Published to npm as @bitkyc08/opencodex@2.43.0 with dist-tag latest.
New Features
- Accept a pasted Muse Code key on Windows and Linux (#3437)
- List the flagship natives regardless of the entitlement roster (#3460)
- Expose Codex Fast to external clients as a selectable --fast row (#3457)
- Make the brand a home control and add refresh-all-quotas to the provider overview (#3466)
- Carry Claude combo capabilities and give reset-credit redeems a stable identity (#3474)
- Close the three verified triage gaps (fable-5-1 metadata, #3284 credit, Ultra Fast opt-in) (#3478)
- Let an operator delete one rollback journal entry (#3477)
- Explain the admin token where it is asked for (#3493)
- Stop reading the auth store on every Anthropic request (#3503)
- Allow direct encrypted V2 task passthrough (carry of #3444) (#3579)
- Support Google Antigravity weekly quota and Ollama Cloud quota (carry of #3447) (#3587)
- Detect usage-window resets and notify on them (rebase of #2783) (#3592)
- Auto-activate quota reset windows (carry of #2973) (#3588)
- Add loopback-first Compose with compatibility identity (carry of #3421) (#3604)
- Preserve reset metadata with bounded cooldown waits (carry of #3329) (#3606)
- Add composable log filter engine (#3508)
- Inherit context window for numeric variants (#3521)
- Add effort command with honest live-state errors (carry of #3528) (#3612)
- Add window-aware 99% main-account hard lock (#3552)
- Add confirmed 99% main-account protection controls (#3560)
- Start large new provider catalogs with model switches off (#3626)
- Guide registrations to model selection (#3636)
- Expose per-account OAuth and API-key usage (#3584)
- Unify current and per-account quota visibility (#3598)
- Allow explicit Luna Reserve alongside routed models (#3578)
- Move the dev version line before the release, not after (#3481)
- Unify quota activation in Advanced settings (#3662)
- Bounded canonical upstream WS reuse (#3664)
- Enable Fast selectors by default for external clients (#3674)
- Restore Grok Responses default with persistent Chat opt-in (#3670)
Bug Fixes
- Allow image routes on loopback listener (#3430)
- Heal deleted cwd at launch and avoid stream init in TTY guard (#3401)
- Preserve outputs missing call ids (#3420)
- Satisfy provider wire contract (#3405)
- Repair two dev regressions from the 260904 merge train (#3439)
- Assemble the Muse key fixture so privacy:scan stays green (#3443)
- Decode the principal lookup with the console code page (#3438)
- Accept dotted ns.name tool echo alongside ns__name (#3403)
- Raise a stale runtime's client version to the measured gated floor (#3442)
- Reject file URI privacy bypasses (#3432)
- Ignore fork PRs in dev bump guard (#3325)
- Support Grok 4.6 Responses (#3394)
- Show passively observed quota and add an operator refresh control (#3448)
- Scope Muse web search compatibility (#3456)
- Advertise the reasoning-effort ladder for native Anthropic models (#3454)
- Stop the Codex Set page head clipping and give it the real Codex mark (#3465)
- Reject unpaired tool results and fail over provider context caps (#3471)
- Count tokens by script and calibrate the context estimate from reported usage (#3476)
- Split escaping from framing using the measured wire model (#3488)
- Stop the admin-token dialog painting an empty error notice (#3491)
- Always fail over to another credential on 429 (#3495)
- Never ask a local dashboard for an admin token (#3496)
- Stop the Claude pool toggle promising 429 failover it no longer owns (#3499)
- Apply a raw patch envelope submitted as the exec body (#3498)
- Arm the home guard before the run lock can throw (#3507)
- Align Astra configuration and Fast pricing (#3537)
- Keep caller cancellations out of upstream failure logs (carry of #3515) (#3541)
