(tui): add Alt+Enter follow-up messages by @rumpl in #3918
• test(cache): fix Windows flake in the torn-file concurrency test by @trungutt in #3921
• fix: frontend-agnostic context overflow message, export recorded errors for recovery by @trungutt in #3920
• docs: clarify sbx sandbox integration by @dvdksn in #3924

New Contributors

• @dvdksn made their first contribution in #3924

Full Changelog: v1.122.0...v1.123.0

This release delivers a set of bug fixes and improvements across filesystem handling, the TUI, shell tooling, and cross-platform compatibility.

What's New

• Adds the resolved interpreter name to the shell tool description so the model knows which shell will execute commands
• Adds an explicit message when list_directory finds an empty directory, distinguishing an empty result from a tool failure
• Adds configurable interrupt confirmation for the Esc key, supporting always (confirmation dialog), double-tap (press twice), or none (immediate interruption) modes

Bug Fixes

• Fixes cross-platform root directory detection and fallback paths in TUI file and directory pickers, ensuring correct behavior on Windows
• Fixes support for path-scoped glob patterns (e.g. pkg/*.go) in post-edit hooks by matching against full relative paths instead of just the base filename
• Fixes a deadlock in the RAG file watcher that could occur when Start fails and Stop is subsequently called
• Fixes malformed inner JSON in double-serialized edit_file payloads, handling the case where both double-serialization and brace-counting errors occur together
• Fixes stream cancellation state being lost after automatic compaction completes mid-run in the TUI
• Fixes agent security and linting issues including goroutine leak prevention in RAG toolset and environment handling improvements

What's Changed

• docs: update CHANGELOG.md for v1.121.0 by @docker-read-write[bot] in #3910
• docs: auto-update for merged PRs (2026-08-05) by @aheritier in #3909
• feat(shell): name the resolved interpreter in the shell tool description by @trungutt in #3911
• feat(filesystem): say when list_directory finds an empty directory by @trungutt in #3912
• fix(filesystem): repair malformed inner JSON in double-serialized edits by @trungutt in #3913
• fix: resolve POSIX path handling and test failures on Windows by @Piyush0049 in #3792
• fix(tui): preserve stream cancellation after compaction by @Sayt-0 in #3914
• fix(tui): resolve cross-platform root detection and fallback paths in pickers by @Piyush0049 in #3795
• fix: agent security and linting improvements by @Piyush0049 in #3831

Full Changelog: v1.121.0...v1.122.0

This release brings several bug fixes and new features including configurable interrupt confirmation for the Esc key, ranged file reads, and improvements to safety classification and filesystem path handling.

What's New

• Adds configurable interrupt confirmation for the Esc key: choose always (default, shows a dialog) or double-tap (requires pressing Esc twice) to interrupt a running stream
• Adds optional line and limit arguments to read_file for ranged file reads, enabling partial reads of large files
• Adds --container-runtime flag to evaluations, allowing an alternative Docker-compatible CLI (e.g. Podman) to be used for image builds and container runs
• Broadens the destructive-command taxonomy in the shell safety classifier to cover additional command shapes (e.g. bare docker rm <id>)
• Adds fail-fast detection of foreign-OS paths (e.g. WSL-style paths on Windows) in filesystem tools, with an explanation of path resolution
• Adds signed-commit checking (Rules 4 and 5) to the triage-prs skill, flagging unsigned or invalid commits and managing the status/needs-signed-commits label

Bug Fixes

• Fixes SSE stream truncation when tool results exceed 64 KiB, which previously caused runs to silently stop
• Fixes the --models-gateway flag being ignored when creating the DMR provider client, causing failures in environments where the gateway is the only reachable path
• Fixes cache entries not expiring when the current time exactly equals their expiry deadline, preventing stale reuse on coarse-resolution clocks (e.g. Windows)
• Fixes self-update failure by reading and validating the GitHub release asset SHA-256 digest before downloading, instead of looking for a missing checksums.txt

Technical Changes

• Replaces arduino/setup-task with the official go-task/setup-task action in CI workflows
• Grants actions: write permission to the PR review workflow, restoring PR review runs that were failing during workflow validation
• Refreshes the embedded models.dev catalog snapshot

