From 0938982a7ed0d1ff19eace69d60b955993fa3ce7 Mon Sep 17 00:00:00 2001
From: dev-claudecode
Date: Sun, 28 Jun 2026 21:11:03 +0800
Subject: [PATCH] build(release): v1.4.0 stable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Closes the v1.4.0 cycle (beta.1 → beta.2 → beta.3) + 3 post-beta cherry-picks:
- #1436 Send goroutine nil-pointer race (process crash)
- #1321 Feishu recall-probe quota throttle
- drainPendingMessages alignment with #1436
15 platforms, 30+ fixes, agent option parsing unified via #1297.
Co-authored-by: Cursor
---
CHANGELOG.md | 29 +++++
Makefile | 2 +-
README.md | 23 ++--
README.zh-CN.md | 31 +++---
changelogs/v1.4.0.md | 256 +++++++++++++++++++++++++++++++++++++++++++
npm/package.json | 2 +-
6 files changed, 317 insertions(+), 26 deletions(-)
create mode 100644 changelogs/v1.4.0.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e9f3bb8c..ae8983a18 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
# Changelog
+## v1.4.0 (2026-06-28)
+
+Stable release of the v1.4.0 series. **Two new platforms join the family** (Cisco Webex, Matrix with E2EE), broader configurability across agents and platforms, Korean i18n, and a long list of fixes — including last-minute critical fixes for a `Send` goroutine race (#1436), a Feishu recall-probe quota burn (#1321), and a `run_as_user` EACCES regression (#1433).
+
+This stable rolls up everything from v1.4.0-beta.1 → beta.2 → beta.3 plus the 3 post-beta.3 cherry-picks (#1436, #1321 and a `drainPendingMessages` follow-up alignment).
+
+See `changelogs/v1.4.0.md` for the full themed summary with credits.
+
+### 🚨 Critical fixes shipped late in the cycle
+- **core Send-goroutine nil-pointer panic race** (#1436, @gotang; follow-up alignment of the third call site in `drainPendingMessages`): would crash the whole cc-connect process and drop every platform connection when an agent process exited just before a `Send` goroutine was scheduled. 100% reproducible in production.
+- **Feishu recall-probe quota burn** (#1321, @qvictl): `MessageRecallDetector` fallback path was polling every 2s, burning ~1.3M Feishu OpenAPI calls/month per stuck session and exhausting the 1M free quota. Probe interval now 1 minute with per-message dedup + in-flight guard.
+- **claudecode `run_as_user` EACCES regression** (#1433, @chenhg5; reported by @vuyiv #1429): chmod `0o644` on per-spawn system-prompt temp file so non-root child processes can read it. Fixes a regression introduced by v1.3.4 (#1376) — `run_as_user` users on beta.1/beta.2 were 100% blocked at agent startup.
+
+### v1.4.0 cycle highlights
+- **Cisco Webex** and **Matrix (with E2EE)** as new first-class platforms (#1402, #834).
+- **agent option parsing refactor**: centralize cmd/env option parsing into core with unified `cmd` field across all agent adapters (#1297).
+- **Slack streaming preview + aggregated turn card** (#1333).
+- **Feishu after_click card replacement for `cmd:` actions** (#1299).
+- **Codex custom `system_prompt` / `append_system_prompt` config** (#1345); codex `model_catalog_json` highest-priority source (#1074).
+- **Zhipu GLM provider presets** for `z.ai` and `bigmodel` CN endpoint (#1412).
+- **Korean (ko) i18n** for the Web admin UI (#1343), plus `nav.cron` translations for ko/ja/es.
+- **`plugin_dir` for Claude Code plugins** (#1325), `cc-connect send --cwd` workdir support (#1380), `max_attachment_size_mb` (#1392), `CC_LOG_MAX_BACKUPS` env var (#1260), configurable `/history` truncation (#1291).
+- 30+ fixes across feishu, slack, dingtalk, claudecode, codex, core engine, runas, web admin and i18n. Full list in `changelogs/v1.4.0.md`.