- Expose continuation spill write health (carry of #3525) (#3542)
- Diagnose invalid persistent instructions config (carry of #3490) (#3545)
- Rebase key failover on persisted state (carry of #3529) (#3546)
- Reconcile journal deletion cleanup (carry of #3484) (#3540)
- Steer Google models away from unrendered LaTeX math formatting (carry of #3480) (#3544)
- Standardize OpenAI estimates on API pricing (#3543)
- Repair proactive-failover policy boundaries (carry of #3502, 1/2) (#3561)
- Carry rotated Kiro auth context into the terminal continuation (carry of #3502, 2/2) (#3562)
- Fall back to native launch when routing is off (carry of #3519) (#3563)
- Rebase startup reconciliation on the persisted config (reimplementation of #3524) (#3564)
- Classify failover failures by blast radius (bounded carry of #3348) (#3565)
- Preserve captured discovery authority with agy aliases (carry of #3531) (#3601)
- Preserve short-window observation provenance for routing (#3605)
- Preserve trusted encrypted routes during fallback (#3597)
- Harden legacy config diagnostics (#3553)
- Deduplicate equivalent quota reset timestamps (#3607)
- Preserve upstream error precedence for location denials (carry of #3547) (#3608)
- Make Astra first and 5.5 last on upgrade (#3609)
- Revalidate waits and decode quota evidence strictly (#3614)
- Carry scheme-bound IPv6 fake-IP admission (#3551) (#3615)
- Carry stable launchd launcher ownership (#3554) (#3616)
- Carry truthful Codex toggle semantics (#3556) (#3617)
- Bind compatibility identity to copied source bytes (#3619)
- Preserve canonical TUN discovery alongside proxy-bound IPv6 (#3489) (#3618)
- Reconcile quota routes and integration fixtures (#3622)
- Repair Windows reset fixtures and route inventory (#3610)
- Preserve caller cancellation in eager SSE relay (#3613)
- Preserve external screenshot tool results and image detail (#3586)
- Release peers accepted by temporary port probes (#3640)
- Enforce pending selection write guards (#3645)
- Preserve HTTP metadata across upstream WebSocket (#3643)
- Make image reference boundaries explicit (#3591)
- Preserve orphan tool image carriers (#3593)
- Prepare active tool screenshot batches (#3595)
- Attach external tool screenshot provenance (#3596)
- Distinguish unresolved fallback models and reject missing policies (#3582)
Documentation
- Plan cross-platform parity and the Windows identity decode fix (#3436)
- Add a platform-support reference page (#3440)
- Record the 260904 bug backlog closeout (#3446)
- Record the second-round bug backlog merges (#3453)
- Record how the Codex Set chrome unit was delivered (#3470)
- Describe the refresh-all-quotas control in zh-cn and ru (#3472)
- Drop the duplicated plan docs from the providers home/quota unit (#3473)
- Record the delivery audit for the providers home/quota unit (#3475)
- Record the green-PR merge train and its closeout (#2877)
- Record the triage gap closure and the review round (#3482)
- Close out the priority-65 unit (#3486)
- Record the admin-token local-UX unit (#3504)
- Close out the apply_patch envelope unit (#3505)
- Close out the admin-token unit with the preload guard fix (#3514)
- Scope the inert pool-settings marker to strategy and threshold (#3517)
- Stop promising a 429 failover kill switch that no longer exists (#3520)
- Closeout for the tests/ domain layout and macOS shard (#3497) (#3534)
- Open the 260905 open-work closeout roadmap unit (#3538)
- Document omit sentinel behavior on provider wires (carry of #2432) (#3603)
- Plan initial provider model selection and registration guidance (#3624)
Chores
- Move dev to 2.43.0 after v2.42.0 (#3434)
- Give the Windows leg a timeout it can meet (#3455)
- Guard the Codex Set page-head wrap and the Codex nav mark (#3468)
