Published to npm as @bitkyc08/opencodex@2.95.0 with dist-tag latest.
New Features
- Show distinct first-response states on the provider overview (#7939)
- Skip Unicode folding for plain ASCII metadata (#7886)
- Per-client model visibility for the Desktop list (#7769)
- Add IAM Identity Center login to dashboard (#7690)
- Opt in to omitting disabled native models (#7889)
- Link completion probe failures to recovery, re-verification, and disconnect scope (#7947)
- Scan SSE inspection fragments incrementally (#7913)
- Test all models of a provider and disable the failures (#7742)
- Complete gracefully on max_output_tokens (#7770)
- Let the omo integration write the Responses dialect (#7890)
- Add keyless CC-Switch provider import with preview, apply and restore (#7935)
- Count snapshot text bytes incrementally (#7957)
- Move integrity scans off the serving thread (#7972)
- Tier role auto-assign candidates by measured capability in the role's task domain (#7624)
Bug Fixes
- Honor explicit Opus 5.5 reasoning summaries (#7881)
- Report main-pool affinity decisions in request logs (#7883)
- Keep local account cooldowns from quarantining combo targets (#7887)
- Reserve SSH forward ports until handoff and recover lost candidates (#7893)
- Re-arm the atomic writer's ACL timeout memo per destination (#7891)
- Preserve tool safety on translated Messages fallbacks (#7919)
- Drop the include entry xAI rejects (#7911)
- Preserve Muse reset countdown after quota exhaustion (#7730)
- Explain why Antigravity project discovery failed (#7888)
- Keep layout.json under the file-size threshold (#7943)
- Default Moonshot API to K3.1 Pro and retire K2.5 (#7880)
- Send LM Studio one leading system message (#7882)
- Treat headless GUI-domain launchctl 125 as an unreachable domain (#7697) (#7745)
- Fail over when a target rejects a request for context length (#7892)
- Support manual consultations during web search (#7858)
- Keep final Responses events without a newline (#7873)
- Resolve the atomic-write fixture root before matching cleanup paths (#7945)
- Budget hosted fixture phases without weakening contracts (#7946)
- Feed the abort fixture's stdout once (#7948)
- Use a never-allocated PID for the pending-child recovery fixture (#7949)
- Give native passthrough success paths the internal header deadline (#7951)
- Publish the overlap fixture after the recheck budget is spent (#7950)
- Judge protected-tree containment per path component (#7884)
- Apply the caller's paid-combo consent and device fallback policy (#7894)
- Explain upstream request failures (#7936)
- Distinguish install failures from owned deadlines (#7977)
- Keep Kimi K3.1 Pro tool continuations valid (#7944)
- Make per-task ceilings configurable from config and dashboard (#7960)
- Keep Advisor requests cloneable for the retry snapshot (#7981)
- Snapshot ACL failure diagnostics (#7970)
- Explain tracked runtime stop refusals (#7973)
- Decode routed slugs via modelDisplayNames ids (#7979)
- Normalize Codex tool catalogs and include for Meta Muse (#7985)
- Bigint probe identity in runtime preflight; release CC-Switch F3 WAL handles (#7986)
- Skip Meta Muse targets for mandatory tool_choice (#7982)
- Accept CR-delimited Responses events (#7989)
- Omit unsupported Responses encrypted output include (#7988)
- Validate CLI and desktop launcher execution boundaries (#7876)
- Stop Windows ancestor-watch feedback loops (#7976)
- Name the invalid model row and the static-list workaround (#7990)
- Stop scoring an elapsed 5-hour window against a pool account (#7994)
- Retire a pool account's carried 5-hour window when WHAM shows none (#7980)
- Keep web_search native when no sidecar backend can run (#7991)
- Keep the quota report cache when pool readings are only restamped (#7992)
- Promote additional_tools to top-level tools for xAI and strict gateways (#7983)
- Prune generated agents when the Claude integration is turned off (#7993)
- Bound the integrity check wait (#7984) (#7997)
- Await recovery ACL checks in async parent admission (#7931)
- Refuse dashboard restart under a systemd unit OpenCodex does not own (#7996)
- Admit config-root cache writes after the optional config-root ACL flight (#7998)
- Compare file identity with bigint stat (#8019)
- Compare Codex and remote workspace file identity with bigint stat (#8023)
- Compare CLI install and update artifact identity with bigint stat (#8031)