+
+### Upgrade notes
+- `cli_path` config field is deprecated in favour of unified `cmd` (#1297). Existing configs continue to work; a deprecation warning is logged. Migrate when convenient.
+- `imageBatchWindow` default for Feishu changed from 150 ms → 500 ms. Override in config if you preferred the older value.
+- `MessageRecallDetector` fallback probe interval changed from 2 s → 60 s. If you relied on the old aggressive polling for custom integrations, the new behaviour is deduped and gated.
+
## v1.4.0-beta.3 (2026-06-28)
Rolling beta with 3 additional commits on top of beta.2: one critical regression fix + two low-risk additions. Two additional critical fixes were cherry-picked on top of beta.3 ahead of the v1.4.0 stable cut.
diff --git a/Makefile b/Makefile
index 063eee934..0d55d1494 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ MODULE := github.com/chenhg5/cc-connect
CMD := ./cmd/cc-connect
DIST := dist
-VERSION := v1.4.0-beta.3
+VERSION := v1.4.0
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
BUILD_TIME := $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
diff --git a/README.md b/README.md
index 3d4304e70..fa0133c7d 100644
--- a/README.md
+++ b/README.md
@@ -161,25 +161,28 @@ MiniMax-M3 pushes the frontier of coding and agentic AI, with a 1M-token context
-## 🆕 What’s New in v1.4.0-beta.1
+## 🆕 What's New in v1.4.0
-First beta of the v1.4.0 series — 22 PRs since v1.3.4, with **two new platforms** joining the family. Also rolls in the v1.3.4 Windows-cmdline hotfix via PR #1378.
+Stable release of the v1.4.0 series — **two new platforms join the family** (Cisco Webex, Matrix with E2EE), broader configurability across agents and platforms, Korean i18n, and a long list of fixes including three critical post-beta cherry-picks for a Send-goroutine race, a Feishu recall-probe quota burn, and a `run_as_user` EACCES regression.
-- **New platforms** — **Cisco Webex** first-class adapter (#1402, @bryantbarzola); **Matrix with E2EE** end-to-end-encrypted room support (#834, @rablwupei). cc-connect now ships 15 chat platforms.
+- 🚨 **Critical fixes shipped late** — Send-goroutine nil-pointer race that crashed the whole cc-connect process (#1436, @gotang); Feishu `MessageRecallDetector` burning ~1.3M OpenAPI calls/month per stuck session (#1321, @qvictl); `run_as_user` EACCES regression introduced by v1.3.4 (#1433, @chenhg5; reported by @vuyiv #1429).
+- **New platforms** — **Cisco Webex** first-class adapter (#1402, @bryantbarzola); **Matrix with E2EE** end-to-end-encrypted room support (#834). cc-connect now ships 15 chat platforms.
+- **Agent option parsing refactor** — unified `cmd` field across all agent adapters; `cli_path` is deprecated (still works with a warning) (#1297, @happyTonakai).
- **Slack streaming + aggregated turn card** — live streaming preview while the agent is thinking, collapses into a single turn card on completion (#1333).
-- **Feishu rich card upgrades** — `after_click` card replacement for `cmd:` action handlers (#1299); batch images dispatched as one multi-image message so the first image of N is no longer dropped (#1408 carrying #1395).
-- **Codex per-config prompts** — `system_prompt` / `append_system_prompt` now honoured for the codex agent, matching claudecode (#1345).
-- **Korean (ko) i18n** — Web admin UI now ships Korean alongside zh / en / ja (#1343).
+- **Feishu rich card upgrades** — `after_click` card replacement for `cmd:` action handlers (#1299); batch images dispatched as one multi-image message (default coalesce window now 500 ms) so the first image of N is no longer dropped (#1408 carrying #1395).
+- **Codex per-config prompts + `model_catalog_json`** — `system_prompt` / `append_system_prompt` now honoured for the codex agent (#1345); Codex's own `model_catalog_json` is preferred as highest-priority model source (#1074, @happyTonakai).
+- **Zhipu GLM provider presets** — `z.ai` and `bigmodel` (CN) endpoint entries added (#1412, @clingnet).
