Skip to content

v1.18.47

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 10:16
· 0 commits to 6f4f1c404daabf425023cbbb8de3e5c662f57c5d since this release
v1.18.47
7b5d47d

Last release: v1.18.46
Target ref: 6f4f1c4

Core

Improvements

  • 18b53aa XCOD-243: lunos cloud git-token set|rm <host> (@pminev1)
  • 5f1bd64 XCOD-194: Mistral counts as EU only at api.eu.mistral.ai (@pminev1)
  • 5c10426 XCOD-242: limit a hosted organisation's policy to an allow-list (@pminev1)
  • bd9a4dd XCOD-234: forward peer actions to the live server; node:http; e2e through lunos (@pminev1)
  • 5371a84 XCOD-234: stop and answer sessions another Lunos process runs (@pminev1)
  • de38152 XCOD-234: live state of sessions run by other Lunos processes; stale when they die (@pminev1)
  • ed9e6be XCOD-234: stop Claude Code / Codex sessions from the Sessions window (@pminev1)
  • c662460 XCOD-242: a hosted organisation's policy can't set or lock cloud.* (@pminev1)
  • a77bf05 XCOD-242: hosted Team without MDM, after a Lunos sign-in (@pminev1)
  • 4687728 XCOD-185: sync queue tests restore Global.Path.data (later test files read auth.json from it) (@pminev1)
  • 23586ca XCOD-194: an EU-only policy also allows Iceland, Liechtenstein and Norway (EU/EEA) (@pminev1)
  • 4a47a79 XCOD-185: CloudSync: ssh:// remotes are kept (@pminev1)
  • 1a945f9 XCOD-185: CloudSync: signed-out checked before the gates; local-path remotes aren't uploaded (@pminev1)
  • 7beff3c XCOD-185: lunos sync link: --personal skips the fetch and excludes a project id; offline refuses a project (@pminev1)
  • f444fe4 XCOD-185: CloudSync: queue the pending turn on shutdown, locked reset, bounded retries, forced refresh on 401, gates before auth (@pminev1)
  • fa6c595 XCOD-185: lunos sync status: live only when the server answered; offline and cached paths tested (@pminev1)
  • 229d37c XCOD-185: lunos sync on, off, status and link (@pminev1)
  • 2b63e86 XCOD-185: CloudSync: stop queueing when enqueue reports the session stopped; rebuild once when another process took the seq (@pminev1)
  • 6852d19 XCOD-185: CloudSync: a chunk rejected for its own reasons doesn't hold up other sessions; truncation keeps ids; tests restore the audit settings (@pminev1)
  • 8baa91a XCOD-185: CloudSync: a 413'd chunk is replaced, not overwritten, now that the queue refuses to overwrite a seq (@pminev1)
  • b70922d XCOD-185: CloudSync: upload each completed turn to the Lunos space, behind the policy, device, directory and residency gates (@pminev1)
  • e4c9f37 XCOD-185: sync client: failures are results not throws, 0600 device.json with a random temp name, 5 s registration at login, session sync in the offline call list (@pminev1)
  • 21c758a XCOD-185: sync queue: per-session lock, no silent seq overwrite, unique temp files (@pminev1)
  • 5ed4b29 XCOD-185: sync queue on disk with backoff (@pminev1)
  • 31f0330 XCOD-185: sync path rule: multi-row grep matches, @-mention synthetic parts, .env* case-insensitive, normalised excludes, quoted diff paths (@pminev1)
  • 3c7a142 XCOD-185: sync client test: assert lastSeq is undefined (@pminev1)
  • a27e094 XCOD-185: sync client: do not parse the out_of_order message; callers use status() (@pminev1)
  • 0a72582 XCOD-185: sync client: endpoint from managed or global config only, device registration at login, upload (@pminev1)
  • 661f018 XCOD-185: sync path rule and credential scanner (@pminev1)