Documentation
- Say when the workflow send ceiling is checked (#7987)
Chores
- Warm the PowerShell ancestry probe before its timed run (#7885)
- Add offline fixtures for claude-cli schema-constrained output (#7908)
- Expose bounded Windows plan refusal diagnostics (#7937)
- Bump rustls from 0.23.45 to 0.23.46 in /desktop/src-tauri (#7942)
- Cover encrypted Responses tool continuation (#7975)
- Corrupt the index the health query plan actually reads (#7995)
- Corrupt the health index through a cold connection (#8000)
- Assert the cold keyring refusal kind and report its cause (#8001)
- Finalize the F1/F2 fixture statements before cleanup (#8002)
- Name the pinned-port holder when a sibling misses its deadline (#8003)
- Await the admitted provider quota cache write (#8004)
- Report the hardened local-CA ACL in the first-party apply suite (#8016)
- Select injected stat targets by canonical path (#8029)
- Give the Windows apply x64 fixture compile the shared spawn budget (#8032)
Other Changes
- Open dev at 2.95.0 before releasing 2.94.0 (#7934)
- Kiro: log the usage Kiro reports on every wire, and forward combo child usage after commit (#7433)
- Promote frozen tip c68885b to main as 2.95.0 (#8034)
Changelog
Full Changelog: v2.94.0...v2.95.0
- #7433 Kiro: log the usage Kiro reports on every wire, and forward combo child usage after commit @hedging8563
- #7624 feat(codex): tier role auto-assign candidates by measured capability in the role's task domain @LilMGenius
- #7690 feat(kiro): add IAM Identity Center login to dashboard @martinbcg
- #7730 fix(gui): preserve Muse reset countdown after quota exhaustion @stephen-drew
- #7742 feat(providers): test all models of a provider and disable the failures @ljluestc
- #7745 fix(service): treat headless GUI-domain launchctl 125 as an unreachable domain (#7697) @lidge-jun
- #7769 feat(claude-desktop): per-client model visibility for the Desktop list @ljluestc
- #7770 feat(responses): complete gracefully on max_output_tokens @omar391
- #7858 fix(advisor): support manual consultations during web search @auroraflux-jhkim
- #7873 fix(sidecars): keep final Responses events without a newline @oocheol
- #7876 fix(codex): validate CLI and desktop launcher execution boundaries @luvs01
- #7880 fix(providers): default Moonshot API to K3.1 Pro and retire K2.5 @lidge-jun
- #7881 fix(anthropic): honor explicit Opus 5.5 reasoning summaries @lidge-jun
- #7882 fix(openai-chat): send LM Studio one leading system message @lidge-jun
- #7883 fix(codex): report main-pool affinity decisions in request logs @lidge-jun
- #7884 fix(test): judge protected-tree containment per path component @lidge-jun
- #7885 test(windows): warm the PowerShell ancestry probe before its timed run @lidge-jun
- #7886 perf(usage): skip Unicode folding for plain ASCII metadata @lidge-jun
- #7887 fix(codex): keep local account cooldowns from quarantining combo targets @lidge-jun
- #7888 fix(oauth): explain why Antigravity project discovery failed @lidge-jun
- #7889 feat(catalog): opt in to omitting disabled native models @lidge-jun
- #7890 feat(clients): let the omo integration write the Responses dialect @lidge-jun
- #7891 fix(config): re-arm the atomic writer's ACL timeout memo per destination @lidge-jun
- #7892 fix(combos): fail over when a target rejects a request for context length @lidge-jun
- #7893 fix(messaging): reserve SSH forward ports until handoff and recover lost candidates @lidge-jun
- #7894 fix(advisor): apply the caller's paid-combo consent and device fallback policy @lidge-jun
- #7908 test: add offline fixtures for claude-cli schema-constrained output @adirwt852-cloud
- #7911 fix(openai-responses): drop the include entry xAI rejects @xubenqiang
- #7913 perf(anthropic): scan SSE inspection fragments incrementally @0disoft
- #7919 fix: preserve tool safety on translated Messages fallbacks @lidge-jun
- #7931 fix(codex): await recovery ACL checks in async parent admission @luvs01
- #7934 chore(release): open dev at 2.95.0 before releasing 2.94.0 @github-actions[bot]
- #7935 feat(provider): add keyless CC-Switch provider import with preview, apply and restore @lidge-jun
- #7936 fix(gui): explain upstream request failures @lidge-jun
- #7937 test(codex): expose bounded Windows plan refusal diagnostics @lidge-jun
- #7939 feat(gui): show distinct first-response states on the provider overview @lidge-jun
