CWapi 2.0.6

CWapi 2.0.6

从 CWapi 2.0.5 升级：先退出 CWapi，然后可以把 CWapi-v2.0.6.zip 直接解压到原 2.0.5 目录并允许覆盖。

发行包不包含 CWapi-data，所以现有账号配置、Tunnel 配置、凭据引用和 durable workspaces 会保留。

主要更新

• Coding 与 Agent 支持保存多个 ChatGPT/Tunnel 账号并一键切换；切换账号不会隔离或复制本地 workspace。
• Coding 新增 coding_attachment；Coding/Agent 均支持受限栅格图片原始字节传输，保持原 MIME，不压缩、不缩放、不转码、不 OCR。普通文件传输仍关闭。
• Agent 生命周期、progress、真流式 SSE、重连/恢复与图片内存预算进一步完善。
• Coding persistent process 支持 stdout/stderr cursor 增量读取；Git 状态刷新与 durable resume 更可靠。
• 精简重复状态、tool-schema cache 和隐藏 command proxy 初始化路径，减少不必要复杂度。

Portable

• Windows x64 portable。
• 内置 pinned Codex、MinGit 与 OpenAI tunnel runtime。
• 已完成 2.0.6 Coding 回归和便携包隐私检查。

开发源码 commit：952c07b4d3976089587c0e34ff1f8c1fbba11648

SHA-256 请见随 Release 上传的 CWapi-v2.0.6.sha256.txt。

CWapi v2.0.5

CWapi 2.0.5 portable package mirror. The uploaded CWapi-v2.0.5.zip was built from the canonical CWapi source commit 176d32e6d3caa6e069f0b73e1ab86c2604ce8915 and passed the final privacy audit with user_data_included=false. The distribution repository main branch has not yet been synchronized to the 2.0.5 source snapshot.

CWapi v2.0.4

CWapi 2.0.4

CWapi 2.0.4 is primarily a Coding security and execution architecture refactor. The release separates permanent safety boundaries, SAFE/FULL profiles, network access, remote Git rewrite capability, and command execution so normal development workflows are no longer blocked by overly broad safety rules while catastrophic operations remain permanently guarded.

Security architecture refactor

• Adds internal/security and restructures the Coding security path into Permanent Safety Guard → SAFE/FULL Profile → Optional Capabilities → Execution. The former executionpolicy package now acts only as a compatibility facade instead of owning every security decision.
• Narrows the Permanent Safety Guard to true disaster-class boundaries: disk/boot modification, automatic elevation, sensitive CWapi internal paths, untrusted Git executables, unsafe push transports, receive-pack injection, and publication of refs/cwapi/safety/*.
• Removes broad denials that interfered with legitimate development. Normal process control, Git credential plumbing, regular Git arguments, shell-script content, build tools, and package-manager workflows are no longer rejected by vague global rules.

SAFE and FULL redefined

• SAFE continues to use Codex workspaceWrite with an isolated identity and Git configuration. Go, npm, pip, Cargo, Gradle, XDG, and similar caches now live for the workspace lifetime to reduce repeated setup and downloads.
• FULL uses dangerFullAccess and begins from the current Windows user's normal development environment while stripping only CWapi / OpenAI / Codex internal secrets. Normal Git global/system configuration, GitHub CLI, SSH, hooks, signing, credential helpers, package-manager configuration, and SDK/toolchain variables remain available.
• GitHub CLI identity is centralized under CWapi-data/auth/github so authentication can be reused across commands and Coding workspaces instead of creating an empty GitHub CLI environment for every workspace.
• Runtime, cache, bridge, and other operational state are moved under CWapi-data so they no longer pollute Git working trees.

Git safety and recovery

• Git policy moves toward an explicit denylist model and now supports normal workflows such as git -C, branch rename, signed/annotated tags, amend, and Git commands invoked from scripts.
• Network Access is independent from SAFE/FULL.
• Remote Git Rewrite is a separate advanced capability and remains disabled by default. When disabled, direct force/delete remote-history updates are rejected. Enabling it still does not bypass unsafe transports, receive-pack injection, CWapi self-protection, safety-ref publication restrictions, or automatic-elevation guards.
• Before direct local Git operations that may discard content, CWapi creates bounded refs/cwapi/safety/* recovery refs. Up to 32 recovery points are retained per workspace.
• Workspace preparation now uses a normal local tracking branch and still refuses to silently overwrite dirty state, local commits, or diverged history.

Coding execution improvements

• coding_exec keeps the existing foreground run behavior and adds a persistent-process lifecycle with start / status / stop for development servers, watchers, and other long-running tools.
• Foreground commands, persistent processes, workspace close, and application shutdown now have explicit process-tree cleanup behavior to reduce orphaned processes.
• The configuration schema remains cwapi.config.v3. Valid 2.0.3 configurations migrate atomically to 2.0.4 with Remote Git Rewrite disabled by default.

The goal of 2.0.4 is not to add more restrictions. It is to put the restrictions in the right layer: permanently block genuinely catastrophic operations while allowing SAFE and FULL to behave like isolated development mode and full local development mode respectively.

Source snapshot: 7b5e51725f6f253f957237ce6847e7e2f32f08a1

Portable SHA-256: ad648cfb5a7995d674a7cdcfbca75f55c92a2a7715b2f78258ef5615d20b5d83

CWapi 2.0.3

CWapi 2.0.3 优化 Agent 模式的协议适配能力：

• 新增 OpenAI-compatible Protocol Adapter 与轻量 Canonical Format
• 新增确定性的 Context Optimizer，减少客户端协议噪声
• 稳定保留消息角色、tool call/result ID 与任务关联
• 增强能力描述、错误边界和 buffered SSE 转换
• 保持 Web GPT 为唯一推理模型，不恢复文件或图片传输

便携包来自精确提交 8941aa5d41768993c01e7798678a485f56331691。
隐私审计通过：user_data_included=false，未包含 CWapi-data、凭据、日志、缓存或用户路径。
ZIP SHA256：1d39a2bf07f9330b84985ef65fbddb997d05dc5703acadddd16d844213fdf61a

CWapi v2.0.2

CWapi 2.0.2 Windows portable.