+- **Korean (ko) i18n** — Web admin UI now ships Korean alongside zh / en / ja (#1343); `nav.cron` also localised for ko/ja/es.
- **Claude Code plugins via `plugin_dir`** — load Claude Code plugins by pointing at a directory (#1325).
-- **Operational knobs** — `max_attachment_size_mb` for `cc-connect send` outbound size cap (#1392); `CC_LOG_MAX_BACKUPS` env var for daemon log rotation (#1260).
+- **Operational knobs** — `cc-connect send --cwd` workdir support (#1380, @MMMarcinho); `max_attachment_size_mb` for `cc-connect send` outbound size cap (#1392, @rablwupei); `CC_LOG_MAX_BACKUPS` env var for daemon log rotation (#1260); configurable `/history` truncation (#1291, @AaronZ345).
- **acp graceful `/stop`** — new `AgentSessionCanceller` interface lets ACP agents stop cleanly (#1275).
-- **Reliability fixes** — workspace model persistence (#1372); core queued messages drain strictly FIFO so older queued items are no longer dropped as stale (#1286); workspace binding + run_as_user fixes (#1315, #1316); claudecode mid-turn compaction keeps the turn alive (#1272); cron permission lookup with composite keys (#1067).
+- **Reliability fixes** — workspace model persistence (#1372); core queued messages drain strictly FIFO (#1286); workspace binding + run_as_user fixes (#1315, #1316, #1433); claudecode mid-turn compaction keeps the turn alive (#1272); claudecode tool output reaches progress card via `EventToolResult` (#1407, @coolrockin); DingTalk stream loop panic recovery (#1390, reported by @gd0094); `/restart` notification queued and dispatched on platform ready (#1388 closing #1383); cron permission lookup with composite keys (#1067).
- **Skill discovery hardened** — only depth-1 `SKILL.md` is registered; nested SKILL.md files are treated as assets, fixing 101 phantom slash-commands from `frontend-design` skill (#1317 carrying #1304).
- **Windows cmdline hotfix on main** — v1.3.4's `--append-system-prompt-file` fix is now on main via #1378. Windows + claudecode users are unblocked here without needing the v1.3.4 hotfix branch.
-⚠️ **Behavior changes**: None. All new config options are optional with safe defaults. Existing v1.3.4 configs upgrade as-is.
+⚠️ **Upgrade notes**: `cli_path` is deprecated in favour of `cmd` (existing configs keep working). Feishu `imageBatchWindow` default changed from 150 ms → 500 ms. Feishu `MessageRecallDetector` fallback probe interval changed from 2 s → 60 s. Override in config if you preferred the old values.
-Full themed summary with credits: `changelogs/v1.4.0-beta.1.md`. The v1.3.4 Windows hotfix is documented in `changelogs/v1.3.4.md`.
+Full themed summary with credits: `changelogs/v1.4.0.md`. Per-beta detail: `changelogs/v1.4.0-beta.1.md`, `v1.4.0-beta.2.md`, `v1.4.0-beta.3.md`. The v1.3.4 Windows hotfix is documented in `changelogs/v1.3.4.md`.
