Faryo 1.12.0

Faryo 1.12.0

Faryo 1.12.0 isolates every structured Web session behind its own supervised
official Codex App Server worker.

• The fixed faryo-appserver.service is now a read-only control plane for
  account, model, history and lifecycle requests. It never starts or resumes a
  Faryo Web thread.
• Each structured session receives an opaque, validated
  faryo-appserver-worker@.service instance and private Unix socket. Turn,
  command, Goal, approval and user-input RPCs route only to that worker.
• Worker clients have independent pending requests, generations, health probes,
  bounded reconnect backoff and circuit breakers. Late events from an old
  generation are ignored.
• A control-plane reconnect no longer reconnects healthy workers. Owner reload
  immediately returns a Loading projection while workers rehydrate, so the
  browser does not fall through to session unknown.
• A timed-out Stop first uses the official interrupt RPC, then recycles only the
  affected worker. Closing a session stops that worker and releases the Codex
  writer immediately.
• Diagnostics expose only worker/RPC category counts and terminal states. They
  contain no message body, title, path, thread identifier, socket, PID or token.
• Upgrade and rollback between the v1.11 shared topology and v1.12 isolated
  topology are idle-only, atomic and health-gated. Failure restores registry
  schema, exact unit files and previous services without touching tmux.

Fault injection proves that a permanently blocked or crashed worker cannot
delay a healthy peer. Real Codex acceptance additionally verifies one thread per
worker, a read-only control process, fast competing-writer failure, stable peer
PID/generation during recovery, an ordinary independent Codex CLI session, and
active-turn convergence across Owner restart.

The installed lifecycle was exercised in both directions: v1.11.11 to v1.12.0,
v1.12.0 back to v1.11.11, and forward to v1.12.0 again. Registry schemas,
services and browser reloads converged at each step while existing tmux pane
identity and geometry remained unchanged.

The release remains source-only and adds no Python, browser or CDN dependency.

Faryo 1.11.11

Faryo 1.11.11

Faryo 1.11.11 replaces generic browser failures with an actionable,
privacy-safe error contract.

• Owner and Gateway now use one versioned error schema with stable machine
  codes, short titles, retry guidance and a concrete recovery action while
  preserving the existing ok: false and error fields.
• New, Resume, Archive, Restore, attachment injection and proxied control
  actions preserve the Owner HTTP status and reviewed error metadata instead
  of collapsing every failure into a generic Gateway error.
• Archiving a conversation still open in another Codex client now explains
  the conflict and asks the user to close that client before retrying.
• Browser network failures, sign-in pages, non-JSON responses, service
  restarts and timeouts are classified without exposing HTML, exception
  strings, local paths, identifiers or credentials.
• Both browser surfaces show the specific title and recovery advice. Mutable
  assets retain content-based revisions, so an ordinary reload or a new tab is
  sufficient after deployment.

The release remains source-only and adds no runtime dependency. Unit and
browser checks cover authentication, CSRF, archive conflicts, status
forwarding, invalid responses and privacy sanitization.

Faryo 1.11.10

Faryo 1.11.10

Faryo 1.11.10 hardens Codex writer ownership after App Server use.

• Resume now probes Codex's process-held per-thread writer lock before starting
  an independent App Server or TUI. A thread already open in another Codex
  client returns an explicit conflict instead of creating a failing tmux pane.
• The probe is advisory and non-mutating: Faryo never deletes or rewrites a
  Codex lock file, and the actual Codex resume remains authoritative for races.
• The production Owner routes bounded thread/read, thread/goal/get, and
  rate-limit reads through its existing supervised Unix-socket App Server. It
  no longer keeps a second stdio App Server and model-refresh worker alive.
• Closing the last Faryo App Server session restarts only the dedicated
  faryo-appserver.service after the turn has settled and the registry record
  is removed. This releases Codex's otherwise delayed writer immediately while
  preserving conversation history.
• If another Web session remains, the shared App Server stays alive; no active
  turn is recycled. Existing TUI sessions, tmux geometry, authentication and
  reliable-send semantics are unchanged.