What's Changed

• fix(skills): expire cache entries at deadline by @Sayt-0 in #3896
• fix(ci): grant PR reviewer actions write permission by @Sayt-0 in #3898
• feat(eval): support configurable container runtime by @Sayt-0 in #3894
• chore: replace arduino/setup-task with go-task/setup-task by @aheritier in #3892
• fix(filesystem): support ranged file reads by @Sayt-0 in #3895
• fix(selfupdate): verify GitHub release asset digests by @Sayt-0 in #3897
• fix(dmr): honor the models gateway when creating the client by @aboullaite in #3875
• docs: update CHANGELOG.md for v1.120.0 by @docker-read-write[bot] in #3891
• feat: flag unsigned commits in triage-prs skill by @aheritier in #3903
• docs: auto-update for merged PRs (2026-08-04) by @aheritier in #3902
• fix(runtime): don't truncate the SSE stream on tool results >64 KiB by @EronWright in #3883
• chore: refresh embedded models.dev snapshot by @github-actions[bot] in #3888
• feat(safety): broaden destructive-command taxonomy by @trungutt in #3907
• feat(filesystem): fail fast on foreign-OS paths and explain path resolution by @trungutt in #3908
• fix(runtime): guard nested agent delegation by @Sayt-0 in #3905
• feat(tui): configurable interrupt confirmation for Esc key by @pkimtani in #3899

New Contributors

• @aboullaite made their first contribution in #3875
• @pkimtani made their first contribution in #3899

Full Changelog: v1.120.0...v1.121.0

This release improves Windows compatibility across the full test suite, adds new TUI features for context compaction and session plan editing, and fixes several platform-specific and sandbox issues.

What's New

• Adds compaction summary display to the /context dialog, showing the verbatim summary text when a session has been compacted
• Makes the current session plan editable from the /plans browser and detail views, labeling it as current session and distinguishing it from shared workspace-global plans

Bug Fixes

• Fixes external editors (e.g., Vim) not attaching to the real terminal when editing a plan in sandbox mode
• Fixes sandbox plan editor to use the available C.UTF-8 locale, preserving non-ASCII (e.g., German) input
• Fixes HOME environment variable handling to be honored correctly across platforms
• Fixes Windows executable support in tool installation
• Fixes handling of Windows file URIs in the LSP implementation
• Fixes Windows home directory path normalization
• Logs and recovers from empty or failed Docker Desktop token fetches, rather than silently discarding the error

Technical Changes

• Runs the full Go test suite natively on Windows as a blocking CI gate
• Consolidates Windows test jobs and uses the Task-based test entry point consistently across platforms
• Adds portable filesystem expectations and Windows-specific shell behavior tests

What's Changed

• docs: update CHANGELOG.md for v1.119.0 by @docker-read-write[bot] in #3868
• fix: preserve terminal and UTF-8 in sandbox plan editor by @Sayt-0 in #3876
• feat(tui): show compaction summary in context dialog by @Sayt-0 in #3877
• feat(tui): make current session plans editable by @Sayt-0 in #3878
• docs: auto-update for merged PRs (2026-08-01) by @aheritier in #3880
• ci: run full test suite on Windows by @Sayt-0 in #3866
• desktop: log and recover empty or failed token fetches by @trungutt in #3890

Full Changelog: v1.119.0...v1.120.0

This release introduces first-class plan management with a new CLI command group and TUI browser, adds YAML safety mode defaults, and includes several bug fixes for runtime stability and structured output handling.

What's New

• Adds docker agent plans CLI command group and a host-facing plan service package for managing plans from outside the agent runtime
• Adds a /plans browser, detail view, and action dialogs to the TUI for interactive plan management
• Adds YAML safety mode defaults to team runtime, individual agents, user settings, and aliases, with declarative precedence rules
• Adds an Active agents only option in TUI settings to filter the sidebar to agents participating in the current session
• Logs a warning when Docker Desktop serves an expired token to the models gateway

Bug Fixes

• Fixes runtime re-entry loop when a content-only turn ends with a bare EOF and no finish_reason from the provider
• Fixes structured output handling for Claude models served through OpenAI-compatible endpoints by reinforcing schema constraints in system instructions
• Fixes evaluation budget termination outcomes so budget_exceeded results are preserved correctly across transcripts, SQLite, and session JSON
• Hardens host plan management and stabilizes asynchronous TUI workflows for plans
• Fixes atomic file replacement on Windows to allow plan storage reads during open file operations

Technical Changes

• Exports ValidateName, CorruptPlanError, SharedStorage, and ChangeNotifier from the plan package
• Adds PlanChangedEvent emission on shared plan mutations in the runtime
• Centralizes plan editor handling in the TUI
• Adds plan storage testing on Windows as a CI gate
• Adds documentation for the Provider Credentials section in eval containers, clarifying GITHUB_TOKEN forwarding behavior

