This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Affected surfaces
ReleasePort's take
Light signalAuthenticate GitHub releases API calls to avoid hitting the anonymous rate limit; strip TELEGRAM_* environment variables from child sessions for added security.
Why it matters: Authentication prevents anonymous request throttling that caps at 60 requests/hour, while stripping TELEGRAM_* vars blocks unintended credential leakage in subprocesses.
Summary
AI summaryUpdates session, recommended, and web across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Authenticate GitHub releases API calls to avoid anonymous rate limit. Authenticate GitHub releases API calls to avoid anonymous rate limit. Source: llm_adapter@2026-05-23 Confidence: high |
— |
| Security | Medium |
Strip all TELEGRAM_* environment variables from child sessions. Strip all TELEGRAM_* environment variables from child sessions. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Feature | Medium |
Add worktree-finish endpoint and UI to web component. Add worktree-finish endpoint and UI to web component. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Feature | Medium |
Preserve explicit --session-id in multi-session-per-cwd scenarios. Preserve explicit --session-id in multi-session-per-cwd scenarios. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Bugfix | Medium |
Serialize pre-push commands to remove lefthook race condition. Serialize pre-push commands to remove lefthook race condition. Source: llm_adapter@2026-05-23 Confidence: low |
— |
Full changelog
Agent Deck v1.9.30
Terminal session manager for AI coding agents.
Installation
Homebrew (recommended):
brew install asheshgoplani/tap/agent-deck
Quick Install:
curl -fsSL https://raw.githubusercontent.com/asheshgoplani/agent-deck/main/install.sh | bash
Go Install:
go install github.com/asheshgoplani/agent-deck/cmd/[email protected]
Changelog
- f1518f60eb6a889c066621e1e86fb2c3f6d5bd9e Authenticate GitHub releases API calls to avoid anonymous rate limit (#1154)
- b20aead420ef59c9b4a7ccc10ea389a75dda99f2 chore(release): v1.9.30 — multi-session-id preserve, lefthook race, telegram env strip, GH API auth, web worktree-finish
- 62b67bdf4df3bedf0a72e3e9c8fde955ddfe28e9 feat(web): worktree-finish endpoint + UI (closes #1126) (#1153)
- eae24183bdbed3523f0b91335c4b23e83c0b0d70 fix(lefthook): serialize pre-push commands to remove css-verify/lint race (closes #1146) (#1151)
- 5333dfb4ebf891665819cc6010fdb093071fa613 fix(session): preserve explicit --session-id in multi-session-per-cwd (closes #1147) (#1148)
- 528f73b97bfdbe5d4822fd6d06cd2c60a3f3df65 fix(session): strip all TELEGRAM_* env vars from child sessions (closes #1133) (#1152)
Full Changelog: https://github.com/asheshgoplani/agent-deck/compare/v1.9.29...v1.9.30
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About agent-deck
Terminal session manager for AI coding agents. One TUI for Claude, Gemini, OpenCode, Codex, and more.
Related context
Related tools
Beta — feedback welcome: [email protected]