The release remains source-only and adds no runtime dependency. The behavior is
covered by writer-lock, runtime, Owner-route and compatibility-channel tests.

Faryo 1.11.9

Faryo 1.11.9

Faryo 1.11.9 fixes completed App Server activity cards accumulating after the
latest assistant answer.

• Paged history remains authoritative for completed command, edit, search, MCP
  and tool activity that it has already reconciled with the durable rollout.
• A differently identified App Server wrapper for the same completed activity
  class is no longer appended a second time at the transcript tail.
• Running, waiting, failed and newly streamed activity remains visible. New
  live blocks are inserted beside their owning message segment instead of at a
  global tail position.
• Regression coverage includes wrapper identities that differ between durable
  history and the live App Server snapshot, wrappers listed after a settled
  answer, and new activity arriving during a stream.

The patch adds no runtime dependency, does not resize tmux, does not change
authentication or sending semantics, and remains source-only. Mutable browser
assets use the new release revision, so an ordinary reload or newly opened tab
receives the fix without a hard refresh.

Faryo 1.11.8

Faryo 1.11.8

Faryo 1.11.8 repairs conversation identity at both the message and session
layers, and makes the mobile conversation chrome adapt to real content rather
than fixed device offsets.

• Codex TUI rollout history now carries authoritative structured message
  blocks. Quoted banners, trust prompts and literal › lines remain inside the
  original user message instead of becoming false bubbles or activity rows.
• Question navigation, Markdown/TeX rendering and exact copy all consume those
  same server-owned message identities; terminal text parsing remains only a
  bounded fallback for genuinely unstructured captures.
• App Server and Codex TUI sessions now allocate faryoN names from one
  namespace under one lock. Every read, write and event route uses one resolver,
  and duplicate ownership returns a bounded 409 instead of silently opening
  or controlling the wrong thread.
• Startup migration moves a persisted App Server alias away from a live tmux
  alias without deleting conversation history or stopping either Codex writer.
• The verified Codex 0.149.1 command snapshot restores busy-task local controls
  such as /goal clear; unknown future versions still fail closed instead of
  inheriting stronger capabilities.
• The bottom status footprint is measured as part of layout, so release/status
  controls no longer cover the newest message.
• Narrow-screen status metadata can be swiped horizontally without widening the
  page. On multi-line phone input, attachment and send controls stack vertically
  to preserve textarea width, then return to the compact row at one line.

The release adds anonymous protocol, route, browser geometry, long-history and
namespace-race regressions. It adds no runtime dependency, does not resize tmux,
does not weaken authentication, and remains source-only.

Faryo 1.11.7

Faryo 1.11.7

Faryo 1.11.7 repairs App Server sessions that looked permanently busy after a
runtime interruption and makes Close semantics match Codex's writer lifecycle.

• Input sent during an active regular turn now uses the official turn/steer
  request with expectedTurnId and the existing idempotent browser message id.
• Authoritative hydration recomputes the active turn instead of preserving a
  stale inProgress id after reconnect or interrupt.
• Busy App Server cards offer an explicit Interrupt and close action. Owner
  waits for the interrupted turn to settle before unsubscribing and retains the
  Codex history.
• Codex keeps the writer for an unsubscribed loaded thread for up to 30 minutes.
  A TUI resume during that interval now uses Codex's official local --remote
  Unix endpoint, so it reuses the resident writer instead of failing with an
  active-writer conflict.
• Long action errors wrap inside the confirmation sheet and remain fully
  readable on phone and desktop instead of ending in a one-line ellipsis.

The release adds protocol, actor, runtime, Owner route and real-browser
regressions. It does not weaken authentication, expose the App Server socket,
delete conversation history, resize tmux, or add a second message store.