  • 7d7c994 XCOD-185: sync config key, default issuer auth.lunos.tech, sync:lunos-cloud residency target, sync audit events (@pminev1)
  • 1561db8 XCOD-191: settings describe "share": "cloud" as it now works (the TUI's /share too); the offline table lists only what offline mode leaves on (@pminev1)
  • 03627f6 XCOD-241: your Lunos console sees which versions run where and which policy they enforce (@pminev1)
  • fcabc18 XCOD-191: your shares list shows only yours with each link's expiry and the organisation's link policy; docs for sharing from the TUI and setting the team features up with MDM (@pminev1)
  • cf08f75 XCOD-191: share to your organisation's console from the TUI's /share; list and revoke your shares; every upload checks the console's declared region (@pminev1)
  • 1e920ae XCOD-193: update machines without internet access from a mirror you control; an LTS line proposed (@pminev1)
  • 8f54b0f XCOD-191: type the fake console's fetch handler so typecheck passes (@pminev1)
  • b2d4acf XCOD-191: tests follow the new share value and memory share subcommand; a missing session is refused before anything is sent (@pminev1)
  • ecbca33 XCOD-191: docs for working as a team on your organisation's Lunos console; subprocess tests for lunos share and lunos memory share (@pminev1)
  • d65f6bb XCOD-191: your organisation's private marketplace, team memory and sharing, on its Lunos console (@pminev1)
  • c3b136d XCOD-238: your organisation's policy is fetched from its Lunos console and enforced (@pminev1)
  • 83647f1 XCOD-237: cloud runs show Lunos Cloud's own billing reason, and say why when billing stops them mid-run (@pminev1)
  • b05e951 XCOD-236: cloud runs take --cloud-secret anywhere, fail when they fail, stop cleanly on Ctrl+C (@pminev1)
  • da9f0c8 XCOD-229: edit the Recommended models in /settings (@pminev1)
  • 78384f6 XCOD-230: choose the default agent from a list (@pminev1)
  • 6149571 XCOD-232: pick a subagent's or agent's reasoning variant from a list (@pminev1)
  • a90867f XCOD-231: a Subagent screen in /settings, and one for every setting made of simple fields (@pminev1)
  • 664a80e XCOD-205: the Sessions view in the TUI (@pminev1)
  • 211838c XCOD-205: stopping a waiting session clears its approval marker; unattended runs are labelled scheduled (@pminev1)
  • 233860b XCOD-218: the session id beside the label, and approvals judged by the default agent whatever the mode (@pminev1)
  • 2678cec XCOD-205: see and organise all your sessions in one Sessions window (@pminev1)
  • 6a0dc7e XCOD-218: Claude Code and Codex sessions in their own TUI session view, with approvals, cost, resume and stop (@pminev1)
  • 60919b8 XCOD-219: a locked agent model stays usable in that agent's mode, and commands follow the lock (@pminev1)
  • 25e062b XCOD-205: Sessions page (web + desktop window) with groups, filters and live state (@pminev1)
  • 6117609 XCOD-219: a locked model is the one the session actually uses (@pminev1)
  • 8c9f4f2 XCOD-205: sessions overview across projects and local session groups (server + API) (@pminev1)
  • fe23da6 XCOD-207: macOS binaries ship with a valid ad-hoc signature (@pminev1)
  • 9c97b80 feat(tui): replace V1 auto-update with V2-style /update dialog (anomalyco#54409)
  • c28b6a0 feat(opencode): add upgrade --major for moving to OpenCode 2
  • 7b39a33 refactor(server): align pty connect preflight order
  • 9962a47 sync release versions for v1.18.46
  • 63be8f9 sync release versions for v1.18.35

