4.3.8 2026-10-14

Extension and twinny-server release: agent mode's changes can be undone from the reply, it follows the project's AGENTS.md, it sees the errors its edits cause, and a team's admin can set what it may do. Also a round of fixes from an audit of agent mode, two of them security fixes to the git tool.

• Undo what a reply changed. Agent mode applies edits straight away, so a reply that changed files now ends with the list of them: 3 files changed +24 −7, each file with its own counts and whether it is new or deleted. Click a file to see it beside what it was before the reply. undo puts one file back, undo all every file. Undo goes through the editor, so the editor's own Undo brings the agent's change back again. A file changed since the reply ended (by you or a later reply) is only put back if you say so. Edits, new files, deletes, moves and renames are covered, and so, inside a git repository, are files a command the agent ran changed (a formatter, a codemod, sed -i): the working tree is read before and after each command through a copy of git's index (about as long as git status takes in that repository), so your staging is untouched and ignored files never appear. Copies are kept in the workspace's storage for the last 50 replies.
• Agent settings in the chat. With agent mode on, a gear beside the agent switch opens what agent mode may do: whether changes apply or wait for review, whether commands ask, run or are off (the same as the auto-run switch), whether they run in the background or the terminal, how many steps a reply may take (8, 12, 20 or 30; new setting twinny.chatToolsMaxSteps, 12 by default), and forgetting the commands set to always run. Each writes your own twinny.chatTools… settings. A rule your team sets shows and cannot be loosened there.
• MCP servers in agent mode. Name Model Context Protocol servers in twinny.chatToolsMcpServers (a command, its arguments and environment), and their tools join agent mode. A server starts with the first agent reply and stops with the chat; it runs on this machine over standard input and output (no HTTP servers yet). Each call shows in the steps with Run, Always run (that tool, whatever its arguments) and Skip, because nothing a server does can be undone from the reply. A team whose rules take commands away takes MCP servers away too, one that asks before every command asks before every tool call, and Policy → Agent mode → MCP servers turns them off on their own. With no servers set, nothing changes: agent mode's prompt and tools are as before. The agent settings panel says how many servers are set and links to the setting.
• The agent sees the errors it causes. After an edit is applied, the result the model gets names the errors the editor now reports in that file that were not there before (up to five), so it can fix its own mistake without spending a step asking. The step's line says · 1 new error. Warnings are left out. In a file that was not open before the edit, only errors on the lines it changed are named, so the file's old errors are not blamed on it.
• AGENTS.md is followed. The project's AGENTS.md at the workspace root (or, without one, CLAUDE.md or .github/copilot-instructions.md) goes into agent mode's instructions. A folder's own AGENTS.md comes along the first time the agent works in that folder, and wins over the root's where they differ. The reply's footer names the files followed; click to open them. Changes to an AGENTS.md are always shown for review.
• Team rules for agent mode. On the gateway's admin page, Policy → Agent mode (or policy.agent in the configuration, with the policy licence feature): turn agent mode off for the team, make every command ask (auto-run and Always run then do nothing) or take commands away, make every change wait for review, and list paths the agent may not list, read, search, see in git or change. The rules only tighten a developer's own settings, are shown on the consent card, and reach developers at their next agent reply. An extension too old to know the rules is refused agent requests while the team sets any (with a message to update twinny or switch agent mode off); its plain chat and completions carry on.
• A finished command can be copied or put in your terminal. A command step the agent ran has a copy button and a terminal button: the command lands in your terminal to look at or run again, and nothing runs until you press Enter.
• Fixed: the git tool could read files outside the workspace. A path outside the repository made git diff compare any two files on the machine, and abbreviated options (--conten for --contents) or --ignore-revs-file read any file. Paths outside the workspace are refused wherever they appear, an option is refused by any start of a refused name, and the files-by-id route is closed too.
• Fixed: the git tool could show files .gitignore hides when git still tracks them, by object id (from ls-files -s), by staged path (:0:path), by a path with ./ or .. in it, or with --relative. ls-files output leaves hidden files out, and status --ignored is refused.
• Fixed: a command that left something running in the background never finished. npm start & or a server started by a script kept its step spinning for ever, and its stop button did nothing. The step now ends when the command does, and what it left running is ended with it (the model is told). A command that ignores SIGTERM is killed when its time runs out, and running commands end when the chat closes.
• Fixed in edits: code that only looks like read_file's line numbers (404: "Missing", YAML ports) is no longer stripped from an edit, and an edit that removes whole lines no longer leaves a blank line behind.
• Fixed in replies: an answer that mentions <tool_call> tags is shown as an answer, not treated as a broken call; text held back in case it began a call (a closing code fence) is shown when the calls come natively; on the last step a stray call is left out and the answer after it kept; calls made together share the context, so their results are not trimmed before the model reads them; call arguments under args, input or params reach the tool; and a reply that ends on an edit waiting for review says so instead of "ran out of tool steps".
• Fixed in the chat: starting a new conversation, or opening another, while an agent reply is running stops the reply instead of letting it land in the conversation you moved to. Shift+Enter on an empty composer no longer applies a waiting delete or move. Every thinking block in an agent reply is hidden, not only the first. A tool step no longer lands inside a code block, or jumps to the end of the reply, when the model wrapped its call in a fence. A reply that failed after its tools ran is no longer labelled stopped, and its tools' notes still go with your next message.
• Fixed in safety rules: .vscode/ and .gitignore are protected in any letter case (as macOS and Windows treat them), *.code-workspace files are protected like .vscode/, a link is judged by where it leads as well as by its name (and a new file is not written through a link whose target is missing), and deleting a file marked skip-worktree or assume-unchanged asks first, since git cannot vouch for it.