What's Changed

• docs: update CHANGELOG.md for v1.118.0 by @docker-read-write[bot] in #3861
• fix(openai): reinforce structured output for Claude proxies by @Sayt-0 in #3863
• feat(config): add YAML safety mode defaults by @Sayt-0 in #3860
• fix(eval): preserve budget termination outcomes by @Sayt-0 in #3862
• docs: explain GITHUB_TOKEN forwarding for eval containers by @priyanka25aug in #3857
• feat: add first-class host UX for plan management (#3844) by @Sayt-0 in #3853
• feat(tui): filter sidebar to active agents by @Sayt-0 in #3864
• fix(plans): address review follow-ups from #3853 by @Sayt-0 in #3865
• fix(runtime): stop content-only turns that end with a bare EOF (no finish_reason) by @awschmeder in #3669
• feat(desktop): log when Docker Desktop serves an expired token by @trungutt in #3867

New Contributors

• @priyanka25aug made their first contribution in #3857
• @awschmeder made their first contribution in #3669

Full Changelog: v1.118.0...v1.119.0

This release brings TUI animation infrastructure improvements, several bug fixes for session isolation, credential security, and model discovery, plus a new desktop token staleness logging feature.

What's New

• Adds a program-scoped animation runtime to the TUI, centralizing spinners, durations, and transitions for more consistent and robust animations
• Adds token staleness logging when Docker Desktop refresh recovery fails, promoting failure paths to Warn/Info level for better observability

Improvements

• Bounds progressive Markdown rendering in the TUI, enabling segmented output that avoids repeatedly re-processing completed blocks
• Adopts the program-scoped animation runtime across TUI animation consumers, migrating to elapsed-time updates and dirty-tick-driven root-view caching
• Compacts detailed sidebar metrics in the TUI to adapt to available width, using short forms (Eff, Ctx, Cost) at constrained widths and restoring full labels and gauges when space allows

Bug Fixes

• Fixes concurrent LoadWithConfig calls from sharing a working directory, preventing sessions from observing each other's working directory under concurrent load
• Fixes duplicated text in GitHub Copilot responses by deduplicating streamed content tracked by both item ID and output_index
• Unifies gateway model discovery between docker agent models and the interactive /model picker so that a non-empty /v1/models response is the source of truth
• Fixes safety modes (autonomous, legacy approval, YOLO state) not being preserved across session flows and /new transitions
• Fixes credential leaks in remote tool transports (MCP and A2A) by restricting bearer tokens and custom headers to requests whose origin matches the transport's configured origin

Technical Changes

• Removes unused dead TUI code including an unused lean TUI transcript reset method, package-level animation registration shim, and user-theme existence helper

What's Changed

• chore: remove dead TUI code by @Sayt-0 in #3836
• docs: update CHANGELOG.md for v1.117.0 by @docker-read-write[bot] in #3838
• fix: prevent concurrent LoadWithConfig calls from sharing working dir by @dgageot in #3842
• TUI - Program-scoped animation runtime by @krissetto in #3843
• fix(openai): deduplicate Copilot response text by @Sayt-0 in #3846
• fix(models): unify gateway model discovery by @Sayt-0 in #3847
• fix: preserve safety modes across session flows by @Sayt-0 in #3848
• fix: prevent credential leaks in remote tool transports by @dgageot in #3850
• chore: update docker-agent-action to v2.0.3 by @docker-agent in #3852
• TUI - enable segmented markdown rendering by @krissetto in #3851
• chore: bump direct go dependencies by @dgageot in #3854
• Adopt program-scoped animation runtime by @krissetto in #3855
• fix(tui): compact detailed sidebar metrics by @Sayt-0 in #3858
• feat(desktop): log token staleness when refresh recovery fails by @trungutt in #3859

Full Changelog: v1.117.0...v1.118.0

This release adds support for Claude Opus 5 and introduces a new three-mode safety policy system for tool approval control.

What's New

• Adds support for Claude Opus 5 (released 2026-07-24, 1M context window, 128k output)
• Adds a three-mode safety policy (strict / balanced / autonomous) with native shell classification, providing a middle ground between per-call approval and blanket session-wide approval

Technical Changes

• Refreshes the embedded models.dev catalog snapshot to 2026-07-24

What's Changed

• docs: update CHANGELOG.md for v1.116.0 by @docker-read-write[bot] in #3828
• feat: support Claude Opus 5 by @aheritier in #3830
• feat: three-mode safety policy (strict / balanced / autonomous) with native shell classification by @trungutt in #3835
• chore: refresh embedded models.dev snapshot by @github-actions[bot] in #3834

Full Changelog: v1.116.0...v1.117.0

This release adds sandbox authentication improvements, compaction-model context visibility in the TUI, MCP lifecycle enforcement, and a range of bug fixes across the TUI, CLI, and OpenAI integration.

