Published to npm as @bitkyc08/opencodex@2.40.0 with dist-tag latest.
New Features
- Phase 1 — runtime roles, /readyz protocol negotiation, data-plane /v1/catalog (#2772)
- Phase 2 — remote GUI sessions, pairing, and management CORS (#2776)
- Phase 3 — ocx connect client core, per-client keys, mode-aware sync (#2777)
- Phase 4 — machine listener, gui two-plane targets, usage slice (#2781)
- Phase 5 — hub management ingress, deployment recipes, oracle dogfood fixes (#2786)
- Phase 6 — key rotation, adversarial gates, seven-locale docs (#2789)
- Adapt reasoning effort to target capabilities (#2731) (#3190)
- Opt-in ceiling for oversized outbound passthrough bodies (#3196)
- Summarize compaction on the default provider when no canonical openai route exists (#3201)
- Add claude-fable-5-1 with official Fable 5.1 pricing (#3203)
- Per-provider retainModels opt-in (#1690, carries #2860) (#3206)
- Relay Codex image_gen to xAI Imagine with Grok OAuth (carry of #2083) (#2986)
- Opt-in authless Codex Desktop routing mode (#1107) (#3207)
- Windows system-proxy discovery behind proxy "auto" (#1525) (#3209)
- Opt-in OS keychain storage for provider API keys (#1221) (#3210)
- Seed claude-fable-5-1 at 1M ahead of the Cursor lineup update (#3211)
- Durable display names for discovered models (#2201, carry of #2715) (#3212)
- Per-account Gem/Cla quota for Google Antigravity (#1082) (#3213)
- Generic pool-settings contract for OAuth providers (#695 slice 1) (#3214)
- Opt-in upstream Responses WebSocket transport (#2816, carry of #2817) (#3216)
- Opt-in reset-credit auto-redemption before expiry (#822) (#3219)
- Derive the picker seed from the capability table and label every row (#3222)
- Advertise api_types and capabilities on the raw /v1/models list (#3230)
- Let the Codex Fast toggle reach Cursor's fast variant (#3225)
- Expose -fast identities to clients without a Fast toggle (#3233)
- Read-only Private Inference status route for the dashboard (#3247)
- Cursor integration tab, overview card, DSH label (#3248)
Bug Fixes
- Call the dev version bump instead of listening for an event that never fires (#3129)
- Allow canonical fake-IP addresses on provider PATCH (carry of #3122) (#3133)
- Windows cold-start budget and code-page-mangled scheduler paths (rebase of #3104) (#3134)
- Align split-reasoning wire schema with the official reasoning_details contract (#3132)
- Read GitHub Copilot context window metadata (#3163)
- Preserve request-owned main pins (#3166)
- Tell the dashboard it is a client (#3169)
- Route ocx models new-policy and new-arrivals to the runtime module (#3171)
- Apply the combo default effort the target can actually reach (#3172)
- Stop the mobile topbar and integration cards overflowing (#3174)
- Rotate accounts on wrapped quota failures (#3176)
- Surface provider 413 as terminal context overflow (#3177)
- Preserve Hermes vision capabilities (carry of #3151) (#3178)
- Restore authenticated GUI health (carry of #3168) (#3179)
- Retry caller main after pool rejection (carry of #3135) (#3180)
- Keep proxy admission keys out of subscription launches (carry of #3148) (#3182)
- Serialize native-main refresh on the CODEX_HOME claim (rebase of #3112) (#3183)
- Route combo compact requests through the failover path (rebase of #3109) (#3184)
- Throttle repeated failed pool quota primes (rebase of #3003) (#3185)
- Report the wait that was actually spent, not the budget (rebase of #3138) (#3186)
- Stop a second Codex restore after graceful shutdown (rebase of #3164) (#3187)
- Let an explicit different --port start a sibling (rebase of #3144) (#3188)
- Exclude user-owned alias overlays from canonical seed validation (rebase of #3121) (#3189)
- Price aggregator models spelled vendor/model (#3194)
- Strip ChatGPT citation control markers before the client (#3195)
- Count uncalibrated Codex plans instead of excluding them (#3198)
- Verify auth.json identity, not just content, before publishing (#3199)
- Explain why routed models are gated during reserve mode (#3202)