Faryo 1.10.3

Faryo 1.10.3

Faryo 1.10.3 restores durable Codex App Server tool activity after Owner
reconnects without returning to a noisy terminal-style transcript.

Changes

• Completed commands omitted by a later thread/read snapshot are recovered
  from Codex's durable rollout and associated with the original App Server turn.
• Commands, searches and file changes merge by stable call identity, with a
  bounded-summary fallback for compatible live events. Reloads do not duplicate
  activity that was already observed while streaming.
• Collapsed cards report their contents, for example command, edit and search
  counts, so a quiet transcript is not mistaken for missing history.
• Private reasoning, command output and patch bodies remain excluded. Long
  command source stays behind the existing second-level disclosure control.
• The rollout reader is incremental, ignores partial JSONL records and resets
  safely after file replacement or truncation.

Validation

• Anonymous protocol fixtures cover reconnect recovery, partial-record catch-up,
  stable turn association, live/durable deduplication and hidden-reasoning
  exclusion.
• Browser-unit coverage verifies descriptive collapsed titles and structured
  history/live merging.
• The source-only release gate covers Python 3.10 and 3.13, browser assets,
  formatting, lint, reproducible bundles and the existing security boundary.

Faryo remains source-only. Release assets contain the reviewed installer,
source archive and SHA-256 manifests.

Faryo 1.10.2

Faryo 1.10.2

Faryo 1.10.2 makes structured Codex App Server conversations substantially
quieter without hiding useful tool activity.

Changes

• Empty private-reasoning items no longer leave repeated Working blocks in
  completed conversation history. The active turn still exposes one explicit
  working or receiving status.
• Commands, searches and file changes are grouped into one Activity · N steps
  card per turn. Cards are closed by default, retain stable identities during
  streaming updates and preserve their open state while their contents change.
• Expanded activity uses a bounded internal scroll area. Long commands remain
  closed as concise command rows until the reader explicitly opens them.
• Activity traces stay outside normal answer-copy output. All changed mutable
  browser assets use the release revision, so an ordinary reload or new tab is
  sufficient after deployment.

Validation

• Focused protocol tests prove hidden reasoning is absent from public message
  blocks while command and file-change summaries remain available.
• JavaScript tests cover placeholder suppression, per-turn grouping, long-command
  folding and unscoped history notices.
• A real mobile-sized Chromium replay verifies default-closed cards, no repeated
  Working rows, bounded expanded detail and no horizontal overflow.
• The canonical source gate passes the maintained Owner, Gateway and unified-CLI
  suites plus formatting, lint, TypeScript and reproducible bundle checks.

Faryo remains source-only. Release assets contain the reviewed installer,
source archive and SHA-256 manifests.

Faryo 1.10.1

Faryo 1.10.1

Faryo 1.10.1 is a focused context-window picker improvement.

Change

• New and Resume now offer Default, 372K, and 1M context-window presets.
  Default still sends no override and follows the selected workstation's
  Codex configuration.
• The bounded Custom field remains available, so values such as 272K can still
  be requested explicitly when needed.
• Current README and interaction documentation now describe the same presets as
  the browser UI. Historical release notes remain unchanged.

Validation

• Gateway's 120 Python tests cover the exact preset markup and reject a
  reintroduced 272K shortcut.
• The canonical source gate passes 229 Owner, 120 Gateway, and 65 unified-CLI
  tests, plus the maintained formatting, lint, TypeScript, bundle, and browser
  contract checks.
• The versioned local deployment preserves existing Codex App Server work and
  every pre-existing tmux session while an ordinary reload receives the updated
  launch picker.

Faryo remains source-only. Release assets contain the reviewed installer,
source archive, and SHA-256 manifests.

Faryo 1.10.0

Faryo 1.10.0

Faryo 1.10.0 makes the two supported Codex backends explicit, tightens browser
state consistency, and reduces maintenance and supply-chain risk without
changing the single-writer or authentication boundary.