- Shard the macOS suite 2-way and keep the unsharded control on dispatch (#3497) (#3501)
- Tests/ domain map, mover and verifier tooling, repo-root helper (#3497) (#3500)
- Move windows, service, update into tests// (#3497) (#3509)
- Pin the rotator set of every 429 recovery loop (#3512)
- Move lib, config, clients, usage, vision, web-search into tests// (#3497) (#3510)
- Move cli, oauth, routing, claude-integration into tests// (#3497) (#3511)
- Pin the rotator against being re-gated, and fix the last stale guide (#3523)
- Move adapters, responses, lab, gui into tests// (#3497) (#3513)
- Drop the duplicated quorum cache test (#3526)
- Move providers and codex-integration into tests// (#3497) (#3516)
- Fail on duplicate test basenames, and close out the 429 unit (#3527)
- Restore a deleted contract test, and fail when one disappears (#3530)
- Prove the unobservable quorum staleness window is harmless (#3533)
- Move server, storage, ci-workflows into tests// (#3497) (#3518)
- Isolate the route scanner probe in a unique temp directory (carry of #3323) (#3539)
- Read the feature transition, not the Windows launcher argv (Windows stack 1/3) (#3548)
- Skip the unlinked-cwd case on Windows (Windows stack 2/3) (#3549)
- Budget the K-owner file and reap children before teardown (Windows stack 3/3) (#3550)
- Observe the quorum-cache store read with a spy, not atime (Windows stack 4/4) (#3555)
- Budget every sub-floor internal wait that gates on a child or server (Windows stack 5/5) (#3558)
- Six shards instead of four, ceiling unchanged (Windows stack 6/6) (#3572)
- Exercise the account-removal path the quorum test is named for (#3600)
- Assert that the bounded completion fallback executes (carry of #3487) (#3602)
- Expose detached recovery failure evidence (#3623)
- Fix native Codex path identity and process readiness (#3629)
- Bound cold restore and injection process lifetimes (#3637)
- Isolate status health and stale-process probes (S14 1/3) (#3633)
- Cover external image wire roundtrips (#3589)
- Isolate the recovery child Codex home (#3655)
- Consolidate verified modularization train and closeout records (#3668)
- [WRONG BRANCH] chore(release): promote verified candidate to 2.43.0 (#3678)
Changelog
Full Changelog: v2.42.0...v2.43.0
- #2877 docs(devlog): record the green-PR merge train and its closeout @lidge-jun
- #3325 fix(release): ignore fork PRs in dev bump guard @luvs01
- #3394 fix(opencode-go): support Grok 4.6 Responses @kremnyi
- #3401 fix(cli): heal deleted cwd at launch and avoid stream init in TTY guard @agentHits
- #3403 fix(proxy): accept dotted ns.name tool echo alongside ns__name @ianlyoo
- #3405 fix(opencode-go): satisfy provider wire contract @adtumk
- #3420 fix(responses): preserve outputs missing call ids @ildunari
- #3430 fix(server): allow image routes on loopback listener @ChickenBreast-ky
- #3432 fix(lab): reject file URI privacy bypasses @luvs01
- #3434 chore(release): move dev to 2.43.0 after v2.42.0 @lidge-jun
- #3436 docs(devlog): plan cross-platform parity and the Windows identity decode fix @lidge-jun
- #3437 feat(meta-muse): accept a pasted Muse Code key on Windows and Linux @lidge-jun
- #3438 fix(windows): decode the principal lookup with the console code page @lidge-jun
- #3439 fix(tests): repair two dev regressions from the 260904 merge train @lidge-jun
- #3440 docs: add a platform-support reference page @lidge-jun
- #3442 fix(codex): raise a stale runtime's client version to the measured gated floor @lidge-jun
- #3443 fix(test): assemble the Muse key fixture so privacy:scan stays green @lidge-jun
- #3446 docs(devlog): record the 260904 bug backlog closeout @lidge-jun
- #3448 fix(gui): show passively observed quota and add an operator refresh control @lidge-jun
- #3453 docs(devlog): record the second-round bug backlog merges @lidge-jun