- Allow POST /v1/alpha/search on the loopback listener (#3205)
- Declare the provider keychain capability and refresh the Cursor seed count (#3215)
- Keep the reserved functions group intact for codex-spark (#3217) (#3224)
- Scope the self-named namespace scrub to declared bare tools (carry of #3226) (#3234)
- Stop a sibling start from persisting its port into config.port (#3232)
- Fail over zero-output transport incompletes (carry of #3227) (#3236)
- Auto-fallback encrypted V2 spawns to native Codex (carry of #3228) (#3239)
- Let encrypted-task recovery run before the synthesized native chain (#3240)
- Allow Codexless V2 task recovery (carry of #3229) (#3241)
- Drop the synthesized native chain for encrypted spawns (#3239, #3240) (#3242)
- Server.stop drains the config-dir ACL flight; retrying test teardown (#3257)
- Writable fsync handles, hermetic ACL test lanes, teardown codemod (#3258)
- [WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 (#3263)
Documentation
- Record the v2.39.0 release train (#3126)
- Record the post-release automation repairs (#3130)
- Record the 2026-08-31 non-priority-70 bug triage round (#3114)
- Close merge train round 3 (#3140)
- Remote hub design unit — audited roadmap for hub/client mode (stack base) (#2771)
- Remote hub restack planning unit (#3149)
- Close out the remote hub merge train (#3159)
- Record the objective closeout and worktree realignment (#3160)
- Verify the four review fixes reached dev (#3161)
- Close the remote hub restack unit (#3162)
- Teach ocx the remote hub roles, pairing boundary, and disconnect halves (#3165)
- Document the readyz protocol fields and the remote-hub config keys (#3173)
- Close the multiplatform QA and GUI unit (#3181)
- Drop remote home-path citations the privacy scanner flags (#3197)
- Explain shim-free Codex token injection boundaries (#2713) (#3208)
- Stack the four demo gifs one per row (#3235)
- Shrink the stacked demo gifs (#3237)
- Orca-style feature rows for the demo gifs (#3238)
- Cursor Private Inference connector guide (#3231)
- Bug-label drawdown campaign record and main->dev regression audit (#3218)
- Record the stack landing SHAs and close residual R5 (#3243)
- Closeout verification on the landed dev (#3244)
- Dashboard section and read-only surface note (#3249)
Chores
- Move dev to 2.40.0 after the v2.39.0 release (#3127)
- Pin the websocket refresh account to stop a cross-platform flake (#3128)
- Close the startup-prime window that rotates the credential mid-fixture (#3139)
- Probe for a free pid instead of assuming 4242 is dead (carry of #3042) (#3137)
- Seed the pool quota after the clock is pinned (#3147)
- Update the failover e2e assertion the effort fix invalidated (#3175)
- Move the malformed-plan pool test onto the #3198 contract (#3200)
Other Changes
- Devlog: wp14 carry record and wp15 disposition (#3221)
- [WRONG BRANCH] release: promote dev to main for v2.40.0 (#3261)
Changelog
Full Changelog: v2.39.0...v2.40.0
- #2771 docs(devlog): remote hub design unit — audited roadmap for hub/client mode (stack base) @lidge-jun
- #2772 feat(remote): phase 1 — runtime roles, /readyz protocol negotiation, data-plane /v1/catalog @lidge-jun
- #2776 feat(remote-gui): phase 2 — remote GUI sessions, pairing, and management CORS @lidge-jun
- #2777 feat(connect): phase 3 — ocx connect client core, per-client keys, mode-aware sync @lidge-jun
- #2781 feat(two-plane): phase 4 — machine listener, gui two-plane targets, usage slice @lidge-jun
- #2786 feat(deploy): phase 5 — hub management ingress, deployment recipes, oracle dogfood fixes @lidge-jun
- #2789 feat(hardening): phase 6 — key rotation, adversarial gates, seven-locale docs @lidge-jun
- #2986 feat(images): relay Codex image_gen to xAI Imagine with Grok OAuth (carry of #2083) @lidge-jun
- #3114 docs(devlog): record the 2026-08-31 non-priority-70 bug triage round @lidge-jun
- #3126 docs(devlog): record the v2.39.0 release train @lidge-jun
- #3127 chore(release): move dev to 2.40.0 after the v2.39.0 release @lidge-jun