What's New

• Adds sbx-login injection for gateway authentication in sandbox environments, replacing the previous file-based token-forwarding mechanism
• Defaults sandbox creation to the docker/docker-agent-sbx-templates:latest template
• Creates sandboxes under the canonical docker-agent name
• Makes oauth clientId optional for remote MCP toolsets, supporting Dynamic Client Registration and interactive credential flows
• Surfaces the compaction-model context-limit cap explicitly in the /context dialog and sidebar, so users can see when a dedicated compaction model is imposing a smaller context window than the primary model
• Adds segment-aware click detection on the sidebar Token Usage reading: clicking the token count/percentage opens /context, clicking the cost/⚠ capped area opens /cost; the "Token Usage" title is no longer clickable
• Enforces lifecycle.call_timeout for MCP tool calls, which was previously parsed but never acted on
• Exposes spawned TUI tabs (opened with ctrl+t) on the --listen control plane so control-plane clients can observe all active sessions
• Adds GitHub Copilot to docker agent setup and doctor, recognizing both GITHUB_TOKEN and GH_TOKEN

Bug Fixes

• Fixes copy buttons rendering in contexts where they were never wired up for hit-testing (reasoning blocks, elicitation dialogs, lean TUI, shell output, welcome messages)
• Fixes the "copied" flash background on user-message copy labels, which previously rendered with a transparent background
• Fixes mouse hit-testing falling out of sync when layout shifts without a terminal resize (e.g., after loading a past session with /session)
• Fixes an infinite loop in backgroundAt when encountering invalid UTF-8 bytes
• Fixes capability handlers (OAuth elicitation, etc.) not being forwarded to inner toolsets when code_mode_tools: true is set
• Fixes data races in deferred tools and the BM25 RAG strategy, and prevents a TUI editor panic
• Fixes wrapped URLs losing their clickability in tool output
• Fixes the ⚠ capped marker on the sidebar opening /cost instead of /context
• Fixes docker agent debug not appearing in the root help output
• Fixes docker agent setup provider path labels to clarify built-in cloud providers vs. custom OpenAI-compatible endpoints
• Fixes OpenAI Responses API function arguments not being recovered when providers omit response.function_call_arguments.delta

Technical Changes

• Refactors sandbox integration to assume the modern CLI surface shared by both backends
• Removes all references to the discontinued agentcatalog Docker Hub namespace, replacing examples with neutral myorg/agent placeholders
• Freezes config schema v14 and advances latest to v15
• Refactors board internals: deduplicates column lookup with a columnIndexLocked helper, deduplicates stored-project access with a projectsLocked helper, and consolidates per-card controller state into a single cardState map

What's Changed

• fix(tui): never render dead code-block copy buttons by @dgageot in #3789
• docs: update CHANGELOG.md for v1.115.0 by @docker-read-write[bot] in #3790
• sandbox: rely on sbx-login injection for gateway auth, modern sandbox CLI surface by @dgageot in #3791
• docs: update slash command and permission pattern docs for recent changes by @aheritier in #3794
• feat(config): make oauth clientId optional for remote MCP toolsets by @dgageot in #3796
• fix(tui): keep copy label background under "copied" flash by @dgageot in #3797
• fix(tui): guard backgroundAt against infinite loop on invalid UTF-8 by @dgageot in #3799
• fix(tui): keep mouse hit-testing in sync when the layout shifts without a resize by @dgageot in #3798
• chore: remove every trace of the discontinued agent catalog by @dgageot in #3804
• chore: bump direct Go dependencies by @dgageot in #3801
• fix(cli): add GitHub Copilot to setup and doctor by @stkevintan in #3793
• feat(config): freeze config v14 and start v15 as latest by @dgageot in #3807
• docs: auto-update for merged PRs (2026-07-23) by @aheritier in #3812
• docs: improve Ollama and local models discoverability by @aheritier in #3810
• fix(codemode): forward capability handlers to inner toolsets by @aheritier in #3809
• docs: auto-update for merged PRs (2026-07-24) by @aheritier in #3815
• feat(tui): open /context or /cost from the sidebar token-usage reading by @aheritier in #3813
• feat(tui): surface compaction-model context-limit cap in the TUI by @aheritier in #3811
• chore: bump direct Go dependencies by @dgageot in #3816
• refactor(board): simplify app and controller internals by @dgageot in #3817
• feat: enforce lifecycle.call_timeout for MCP tool calls by @jedp-docker in #3814
• feat(run): expose spawned TUI tabs on the --listen control plane by @dgageot in #3819
• fix: resolve data races in deferred tools and BM25 strategy, prevent TUI editor panic by @Piyush0049 in #3822
• fix(tui): keep wrapped URLs clickable by @Sayt-0 in #3823
• fix(setup): clarify model provider paths by @Sayt-0 in #3824
• fix(openai): recover final response tool arguments by @Sayt-0 in #3825
• fix(tui): open /context (not /cost) when clicking the ⚠ capped marker by @aheritier in #3826
• fix(cli): show debug command in help by @Sayt-0 in #3827

