Faryo 1.10.0

Faryo 1.10.0

Faryo 1.10.0 makes the two supported Codex backends explicit, tightens browser
state consistency, and reduces maintenance and supply-chain risk without
changing the single-writer or authentication boundary.

Highlights

• New uses one options sheet for workstation, Codex App Server or
  Codex TUI (tmux), directory and context; there is no preliminary workstation
  sheet even when several endpoints are configured. Resume reuses the same
  backend/directory/context controls. App Server remains the default.
• App Server and TUI now share one faryoN namespace. Persisted collisions are
  reassigned without closing Codex, and each browser launch verifies the exact
  launch receipt before navigating, preventing a new launch from opening an old
  same-named conversation.
• Session Details shows the authoritative backend name. Cross-backend resume is
  permitted only before ownership is acquired; a competing active writer fails
  atomically with HTTP 409.
• The runtime slash-command inventory is reconciled with a version-bound
  fallback. Busy-time capabilities fail closed across Codex version drift, while
  verified commands such as /goal clear no longer wait behind a generic ready
  gate.
• /model, /usage, resume-directory prompts and other blocking TUI menus use
  generation-bound structured interactions rather than blind key sequences.
• Status refresh now has a focused controller for cancellation, timeout,
  concurrent-request coalescing and session-generation fencing. A late response
  cannot overwrite Goal, Git, cwd, usage, model or backend for another session.
• Browser JSON and SSE payloads use envelopeVersion: 1. Legacy reads without
  the field remain accepted for rolling updates; explicit future versions fail
  closed.
• App Server history and live items now retain explicit user/assistant/process
  roles and stable browser-safe identities. Incremental answers stay visible
  while growing, expose a working/receiving indicator, and bind the question
  rail to real user blocks instead of terminal-text guesses.
• Active App Server history keeps that identity domain even after rollout JSONL
  appears and groups the actor's structured items by turn, preserving a user
  item even when Codex's completed-turn payload contains only assistant items.
  JSONL takes over only after the Web session closes. Unknown or closed SSE
  targets now fail or finish cleanly instead of raising after response headers
  have already been sent.
• Owner session catalog and launch/lifecycle policy moved out of the main server
  composition root, reducing it by about 21.5% with no duplicate implementation.
• CI now pins third-party Actions by full commit SHA, tests Ubuntu 22.04/Python
  3.10 and Ubuntu 24.04/Python 3.13, runs Python/JavaScript CodeQL, and receives
  low-noise weekly Dependabot proposals without auto-merge.

Validation

• Canonical source gate: 229 Owner, 120 Gateway and 65 unified-CLI Python tests,
  plus Ruff, ESLint, Prettier, TypeScript, Node contract tests and reproducible
  local Preact bundles.
• Backend ownership, New/Resume payloads, command-version drift, busy slash
  policy, browser-envelope compatibility and stale-session status responses have
  focused regression coverage.
• The v1.10.0 local install passed 24/24 doctor checks with all three user
  services active. Authenticated ordinary reloads showed authoritative backend
  labels for real App Server and TUI sessions and loaded the v1.10.0 asset
  revision without a hard refresh.
• An isolated real Codex App Server passed streamed delta/final convergence,
  multiple visible answer-length stages, distinct user/assistant blocks,
  Markdown/KaTeX, an actual question-marker jump, approval, user input and
  active-turn Owner restart. Anonymous browser fixtures passed 40-turn lazy
  history, question navigation, 20-message reliable delivery, clipboard image,
  network recovery and session isolation.
• Authenticated 430x820 browser checks started and cleaned both a fresh App
  Server session and a fresh TUI session from the single combined options sheet.
  The deployed collision migration left zero overlapping App Server/tmux names
  and preserved every pre-existing pane name, PID, width and height.
• Pull-request CI passed Ubuntu 22.04/Python 3.10, Ubuntu 24.04/Python 3.13,
  Python CodeQL and JavaScript/TypeScript CodeQL.

Faryo remains source-only. The Release publishes the reviewed bootstrap
installer, source archive and SHA-256 manifests; it does not publish stale Linux
or macOS binary packages.