- #7942 build(deps): bump rustls from 0.23.45 to 0.23.46 in /desktop/src-tauri @dependabot[bot]
- #7943 fix(test-layout): keep layout.json under the file-size threshold @lidge-jun
- #7944 fix(volcengine): keep Kimi K3.1 Pro tool continuations valid @AaronZ345
- #7945 test(windows): resolve the atomic-write fixture root before matching cleanup paths @lidge-jun
- #7946 test(windows): budget hosted fixture phases without weakening contracts @lidge-jun
- #7947 feat(gui): link completion probe failures to recovery, re-verification, and disconnect scope @lidge-jun
- #7948 test(codebuddy): feed the abort fixture's stdout once @lidge-jun
- #7949 test(windows): use a never-allocated PID for the pending-child recovery fixture @lidge-jun
- #7950 test(config): publish the overlap fixture after the recheck budget is spent @lidge-jun
- #7951 test(claude): give native passthrough success paths the internal header deadline @lidge-jun
- #7957 perf(responses): count snapshot text bytes incrementally @0disoft
- #7960 fix(workflow-budget): make per-task ceilings configurable from config and dashboard @robin-bially
- #7970 fix(windows): snapshot ACL failure diagnostics @luvs01
- #7972 perf(history): move integrity scans off the serving thread @luvs01
- #7973 fix(cli): explain tracked runtime stop refusals @luvs01
- #7975 test(xai): cover encrypted Responses tool continuation @Reedtrullz
- #7976 fix(credentials): stop Windows ancestor-watch feedback loops @luvs01
- #7977 fix(ci): distinguish install failures from owned deadlines @luvs01
- #7979 fix(router): decode routed slugs via modelDisplayNames ids @lidge-jun
- #7980 fix(codex): retire a pool account's carried 5-hour window when WHAM shows none @lidge-jun
- #7981 fix(kiro): keep Advisor requests cloneable for the retry snapshot @lidge-jun
- #7982 fix(combo): skip Meta Muse targets for mandatory tool_choice @lidge-jun
- #7983 fix(responses): promote additional_tools to top-level tools for xAI and strict gateways @lidge-jun
- #7985 fix(responses): normalize Codex tool catalogs and include for Meta Muse @lidge-jun
- #7986 fix(windows): bigint probe identity in runtime preflight; release CC-Switch F3 WAL handles @lidge-jun
- #7987 docs(config): say when the workflow send ceiling is checked @lidge-jun
- #7988 fix(azure): omit unsupported Responses encrypted output include @lidge-jun
- #7989 fix(sidecars): accept CR-delimited Responses events @lidge-jun
- #7990 fix(discovery): name the invalid model row and the static-list workaround @lidge-jun
- #7991 fix(claude): keep web_search native when no sidecar backend can run @lidge-jun
- #7992 fix(providers): keep the quota report cache when pool readings are only restamped @lidge-jun
- #7993 fix(claude): prune generated agents when the Claude integration is turned off @lidge-jun
- #7994 fix(codex): stop scoring an elapsed 5-hour window against a pool account @lidge-jun
- #7995 test(history): corrupt the index the health query plan actually reads @lidge-jun
- #7996 fix(update): refuse dashboard restart under a systemd unit OpenCodex does not own @lidge-jun
- #7997 fix(history): bound the integrity check wait (#7984) @lidge-jun
- #7998 fix(windows): admit config-root cache writes after the optional config-root ACL flight @lidge-jun
- #8000 test(history): corrupt the health index through a cold connection @lidge-jun
- #8001 test(codex): assert the cold keyring refusal kind and report its cause @lidge-jun
- #8002 test(cc-switch): finalize the F1/F2 fixture statements before cleanup @lidge-jun
- #8003 test(cli): name the pinned-port holder when a sibling misses its deadline @lidge-jun
- #8004 test(anthropic): await the admitted provider quota cache write @lidge-jun
- #8016 test(claude): report the hardened local-CA ACL in the first-party apply suite @lidge-jun
- #8019 fix: compare file identity with bigint stat @lidge-jun
- #8023 fix: compare Codex and remote workspace file identity with bigint stat @lidge-jun
- #8029 test: select injected stat targets by canonical path @lidge-jun
- #8031 fix: compare CLI install and update artifact identity with bigint stat @lidge-jun
- #8032 test: give the Windows apply x64 fixture compile the shared spawn budget @lidge-jun
- #8034 release: promote frozen tip c68885b to main as 2.95.0 @lidge-jun
Code signing
Windows binaries follow the code signing policy.
Free code signing provided by SignPath.io, certificate by SignPath Foundation.