- #3454 fix(providers): advertise the reasoning-effort ladder for native Anthropic models @lidge-jun
- #3455 ci(npm-global): give the Windows leg a timeout it can meet @lidge-jun
- #3456 fix(responses): scope Muse web search compatibility @kremnyi
- #3457 feat(fast-row): expose Codex Fast to external clients as a selectable --fast row @lidge-jun
- #3460 feat(codex): list the flagship natives regardless of the entitlement roster @lidge-jun
- #3465 fix(gui): stop the Codex Set page head clipping and give it the real Codex mark @lidge-jun
- #3466 feat(gui): make the brand a home control and add refresh-all-quotas to the provider overview @lidge-jun
- #3468 test(gui): guard the Codex Set page-head wrap and the Codex nav mark @lidge-jun
- #3470 docs(devlog): record how the Codex Set chrome unit was delivered @lidge-jun
- #3471 fix(responses,combos): reject unpaired tool results and fail over provider context caps @lidge-jun
- #3472 docs(site): describe the refresh-all-quotas control in zh-cn and ru @lidge-jun
- #3473 docs(devlog): drop the duplicated plan docs from the providers home/quota unit @lidge-jun
- #3474 feat(catalog,codex): carry Claude combo capabilities and give reset-credit redeems a stable identity @lidge-jun
- #3475 docs(devlog): record the delivery audit for the providers home/quota unit @lidge-jun
- #3476 fix(kiro): count tokens by script and calibrate the context estimate from reported usage @lidge-jun
- #3477 feat(integrations): let an operator delete one rollback journal entry @lidge-jun
- #3478 feat: close the three verified triage gaps (fable-5-1 metadata, #3284 credit, Ultra Fast opt-in) @lidge-jun
- #3481 feat(release): move the dev version line before the release, not after @lidge-jun
- #3482 docs(devlog): record the triage gap closure and the review round @lidge-jun
- #3486 docs(devlog): close out the priority-65 unit @lidge-jun
- #3488 fix(kiro): split escaping from framing using the measured wire model @lidge-jun
- #3491 fix(gui): stop the admin-token dialog painting an empty error notice @lidge-jun
- #3493 feat(gui,docs): explain the admin token where it is asked for @lidge-jun
- #3495 fix(oauth): always fail over to another credential on 429 @lidge-jun
- #3496 fix(gui): never ask a local dashboard for an admin token @lidge-jun
- #3498 fix(responses): apply a raw patch envelope submitted as the exec body @lidge-jun
- #3499 fix(gui): stop the Claude pool toggle promising 429 failover it no longer owns @lidge-jun
- #3500 test(layout): tests/ domain map, mover and verifier tooling, repo-root helper (#3497) @lidge-jun
- #3501 ci(macos): shard the macOS suite 2-way and keep the unsharded control on dispatch (#3497) @lidge-jun
- #3503 perf(oauth): stop reading the auth store on every Anthropic request @lidge-jun
- #3504 docs(devlog): record the admin-token local-UX unit @lidge-jun
- #3505 docs(devlog): close out the apply_patch envelope unit @lidge-jun
- #3507 fix(tests): arm the home guard before the run lock can throw @lidge-jun
- #3508 feat(logs): add composable log filter engine @yansigit
- #3509 test(layout): move windows, service, update into tests// (#3497) @lidge-jun
- #3510 test(layout): move lib, config, clients, usage, vision, web-search into tests// (#3497) @lidge-jun
- #3511 test(layout): move cli, oauth, routing, claude-integration into tests// (#3497) @lidge-jun
- #3512 test(oauth): pin the rotator set of every 429 recovery loop @lidge-jun
- #3513 test(layout): move adapters, responses, lab, gui into tests// (#3497) @lidge-jun
- #3514 docs(devlog): close out the admin-token unit with the preload guard fix @lidge-jun
- #3516 test(layout): move providers and codex-integration into tests// (#3497) @lidge-jun
- #3517 docs(oauth): scope the inert pool-settings marker to strategy and threshold @lidge-jun