New Contributors

• @stkevintan made their first contribution in #3793

Full Changelog: v1.115.0...v1.116.0

This release fixes permission pattern parsing for colon-containing values, adds provider-level compaction model defaults, resolves agent-switch slash commands over HTTP, and includes several bug fixes and refactors.

What's New

• Adds X-Cagent-Compacting: 1 HTTP header on session-compaction LLM calls to allow gateway-side policies to distinguish compaction calls from regular chat completions
• Adds support for provider-level compaction_model default, so agents sharing a provider no longer need to repeat the setting individually
• Adds an optional description field to model config entries for human-readable annotations
• Resolves agent-switch slash commands in RunSession for HTTP/REST clients, enabling mid-session agent switches without requiring the two-segment route

Bug Fixes

• Fixes permission pattern parsing where colons in argument values (e.g. URLs or Windows drive paths) caused patterns to be silently truncated, resulting in deny rules never firing
• Fixes A2A tool silently succeeding when a sub-agent stream returns empty; also resolves cross-platform test instability on Windows
• Fixes compaction_model references not being resolved during first_available reachability checks and environment preflight
• Fixes model description not being preserved across first_available resolution and shorthand marshalling
• Fixes agent-switch pre-switch command resolution and rolls back partial switches on failure
• Fixes TUI history-search input not being restyled when a live theme change occurs, leaving stale styling after switching themes
• Fixes GatewayHTTPOptions panicking when model options are nil
• Reverts a WorkingDir containment check that broke callers running docker-agent as a long-lived daemon pointing sessions at arbitrary paths

Technical Changes

• Fixes log-injection (CodeQL go/log-injection) in pkg/telemetry/client.go by replacing string concatenation with structured key-value logging
• Sanitizes string arguments to close remaining log-injection taint paths and closes unbarriered passthrough in sanitizeLogArgs
• Refactors permission pattern parsing to use strings.Cut and then a regexp-based approach replacing the hand-rolled colon scanner
• Moves Desktop proxy HTTP transport to a new leaf package pkg/desktop/transport
• Moves Vertex AI support to anthropic/vertex subpackage to reduce transitive dependencies for library consumers

What's Changed

• docs: update CHANGELOG.md for v1.114.0 by @docker-read-write[bot] in #3775
• feat: add X-Cagent-Compacting header for session-compaction LLM calls by @dgageot in #3777
• refactor: trim transitive dependencies for library consumers by @dgageot in #3778
• chore: bump direct Go dependencies by @dgageot in #3776
• docs: update docs for config v14 and Mermaid state diagram directions by @aheritier in #3779
• fix(codeql): go/log-injection in pkg/telemetry/client.go:24 by @ronan-thibaut-glitch in #3755
• chore: bump github.com/anthropics/anthropic-sdk-go from v1.58.0 to v1.58.1 by @dgageot in #3781
• fix(permissions): keep colons in argument values from truncating patterns by @parveshsaini in #3767
• feat(config): add description attribute to models by @dgageot in #3783
• feat: support provider-level compaction_model default by @dgageot in #3785
• fix: A2A response error handling and cross-platform test stability by @Piyush0049 in #3745
• fix(tui): restyle history-search input on live theme change by @aheritier in #3786
• feat(server): resolve agent-switch slash commands in RunSession by @trungutt in #3782
• Revert "fix(codeql): go/path-injection in pkg/server/session_manager.go:542" (#3758) by @trungutt in #3788

Full Changelog: v1.114.0...v1.115.0