Published to npm as @bitkyc08/opencodex@2.60.0 with dist-tag latest.
New Features
- Add versioned structure contract authority (#5155)
- Admit every inference send through the shared budget (#5152)
- Expose max reasoning effort to routed clients (#5094)
- Require one writer lease per state directory for the spend journal (#5157)
- Derive selector decode hints from a classified registry (#5177)
- Route Codex compaction to a configured model for the triggers you name (#5202)
- Migrate static policy consumers onto the resolved policy (#5174)
- Add server-owned integration mutation previews (#5185)
- Show server-owned plans in integration confirmations (#5197)
Bug Fixes
- Classify the merged regression tests explicitly in the layout inventories (#5075)
- Stop the Antigravity rename migration re-announcing itself on every boot (#5077)
- Judge cold-spawn warm-up registration structurally (#5080)
- Keep routed rows from inheriting experimental context (#5085)
- Shell-quote hub invite arguments (#5065)
- Keep file clients unknown on a failed-cold client read (#5088)
- Avoid sending management token to DNS-recorded stop hosts (#5086)
- Preserve mixed-case effort aliases (#5084)
- Validate Claude Desktop status payloads before trusting them (#5089)
- Emit the tool name the undeclared-tool guard authorized (#5095) (#5100)
- Repair legacy dotted call names on replay (#5095) (#5101)
- Return null bodies for 204 and 205 on raw outbound transports (#5125)
- Do not offer retry for the Grok coupon reset POST (#5103)
- Patient same-target 429 fallback for OpenCode Go (#5067)
- State the T04 re-arming contract on an injectable clock (#5131)
- Settle SOCKS5 uploads on abort and early final responses (#5127)
- Decode content-coded responses on the pinned direct route (#5126)
- Share one progressive freeform decoder with routed restoration (#5129)
- Refuse a continuation whose task scope does not match (#5130)
- Raise the native passthrough reset from a requested pull (#5128)
- Defuse bot-authored mentions at punctuation and Markdown boundaries (#5105)
- Tolerate a malformed CODEX_HOME/agents path during the role scan (#5106)
- Bound remote image prompt references (#5139)
- Keep custom websocket upstreams on bounded HTTP SSE (#5141)
- Preserve legacy history manifest targets for history jobs (#5107)
- Replay burst 429s on the forward sidecar search (#5158)
- Persist and enforce tool-suspended checkpoint snapshots (#5133)
- Distinguish unmapped prompt layers from the unprintable base prompt (#5102)
- Normalize integral Responses timestamps (#5071)
- Bound destroyed-shim diagnostics to the stable probe (#5136)
- Preserve punctuation-bearing emails when defusing mentions (#5172)
- Match the OpenCode Go destination canonically (#5165)
- Honor autoSwitchThreshold=0 as disabled (#5091)
- Fail closed for legacy custom ACP rows (#5149)
- Refuse provider-table transitions that strand paginated openai threads (#5137)
- Fail over Astra tool routing mismatch (#5142)
- Skip byte-identical models-cache writes so a start cannot claim disk state changed (#5108)
- Deliver an upstream refusal as a terminal error instead of a retryable one (#5200)
- Stop one account failure from taking the whole proxy out of service (#5199)
- Carry three transport hardening PRs and close the reordered freeform wrapper gap (#5203)
- Scope catalog credential (#5194)
- Clear disconnected hub token on standalone recycle (#5144)
- Bound inline image decoding (#5208)
- Validate raw paste code#state suffix against expected state (#5090)
- Reuse parsed body for policy fallback (#5207)
- Replay ambiguous resets on the OpenCode Go initial send (#5223)
- Persist terminal pool reauth causes and surface stored verdicts (#5222)
- Read restart safety through the CLI instead of the admin-gated API (#5184)
- Recognize boolean native context opt-in (#5156)
- Let an explicit custom row outrank the provider vision hints (#5163)
- Reclassify the Zen Go DeepSeek route as native vision (#5164)
- Hand off affinity in refresh flight (#5135)
- Bound concurrent filtered scans (#5231)
- Gate synthetic ultra (1m) catalog rows on discovered Max Mode (#5228)
- Preserve Windows per-scheme proxy scope (#5227)
- Thread abort signal into image normalization call sites (#5226)
- Terminate Windows coding-agent trees (#5224)
- Rebind the sidecar retry request after OAuth rotation (#5238)
- Bound replayed tool promotion (#5235)
- Add modelResponsesTerminalRepair for muse-spark on OpenCode gateways (#5240)
- Reject Fernet-shaped agent plaintext (#5239)
Documentation
- Separate data-plane API keys from management credentials (#5134)
- Bind the Lab isolation invariant (#5138)
- Align SOCKS5 HTTP/SSE routing documentation (#5153)
- Record contract gap analysis and delivery evidence (#5175)
- Record thirteen verified contract issue outcomes (#5187)
- Record contract campaign review and verification progress (#5192)