- #3518 test(layout): move server, storage, ci-workflows into tests// (#3497) @lidge-jun
- #3520 docs: stop promising a 429 failover kill switch that no longer exists @lidge-jun
- #3521 feat(anthropic): inherit context window for numeric variants @everton-dgn
- #3523 test(oauth): pin the rotator against being re-gated, and fix the last stale guide @lidge-jun
- #3526 test(layout): drop the duplicated quorum cache test @lidge-jun
- #3527 test(hygiene): fail on duplicate test basenames, and close out the 429 unit @lidge-jun
- #3530 test(oauth): restore a deleted contract test, and fail when one disappears @lidge-jun
- #3533 test(oauth): prove the unobservable quorum staleness window is harmless @lidge-jun
- #3534 docs(layout): closeout for the tests/ domain layout and macOS shard (#3497) @lidge-jun
- #3537 fix(openai): align Astra configuration and Fast pricing @lidge-jun
- #3538 docs(devlog): open the 260905 open-work closeout roadmap unit @lidge-jun
- #3539 test: isolate the route scanner probe in a unique temp directory (carry of #3323) @lidge-jun
- #3540 fix(integrations): reconcile journal deletion cleanup (carry of #3484) @lidge-jun
- #3541 fix(responses): keep caller cancellations out of upstream failure logs (carry of #3515) @lidge-jun
- #3542 fix(responses): expose continuation spill write health (carry of #3525) @lidge-jun
- #3543 fix(usage): standardize OpenAI estimates on API pricing @lidge-jun
- #3544 fix(google): steer Google models away from unrendered LaTeX math formatting (carry of #3480) @lidge-jun
- #3545 fix(codex): diagnose invalid persistent instructions config (carry of #3490) @lidge-jun
- #3546 fix(providers): rebase key failover on persisted state (carry of #3529) @lidge-jun
- #3548 test(v2): read the feature transition, not the Windows launcher argv (Windows stack 1/3) @lidge-jun
- #3549 test(update): skip the unlinked-cwd case on Windows (Windows stack 2/3) @lidge-jun
- #3550 test(catalog): budget the K-owner file and reap children before teardown (Windows stack 3/3) @lidge-jun
- #3552 feat(codex): add window-aware 99% main-account hard lock @lidge-jun
- #3553 fix(codex): harden legacy config diagnostics @Ingwannu
- #3555 test(routing): observe the quorum-cache store read with a spy, not atime (Windows stack 4/4) @lidge-jun
- #3558 test: budget every sub-floor internal wait that gates on a child or server (Windows stack 5/5) @lidge-jun
- #3560 feat(gui): add confirmed 99% main-account protection controls @lidge-jun
- #3561 fix(oauth): repair proactive-failover policy boundaries (carry of #3502, 1/2) @lidge-jun
- #3562 fix(responses): carry rotated Kiro auth context into the terminal continuation (carry of #3502, 2/2) @lidge-jun
- #3563 fix(claude): fall back to native launch when routing is off (carry of #3519) @lidge-jun
- #3564 fix(oauth): rebase startup reconciliation on the persisted config (reimplementation of #3524) @lidge-jun
- #3565 fix(combos): classify failover failures by blast radius (bounded carry of #3348) @lidge-jun
- #3572 ci(windows): six shards instead of four, ceiling unchanged (Windows stack 6/6) @lidge-jun
- #3578 feat(codex): allow explicit Luna Reserve alongside routed models @lidge-jun
- #3579 feat(providers): allow direct encrypted V2 task passthrough (carry of #3444) @lidge-jun
- #3582 fix(usage): distinguish unresolved fallback models and reject missing policies @lidge-jun
- #3584 feat(quota): expose per-account OAuth and API-key usage @lidge-jun
- #3586 fix(chat): preserve external screenshot tool results and image detail @lidge-jun
- #3587 feat(quota): support Google Antigravity weekly quota and Ollama Cloud quota (carry of #3447) @lidge-jun
- #3588 feat(codex): auto-activate quota reset windows (carry of #2973) @lidge-jun