Highlights

• New uses one options sheet for workstation, Codex App Server or
  Codex TUI (tmux), directory and context; there is no preliminary workstation
  sheet even when several endpoints are configured. Resume reuses the same
  backend/directory/context controls. App Server remains the default.
• App Server and TUI now share one faryoN namespace. Persisted collisions are
  reassigned without closing Codex, and each browser launch verifies the exact
  launch receipt before navigating, preventing a new launch from opening an old
  same-named conversation.
• Session Details shows the authoritative backend name. Cross-backend resume is
  permitted only before ownership is acquired; a competing active writer fails
  atomically with HTTP 409.
• The runtime slash-command inventory is reconciled with a version-bound
  fallback. Busy-time capabilities fail closed across Codex version drift, while
  verified commands such as /goal clear no longer wait behind a generic ready
  gate.
• /model, /usage, resume-directory prompts and other blocking TUI menus use
  generation-bound structured interactions rather than blind key sequences.
• Status refresh now has a focused controller for cancellation, timeout,
  concurrent-request coalescing and session-generation fencing. A late response
  cannot overwrite Goal, Git, cwd, usage, model or backend for another session.
• Browser JSON and SSE payloads use envelopeVersion: 1. Legacy reads without
  the field remain accepted for rolling updates; explicit future versions fail
  closed.
• App Server history and live items now retain explicit user/assistant/process
  roles and stable browser-safe identities. Incremental answers stay visible
  while growing, expose a working/receiving indicator, and bind the question
  rail to real user blocks instead of terminal-text guesses.
• Active App Server history keeps that identity domain even after rollout JSONL
  appears and groups the actor's structured items by turn, preserving a user
  item even when Codex's completed-turn payload contains only assistant items.
  JSONL takes over only after the Web session closes. Unknown or closed SSE
  targets now fail or finish cleanly instead of raising after response headers
  have already been sent.
• Owner session catalog and launch/lifecycle policy moved out of the main server
  composition root, reducing it by about 21.5% with no duplicate implementation.
• CI now pins third-party Actions by full commit SHA, tests Ubuntu 22.04/Python
  3.10 and Ubuntu 24.04/Python 3.13, runs Python/JavaScript CodeQL, and receives
  low-noise weekly Dependabot proposals without auto-merge.

Validation

• Canonical source gate: 229 Owner, 120 Gateway and 65 unified-CLI Python tests,
  plus Ruff, ESLint, Prettier, TypeScript, Node contract tests and reproducible
  local Preact bundles.
• Backend ownership, New/Resume payloads, command-version drift, busy slash
  policy, browser-envelope compatibility and stale-session status responses have
  focused regression coverage.
• The v1.10.0 local install passed 24/24 doctor checks with all three user
  services active. Authenticated ordinary reloads showed authoritative backend
  labels for real App Server and TUI sessions and loaded the v1.10.0 asset
  revision without a hard refresh.
• An isolated real Codex App Server passed streamed delta/final convergence,
  multiple visible answer-length stages, distinct user/assistant blocks,
  Markdown/KaTeX, an actual question-marker jump, approval, user input and
  active-turn Owner restart. Anonymous browser fixtures passed 40-turn lazy
  history, question navigation, 20-message reliable delivery, clipboard image,
  network recovery and session isolation.
• Authenticated 430x820 browser checks started and cleaned both a fresh App
  Server session and a fresh TUI session from the single combined options sheet.
  The deployed collision migration left zero overlapping App Server/tmux names
  and preserved every pre-existing pane name, PID, width and height.
• Pull-request CI passed Ubuntu 22.04/Python 3.10, Ubuntu 24.04/Python 3.13,
  Python CodeQL and JavaScript/TypeScript CodeQL.

Faryo remains source-only. The Release publishes the reviewed bootstrap
installer, source archive and SHA-256 manifests; it does not publish stale Linux
or macOS binary packages.