Bugfixes

  • 6123148 XCOD-185: sync registers only on lunos login or lunos sync on, only for Lunos's own issuer or an explicit endpoint; final review fixes (@pminev1)
  • 5e2df97 fix(provider): accept OpenAI ultrafast service tier (anomalyco#53875)
  • 83802d8 fix(opencode): bump @ai-sdk/xai to 3.0.139 so tool-result images reach xAI (anomalyco#53549) (@Jaaneek)

Desktop

Improvements

  • 3c0d9ef XCOD-235: open sessions picked in the desktop Sessions window in the main window (@pminev1)
  • a403f07 XCOD-235: sub-cent session costs and translated /sessions vs /resume docs (@pminev1)
  • 4b5b254 XCOD-205: Sessions window strings in every language (@pminev1)

Bugfixes

  • 233e535 XCOD-235: axe over the Sessions window; fix its light-theme warning contrast (@pminev1)

Community Contributors Input

Thank you to 5 community contributors:

  • @jm0ney337:
    • docs(ecosystem): add opencode-supabase to ecosystem plugins (anomalyco#49848)
  • @Jaaneek:
    • fix(opencode): bump @ai-sdk/xai to 3.0.139 so tool-result images reach xAI (anomalyco#53549)
  • @dc85:
  • @pminev1:
    • XCOD-227: v1.18.46 has its changelog, and a release can't ship without one
    • XCOD-207: macOS binaries ship with a valid ad-hoc signature
    • XCOD-205: sessions overview across projects and local session groups (server + API)
    • XCOD-219: a locked model is the one the session actually uses
    • XCOD-228: launch pack refreshed for v1.18.46, with gates and a comment-watch FAQ
    • XCOD-227: drop the duplicated 1.18.46 entries; docs no longer call shipped features unreleased
    • XCOD-205: Sessions page (web + desktop window) with groups, filters and live state
    • XCOD-219: a locked agent model stays usable in that agent's mode, and commands follow the lock
    • XCOD-218: Claude Code and Codex sessions in their own TUI session view, with approvals, cost, resume and stop
    • XCOD-205: see and organise all your sessions in one Sessions window
    • XCOD-218: the session id beside the label, and approvals judged by the default agent whatever the mode
    • XCOD-205: stopping a waiting session clears its approval marker; unattended runs are labelled scheduled
    • XCOD-205: Sessions window strings in every language
    • Merge remote-tracking branch 'origin/dev' into xcod-205-sessions-window
    • XCOD-219: restore the changelog entry lost in the dev merge
    • Merge remote-tracking branch 'origin/dev' into xcod-219-locked-model-picker
    • Merge remote-tracking branch 'origin/dev' into xcod-207-macos-adhoc-resign
    • XCOD-205: the Sessions view in the TUI
    • Merge remote-tracking branch 'origin/dev' into xcod-205b-tui-sessions
    • XCOD-233: /settings keys work the same on every screen
    • XCOD-231: a Subagent screen in /settings, and one for every setting made of simple fields
    • XCOD-232: pick a subagent's or agent's reasoning variant from a list
    • XCOD-230: choose the default agent from a list
    • XCOD-229: edit the Recommended models in /settings
    • XCOD-236: cloud runs take --cloud-secret anywhere, fail when they fail, stop cleanly on Ctrl+C
    • XCOD-237: cloud runs show Lunos Cloud's own billing reason, and say why when billing stops them mid-run
    • XCOD-238: your organisation's policy is fetched from its Lunos console and enforced
    • Merge upstream opencode v1.19.0 into Lunos
    • XCOD-239: upstream v2 spike — feature map, estimate and recommendation (draft)
    • XCOD-239: upstream v2 spike — feature map, estimate and recommendation
    • ci(upstream-sync): track upstream's v1 release tags instead of dev
    • XCOD-191: your organisation's private marketplace, team memory and sharing, on its Lunos console
    • XCOD-191: docs for working as a team on your organisation's Lunos console; subprocess tests for lunos share and lunos memory share
    • XCOD-191: tests follow the new share value and memory share subcommand; a missing session is refused before anything is sent
    • XCOD-191: type the fake console's fetch handler so typecheck passes
    • XCOD-193: update machines without internet access from a mirror you control; an LTS line proposed
    • XCOD-193: the release mirror script is marked 'from the next release' in the trust pack
    • XCOD-191: share to your organisation's console from the TUI's /share; list and revoke your shares; every upload checks the console's declared region
