CCCC v0.4.43 Release Notes

CCCC v0.4.43 brings Voice Secretary into one shared service, adds ChatGPT Dots through native MCP Events, and expands structured control to Pi and five more official ACP runtimes. Settings, message delivery and session recovery are also more consistent, with clearer diagnostics when work cannot proceed.

This note covers development starting with 22e500f0, the first commit after v0.4.42, including subsequent contribution integrations and fixes.

One Voice Secretary for the Instance

Voice Secretary no longer appears as an Actor in each Group. Configure its Runtime directly or link a Runtime Profile in Settings → Voice → Voice Secretary. Documents, transcripts and requests remain in their original Groups; Secretary and Voice Analyst retain independent runtime configuration.

The first model task starts a resident Secretary conversation. Tasks from all Groups run sequentially in that conversation, which stays available while idle. CCCC fixes each task's Group, workspace and destination when accepting it, so changing the visible Group cannot redirect a running task or its result.

• Prompt is the first and default capture mode. It defaults to dictation directly into the composer, without a model task. Enable Polish after recording for automatic refinement, or polish typed or dictated text with the manual button. Selecting Prompt, Doc or Ask closes the mode menu; the checkbox changes only the Prompt preference.
• Doc records into a document. The workspace separates the document library, editor and input controls; recording from a viewed document targets that document, while the composer shortcut uses the default document.
• Ask retains the question, answer, sources and follow-up together. Pending work stays observable when the workspace is hidden. Its composer hint can be opened or dismissed without cancelling the task or losing its eventual reply.
• View Secretary opens the shared native terminal or structured execution output for instance administrators. Supported native terminals accept keyboard and mouse input; queued tasks wait for manual turns to finish. Viewing does not launch a model task, and hiding the panel does not stop the conversation. Recent tasks are optional history, ordered newest first.

Drafts never send themselves. A late refinement cannot overwrite newer composer text; a conflicting draft remains available for review. Document updates use a working copy and a version-checked atomic commit, with a retained candidate on conflict. Proposed messages to other Actors require user confirmation. Saved input, failed work and unconfirmed outcomes remain visible rather than being silently reported as complete. Blocking Runtime approval requests release the queue with a needs-information result.

The shared conversation is not a confidentiality boundary between Groups. Task destination checks prevent misrouted results, but do not isolate model history. Native tools keep their Runtime's permissions; document working copies are not a filesystem sandbox. Long tasks can delay other Secretary requests. An idle New session clears the active conversation without deleting saved work; daemon restart also starts a new conversation on the next task.

Voice Settings and Workspaces Follow the Same Rules

Instance Voice settings now have two feature tabs: Voice Secretary and Codex Voice. Secretary recognition services, local ASR models and processing defaults live with its runtime settings. Group Voice settings and enable toggles are removed.

Microphone and speaker preferences share one browser device editor across both workflows. Capture mode, recognition language and automatic polishing are remembered separately for each Group in that browser. Active recordings and calls retain their starting settings. Browser ASR uses the browser's default microphone; local and external ASR use the selected device. Browser ASR normalizes system-language preferences to recognition locales while preserving explicit regional choices.

The Secretary workspace focuses on documents and questions; switching its view does not switch the composer's capture mode. Codex Voice keeps Analyst collapsed by default, distinguishes call readiness from Analyst readiness, and renders completed structured investigations as Markdown. Settings and nested dialogs share controls, keyboard focus behavior and return paths across English, Chinese and Japanese.

Missing configuration, owner startup failures and provider errors stay visible without blocking plain dictation or discarding saved input. Slow polling no longer discards every response, older document reads cannot replace accepted edits, and leaving a view during an action cannot permanently disable its controls. Progress redaction also covers secrets split across streamed chunks.

Codex Voice remains experimental. Its current call path uses the configured Codex ChatGPT login and ChatGPT-backed Realtime backend; public OpenAI Realtime API credits alone do not configure that path. See the Voice guide.

ChatGPT Dots Uses Native Events

The new ChatGPT Dots runtime receives work through ChatGPT's native event-triggered task and the shared CCCC MCP plugin. CCCC does not type task messages into the Dots browser, and its hosted browser login window need not remain open. The public HTTPS MCP endpoint must remain reachable.

