Highlights: Grok and Devin CLI summaries with isolated configuration, new OpenAI model support, and dependency security fixes.
- Security: update brace-expansion in extension tooling to bound comma, nesting, and closing-brace parsing, preventing stack exhaustion and CPU denial of service.
- CLI providers: add opt-in Grok CLI summaries with private prompt files, auth-only home isolation, disabled tools/web/MCP/subagents, strict sandboxing, usage/cost reporting, and daemon/Chrome model picker support (#498, thanks @vincent-peng).
- CLI providers: add opt-in Devin CLI summaries with private prompt files, ATIF token accounting, isolated configuration, and workspace trust checks for caller directories (#499, thanks @vincent-peng).
- OpenAI: support GPT-6.1 Sol (
openai/gpt-6.1-sol) with pricing and model-picker entries, omit its unsupportedtemperatureparameter, and reject its unsupported--thinking nonebefore sending a request (#500, thanks @zackleman). - Maintenance: refresh stabilized provider, network, browser media, localization, and development dependencies while retaining Node 24 and the seven-day adoption hold.
- Browser media: update MediaBunny to 1.59.1 after its seven-day stabilization hold.
- Release: safely resume CLI publication after npm core propagation delays by verifying the existing core tarball integrity before continuing.