    • XCOD-191: your shares list shows only yours with each link's expiry and the organisation's link policy; docs for sharing from the TUI and setting the team features up with MDM
    • XCOD-241: your Lunos console sees which versions run where and which policy they enforce
    • XCOD-191: settings describe "share": "cloud" as it now works (the TUI's /share too); the offline table lists only what offline mode leaves on
    • Merge remote-tracking branch 'origin/dev' into xcod-241-client-start
    • XCOD-226: trust pages no longer claim a counsel review that is still pending
    • XCOD-226: docs site trust page matches: counsel review pending
    • XCOD-185: lunos_idp resolution rule and its Docker build
    • XCOD-185: the lunos_idp protocol mapper (ID, access and userinfo tokens)
    • XCOD-185: lunos_idp never imitates the org form from an alias; introspection carries it; pin the Maven image
    • XCOD-185: realm Lunos: lunos client scope (lunos_idp, lunos-api audience), app and console clients
    • XCOD-185: lunos_idp and the realm's clients proven against Keycloak 26.3 in Docker
    • XCOD-185: lunos_idp follows the session's latest authentication (event listener), so a password re-authentication drops the org value
    • XCOD-185: lunos_idp on the device and consent path and in reused offline sessions; tests always rebuild the jar
    • XCOD-185: configure-realm.ts brings a running realm to the bundle's shape, idempotently
    • XCOD-185: configure-realm.ts keeps an owned client's extra URIs and secret, refuses a wrong mapper type before any write
    • XCOD-185: README: the lunos_idp claim, install, upgrading the running realm
    • XCOD-185: README: a missing jar imports silently and drops the claim; how to detect and fix it
    • XCOD-185: configure-realm.ts's create path covered as live will take it; README: a step-up in the browser also changes CLI tokens
    • XCOD-185: README: ID tokens carry lunos_idp, a new *_SECRET rotates the live secret, lowercase social aliases; harness cleanup note
    • XCOD-185: README: a lunos-console-admin created by configure-realm.ts also has Keycloak's service_account scope
    • XCOD-185: sync config key, default issuer auth.lunos.tech, sync:lunos-cloud residency target, sync audit events
    • XCOD-185: session-embed, a self-contained build of the session timeline for app.lunos.tech
    • XCOD-185: session-embed README sizes wording
    • XCOD-185: sync path rule and credential scanner
    • XCOD-185: session-embed smoke under the app's CSP, dispose and re-mount, title defaults
    • XCOD-185: sync client: endpoint from managed or global config only, device registration at login, upload
    • XCOD-185: sync client: do not parse the out_of_order message; callers use status()
    • XCOD-185: sync client test: assert lastSeq is undefined
    • XCOD-185: sync path rule: multi-row grep matches, @-mention synthetic parts, .env* case-insensitive, normalised excludes, quoted diff paths
    • XCOD-185: sync queue on disk with backoff
    • XCOD-185: sync queue: per-session lock, no silent seq overwrite, unique temp files
    • XCOD-185: sync client: failures are results not throws, 0600 device.json with a random temp name, 5 s registration at login, session sync in the offline call list
    • XCOD-185: CloudSync: upload each completed turn to the Lunos space, behind the policy, device, directory and residency gates
    • XCOD-185: CloudSync: a 413'd chunk is replaced, not overwritten, now that the queue refuses to overwrite a seq
    • XCOD-185: CloudSync: a chunk rejected for its own reasons doesn't hold up other sessions; truncation keeps ids; tests restore the audit settings
    • XCOD-185: CloudSync: stop queueing when enqueue reports the session stopped; rebuild once when another process took the seq
    • XCOD-185: lunos sync on, off, status and link
    • XCOD-185: docs: session sync, default issuer, audit events, residency target
    • XCOD-185: lunos sync status: live only when the server answered; offline and cached paths tested
    • XCOD-185: provider jurisdictions: name session sync
    • XCOD-185: provider jurisdictions: fix wording
    • XCOD-185: CloudSync: queue the pending turn on shutdown, locked reset, bounded retries, forced refresh on 401, gates before auth
    • XCOD-185: lunos sync link: --personal skips the fetch and excludes a project id; offline refuses a project
    • XCOD-185: docs: session sync after the review fixes (shutdown queue, endpoint change, rejected chunks)