## 🧩 Platform feature snapshot
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 78372f885..4a49cbc53 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -160,25 +160,28 @@ MiniMax M3 突破 Coding 与 Agentic AI 前沿,基于 MiniMax Sparse Attention
-## 🆕 v1.4.0-beta.1 更新了什么
+## 🆕 v1.4.0 更新了什么
-v1.4.0 系列首个 beta —— 自 v1.3.4 起 22 个 PR,**两个新平台**加入家族。同时把 v1.3.4 的 Windows 命令行修复通过 PR #1378 回流到 main。
+v1.4.0 正式版 —— **两个新平台**加入家族(Cisco Webex、含 E2EE 的 Matrix),agent 与平台层配置选项全面拓宽,韩语 i18n,加上一连串修复,其中包含三个 beta 收尾期紧急 cherry-pick 的关键修复。
-- **新增平台** — **Cisco Webex** 一等公民适配器 (#1402, @bryantbarzola);**Matrix(含 E2EE)** 端到端加密房间支持 (#834, @rablwupei)。cc-connect 内置平台数达到 15 个。
+- 🚨 **关键修复(beta 之后紧急 ship)** — Send goroutine nil 指针 race 会让整个 cc-connect 进程崩溃,所有平台连接断开 (#1436, @gotang);飞书 `MessageRecallDetector` fallback 每 2 秒探测一次,单 session 一个月烧 ~130 万次飞书 OpenAPI 调用,把免费额度打穿 (#1321, @qvictl);v1.3.4 引入的 `run_as_user` EACCES regression,beta.1/beta.2 上 `run_as_user` 用户 100% 在 agent 启动时被堵 (#1433, @chenhg5;@vuyiv 报告 #1429)。
+- **新增平台** — **Cisco Webex** 一等公民适配器 (#1402, @bryantbarzola);**Matrix(含 E2EE)** 端到端加密房间支持 (#834)。cc-connect 内置平台数达到 15 个。
+- **agent option 解析重构** — 所有 agent 适配层走统一 `cmd` 字段,`cli_path` 废弃但仍兼容(带 deprecation 警告)(#1297, @happyTonakai)。
- **Slack 流式预览 + 聚合 turn 卡片** — agent 思考期间显示实时流式预览,turn 结束后折叠为单张聚合卡片 (#1333)。
-- **飞书富卡片升级** — `cmd:` action handler 支持点击后替换卡片内容 (#1299);批量图片合并为一条多图消息,不再被 `create_time` watermark 丢掉第一张 (#1408 携带 #1395)。
-- **Codex per-config prompt** — codex agent 现在也支持 `system_prompt` / `append_system_prompt`,跟 claudecode 对齐 (#1345)。
-- **韩语 (ko) i18n** — Web 管理后台增加韩语,已覆盖 zh / en / ja / ko (#1343)。
-- **Claude Code 插件加载** — 新增 `plugin_dir` 配置项,直接指向插件目录加载 (#1325)。
-- **运维参数** — `cc-connect send` 增加 `max_attachment_size_mb` 上限配置 (#1392);daemon 日志轮转支持 `CC_LOG_MAX_BACKUPS` 环境变量 (#1260)。
-- **acp 优雅 `/stop`** — 新增 `AgentSessionCanceller` 接口,让 ACP agent 可以干净停止 (#1275)。
-- **可靠性修复** — workspace 模型选择跨重启持久化 (#1372);core 队列消息严格 FIFO drain,旧消息不再被新消息的 `create_time` 误判为 stale 而丢弃 (#1286);`run_as_user` 下的 workspace 绑定 + workspace 启动修复 (#1315, #1316);claudecode 中途遇到 compaction 事件不再终止 turn (#1272);cron session 复合 key 的权限查找修复 (#1067)。
-- **Skill 发现加固** — 只注册 depth-1 `SKILL.md`,嵌套的 SKILL.md 当作 skill 资产忽略,修复了 `frontend-design` skill 泄漏 101 个幻影 slash 命令的问题 (#1317 携带 #1304)。
-- **Windows 命令行修复回流 main** — v1.3.4 的 `--append-system-prompt-file` 修复通过 #1378 上 main。Windows + claudecode 用户在 v1.4.0 上直接可用,不再依赖 v1.3.4 hotfix 分支。
+- **飞书富卡片升级** — `cmd:` action handler 支持点击后替换卡片内容 (#1299);批量图片合并为一条多图消息(默认 coalesce 窗口由 150ms 调至 500ms),不再被 `create_time` watermark 丢掉第一张 (#1408 携带 #1395)。
+- **Codex per-config prompt + model_catalog_json** — codex agent 支持 `system_prompt` / `append_system_prompt`,跟 claudecode 对齐 (#1345);Codex 自身的 `model_catalog_json` 作为最高优先级 model 源 (#1074, @happyTonakai)。
