What's Changed
- fix(cli): align View label spacing in final panel by @devin-ai-integration[bot] in #918
- fix viewer tool call collisions across agents by @bearsyankees in #917
- fix: recoverable guardrail blocks and decoupled crash-notify by @devin-ai-integration[bot] in #919
- Scope viewer session cookie to the bound port by @yoni-at-strix in #922
- fix(cost): capture OpenRouter streamed usage.cost (fixes $0 kimi-k3 c… by @bearsyankees in #929
- fix(runtime): label docker sandbox containers with the run id for teardown by @devin-ai-integration[bot] in #933
- feat(llm): custom request headers for OpenAI-compatible endpoints via LLM_EXTRA_HEADERS by @devin-ai-integration[bot] in #936
- fix(llm): pass LLM_EXTRA_HEADERS through ModelSettings so they reach the agent loop by @devin-ai-integration[bot] in #937
- feat(llm): opt-in LLM_DISABLE_STREAMING for non-streaming OpenAI-compatible endpoints by @devin-ai-integration[bot] in #938
- fix(llm): prevent ChatGPT subscription scan freezes by @chunguscodes in #943
- fix(llm): surface structured provider refusals by @bearsyankees in #944
- fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity by @devin-ai-integration[bot] in #923
- docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them by @devin-ai-integration[bot] in #955
- fix(core): explicit lifecycle contract — plain text never ends a run; respond_to_user / wait_for_agents split by @devin-ai-integration[bot] in #954
- docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) by @devin-ai-integration[bot] in #901
- feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it by @devin-ai-integration[bot] in #956
- fix(tools): accept both the string and structured form of every tool argument by @devin-ai-integration[bot] in #957
- perf(cli): ~10x faster startup via lazy imports by @devin-ai-integration[bot] in #920
- fix(core): a child never leaves its parent waiting silently by @devin-ai-integration[bot] in #959
- feat(runtime): mount local targets instead of copying them in by @devin-ai-integration[bot] in #958
- fix: calibrate vulnerability severity to demonstrated impact by @bearsyankees in #962
- feat(tui): replace Textual with a Go/Bubble Tea interface by @kusonooyasumi in #941
- Create credential files with owner-only permissions by @lukiod in #945
- fix(tui): remove the shift+enter newline hint from the setup footer by @devin-ai-integration[bot] in #968
- feat: support API specs and Postman collections as targets by @5h4d0wr007 in #866
- fix(tui): keep a long error inside the status row by @0xallam in #970
- feat(reporting): record transitive dependency chain on SCA findings by @devin-ai-integration[bot] in #971
- fix(llm): keep tool-call ids unique so a recycled id can't erase history by @devin-ai-integration[bot] in #976
- fix(llm): cap the tool calls one assistant response may queue by @devin-ai-integration[bot] in #977
- fix(llm): abandon a model stream that stops producing events by @devin-ai-integration[bot] in #978
- fix(agents): collapse repeated waits queued inside one model turn by @devin-ai-integration[bot] in #979
- feat(reporting): structured reachability evidence ladder for dependen… by @bearsyankees in #974
- feat(reporting): require repo-relative manifest_path on dependency CVE findings by @devin-ai-integration[bot] in #982
- prompt changes by @devin-ai-integration[bot] in #984
- update readme by @devin-ai-integration[bot] in #985
- feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… by @bearsyankees in #926
- docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis by @devin-ai-integration[bot] in #986
- chore: release v1.5.0 + bump sandbox image to 1.3.0 by @devin-ai-integration[bot] in #987
- ci: fix Windows release build — TUI-sidecar archive check used forward-slash paths by @devin-ai-integration[bot] in #990
- ci: tolerate repr-escaped backslashes in the release TUI-sidecar check by @devin-ai-integration[bot] in #991
New Contributors
- @chunguscodes made their first contribution in #943
- @lukiod made their first contribution in #945
- @5h4d0wr007 made their first contribution in #866
Full Changelog: v1.4.1...v1.5.0
What's Changed