    • XCOD-185: CloudSync: signed-out checked before the gates; local-path remotes aren't uploaded
    • XCOD-185: CloudSync: ssh:// remotes are kept
    • XCOD-185: docs: trust and deployment docs name session sync; cloud-sync accuracy fixes
    • XCOD-185: sync registers only on lunos login or lunos sync on, only for Lunos's own issuer or an explicit endpoint; final review fixes
    • XCOD-185: docs: a lunos run turn uploads when Lunos next starts
    • XCOD-194: an EU-only policy also allows Iceland, Liechtenstein and Norway (EU/EEA)
    • XCOD-185: sync queue tests restore Global.Path.data (later test files read auth.json from it)
    • XCOD-235: sub-cent session costs and translated /sessions vs /resume docs
    • XCOD-242: hosted Team without MDM, after a Lunos sign-in
    • XCOD-242: a hosted organisation's policy can't set or lock cloud.*
    • XCOD-234: stop Claude Code / Codex sessions from the Sessions window
    • XCOD-234: live state of sessions run by other Lunos processes; stale when they die
    • XCOD-234: stop and answer sessions another Lunos process runs
    • XCOD-234: forward peer actions to the live server; node:http; e2e through lunos
    • XCOD-235: open sessions picked in the desktop Sessions window in the main window
    • XCOD-235: axe over the Sessions window; fix its light-theme warning contrast
    • Merge remote-tracking branch 'origin/dev' into xcod-235-open-in-main
    • XCOD-234: sessions-peers-e2e no longer hangs when a server fails to start
    • XCOD-242: limit a hosted organisation's policy to an allow-list
    • XCOD-194: Mistral counts as EU only at api.eu.mistral.ai
    • XCOD-243: lunos cloud git-token set|rm <host>
    • Release 1.18.47: changelog section
  • @pminevp:
    • Merge pull request #183 from AxsionDev/xcod-227-changelog-gate
    • Merge pull request #185 from AxsionDev/xcod-228-launch-pack-refresh
    • Merge branch 'dev' into xcod-219-locked-model-picker
    • Merge branch 'dev' into xcod-218-external-session-tab
    • Merge pull request #187 from AxsionDev/xcod-218-external-session-tab
    • Merge pull request #184 from AxsionDev/xcod-207-macos-adhoc-resign
    • Merge pull request #186 from AxsionDev/xcod-219-locked-model-picker
    • Merge branch 'dev' into xcod-205-sessions-window
    • Merge pull request #188 from AxsionDev/xcod-205-sessions-window
    • Merge pull request #189 from AxsionDev/xcod-205b-tui-sessions
    • Merge pull request #191 from AxsionDev/xcod-229-settings-controls
    • Merge pull request #192 from AxsionDev/xcod-236-cloud-client-fixes
    • Merge pull request #193 from AxsionDev/marketplace-check/2026-10-12-38259977956
    • Merge pull request #194 from AxsionDev/xcod-237-cloud-billing-messages
    • Merge pull request #195 from AxsionDev/xcod-238-console-policy
    • Merge pull request #196 from AxsionDev/xcod-236-cloud-client-fixes
    • Merge pull request #197 from AxsionDev/xcod-239-v2-spike
    • Merge pull request #198 from AxsionDev/upstream-sync/v1.19.0
    • Merge pull request #199 from AxsionDev/upstream-sync-v1-tags
    • Merge pull request #200 from AxsionDev/xcod-191-team-client
    • Merge pull request #201 from AxsionDev/xcod-193-enterprise-client
    • Merge pull request #202 from AxsionDev/xcod-191-share-rework
    • Merge pull request #203 from AxsionDev/xcod-241-client-start
    • Merge pull request #204 from AxsionDev/xcod-226-counsel-pending
    • Merge pull request #205 from AxsionDev/xcod-185-lunos-idp
    • Merge pull request #206 from AxsionDev/xcod-185-session-embed
    • Merge pull request #207 from AxsionDev/xcod-185-cloud-sync
    • Merge pull request #208 from AxsionDev/xcod-194-eu-eea
    • Merge pull request #209 from AxsionDev/xcod-185-sync-test-hygiene
    • Merge pull request #210 from AxsionDev/xcod-235-sessions-followups
    • Merge pull request #211 from AxsionDev/xcod-242-hosted-team
    • Merge branch 'dev' into xcod-234-cross-process-sessions
    • Merge pull request #212 from AxsionDev/xcod-234-cross-process-sessions
    • Merge pull request #213 from AxsionDev/xcod-235-open-in-main
    • Merge pull request #214 from AxsionDev/sessions-peers-e2e-fix
    • Merge pull request #215 from AxsionDev/xcod-242-hosted-allowlist
    • Merge pull request #217 from AxsionDev/xcod-243-git-token-cli
    • Merge pull request #216 from AxsionDev/xcod-194-mistral-eu-endpoint
    • Merge pull request #218 from AxsionDev/release-1.18.47-changelog

Contributors

dc85, pminevp, and 3 other contributors
Assets 58
Loading