+- **智谱 GLM 预设** — `z.ai` 与 `bigmodel`(国内端点)的 provider preset (#1412, @clingnet)。
+- **韩语 (ko) i18n** — Web 管理后台增加韩语 (#1343);`nav.cron` 同步补齐 ko/ja/es 翻译。
+- **Claude Code 插件加载** — 新增 `plugin_dir` 配置项 (#1325)。
+- **运维参数** — `cc-connect send --cwd` 工作目录 (#1380, @MMMarcinho);`max_attachment_size_mb` 附件上限 (#1392, @rablwupei);daemon 日志轮转 `CC_LOG_MAX_BACKUPS` 环境变量 (#1260);可配置的 `/history` truncation (#1291, @AaronZ345)。
+- **acp 优雅 `/stop`** — 新增 `AgentSessionCanceller` 接口 (#1275)。
+- **可靠性修复** — workspace 模型选择跨重启持久化 (#1372);core 队列严格 FIFO drain (#1286);`run_as_user` workspace 绑定 + 启动修复 (#1315, #1316, #1433);claudecode 中途 compaction 不终止 turn (#1272);claudecode 工具输出能进 progress card (#1407, @coolrockin);DingTalk stream loop panic 恢复 (#1390, @gd0094 报告);`/restart` 通知 queue 后等平台 ready 再 dispatch (#1388 关闭 #1383);cron 复合 key 权限查找修复 (#1067)。
+- **Skill 发现加固** — 只注册 depth-1 `SKILL.md` (#1317 携带 #1304)。
+- **Windows 命令行修复回流 main** — v1.3.4 的 `--append-system-prompt-file` 修复通过 #1378 上 main (#1378)。
-⚠️ **行为变更**:无。所有新配置项均为可选且有安全默认值。v1.3.4 已有配置可直接升级。
+⚠️ **升级提示**:`cli_path` 已废弃,建议迁移到 `cmd`(旧配置仍兼容)。飞书 `imageBatchWindow` 默认值由 150ms 调至 500ms。飞书 `MessageRecallDetector` fallback 探测间隔由 2s 调至 60s。如有自定义需求,可在配置中覆盖。
-完整主题汇总(含致谢)见 `changelogs/v1.4.0-beta.1.md`。v1.3.4 的 Windows 命令行修复另见 `changelogs/v1.3.4.md`。
+完整主题汇总(含致谢)见 `changelogs/v1.4.0.md`。各 beta 详情:`changelogs/v1.4.0-beta.1.md`、`v1.4.0-beta.2.md`、`v1.4.0-beta.3.md`。v1.3.4 的 Windows 命令行修复另见 `changelogs/v1.3.4.md`。
## 🧩 平台能力一览
diff --git a/changelogs/v1.4.0.md b/changelogs/v1.4.0.md
new file mode 100644
index 000000000..fac755881
--- /dev/null
+++ b/changelogs/v1.4.0.md
@@ -0,0 +1,256 @@
+# v1.4.0 — 2026-06-28
+
+Stable release of the v1.4.0 series. Closes a 6-day beta cycle (beta.1 →
+beta.2 → beta.3) plus three critical post-beta cherry-picks merged into
+stable: a `Send` goroutine race, a Feishu recall-probe quota burn, and
+an alignment follow-up.
+
+This page is the consolidated stable changelog. For per-beta detail, see
+[`v1.4.0-beta.1.md`](v1.4.0-beta.1.md), [`v1.4.0-beta.2.md`](v1.4.0-beta.2.md),
+and [`v1.4.0-beta.3.md`](v1.4.0-beta.3.md).
+
+---
+
+## 🚨 Critical fixes shipped late in the cycle
+
+These three landed after beta.3's QA PASS and are part of why v1.4.0 stable
+is being cut now rather than as a clean re-spin of beta.3:
+
+- **core: `Send` goroutine nil-pointer panic race** (#1436,
+ [@gotang](https://github.com/gotang); follow-up alignment of the third
+ call site in `drainPendingMessages` by cc-connect/qa-cursor) —
+ `cleanupInteractiveState` could nil `state.agentSession` while three
+ `Send` goroutines were still reading it without holding the lock. When
+ an agent process exited just before its `Send` was scheduled, the whole
+ cc-connect process would panic and drop every platform connection.