- #3589 test(protocols): cover external image wire roundtrips @lidge-jun
- #3591 fix(protocols): make image reference boundaries explicit @lidge-jun
- #3592 feat(quota): detect usage-window resets and notify on them (rebase of #2783) @lidge-jun
- #3593 fix(adapters): preserve orphan tool image carriers @lidge-jun
- #3595 fix(cursor): prepare active tool screenshot batches @lidge-jun
- #3596 fix(cursor): attach external tool screenshot provenance @lidge-jun
- #3597 fix(responses): preserve trusted encrypted routes during fallback @Ingwannu
- #3598 feat(gui): unify current and per-account quota visibility @lidge-jun
- #3600 test(oauth): exercise the account-removal path the quorum test is named for @lidge-jun
- #3601 fix(catalog): preserve captured discovery authority with agy aliases (carry of #3531) @lidge-jun
- #3602 test(kiro): assert that the bounded completion fallback executes (carry of #3487) @lidge-jun
- #3603 docs: document omit sentinel behavior on provider wires (carry of #2432) @lidge-jun
- #3604 feat(container): add loopback-first Compose with compatibility identity (carry of #3421) @lidge-jun
- #3605 fix(codex): preserve short-window observation provenance for routing @lidge-jun
- #3606 feat(combos): preserve reset metadata with bounded cooldown waits (carry of #3329) @lidge-jun
- #3607 fix(codex): deduplicate equivalent quota reset timestamps @lidge-jun
- #3608 fix(google): preserve upstream error precedence for location denials (carry of #3547) @lidge-jun
- #3609 fix(subagents): make Astra first and 5.5 last on upgrade @lidge-jun
- #3610 fix(quota): repair Windows reset fixtures and route inventory @lidge-jun
- #3612 feat(cli): add effort command with honest live-state errors (carry of #3528) @lidge-jun
- #3613 fix(responses): preserve caller cancellation in eager SSE relay @lidge-jun
- #3614 fix(combos): revalidate waits and decode quota evidence strictly @lidge-jun
- #3615 fix(discovery): carry scheme-bound IPv6 fake-IP admission (#3551) @lidge-jun
- #3616 fix(service): carry stable launchd launcher ownership (#3554) @lidge-jun
- #3617 fix(integrations): carry truthful Codex toggle semantics (#3556) @lidge-jun
- #3618 fix(discovery): preserve canonical TUN discovery alongside proxy-bound IPv6 (#3489) @lidge-jun
- #3619 fix(container): bind compatibility identity to copied source bytes @lidge-jun
- #3622 fix(ci): reconcile quota routes and integration fixtures @lidge-jun
- #3623 test(update): expose detached recovery failure evidence @lidge-jun
- #3624 docs: plan initial provider model selection and registration guidance @lidge-jun
- #3626 feat(models): start large new provider catalogs with model switches off @lidge-jun
- #3629 test(windows): fix native Codex path identity and process readiness @lidge-jun
- #3633 refactor(cli): isolate status health and stale-process probes (S14 1/3) @lidge-jun
- #3636 feat(onboarding): guide registrations to model selection @lidge-jun
- #3637 test(windows): bound cold restore and injection process lifetimes @lidge-jun
- #3640 fix(server): release peers accepted by temporary port probes @lidge-jun
- #3643 fix(codex): preserve HTTP metadata across upstream WebSocket @lidge-jun
- #3645 fix(models): enforce pending selection write guards @lidge-jun
- #3655 test(update): isolate the recovery child Codex home @lidge-jun
- #3662 feat(gui): unify quota activation in Advanced settings @lidge-jun
- #3664 feat(responses): bounded canonical upstream WS reuse @lidge-jun
- #3668 refactor: consolidate verified modularization train and closeout records @lidge-jun
- #3670 feat(xai): restore Grok Responses default with persistent Chat opt-in @lidge-jun
- #3674 feat: enable Fast selectors by default for external clients @lidge-jun
- #3678 [WRONG BRANCH] chore(release): promote verified candidate to 2.43.0 @lidge-jun