The Actor pane provides the complete setup path: create or reuse the shared ChatGPT connector, open Dots, copy setup instructions, and check pairing and subscription separately. One Dot binds to one explicitly selected Actor and Group per connector; it does not create independent Dots for multiple Actors.

Setup uses a short-lived code to pair the Dot's conversation. Its saved native handler claims work with {}, using ChatGPT-provided conversation metadata; there is no permanent claim credential in the handler or attached to every message. CCCC returns an execution credential for the accepted turn, with exact reply and completion authority. Subscription credentials stay in the native subscription configuration. Fresh setup instructions remain available in the same pane if the ten-minute pairing code expires.

Delivery separates queued work, an accepted event waiting for ChatGPT, a claimed turn being processed, and a confirmed completion receipt. An event acknowledgement is not proof that the Dot has started or finished. Subscription and task-tool diagnostics retain bounded, safe reason codes. Callbacks support configured HTTPS/SOCKS proxies with hostname restrictions, and subscriptions are persistent when their expiry is omitted.

Pausing CCCC access blocks new claims and revokes old execution authority, including pending local-tool calls. It cannot cancel actions already running in ChatGPT's cloud. Unfinished work requires explicit resolution; reconnecting does not silently replay an accepted task. A Dot's chat confirmation alone is not proof that its native event task was saved.

See Dots setup and recovery. Existing ChatGPT Web Actors continue to use browser delivery and the shared connector; Dots is a separate event path, not a replacement for that integration.

More Runtimes with Structured Control

Pi joins Actors, Runtime Profiles, Voice Analyst and Voice Secretary through its official RPC interface. It supports structured progress and results, cancellation, verified session recovery, and extension questions. Pi requires 1.1.0 or newer from @earendil-works/pi-coding-agent; it has a structured workspace, not an attached native terminal.

Kimi Code, Auggie, Kiro V3, Hermes and Droid gain optional official ACP modes across the same surfaces. Native TUI remains their default. The existing Antigravity, Copilot, Devin and Cursor ACP adapters remain available.

These ACP modes run without a native terminal. Codex, Claude Code, Grok Build, OpenCode and Kilo retain their existing managed control and same-conversation native terminals. A TUI-only configuration does not acquire Voice controls merely by installing the CLI.

Saved mode, command, model and permission changes apply on restart or next start; Start preserves a healthy running session. Explicit model and mode choices are reapplied to new and resumed managed sessions. Provider login and native permissions remain provider-owned; session MCP injection is not a filesystem sandbox or a guarantee that other configured MCP servers are absent.

Hermes native setup now uses the correct MCP registration flow and verifies its enabled entry. Its ACP errors identify the failed request with bounded, redacted details; cancellation retires the process while retaining the exact conversation for recovery. Kiro V3 uses its native CLI authentication and exposes prompt admission errors. Pi identities include inherited provider-home settings, so changing homes cannot silently resume another identity. See the Runtime guide for prerequisites and per-runtime differences.

