Published to npm as @bitkyc08/opencodex@2.59.0 with dist-tag latest.
New Features
- Rank Antigravity failover by Gemini vs Claude quota family (#4676)
- Cache immutable assets and static files (#4071)
- Show API list-price in breakdowns (#4033)
- Avoid eager Unicode schema cloning (#4526)
- Warn when the Codex default model is not exposed by the proxy (#4963)
- Let operators choose the injected provider display name (#4965)
- Scan SSE data payloads in place and share the empty byte view (#4979)
- Warn about opencodex-derived Codex role TOMLs with no model pin (#4966)
- Safely attest the selected CLI installation (#4978)
- Add Vietnamese localization (#4984)
- Add Crusoe Serverless Inference preset (#4988)
- Show what the usage threshold means per strategy (#4982)
- Implement real SOCKS5 outbound transport (#4986)
- Add Opper as a built-in API-key gateway provider (#4981)
- Import Orca-managed accounts (#4985)
- Add Dashboard Fast row toggle and refresh integrations (#4987)
- Manage existing native main login profiles (#3417, phase 1) (#4781)
- Opt-in ENABLE_TOOL_SEARCH injection for launched Claude Code sessions (#5029)
- Make the durable token ceiling configurable and its refusal legible (#5032)
- Suppress synthetic max per model while retaining ultra (#5036)
- Attribute a recovery the send budget withheld (#5056)
Bug Fixes
- Retain raised inbound body admission through HTTP lifetime (#4753)
- Replay executed bridge searches to the destination (#4919)
- Decide flagship model availability by roster and refusal evidence (#4921)
- Forward the selected model's input ceiling (#4877)
- Allow canonical Antigravity through fake-IP save validation (#4723)
- Price OpenCode Go models missing cost estimates (#4898)
- Hop a response_format capability refusal to the next target (#4927)
- Seed Muse Spark 1.3 so live discovery can surface it (#4924)
- Strip x-anthropic-billing-header for Cloud Code Assist models (#4913)
- Stop grok-4.6 tool-result echo from poisoning later turns (#4929)
- Make loopback integration work without an API key env var (#4805)
- Bound OrcaRouter key-exchange responses (#4933)
- Key pool affinity on the conversation cohort, not the thread (#4935)
- Bind stored Direct account identity on both materializers (#4593)
- Register legacy recovery backups for owned cleanup (#4572)
- Pin Union Alpha wire and namespace Go sessions (#4930)
- Validate provider send paths before management writes (#4523)
- Preserve retryable reauth cancellation and settle terminal failures (#4594)
- Honor the provider transient-5xx policy on the passthrough lane (#4925)
- Explain a suppressed Luna Reserve row in the sync log (#4958)
- Tell a client-role listener apart from a missing management route (#4959)
- Publish opencode-go context windows so live rows stop falling back to 128k (#4962)
- Report the selected model base prompt in the prompt probe (#4964)
- Inspect a cleanly-closed WAL state store in the history preflight (#4957)
- Report one outcome when a repair or restart fails (#4967)
- Preserve polling through cancellation HTTP races (#4945)
- Enforce configured total sends during recovery (#4947)
- Report the pin routing will release instead of a bare accepted 200 (#4521) (#4970)
- Bound the usage-log permission hardening cache (#4976)
- Decide fresh-connection opt-out at the dispatch boundary (#4977)
- Decide pending-teardown ownership by identity, not bare PID liveness (#4960)
- Refuse Reserve turns the Desktop authless opt-in cannot serve (#4968)
- Detect SSH endpoints per token, and stop scanning on import (#4975)
- Harden OpenRouter quota reset cooldowns (#4980)
- Recover malformed freeform tool wrappers (#4983)
- Complete the Vietnamese catalog for the threshold summary keys (#5005)
- Keep prototype-named model context drafts safe (#4922)
- Bound optimistic active-account reconciliation (#4939)
- Release unused quota probe leases (#4990)
- Account for auxiliary model charges (#4993)
- Preserve absent OAuth plan fields (#4996)
- Never hop off a busy port into a duplicate proxy (#5015)
- Preserve unknown live multi-agent pins (#4941)
- Release unused OpenAI probe leases (#4946)
- Bind lifecycle to CODEX_SQLITE_HOME (#4951)
- Block OAuth replay after local effects (#4953)
- Drop expired non-blocking quota evidence (#4955)
- Restrict OAuth login manual-open links to http(s) (#4995)
