Highlights
17 issues fixed and 4 new foundations introduced via PR #2282 — a 24-cycle review-loop landed across 33 commits.
New capabilities
- OAuth keychain reader (#2215) —
readClaudeOAuthToken()reads from platform-native credential stores (macOS keychain, Windows DPAPI, Linux libsecret) at worker spawn-time. JWT exp / sidecarexpiresAtvalidation refuses stale tokens. Re-login hint surfaced via SessionStartadditionalContext. - Quota-aware wall-clock guard (#2234) — new
RateLimitStorewith auth-type gate:api_keynever aborts; cli/oauth aborts at per-window thresholds (5h:0.95, 7d_opus:0.93, 7d_sonnet:0.92). 15min reset-grace buffer with 0.85 utilization floor.rateLimitsexposed on/api/health. - Network retry helper (#2254) —
withRetryhonorsClassifiedProviderError.kind, exponential backoff with jitter, request-id capture for dedup logging.
Foundations (new public modules)
- F1
spawnHidden(src/shared/spawn.ts) —windowsHide: truedefault; 8 spawn sites adopted. - F2
paths(src/shared/paths.ts) — 24 hardcodedhomedir() + '.claude-mem'sites collapsed into 18 named accessors.CLAUDE_MEM_DATA_DIRflows through 100% of runtime. Self-extending invariant test. - F3
getUptimeSeconds(src/shared/uptime.ts) — fixes ms-bug atServer.ts:165. - F4
ClassifiedProviderError(src/services/worker/provider-errors.ts) —kindunion (transient | unrecoverable | rate_limit | quota_exhausted | auth_invalid); per-provider classifiers;unrecoverablePatternsallowlist deleted.
Bug fixes
- #2188 — empty stdin no longer falls back to
'{}'; diagnostic log +CAPTURE_BROKENmarker - #2196 —
ANTHROPIC_BASE_URLdocumentation added - #2220 / #2253 — chroma-mcp CPU storm (Windows + macOS): thread caps, per-batch watermarks, telemetry off,
killProcessTreeon shutdown - #2225 — opencode
_zod.defcrash: Zod schemas replace plain JSON-schema arg shapes - #2231 —
SECURITY.mdat repo root populates GitHub Security tab - #2233 — Part A:
stripCodeFences()+ fence example removed from prompt (Part B deferred) - #2236 — observer agent visible windows on Windows (consumed F1)
- #2237 / #2238 — hardcoded paths (consumed F2)
- #2240 — dedupe
observationIdsbefore Chroma sync - #2242 —
check-pending-queue.tspoints at/api/processing-status+/api/processing; honorsCLAUDE_MEM_WORKER_PORT - #2243 —
scripts/sync-marketplace.cjsrsync excludes stalescripts/package.json+scripts/node_modules - #2244 —
unrecoverablePatternsallowlist deleted; worker dispatches onerror.kind - #2247 — Codex
task_completeevent added to session-end matched types - #2248 — Cursor sessions never summarized: 3 bugs in stop→summarize path fixed (transcriptPath, type-only match, empty-text first-match) — 10-case regression test added
- #2250 — health endpoint uptime returns seconds (consumed F3)
- #2222 —
CLAUDE_CODE_PATHdesktop-app silent fail: rejectsClaude.exepaths, falls back to real CLI binary
Tests / CI
- 1454 pass / 77 fail — matches main baseline, zero net regressions
- All CI green: build, CodeRabbit (17 rounds resolved), Greptile (clean)
Out of scope (deferred)
#2213 dual-queue avalanche, #2256 unbounded transcript retention, #2217 observation chunking, #2202 codex compression provider, #2249 Codex hook lifecycle migration, #2218 installer cache cleanup, #2167 parallel-agent throughput, #2191 Kiro IDE, #2212 Windows PTY, #2166 stable/beta channels.