Reliable Delivery, Recovery and Shared State

• Mail reaches idle managed Actors promptly. Existing disable switches remain effective, and busy or unknown states keep their ordinary delay. Mail consumption still requires an explicit Inbox read.
• Local cross-Group replies return to their origin. Thread references and reply obligations remain consistent in both Groups. Invalid attachments are rejected before recording a reply, and idempotent retries cannot change the accepted destination or parent.
• Files and images travel between local Groups. Web uploads and MCP cccc_file_send support a local destination, with up to 100 MiB of attachments per cross-group message. Verified files are placed in the destination's own blob store before either ledger entry is recorded. Invalid scopes and unusable existing blobs fail before recording; partial-delivery retries retain the accepted content and complete the missing copy once.
• IM controls agree with the Web. Per-chat relay modes cover all traffic, user-facing messages, or explicitly user-addressed messages. Telegram sends are bounded and preserve reply threading; skipped or throttled sends no longer masquerade as recovery from a delivery failure.
• Actor failures remain inspectable. Restored starts, process exits and managed turn outcomes retain safe diagnostics. Historical failure replay cannot replace newer daemon-owned Actor state, while matching stop and cancellation events still retire streaming output.
• Claude's autonomous turns stay connected. Scheduled or peer input can start a turn without a preceding controlled prompt. CCCC tracks that work; competing delivery ownership is reported as ambiguous instead of leaving an unrelated message pending indefinitely.
• Saved conversations survive failed resume. Codex, Grok, OpenCode and Kilo join Claude's explicit recovery behavior. Failed verification pauses automatic startup; Start/Restart retries the selected conversation and New session starts fresh without deleting provider history. An unrelated old receipt cannot restart a healthy ACP session.
• Large valid protocol output stays usable. Codex accepts bounded large frames, including resume previews; OpenCode and Kilo retain lifecycle events with inline image results up to the encoded-line limit. Malformed or oversized streams still fail explicitly.
• Linux Group retirement cleans attributed processes. Cleanup revalidates CCCC-home and process identity, including children that escaped the original process group, without relying on broad process-name matching.
• Context relationships and permissions stay intact. Task IDs are not reused after deletion or failed writes. Legacy ID collisions preserve valid canonical dependencies and parents; ambiguous recovery is reported. Subtree deletion and scope administration check ownership before mutation.
• Profiles and automation keep their authority. Existing Profiles without stored scope/owner fields use the established defaults when read or edited. Copying private environment values checks source and target independently. Cron validation handles POSIX Sunday ranges and bounded weekday steps; partial automation failures retain notices already written.

Everyday UI and Documentation

Settings pages share labelled rows, compact layouts and save actions. The Group header, sidebar and terminal columns use space more predictably, while chat history loading preserves scroll position. Mobile Presentation has clearer document navigation, slot selection and shared Standard/Enhanced preview controls. Modals follow the visual viewport, terminal resize requests are coalesced, and composer slash commands and attachment chips are more consistent.

Relative CLI project paths resolve from the invoking terminal. Realtime reconnect feedback uses the actual transport state and retry countdown, and coordination briefs preserve complete constraints or provide an explicit full-context lookup. English, Chinese and Japanese CLI quick starts now agree on startup, Group selection and the fact that Inbox reads consume Mail. Worktree guidance explains cleanup for long-lived Actors without adding an automatic Git cleanup service.

Upgrade Notes

1. Upgrade CCCC, restart it using your usual method, and refresh the Web UI. Saving Runtime settings alone preserves the current execution surface.
2. Configure the global Secretary explicitly. Startup retires obsolete per-Group secretary Actors through the normal lifecycle, retaining documents and transcripts; their old execution path and three MCP tools are removed. Old Actor inputs are not automatically replayed. When saved unclaimed input exists, choose whether to process it or hold it when configuring the Runtime. Leftover per-Group enable flags no longer block recording. Custom integrations must stop using cccc_voice_secretary_document, cccc_voice_secretary_composer and cccc_voice_secretary_request; the new task tool is scoped to the global Secretary's accepted work.
3. For Dots, reuse the shared plugin and refresh its tools/events after upgrading. Older native tasks that saved a claim credential or expected to read subscription configuration must be updated with the current setup instructions and credential-free handler. CCCC cannot rewrite a task already saved in ChatGPT. Keep a working pairing; do not reset it merely to upgrade. Very old Actor-specific ChatGPT connectors still follow the v0.4.41 migration.
4. Install and authenticate the required official Runtime before selecting its ACP or RPC adapter. Installation detection alone does not prove login or task readiness. Review unconfirmed work before retrying or replacing a conversation; an uncertain submission is not safe to assume unexecuted.

Validation Scope

Release preparation checks the Rust workspace, Web tests and static checks, repository contracts, documentation, and an isolated packaged Linux/WSL smoke test. The local release binary and its served Web assets are checked together. Synthetic protocol fixtures exercise routing, cancellation, recovery and authority boundaries without consuming provider credits.

This is not a claim of complete live acceptance across every provider, account, browser or operating system. Native Windows/macOS release builds remain part of release CI. Real microphones, ASR services, Realtime audio and cloud Dots tasks depend on the provider and user environment. Existing successful live tests do not eliminate those differences.

Thanks to chriscoveries, waterbang, zixuniaowu, and everyone who contributed code, reported failures and tested the evolving workflows.

Full source comparison