- Fence device reauth cancellation (#4998)
- Validate complete provider POST candidates before adoption (#5013)
- Restore glm-5.3 to both Alibaba Token Plan catalogs (#5010)
- Guard the first read in the history injection preflight (#5007)
- Keep Devin migration account-bound (#4937)
- Bound reasoning_details snapshots and account them to TranslatorBudget (#4931)
- Allow graceful completion on text-only streams without terminal event (#4803)
- Complete the native-main namespace for the Vietnamese locale (#5020)
- Let a provider declare the hosted tools it rejects (#5021)
- Backfill a published context window onto a live routed row (#5023)
- Apply the fresh-connection policy to a selected provider transport (#5022)
- Keep live pins when the supplied baseline omits the slug (#5025)
- Build the compatibility manifest inside the image (#5030)
- Name the three model catalog delivery states (#5031)
- Give a dispatched run its own concurrency group (#5048)
- Rebind continuation replay scope after generic OAuth 429 failover (#4926)
- Fence propagated quota recovery aliases (#4938)
- Bind service start to the installed environment (#5026)
- Declare CommandCode deepseek/deepseek-v4.1-flash natively image-capable (#5039)
- Fence loopback-bootstrapped GUI sessions from machine mutations (#4994)
- Gate the directory that is itself a gate (#5050)
- Fail closed DNS bind names for credential-bearing destinations (#5042)
- Compile the apply_patch body recognition accepted (#5051)
- Scope compact handoff cache to authenticated admission principal (#4928)
- Bind Cursor retry replay to the admitted OAuth account on 429 failover (#4954)
- Wait out a stated rate-limit reset and replay the turn (#5041)
- Hold a freeform wrapper the completed item will unwrap (#5053)
- Give each parallel child its own Antigravity session (#5054)
- Make the account-switch warning agree with routing (#5055)
- Bound body inactivity without premature shared abort (#4751)
- Report the prompt this proxy counted on message_start (#5057)
- Key the Antigravity session on the parent/child pair (#5062)
- Match freeform streaming to its completion grammar and decode SOCKS5 content-codings (#5070)
Documentation
- Record the 2.58.0 release evidence (#4918)
- Remove remote runner access details from offload notes (#4623)
- Assess what the dev tip closes of the pooled-routing cost incident (#4546) (#4969)
- Record the lane I catalog and model-visibility unit (#4973)
- Split runtime.md at the providers and adapters boundary (#4999)
- Clarify platform-specific service repair behavior (#4920)
- Record what a green pull request does not tell you (#5034)
Chores
- Measure cold status setup before timed projections (#4948)
- Hold the prototype-named override case in a sibling file (#5011)
- Hold the newest catalog and provider cases in sibling files (#5018)
- Release the combo connect-cancellation fixture during cleanup (#5014)
- Size the unsharded control budget to its measured duration (#5028)
- Pin the second gateway response_format refusal envelope (#5040)
- Warm a spawned child module graph before it is timed (#5038)
Other Changes
Changelog
Full Changelog: v2.58.0...v2.59.0
- #4033 feat(usage): show API list-price in breakdowns @harryzhou2000
- #4071 perf(gui): cache immutable assets and static files @chilung-cgu
- #4523 fix(config): validate provider send paths before management writes @luvs01
- #4526 perf(adapters): avoid eager Unicode schema cloning @luvs01
- #4572 fix(oauth): register legacy recovery backups for owned cleanup @luvs01
- #4593 fix(codex): bind stored Direct account identity on both materializers @luvs01
- #4594 fix(gui): preserve retryable reauth cancellation and settle terminal failures @luvs01
- #4623 docs: remove remote runner access details from offload notes @luvs01
- #4676 feat(oauth): rank Antigravity failover by Gemini vs Claude quota family @agentHits
- #4723 fix(providers): allow canonical Antigravity through fake-IP save validation @juzijia
- #4751 fix(responses): bound body inactivity without premature shared abort @luvs01
- #4753 fix(server): retain raised inbound body admission through HTTP lifetime @luvs01
- #4781 feat(gui): manage existing native main login profiles (#3417, phase 1) @luvs01
- #4803 fix(sse): allow graceful completion on text-only streams without terminal event @Yum-wu