+ **100% reproducible in production**. Fix captures `state.agentSession`
+ under `state.mu` before launching `Send` goroutines and adds a
+ nil-check fallback inside each goroutine.
+- **Feishu: recall-probe quota burn** (#1321,
+ [@qvictl](https://github.com/qvictl)) — `MessageRecallDetector`
+ fallback path was polling `GET /im/v1/messages/{message_id}` every 2 s
+ for the same active message, burning **~1.3M Feishu OpenAPI calls/month
+ per stuck session** and exhausting the 1M/month free quota. Probe
+ interval now 1 minute; per-message dedup + in-flight guard inside
+ `interactiveState`. Reset on each new active message so recall
+ detection still works for normal turns.
+- **claudecode: `run_as_user` EACCES regression** (#1433,
+ [@chenhg5](https://github.com/chenhg5); reported by
+ [@vuyiv](https://github.com/vuyiv) #1429) — chmod `0o644` on per-spawn
+ system-prompt temp file so non-root child processes can read it after
+ dropping privileges. Fixes a regression introduced by v1.3.4 (#1376):
+ `run_as_user` users on beta.1/beta.2 were 100% blocked at agent
+ startup with `EACCES` errors.
+
+---
+
+## New platforms
+
+- **Cisco Webex** — first-class Webex Teams adapter with bot identity,
+ message routing, and reply support
+ (#1402, [@bryantbarzola](https://github.com/bryantbarzola)).
+- **Matrix (with E2EE)** — first-class Matrix adapter including
+ end-to-end encrypted room support (#834).
+
+---
+
+## Features
+
+### Agents
+- **Codex `system_prompt` / `append_system_prompt`** config: codex
+ agent now honours per-config prompts the same way claudecode does (#1345).
+- **Codex `model_catalog_json`** preferred as highest-priority model
+ source (#1074, [@happyTonakai](https://github.com/happyTonakai)).
+- **Claude Code `plugin_dir`** — claudecode agent supports loading
+ plugins via `--plugin-dir`, exposed as a new `plugin_dir` config
+ option (#1325).
+- **agent option parsing refactor** — centralize cmd/env option parsing
+ into core with a unified `cmd` field across all agent adapters
+ (39 files, +863/-419) (#1297,
+ [@happyTonakai](https://github.com/happyTonakai)).
+ `cli_path` is deprecated in favour of `cmd`. Existing configs continue
+ to work with a deprecation warning.
+
+### Platforms
+- **Slack streaming preview + aggregated turn card** — live streaming
+ preview while the agent is thinking, collapses into a single
+ aggregated turn card on completion (#1333).
+- **Feishu after_click card replacement for `cmd:` actions** — rich
+ cards can now replace their content after a button click for `cmd:`
+ action handlers (#1299).
+
+### Send / cc-connect CLI
+- **`cc-connect send --cwd`** — specify the working directory for send
+ commands (#1380, [@MMMarcinho](https://github.com/MMMarcinho)).
+- **`max_attachment_size_mb` for `cc-connect send`** — configurable
+ upper bound for outbound attachment size; default preserved
+ (#1392, [@rablwupei](https://github.com/rablwupei)).
+
+### Provider presets
+- **Zhipu GLM**: `z.ai` and `bigmodel` (CN) presets added to embedded
+ `provider-presets.json` (#1412, [@clingnet](https://github.com/clingnet)).
+
+### Web admin / i18n
+- **Korean (ko) i18n** — Web admin UI now ships Korean translations
+ alongside zh/en/ja (#1343).
+- **`nav.cron`** translated for ko/ja/es (was leaking raw "Cron" string
+ in the sidebar).
+
+### Daemon / observability
+- **`CC_LOG_MAX_BACKUPS` env var** — control daemon log rotation backup
+ count via env (#1260).