- fix(cli): align View label spacing in final panel by @devin-ai-integration[bot] in #918
- fix viewer tool call collisions across agents by @bearsyankees in #917
- fix: recoverable guardrail blocks and decoupled crash-notify by @devin-ai-integration[bot] in #919
- Scope viewer session cookie to the bound port by @yoni-at-strix in #922
- fix(cost): capture OpenRouter streamed usage.cost (fixes $0 kimi-k3 c… by @bearsyankees in #929
- fix(runtime): label docker sandbox containers with the run id for teardown by @devin-ai-integration[bot] in #933
- feat(llm): custom request headers for OpenAI-compatible endpoints via LLM_EXTRA_HEADERS by @devin-ai-integration[bot] in #936
- fix(llm): pass LLM_EXTRA_HEADERS through ModelSettings so they reach the agent loop by @devin-ai-integration[bot] in #937
- feat(llm): opt-in LLM_DISABLE_STREAMING for non-streaming OpenAI-compatible endpoints by @devin-ai-integration[bot] in #938
- fix(llm): prevent ChatGPT subscription scan freezes by @chunguscodes in #943
- fix(llm): surface structured provider refusals by @bearsyankees in #944
- fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity by @devin-ai-integration[bot] in #923
- docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them by @devin-ai-integration[bot] in #955
- fix(core): explicit lifecycle contract — plain text never ends a run; respond_to_user / wait_for_agents split by @devin-ai-integration[bot] in #954
- docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) by @devin-ai-integration[bot] in #901
- feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it by @devin-ai-integration[bot] in #956
- fix(tools): accept both the string and structured form of every tool argument by @devin-ai-integration[bot] in #957
- perf(cli): ~10x faster startup via lazy imports by @devin-ai-integration[bot] in #920
- fix(core): a child never leaves its parent waiting silently by @devin-ai-integration[bot] in #959
- feat(runtime): mount local targets instead of copying them in by @devin-ai-integration[bot] in #958
- fix: calibrate vulnerability severity to demonstrated impact by @bearsyankees in #962
- feat(tui): replace Textual with a Go/Bubble Tea interface by @kusonooyasumi in #941
- Create credential files with owner-only permissions by @lukiod in #945
- fix(tui): remove the shift+enter newline hint from the setup footer by @devin-ai-integration[bot] in #968
- feat: support API specs and Postman collections as targets by @5h4d0wr007 in #866
- fix(tui): keep a long error inside the status row by @0xallam in #970
- feat(reporting): record transitive dependency chain on SCA findings by @devin-ai-integration[bot] in #971
- fix(llm): keep tool-call ids unique so a recycled id can't erase history by @devin-ai-integration[bot] in #976
- fix(llm): cap the tool calls one assistant response may queue by @devin-ai-integration[bot] in #977
- fix(llm): abandon a model stream that stops producing events by @devin-ai-integration[bot] in #978
- fix(agents): collapse repeated waits queued inside one model turn by @devin-ai-integration[bot] in #979
- feat(reporting): structured reachability evidence ladder for dependen… by @bearsyankees in #974
- feat(reporting): require repo-relative manifest_path on dependency CVE findings by @devin-ai-integration[bot] in #982
- prompt changes by @devin-ai-integration[bot] in #984
- update readme by @devin-ai-integration[bot] in #985
- feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… by @bearsyankees in #926
- docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis by @devin-ai-integration[bot] in #986
- chore: release v1.5.0 + bump sandbox image to 1.3.0 by @devin-ai-integration[bot] in #987
- ci: fix Windows release build — TUI-sidecar archive check used forward-slash paths by @devin-ai-integration[bot] in #990
- ci: tolerate repr-escaped backslashes in the release TUI-sidecar check by @devin-ai-integration[bot] in #991
- ci: publish nested standalone archives as release assets by @devin-ai-integration[bot] in #994
New Contributors
- @chunguscodes made their first contribution in #943
- @lukiod made their first contribution in #945
- @5h4d0wr007 made their first contribution in #866
Full Changelog: v1.4.1...v1.5.0