Codeman 1.43.0: GitHub Copilot CLI as a run mode, and a security warning for OpenCode users

[Ark0N]

Codeman 1.43.0 is out. Two big ones: GitHub Copilot CLI is now a run mode, and Codeman can warn you about security incidents in the agent CLIs you actually use, starting with the OpenCode Console breach from yesterday. 10 PRs from three contributors.

Security notices, starting with OpenCode. On 17 October OpenCode reported unauthorized access to a legacy system, and provider API keys (OpenAI, Anthropic and others) saved in some OpenCode Console workspaces may have been exposed. If OpenCode emailed you, revoke and replace those keys and check their usage; if you got no email, OpenCode says you weren't affected. Codeman now shows that warning, with a button to OpenCode's own notice, but only on machines where OpenCode is installed. If you're updating, it sits inside the "Codeman updated" note; on a fresh install it's a card of its own. It stays until you close it or open the link, and it expires by itself at the end of the year. A notice about any other CLI would work the same way. Building it turned up a bug too: browsers cached the JSON files the page fetches (this one and the update note) for a whole year. They're served fresh now.

GitHub Copilot CLI is a run mode. @opticon454 added copilot as the eleventh CLI: install it (npm install -g @github/copilot) and it shows up in the Run menu, on the welcome screen, in cron and in CLI management. It shows working and idle and its model off its own footer, takes the usual launch options (yolo mode is clamped off for non-granted users in multi-user mode), works with Custom Model Endpoints through Copilot's BYOK variables, joins MCP sync, and codeman agent spawn, send and read work with it. Copilot had two open upstream bugs that used to break exactly this (typed input ignored, shell tools hanging inside tmux), so before merging I checked Copilot 1.0.98: neither reproduces, and a session driven through Codeman answered end to end. One thing to know: its folder-trust dialog still needs one Enter the first time you use a folder.

Pin tab names on the CLI (optional). Also from @opticon454: a new switch in App Settings, off by default, launches every Claude session with --name <tab name>, so Claude's prompt label, /resume list and remote session list match your tabs. The setting tells you the cost: Claude stops generating its own titles for those sessions, and a rename in Codeman only holds until the next turn.

Antigravity tabs show when they're working. @opticon454 again: an agy turn now marks its tab working and a finished one goes idle. A shell command waiting for your approval stays "working" until you answer it.

Fixes.

• @opticon454: Create New with a custom folder no longer refuses everything below a broad cases folder (only the cases folder itself and its direct children), and the WS pill stops flickering wider on every paste or fast typing burst.
• @JDProfresh, following up on last release's document uploads: a mixed pick, drop or paste attaches what it can and tells you how many files it skipped, a refused text file is told it isn't UTF-8 (or is UTF-16) and to save it as UTF-8, and on a phone, after switching tabs, a link you tap opens on the right row while a URL you're typing in the prompt stays editable.
• @irisitymichaelgrundberg made .diff and .patch paths clickable, so an agent's review diff opens in one click.

Release notes: https://github.com/Ark0N/Codeman/releases/tag/codeman%401.43.0

To update: Settings, System, Updates in the app, or re-run the install line.

Thanks: @opticon454, @JDProfresh, @irisitymichaelgrundberg.