- #3128 test(auth): pin the websocket refresh account to stop a cross-platform flake @lidge-jun
- #3129 fix(release): call the dev version bump instead of listening for an event that never fires @lidge-jun
- #3130 docs(devlog): record the post-release automation repairs @lidge-jun
- #3132 fix(minimax): align split-reasoning wire schema with the official reasoning_details contract @lidge-jun
- #3133 fix(openai): allow canonical fake-IP addresses on provider PATCH (carry of #3122) @lidge-jun
- #3134 fix(service): Windows cold-start budget and code-page-mangled scheduler paths (rebase of #3104) @lidge-jun
- #3137 test: probe for a free pid instead of assuming 4242 is dead (carry of #3042) @lidge-jun
- #3139 test(auth): close the startup-prime window that rotates the credential mid-fixture @lidge-jun
- #3140 docs(devlog): close merge train round 3 @lidge-jun
- #3147 test(auth): seed the pool quota after the clock is pinned @lidge-jun
- #3149 docs(devlog): remote hub restack planning unit @lidge-jun
- #3159 docs(devlog): close out the remote hub merge train @lidge-jun
- #3160 docs(devlog): record the objective closeout and worktree realignment @lidge-jun
- #3161 docs(devlog): verify the four review fixes reached dev @lidge-jun
- #3162 docs(devlog): close the remote hub restack unit @lidge-jun
- #3163 fix(catalog): read GitHub Copilot context window metadata @Ingwannu
- #3165 docs(skill): teach ocx the remote hub roles, pairing boundary, and disconnect halves @lidge-jun
- #3166 fix(codex): preserve request-owned main pins @Ingwannu
- #3169 fix(client): tell the dashboard it is a client @lidge-jun
- #3171 fix(cli): route ocx models new-policy and new-arrivals to the runtime module @lidge-jun
- #3172 fix(combo): apply the combo default effort the target can actually reach @lidge-jun
- #3173 docs(reference): document the readyz protocol fields and the remote-hub config keys @lidge-jun
- #3174 fix(gui): stop the mobile topbar and integration cards overflowing @lidge-jun
- #3175 test(combo): update the failover e2e assertion the effort fix invalidated @lidge-jun
- #3176 fix(codex): rotate accounts on wrapped quota failures @Vadevious
- #3177 fix(responses): surface provider 413 as terminal context overflow @Ingwannu
- #3178 fix(export): preserve Hermes vision capabilities (carry of #3151) @lidge-jun
- #3179 fix(remote): restore authenticated GUI health (carry of #3168) @lidge-jun
- #3180 fix(codex): retry caller main after pool rejection (carry of #3135) @lidge-jun
- #3181 docs(devlog): close the multiplatform QA and GUI unit @lidge-jun
- #3182 fix(claude): keep proxy admission keys out of subscription launches (carry of #3148) @lidge-jun
- #3183 fix(codex): serialize native-main refresh on the CODEX_HOME claim (rebase of #3112) @lidge-jun
- #3184 fix(compact): route combo compact requests through the failover path (rebase of #3109) @lidge-jun
- #3185 fix(codex): throttle repeated failed pool quota primes (rebase of #3003) @lidge-jun
- #3186 fix(service): report the wait that was actually spent, not the budget (rebase of #3138) @lidge-jun
- #3187 fix(cli): stop a second Codex restore after graceful shutdown (rebase of #3164) @lidge-jun
- #3188 fix(cli): let an explicit different --port start a sibling (rebase of #3144) @lidge-jun
- #3189 fix(openai): exclude user-owned alias overlays from canonical seed validation (rebase of #3121) @lidge-jun
- #3190 feat(combo): adapt reasoning effort to target capabilities (#2731) @lidge-jun
- #3194 fix(usage): price aggregator models spelled vendor/model @lidge-jun
- #3195 fix(responses): strip ChatGPT citation control markers before the client @lidge-jun
- #3196 feat(responses): opt-in ceiling for oversized outbound passthrough bodies @lidge-jun
- #3197 docs(devlog): drop remote home-path citations the privacy scanner flags @lidge-jun
- #3198 fix(capacity): count uncalibrated Codex plans instead of excluding them @lidge-jun
- #3199 fix(codex): verify auth.json identity, not just content, before publishing @lidge-jun
