0.36.0 (2026-08-20)
Features
- add deterministic runtime rollout controls (#1490) (3077ac8)
- proxy: let extensions report cost savings and their own latency (#3051) (f9807fd)
- proxy: unify savings attribution across stats, perf, metrics, and dashboard (1b0b0b8), closes #2976
- wrap/claude: make the --1m fallback model configurable via HEADROOM_1M_MODEL (#2983) (2a84725)
Bug Fixes
- anthropic: honor the [1m] 1M-context tier, and price it correctly (#3073) (6d2254d)
- ccr: make --no-ccr disable server-side response handling too (#3101) (131b119), closes #3082
- ccr: make StreamingCCRHandler work on OpenAI streams (#3069) (7ef736f)
- ccr: only buffer a stream when a marker is actually redeemable (#3092) (c502087)
- ccr: re-inject headroom_retrieve when history references it on the sessionless path (942af56)
- ccr: relay a successful upstream turn when post-processing fails (#3094) (0ec73fa)
- ccr: send Accept: application/json on a buffered stream:false turn (#3102) (139c7cb), closes #3078
- ccr: verify a scanned marker's hash before advertising it (#2908) (41dab2d)
- ci: prevent native detector from hanging test shards (#2996) (a708c05)
- ci: scope the release credential and stop persisting it to disk (#3062) (ac8646a)
- ci: unjam release and Docker publishing (#2958) (e269afb)
- claude: reject conflicting auth before proxy startup (#2993) (2d88e31)
- cli/install: resolve the deployment profile instead of dead-ending on default (#2832) (8252619)
- cli: stop the macOS malloc re-exec replacing an embedder's process (#3064) (96c25f5)
- copilot: route VS Code inline completions to Copilot, not OpenAI (#3077) (204e751)
- copilot: send VS Code inline completions to the host that serves them (#3112) (b77d612)
- deps: bump datasets past PYSEC-2026-3716 (#3136) (df6ff6b)
- deps: clear the two Rust advisories and make cargo audit blocking (#3121) (93c474e)
- deps: raise the GitPython floor to 3.1.58 to clear 9 open advisories (#3120) (8156d4d)
- docker: publish compose ports on loopback only (#3061) (481e0b8)
- docker: ship Bedrock auth and current registry (#2982) (eafdf11)
- doctor: surface that Claude Desktop agent sessions bypass the proxy (#2987) (be5b26d)
- install: consolidate Windows fallback and cleanup safety (#2980) (ddd2a25)
- install: honor HEADROOM_PORT in install apply and deploy (#3085) (58f28dc)
- install: stop the PowerShell installer leaking temp dirs into the real user PATH (#2985) (ddd9f76)
- learn: include stdout in CLI failure messages, not just stderr (#3080) (c5563d3)
- mcp: restore SDK v1 compatibility cap (#2978) (6077e5a)
- memory: sanitize entity_refs to prevent dict-shaped entries crashing search (#2951) (2d1e96b)
- onnx: enforce Rust API-24 runtime compatibility (#2979) (a3fe5cb)
- openclaw-plugin: circuit breaker + per-request timeout for proxy resilience (#639) (6576ef6)
- opencode: send x-headroom-project header on all proxied requests (#2868) (eeb038b)
- policy: price net-cost mutations with the 1h cache-write tier (#2780) (ef7e07e)
- providers: don't crash on a non-object HEADROOM_MODEL_LIMITS / models.json (#3089) (3ed8f76)
- proxy/anthropic: don't buffer a CCR stream when passthrough discards the stream flip (#2953) (f1c34d3)
- proxy/anthropic: don't replay recorded prefix over live history (#3026) (#3052) (c16be9b)
- proxy/anthropic: repair headroom_retrieve history references the tools array cannot support (#2876) (7de3573)
- proxy/anthropic: stop answering a non-streaming turn with an event stream (#3142) (0e26fb8)
- proxy/cache: strip cache_control from messages in the semantic cache key (#3086) (2cae0f8)
- proxy/gemini: guard CCR continuation usage against present-null counts (#3035) (a01897c)
- proxy/openai: propagate provider usage on the Responses WS->HTTP fallback (#2988) (536c949)
- proxy: adapt 200 SSE upstream replies on buffered /v1/responses instead of 502 (#2622) (d76fce0)
- proxy: align signed-thinking wire accounting (#3015) (b3f4436)
- proxy: complete stateless Responses and buffered CCR lifecycle (#2997) (8a1d38b)
- proxy: guard feedback endpoints and add CSRF checks to loopback writes (#3060) (a6ab359)
- proxy: keep prefixed core tools resident (#3046) (2f4d001)
- proxy: preserve Codex WebSocket model attribution (#3029) (a06a51e)
- proxy: relocate stray system-role messages to the top-level system param (#765) (#1357) (9fde127)
- proxy: restore the buffered-CCR heartbeat behind a grace window (#3091) (a29d201)
- proxy: scope the signed-thinking lock to blocks that actually changed (#3124) (17522fb)
- proxy: stop a lone surrogate turning a thinking body into a 500 (#3134) (284ff31)
- proxy: stop cached responses replaying the producing turn's wire framing (#3024) (9d37059)
- proxy: stop operator secrets following a client-chosen upstream (#3122) (05f5ef4)
- proxy: tune macOS libmalloc and trim allocator pages so long-lived RSS stays bounded (#2879) (6d87825)
- reporting: show net vs gross savings, real skip thresholds, and the effective profile (#3123) (250ede2)
- tool_search_tool_regex deferred and falsely resolved on direct-Anthropic path (#2971) (8ea87e7)
- vscode: persist compatible Claude modes and route Copilot CAPI (#2986) (1aa701a)
- wrap: set xAI upstream for grok-build proxy (#2772) (c831081)
- wrap: stop the Serena pre-index stalling the launch path for 300s (#2945) (6147883)
- wrap: verify proxy deps before mutating Codex config (#1628) (b7f342c)
Performance Improvements
Dependencies
- bump axum from 0.7.9 to 0.8.9 (#2966) (5731be7)
- bump criterion from 0.5.1 to 0.8.2 (#2965) (b30f339)
- bump ruff from 0.15.22 to 0.16.2 in the pip-minor-patch group across 1 directory (#2962) (ff17961)
- bump sha2 from 0.10.9 to 0.11.0 (#2288) (322425c)
- bump the cargo-minor-patch group across 1 directory with 4 updates (#2964) (888a9f4)
- bump tokio-tungstenite from 0.24.0 to 0.30.0 (#2967) (bbe9013)
- update mcp requirement from <2.0.0,>=1.28.1 to >=1.28.1,<3.0.0 (#2963) (d6fb536)