Highlights:

• Strengthens Agent task-state handling with explicit state=responses, narrow no_request semantics, structured activity, and same-exchange tool-result follow-up waits.
• Keeps Web GPT as the sole task controller and separates MCP request IDs from local command sessions.
• Accepts native JSON tool arguments/content with canonical idempotency handling.
• Fixes Coding execution-policy and Windows SAFE/FULL behavior carried forward from 2.0.1.
• Uses the exact four-tool Coding catalog and transports no files or images through Coding or Agent MCP.

Project source commit: 05068c482a617c6beb2acd5c6d2ff15cfedc7598

Release source snapshot: 734250e7409717a2bdf56a050c8b6eb211d5a74c

ZIP SHA-256: 050288f9948b20d7fae1a3ac09308ef92e2dbee2013464591712539a9f6ba765

Portable privacy audit passed; CWapi-data and user data are not included.

CWapi v2.0.1

CWapi 2.0.1 Windows portable.

ZIP SHA-256: 53c91dc18be30a15a06e24436f6710195e91c1095bd15e54b47a79d32696220f

CWapi v2.0.0

CWapi 2.0.0 is the new main release line.

Highlights

• Two isolated local bridges: Coding MCP and Agent MCP.
• Coding uses durable repository workspaces and exact command/argv execution; Web GPT remains the sole coding agent.
• Bundled Codex is used only as a model-free command/exec toolhost. No Codex thread/turn or Codex Agent quota is used by the Coding path.
• Agent exposes a localhost OpenAI-compatible provider and bridges requests to Agent Web GPT.
• Coding and Agent use independent tokens, MCP servers, tool catalogs, and OpenAI Secure MCP Tunnel configurations.
• General file transfer is intentionally not exposed through MCP attachments; supported raster images remain the attachment path.
• Portable runtime includes OpenAI Codex 0.150.1, MinGit 2.55.0.windows.4, and OpenAI tunnel-client 0.0.10.

Release tracks

• main: CWapi 2.x clean release source snapshots.
• 1.6.x: preserved CWapi 1.6.3 legacy release line and previous release-repository history.

The 2.x and 1.6.x workflows/configurations are not interchangeable.

Source

Development repository: AAAYNMMM/CWapi

Source commit used for this portable build:

d904ae80428c90717e050a151c65fa35b6b83c63

The release-repository main branch is a clean release snapshot and intentionally excludes tests, build/package automation, validation scripts, and development-progress documents.

Privacy audit

Portable privacy gate: PASS

• user data included: false
• forbidden private-data paths: 0
• portable files: 376

ZIP SHA-256:

6b62d347be86b4ef0c92dc1bb337451a7e89d0dedf4fe8c9bc5888eeb6c8ba98

CWapi v1.6.3

CWapi v1.6.3 portable release.

Highlights:

• Persistent one-workspace-per-repository lifecycle with exact-commit reconciliation and derived-state reuse.
• Startup stale-workspace sweep and shutdown cleanup while retaining bare mirrors.
• Improved GUI visibility for workspace/runtime failures; execution status remains authoritative for process outcome.
• Packaged real-chain validation and deep ZIP privacy audit passed.

Source repository: AAAYNMMM/CWapi
Source commit: d89e019e8a7acf340e8d38694939689b403d6523
ZIP SHA-256: 6d559d0f80a0de3631c1b3bf1685abfbf4b7f11ad7eddbe61af63d0dd8b40c3d

CWapi v1.6.2

Bug-fix release for CWapi FULL-mode sandbox fallback.

Fixes

• Fixed a bug where sandbox/capability blocks reported after the initial process_start observation window could fail to enter the FULL-mode System fallback path.
• Cooperative script-reported sandbox block exit code 197 is now recognized alongside Windows access-denied exit code 5 and mapped to PERMISSION_DENIED.
• Late permission blocks can surface through process_status with a one-time System Token.
• Ordinary runtime/program failures remain PROGRAM_FAILURE and do not trigger elevated fallback.
• Permanent safety policy remains non-bypassable in FULL mode.
• Improved portable build/privacy validation compatibility for the v1.6.2 package.

Validated

• SAFE -> PERMISSION_DENIED -> one-time System Token -> exact System retry.
• Reusing a consumed System Token is rejected.
• System backend failures do not recursively issue another token.
• Portable privacy and source-clean gates passed.

Source commit: 5fe44fec92e8412b3794c8d13a09e00a63b1fdf3
SHA256: 13f0073bbdb15a7348c985cb246ea896c4f361b4c7d66c00f25f48f5f9cd111b

CWapi v1.6.1

CWapi v1.6.1 upgrades the Web GPT -> Slack -> local Windows workflow to MCP v2. Highlights: GitHub repository URL + exact 40-char commit replaces project registry; Go Core owns process_start/status/stop; SAFE remains the default and FULL uses Codex-first System Token fallback; stock MCP contexts are request-scoped ephemeral; MCP image/blob/large results can be delivered as Slack Files; Playwright screenshots intended for ChatGPT should omit filename; runtime discovery follows CWapi-managed -> local installed -> FULL install/manual install; continuous external waiting is capped at 3 minutes. Portable manifest source commit: c901841faeede4b851946bb35b6c1724fa1ffb74.