- Record fourteen verified contract issue closures (#5218)
- Archive contract implementation and record release handoff (#5242)
Chores
- Open dev at 2.60.0 before releasing 2.59.0 (#5072)
- Diag(google): describe the Antigravity wire request without its contents (#5008) (#5079)
- Split phase timing for the four #4997 budget overruns (#5081)
- Move fixture and host-probe cost out of the #4997 measured windows (#5082)
- Give the Windows nested live-lock case its own lock owner (#5078)
- Report what the sideband peer saw at the 50MiB frame ceiling (#5161)
- State the T04 heartbeat-only contract on the injectable clock (#5169)
- Assert which error the refused send raises and what the caller sees (#5170)
- Assemble the userinfo fixture instead of writing it inline (#5195)
- Split two files back under their size caps (#5201)
- Declare wreq-js as optional TLS runtime dependency (#5083)
- Move in-flight login state into its own module (#5220)
- Cover HEAD preservation, interim answers and the SOCKS response timeout (#5225)
- Mint the surviving blob as a valid Fernet token (#5246)
Other Changes
- Report endpoint-scoped Google tool-schema loss (#5162)
- Reject lossy Google tool schemas on opt-in (#5167)
- Resolve static model policy once for catalog and routing (#5171)
- Provider discovery and model surface: outbound User-Agent, Volcengine Responses, Token Plan opt-in, Command Code ladders (#5198)
- Export bounded request metrics through an opt-in scrape endpoint (#5183)
- Promote the verified 2.60.0 tree to main (#5249)
Changelog
Full Changelog: v2.59.0...v2.60.0
- #5065 fix(cli): shell-quote hub invite arguments @luvs01
- #5067 fix(providers): patient same-target 429 fallback for OpenCode Go @agentHits
- #5071 fix(grok): normalize integral Responses timestamps @shawn-kim-ai
- #5072 chore(release): open dev at 2.60.0 before releasing 2.59.0 @github-actions[bot]
- #5075 fix(ci): classify the merged regression tests explicitly in the layout inventories @lidge-jun
- #5077 fix(providers): stop the Antigravity rename migration re-announcing itself on every boot @lidge-jun
- #5078 test(ci): give the Windows nested live-lock case its own lock owner @lidge-jun
- #5079 diag(google): describe the Antigravity wire request without its contents (#5008) @lidge-jun
- #5080 fix(tests): judge cold-spawn warm-up registration structurally @lidge-jun
- #5081 test(ci): split phase timing for the four #4997 budget overruns @lidge-jun
- #5082 test(ci): move fixture and host-probe cost out of the #4997 measured windows @lidge-jun
- #5083 chore(deps): declare wreq-js as optional TLS runtime dependency @yansigit
- #5084 fix(cursor): preserve mixed-case effort aliases @luvs01
- #5085 fix(codex): keep routed rows from inheriting experimental context @Mpayro
- #5086 fix(process-control): avoid sending management token to DNS-recorded stop hosts @luvs01
- #5088 fix(gui): keep file clients unknown on a failed-cold client read @luvs01
- #5089 fix(gui): validate Claude Desktop status payloads before trusting them @luvs01
- #5090 fix(oauth): validate raw paste code#state suffix against expected state @luvs01
- #5091 fix(accounts): honor autoSwitchThreshold=0 as disabled @luvs01
- #5094 feat(meta-muse): expose max reasoning effort to routed clients @shawn-kim-ai
- #5100 fix(responses): emit the tool name the undeclared-tool guard authorized (#5095) @lidge-jun
- #5101 fix(responses): repair legacy dotted call names on replay (#5095) @lidge-jun
- #5102 fix(gui): distinguish unmapped prompt layers from the unprintable base prompt @luvs01
- #5103 fix(gui): do not offer retry for the Grok coupon reset POST @luvs01
- #5105 fix(ci): defuse bot-authored mentions at punctuation and Markdown boundaries @luvs01
- #5106 fix(doctor): tolerate a malformed CODEX_HOME/agents path during the role scan @luvs01
- #5107 fix(codex): preserve legacy history manifest targets for history jobs @luvs01
- #5108 fix(catalog): skip byte-identical models-cache writes so a start cannot claim disk state changed @neerajdad123-byte
- #5125 fix(transport): return null bodies for 204 and 205 on raw outbound transports @lidge-jun
- #5126 fix(transport): decode content-coded responses on the pinned direct route @lidge-jun
- #5127 fix(transport): settle SOCKS5 uploads on abort and early final responses @lidge-jun
- #5128 fix(test): raise the native passthrough reset from a requested pull @lidge-jun
- #5129 fix(responses): share one progressive freeform decoder with routed restoration @lidge-jun
- #5130 fix(responses): refuse a continuation whose task scope does not match @lidge-jun
- #5131 fix(cursor): state the T04 re-arming contract on an injectable clock @lidge-jun
- #5133 fix(cursor): persist and enforce tool-suspended checkpoint snapshots @luvs01
- #5134 docs(config): separate data-plane API keys from management credentials @lidge-jun
- #5135 fix(codex): hand off affinity in refresh flight @luvs01