- #4805 fix(gajae): make loopback integration work without an API key env var @yeongjunyoo
- #4877 fix(devin): forward the selected model's input ceiling @luvs01
- #4898 fix(usage): price OpenCode Go models missing cost estimates @agentHits
- #4913 fix(google): strip x-anthropic-billing-header for Cloud Code Assist models @albifhrzq
- #4916 chore(release): open dev at 2.59.0 before releasing 2.58.0 @github-actions[bot]
- #4918 docs(devlog): record the 2.58.0 release evidence @lidge-jun
- #4919 fix(web-search): replay executed bridge searches to the destination @lidge-jun
- #4920 docs(cli): clarify platform-specific service repair behavior @luvs01
- #4921 fix(codex): decide flagship model availability by roster and refusal evidence @lidge-jun
- #4922 fix(gui): keep prototype-named model context drafts safe @luvs01
- #4924 fix(cursor): seed Muse Spark 1.3 so live discovery can surface it @lidge-jun
- #4925 fix(responses): honor the provider transient-5xx policy on the passthrough lane @lidge-jun
- #4926 fix(oauth): rebind continuation replay scope after generic OAuth 429 failover @luvs01
- #4927 fix(combos): hop a response_format capability refusal to the next target @lidge-jun
- #4928 fix(responses): scope compact handoff cache to authenticated admission principal @luvs01
- #4929 fix(cursor): stop grok-4.6 tool-result echo from poisoning later turns @lidge-jun
- #4930 fix: pin Union Alpha wire and namespace Go sessions @lidge-jun
- #4931 fix(openai-chat): bound reasoning_details snapshots and account them to TranslatorBudget @luvs01
- #4933 fix(oauth): bound OrcaRouter key-exchange responses @lidge-jun
- #4935 fix(codex): key pool affinity on the conversation cohort, not the thread @lidge-jun
- #4937 fix(oauth): keep Devin migration account-bound @luvs01
- #4938 fix(codex): fence propagated quota recovery aliases @luvs01
- #4939 fix(gui): bound optimistic active-account reconciliation @luvs01
- #4941 fix(catalog): preserve unknown live multi-agent pins @luvs01
- #4945 fix(reauth): preserve polling through cancellation HTTP races @lidge-jun
- #4946 fix(web-search): release unused OpenAI probe leases @luvs01
- #4947 fix(responses): enforce configured total sends during recovery @lidge-jun
- #4948 test(cli): measure cold status setup before timed projections @lidge-jun
- #4951 fix(service): bind lifecycle to CODEX_SQLITE_HOME @luvs01
- #4953 fix(cursor): block OAuth replay after local effects @luvs01
- #4954 fix(server): bind Cursor retry replay to the admitted OAuth account on 429 failover @luvs01
- #4955 fix(codex): drop expired non-blocking quota evidence @luvs01
- #4957 fix(codex): inspect a cleanly-closed WAL state store in the history preflight @lidge-jun
- #4958 fix(catalog): explain a suppressed Luna Reserve row in the sync log @lidge-jun
- #4959 fix(cli): tell a client-role listener apart from a missing management route @lidge-jun
- #4960 fix(cli): decide pending-teardown ownership by identity, not bare PID liveness @lidge-jun
- #4962 fix(catalog): publish opencode-go context windows so live rows stop falling back to 128k @lidge-jun
- #4963 feat(doctor): warn when the Codex default model is not exposed by the proxy @lidge-jun
- #4964 fix(codex): report the selected model base prompt in the prompt probe @lidge-jun
- #4965 feat(codex): let operators choose the injected provider display name @lidge-jun
- #4966 feat(doctor): warn about opencodex-derived Codex role TOMLs with no model pin @lidge-jun
- #4967 fix(service): report one outcome when a repair or restart fails @lidge-jun
- #4968 fix(codex): refuse Reserve turns the Desktop authless opt-in cannot serve @lidge-jun
- #4969 docs(devlog): assess what the dev tip closes of the pooled-routing cost incident (#4546) @lidge-jun
- #4970 fix(codex): report the pin routing will release instead of a bare accepted 200 (#4521) @lidge-jun
- #4973 docs(devlog): record the lane I catalog and model-visibility unit @lidge-jun
- #4975 fix(privacy): detect SSH endpoints per token, and stop scanning on import @lidge-jun
- #4976 fix(usage): bound the usage-log permission hardening cache @lidge-jun
- #4977 fix(transport): decide fresh-connection opt-out at the dispatch boundary @lidge-jun
- #4978 feat(codex): safely attest the selected CLI installation @lidge-jun
- #4979 perf(sse): scan SSE data payloads in place and share the empty byte view @lidge-jun
- #4980 fix(providers): harden OpenRouter quota reset cooldowns @lidge-jun