+- **Configurable `/history` truncation** length (#1291,
+ [@AaronZ345](https://github.com/AaronZ345)).
+
+---
+
+## Fixes
+
+### Core engine
+- **Send goroutine race** (#1436, see Critical above).
+- **Feishu recall-probe quota burn** (#1321, see Critical above).
+- **`/restart` notification race** — queue the `/restart` success
+ notification on the engine and dispatch it when the target platform
+ reaches `OnPlatformReady` (with bounded retry + 10 s safety timeout)
+ instead of firing immediately after engine startup. Closes the race
+ where notifications were silently dropped on platforms with async
+ connect (Telegram ~2.6 s, Discord, Weixin, Matrix)
+ (#1388 closing #1383).
+- **FIFO drain** — queued messages now drain strictly in FIFO order,
+ preventing earlier queued messages from being dropped as stale when a
+ later one has a higher `create_time` (#1286).
+- **Skill discovery depth-1 only** — skill scanning no longer recurses
+ into subdirectories. Only `//SKILL.md` is registered;
+ nested `SKILL.md` files are treated as skill assets and ignored,
+ matching Claude Code CLI conventions. Previously, nested `SKILL.md`
+ leaked into platform command menus as phantom slash commands (101
+ leaked commands from `frontend-design` skill alone)
+ (#1317 carrying #1304).
+- **acp graceful `/stop`** — new `AgentSessionCanceller` interface lets
+ `/stop` shut a session down gracefully via ACP (#1275).
+
+### Run-as-user
+- **`run_as_user` EACCES regression** (#1433, see Critical above).
+- **Engine workspace binding under `run_as_user`** — keep workspace
+ binding even when the supervisor cannot stat it under `run_as_user`
+ (#1316).
+- **Runas workspace** — run the agent in its own workspace under
+ `run_as_user` (#1315).
+
+### claudecode
+- **Windows cmdline limit** — file-based system prompt delivery via
+ `--append-system-prompt-file` lands on main (port of the v1.3.4
+ hotfix). Windows users on claudecode are no longer affected by the
+ cmd.exe 8192-byte cmdline limit (#1378 porting #1376).
+- **Mid-turn compaction** — keep the turn running when a compaction
+ event arrives mid-turn (fixes #481) (#1272).
+- **Progress card tool result** — emit `EventToolResult` so tool output
+ reaches the progress card (#1407,
+ [@coolrockin](https://github.com/coolrockin)).
+
+### Feishu
+- **Batch images dropped** — coalesce consecutive image messages from
+ the same session into a single multi-image dispatch (configurable
+ quiet window, default bumped from 150 ms to 500 ms) so first-image-of-N
+ is no longer dropped by the `create_time` watermark from PR #1168
+ (#1408 carrying #1395; default tuning by cc-connect/qa-cursor).
+- **Markdown `text_color`** — keep `text_color` on `plain_text` elements
+ only; removing it from `markdown` elements fixes rendering glitches
+ (#1278).
+
+### Slack
+- **Streaming card `msg_too_long`** — stop `chat.update` once payload
+ exceeds Slack's size limit; deliver full reply via fresh `postMessage`
+ instead of crashing (QA hotfix, cc-connect/qa-cursor).
+
+### DingTalk
+- **Stream loop panic** — recover panic in DingTalk `StreamClient`
+ `processLoop` to prevent process crash on closed channel
+ (#1390, fix for issue reported by [@gd0094](https://github.com/gd0094)).
+
+### Workspace / state
+- **Workspace model persistence** — workspace-level model selections
+ now persist across restarts instead of resetting to default (#1372).
+
+### Cron
+- **Permission lookup with composite keys** — pending permission lookup
+ for cron sessions now resolves correctly when the key is composite
+ (#1067).
+
+---
+
+## Tests
+- Regression test for issue #814 — verifies queued messages use their
+ own `replyCtx` via the outer drain (#1261).
+- `TestWriteTempAppendPromptFile_ReadableByOtherUser` covers the
+ `run_as_user` EACCES regression (#1433).