- #3200 test(quota): move the malformed-plan pool test onto the #3198 contract @olddonkey
- #3201 feat(router): summarize compaction on the default provider when no canonical openai route exists @lidge-jun
- #3202 docs(codex): explain why routed models are gated during reserve mode @lidge-jun
- #3203 feat(anthropic): add claude-fable-5-1 with official Fable 5.1 pricing @lidge-jun
- #3205 fix(server): allow POST /v1/alpha/search on the loopback listener @lidge-jun
- #3206 feat(catalog): per-provider retainModels opt-in (#1690, carries #2860) @lidge-jun
- #3207 feat(codex): opt-in authless Codex Desktop routing mode (#1107) @lidge-jun
- #3208 docs(cli): explain shim-free Codex token injection boundaries (#2713) @lidge-jun
- #3209 feat(proxy): Windows system-proxy discovery behind proxy "auto" (#1525) @lidge-jun
- #3210 feat(providers): opt-in OS keychain storage for provider API keys (#1221) @lidge-jun
- #3211 feat(cursor): seed claude-fable-5-1 at 1M ahead of the Cursor lineup update @lidge-jun
- #3212 feat(catalog): durable display names for discovered models (#2201, carry of #2715) @lidge-jun
- #3213 feat(quota): per-account Gem/Cla quota for Google Antigravity (#1082) @lidge-jun
- #3214 feat(oauth): generic pool-settings contract for OAuth providers (#695 slice 1) @lidge-jun
- #3215 fix(ci): declare the provider keychain capability and refresh the Cursor seed count @lidge-jun
- #3216 feat(responses): opt-in upstream Responses WebSocket transport (#2816, carry of #2817) @lidge-jun
- #3218 docs(devlog): bug-label drawdown campaign record and main->dev regression audit @lidge-jun
- #3219 feat(codex): opt-in reset-credit auto-redemption before expiry (#822) @lidge-jun
- #3221 devlog: wp14 carry record and wp15 disposition @lidge-jun
- #3222 feat(cursor): derive the picker seed from the capability table and label every row @lidge-jun
- #3224 fix(responses): keep the reserved functions group intact for codex-spark (#3217) @lidge-jun
- #3225 feat(cursor): let the Codex Fast toggle reach Cursor's fast variant @lidge-jun
- #3230 feat(server): advertise api_types and capabilities on the raw /v1/models list @lidge-jun
- #3231 docs: Cursor Private Inference connector guide @lidge-jun
- #3232 fix(cli): stop a sibling start from persisting its port into config.port @lidge-jun
- #3233 feat(cursor): expose -fast identities to clients without a Fast toggle @lidge-jun
- #3234 fix(responses): scope the self-named namespace scrub to declared bare tools (carry of #3226) @lidge-jun
- #3235 docs(readme): stack the four demo gifs one per row @lidge-jun
- #3236 fix(combo): fail over zero-output transport incompletes (carry of #3227) @lidge-jun
- #3237 docs(readme): shrink the stacked demo gifs @lidge-jun
- #3238 docs(readme): orca-style feature rows for the demo gifs @lidge-jun
- #3239 fix(subagents): auto-fallback encrypted V2 spawns to native Codex (carry of #3228) @lidge-jun
- #3240 fix(subagents): let encrypted-task recovery run before the synthesized native chain @lidge-jun
- #3241 fix(agents): allow Codexless V2 task recovery (carry of #3229) @lidge-jun
- #3242 revert(subagents): drop the synthesized native chain for encrypted spawns (#3239, #3240) @lidge-jun
- #3243 docs(cursor): record the stack landing SHAs and close residual R5 @lidge-jun
- #3244 docs(cursor): closeout verification on the landed dev @lidge-jun
- #3247 feat(cursor): read-only Private Inference status route for the dashboard @lidge-jun
- #3248 feat(gui): Cursor integration tab, overview card, DSH label @lidge-jun
- #3249 docs(cursor): dashboard section and read-only surface note @lidge-jun
- #3257 fix(windows): server.stop drains the config-dir ACL flight; retrying test teardown @lidge-jun
- #3258 fix(windows): writable fsync handles, hermetic ACL test lanes, teardown codemod @lidge-jun
- #3261 [WRONG BRANCH] release: promote dev to main for v2.40.0 @lidge-jun
- #3263 [WRONG BRANCH] release: carry the release.yml permissions fix onto main for v2.40.0 @lidge-jun