- #4981 feat(providers): add Opper as a built-in API-key gateway provider @lidge-jun
- #4982 feat(account-pool): show what the usage threshold means per strategy @lidge-jun
- #4983 fix(responses): recover malformed freeform tool wrappers @lidge-jun
- #4984 feat(i18n): add Vietnamese localization @lidge-jun
- #4985 feat(codex): import Orca-managed accounts @lidge-jun
- #4986 feat(proxy): implement real SOCKS5 outbound transport @lidge-jun
- #4987 feat(gui): add Dashboard Fast row toggle and refresh integrations @lidge-jun
- #4988 feat(providers): add Crusoe Serverless Inference preset @lidge-jun
- #4990 fix(sidecar): release unused quota probe leases @luvs01
- #4993 fix(catalog): account for auxiliary model charges @luvs01
- #4994 fix(client): fence loopback-bootstrapped GUI sessions from machine mutations @luvs01
- #4995 fix(gui): restrict OAuth login manual-open links to http(s) @luvs01
- #4996 fix(cli): preserve absent OAuth plan fields @luvs01
- #4998 fix(codex): fence device reauth cancellation @luvs01
- #4999 docs(structure): split runtime.md at the providers and adapters boundary @lidge-jun
- #5005 fix(gui): complete the Vietnamese catalog for the threshold summary keys @lidge-jun
- #5007 fix(codex): guard the first read in the history injection preflight @lidge-jun
- #5010 fix(providers): restore glm-5.3 to both Alibaba Token Plan catalogs @oliver-mee
- #5011 test(server): hold the prototype-named override case in a sibling file @lidge-jun
- #5013 fix(management): validate complete provider POST candidates before adoption @luvs01
- #5014 test(server): release the combo connect-cancellation fixture during cleanup @luvs01
- #5015 fix(cli): never hop off a busy port into a duplicate proxy @lidge-jun
- #5018 test: hold the newest catalog and provider cases in sibling files @lidge-jun
- #5020 fix(gui): complete the native-main namespace for the Vietnamese locale @lidge-jun
- #5021 fix(responses): let a provider declare the hosted tools it rejects @lidge-jun
- #5022 fix(transport): apply the fresh-connection policy to a selected provider transport @lidge-jun
- #5023 fix(catalog): backfill a published context window onto a live routed row @lidge-jun
- #5025 fix(catalog): keep live pins when the supplied baseline omits the slug @luvs01
- #5026 fix(service): bind service start to the installed environment @luvs01
- #5028 ci(macos): size the unsharded control budget to its measured duration @lidge-jun
- #5029 feat(claude): opt-in ENABLE_TOOL_SEARCH injection for launched Claude Code sessions @lidge-jun
- #5030 fix(docker): build the compatibility manifest inside the image @lidge-jun
- #5031 fix(gui): name the three model catalog delivery states @lidge-jun
- #5032 feat(spend): make the durable token ceiling configurable and its refusal legible @lidge-jun
- #5034 docs(agents): record what a green pull request does not tell you @lidge-jun
- #5036 feat(catalog): suppress synthetic max per model while retaining ultra @lidge-jun
- #5038 test(ci): warm a spawned child module graph before it is timed @lidge-jun
- #5039 fix(registry): declare CommandCode deepseek/deepseek-v4.1-flash natively image-capable @xinzhihong-ship-it
- #5040 test(combos): pin the second gateway response_format refusal envelope @lidge-jun
- #5041 fix(devin): wait out a stated rate-limit reset and replay the turn @luvs01
- #5042 fix(local): fail closed DNS bind names for credential-bearing destinations @luvs01
- #5048 fix(ci): give a dispatched run its own concurrency group @lidge-jun
- #5050 fix(ci): gate the directory that is itself a gate @lidge-jun
- #5051 fix(responses): compile the apply_patch body recognition accepted @lidge-jun
- #5053 fix(bridge): hold a freeform wrapper the completed item will unwrap @lidge-jun
- #5054 fix(google): give each parallel child its own Antigravity session @lidge-jun
- #5055 fix(quota): make the account-switch warning agree with routing @lidge-jun
- #5056 feat(usage): attribute a recovery the send budget withheld @lidge-jun
- #5057 fix(claude): report the prompt this proxy counted on message_start @lidge-jun
- #5062 fix(google): key the Antigravity session on the parent/child pair @lidge-jun
- #5070 fix(transport): match freeform streaming to its completion grammar and decode SOCKS5 content-codings @lidge-jun
- #5074 release: promote 2.59.0 to main @lidge-jun