+- Several `-race` regression tests around `interactiveState` mutation
+ paths (#1436 / #1321 cycle).
+
+---
+
+## Chore / dev experience
+- `.gitignore`: add `.worktrees/` for local-only multi-agent scratch
+ dirs (#1443). Does not affect the binary.
+- Sponsor list refresh — remove four lapsed sponsor entries (#1404).
+
+---
+
+## Upgrade notes
+
+- **`cli_path` deprecation** — switch to the unified `cmd` field at
+ your convenience. Old configs continue to work with a deprecation
+ warning. The deprecation will not be removed in v1.4.x.
+- **Feishu `imageBatchWindow`** default changed from 150 ms → 500 ms.
+ Override in config if you preferred the older value.
+- **Feishu `MessageRecallDetector`** fallback probe interval changed
+ from 2 s → 60 s. If you relied on the old aggressive polling for
+ custom integrations, the new behaviour is deduped and gated.
+
+---
+
+## Contributors
+
+External contributors (community PRs landed in v1.4.0):
+
+- [@bryantbarzola](https://github.com/bryantbarzola) — Cisco Webex
+ platform (#1402)
+- [@happyTonakai](https://github.com/happyTonakai) — Codex
+ `model_catalog_json` (#1074); agent option parsing refactor (#1297)
+- [@AaronZ345](https://github.com/AaronZ345) — `/history` truncation
+ configurable (#1291)
+- [@MMMarcinho](https://github.com/MMMarcinho) — `cc-connect send --cwd`
+ (#1380)
+- [@coolrockin](https://github.com/coolrockin) — claudecode
+ `EventToolResult` progress card (#1407)
+- [@rablwupei](https://github.com/rablwupei) — `max_attachment_size_mb`
+ (#1392)
+- [@clingnet](https://github.com/clingnet) — Zhipu GLM presets (#1412)
+- [@gotang](https://github.com/gotang) — `Send` goroutine race (#1436)
+- [@qvictl](https://github.com/qvictl) — Feishu recall-probe throttling
+ (#1321)
+- [@vuyiv](https://github.com/vuyiv) — reported #1429 (run_as_user
+ EACCES) with a clean repro
+- [@gd0094](https://github.com/gd0094) — reported the DingTalk stream
+ panic (#1390)
+
+Internal team:
+
+- [@chenhg5](https://github.com/chenhg5) (cg33) — maintainer; many fixes
+ and the v1.4.0 cycle ownership
+- cc-connect/dev-claudecode, cc-connect/dev-codex, cc-connect/dev-cursor
+ — implementation across the cycle
+- cc-connect/qa-cursor — full QA cycle across beta.1 → beta.2 → beta.3
+ plus three post-beta cherry-picks, including the `drainPendingMessages`
+ follow-up alignment
+
+---
+
+## Reference
+
+- Previous stable: [v1.3.4](https://github.com/chenhg5/cc-connect/releases/tag/v1.3.4) (2026-06-16, Windows cmdline hotfix)
+- Full diff: [v1.3.4...v1.4.0](https://github.com/chenhg5/cc-connect/compare/v1.3.4...v1.4.0)
+- Beta cycle:
+ [v1.4.0-beta.1](https://github.com/chenhg5/cc-connect/releases/tag/v1.4.0-beta.1) (2026-06-22),
+ [v1.4.0-beta.2](https://github.com/chenhg5/cc-connect/releases/tag/v1.4.0-beta.2) (2026-06-23),
+ [v1.4.0-beta.3](https://github.com/chenhg5/cc-connect/releases/tag/v1.4.0-beta.3) (2026-06-28)
diff --git a/npm/package.json b/npm/package.json
index bf77c1fb9..9cd9cb23d 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -1,6 +1,6 @@
{
"name": "cc-connect",
- "version": "1.4.0-beta.3",
+ "version": "1.4.0",
"description": "Bridge local AI coding agents (Claude Code, Cursor, Gemini CLI) to messaging platforms (Feishu, DingTalk, Slack, Telegram, Discord, LINE, WeChat Work)",
"keywords": [
"claude-code",