- #5136 fix(codex): bound destroyed-shim diagnostics to the stable probe @luvs01
- #5137 fix(codex): refuse provider-table transitions that strand paginated openai threads @luvs01
- #5138 docs(structure): bind the Lab isolation invariant @lidge-jun
- #5139 fix(devin): bound remote image prompt references @luvs01
- #5141 fix(responses): keep custom websocket upstreams on bounded HTTP SSE @luvs01
- #5142 fix(combo): fail over Astra tool routing mismatch @87003697
- #5144 fix(client): clear disconnected hub token on standalone recycle @luvs01
- #5149 fix(devin): fail closed for legacy custom ACP rows @luvs01
- #5152 feat(devin): admit every inference send through the shared budget @lidge-jun
- #5153 docs(proxy): align SOCKS5 HTTP/SSE routing documentation @lidge-jun
- #5155 Add versioned structure contract authority @lidge-jun
- #5156 fix(codex): recognize boolean native context opt-in @luvs01
- #5157 feat(spend): require one writer lease per state directory for the spend journal @lidge-jun
- #5158 fix(web-search): replay burst 429s on the forward sidecar search @agentHits
- #5161 test(server): report what the sideband peer saw at the 50MiB frame ceiling @lidge-jun
- #5162 Report endpoint-scoped Google tool-schema loss @lidge-jun
- #5163 fix(vision): let an explicit custom row outrank the provider vision hints @RobinBially
- #5164 fix(registry): reclassify the Zen Go DeepSeek route as native vision @RobinBially
- #5165 fix(providers): match the OpenCode Go destination canonically @agentHits
- #5167 Reject lossy Google tool schemas on opt-in @lidge-jun
- #5169 test(cursor): state the T04 heartbeat-only contract on the injectable clock @lidge-jun
- #5170 test(devin): assert which error the refused send raises and what the caller sees @lidge-jun
- #5171 Resolve static model policy once for catalog and routing @lidge-jun
- #5172 fix(ci): preserve punctuation-bearing emails when defusing mentions @luvs01
- #5174 Migrate static policy consumers onto the resolved policy @lidge-jun
- #5175 docs: record contract gap analysis and delivery evidence @lidge-jun
- #5177 feat(registry): derive selector decode hints from a classified registry @lidge-jun
- #5183 Export bounded request metrics through an opt-in scrape endpoint @lidge-jun
- #5184 fix(tray): read restart safety through the CLI instead of the admin-gated API @ahmedfrawelo
- #5185 Add server-owned integration mutation previews @lidge-jun
- #5187 docs: record thirteen verified contract issue outcomes @lidge-jun
- #5192 docs: record contract campaign review and verification progress @lidge-jun
- #5194 fix(opencode): scope catalog credential @luvs01
- #5195 test(providers): assemble the userinfo fixture instead of writing it inline @lidge-jun
- #5197 Show server-owned plans in integration confirmations @lidge-jun
- #5198 Provider discovery and model surface: outbound User-Agent, Volcengine Responses, Token Plan opt-in, Command Code ladders @lidge-jun
- #5199 fix: stop one account failure from taking the whole proxy out of service @lidge-jun
- #5200 Deliver an upstream refusal as a terminal error instead of a retryable one @lidge-jun
- #5201 refactor(codex,tests): split two files back under their size caps @lidge-jun
- #5202 feat(responses): route Codex compaction to a configured model for the triggers you name @lidge-jun
- #5203 fix(streaming): carry three transport hardening PRs and close the reordered freeform wrapper gap @lidge-jun
- #5207 fix(routing): reuse parsed body for policy fallback @luvs01
- #5208 fix(adapters): bound inline image decoding @luvs01
- #5218 docs: record fourteen verified contract issue closures @lidge-jun
- #5220 refactor(oauth): move in-flight login state into its own module @lidge-jun
- #5222 fix(codex): persist terminal pool reauth causes and surface stored verdicts @luvs01
- #5223 fix(providers): replay ambiguous resets on the OpenCode Go initial send @agentHits
- #5224 fix(adapters): terminate Windows coding-agent trees @luvs01
- #5225 Cover HEAD preservation, interim answers and the SOCKS response timeout @lidge-jun
- #5226 fix(adapters): thread abort signal into image normalization call sites @luvs01
- #5227 fix(proxy): preserve Windows per-scheme proxy scope @luvs01
- #5228 fix(cursor): gate synthetic ultra (1m) catalog rows on discovered Max Mode @luvs01
- #5231 fix(usage): bound concurrent filtered scans @luvs01
- #5235 fix(opencode-go): bound replayed tool promotion @luvs01
- #5238 fix(sidecars): rebind the sidecar retry request after OAuth rotation @luvs01
- #5239 fix(responses): reject Fernet-shaped agent plaintext @Ingwannu
- #5240 fix(registry): add modelResponsesTerminalRepair for muse-spark on OpenCode gateways @Yum-wu
- #5242 docs: archive contract implementation and record release handoff @lidge-jun
- #5246 test(responses): mint the surviving blob as a valid Fernet token @lidge-jun
- #5249 release: promote the verified 2.60.0 tree to main @lidge-jun