v0.1.0-dev.61.1

Development build from 8121b6d. Discovered only by deployments explicitly configured with RELEASE_CHANNEL=dev; stable deployments ignore this Pre-release.

Changes in this candidate

• Add browser-bound, self-service first setup and forgotten-login recovery at /admin, verified through the target Worker's runtime Variable or Secret.
• Guide first-time users to copy NAME=value into Cloudflare's Key field; existing entries copy only the value. Verification tolerates surrounding spaces and line breaks.
• Limit new or restarted requests to ten per Server per 60-second window. Resuming and verifying existing requests do not consume that allowance; password/passkey login has its own budget.

Updating from dev.60.1

Update the Server code and its matching public assets together, preserving the Worker, origin, SERVICE_ID, existing variables/secrets, DeviceHub and OAuth KV. No schema migration, browser-login reset, Codex re-enrollment or Personal Agent reauthorization is required. DOTX_ADMIN_CLAIM is optional and is written only when the user chooses self-service verification; do not prefill it during deployment. Wrangler-issued links remain available.

Desktop runtime behavior and wire 5 are unchanged by this candidate. Both packages include the updated browser-login guide. Refresh connected Personal Agent catalogs to receive the current instructions; keep the existing connection.

Installation and update requirements

0.1.0 requires a fresh native installation from 0.0.1; no owner keys, device tokens or OAuth grants are migrated. Preserve native Codex accounts, projects and conversations. Install the Server, connect the first Codex and then connect each Personal Agent using its own access code. Updates within the 0.1.0 development series preserve the account, Worker, origin, SERVICE_ID, browser login methods and DO/KV resources; point both main and assets.directory at this release. Loaded Desktop instances automatically pick up complete first-time configuration; verify the actual owner and connection without a routine app restart. If a newly installed plugin's tool is missing, keep trying normal host loading/refresh while offering a convenient user restart; when needed, arrange a new ordinary Codex Desktop conversation on the same Mac, not a subagent. See the bundled plugin-loading guide. Desktop updates still require refreshing every host retaining old plugin instances and verifying the actual owner version. Refresh each Personal Agent catalog when remote_catalog is true. This release uses wire 5; 0.0.1 uses wire 4. Product versions may differ; wire versions must match. Report component completion separately from link recovery.

Browser administration uses a DotX password or passkey; Wrangler management and Personal Agent MCP OAuth remain independent. For self-service first setup or recovery, open /admin, start a request and write its verification value to DOTX_ADMIN_CLAIM in the target Worker’s Cloudflare Production settings. Both Variable and Secret work. Save and deploy, then return to the same browser to set a password or passkey. The request lasts 24 hours and can resume after closing the page. No CF OAuth client or API-token handoff is required. An authorized Wrangler user can still issue a setup or reset-login link. Browser setup may be deferred while installation continues through Wrangler. Successful recovery replaces browser credentials and signs out previous browser sessions; device and Personal Agent access is preserved. Earlier dev CF browser sessions require one password/passkey setup after upgrading; obsolete CF_OAUTH_CLIENT_ID/CF_OAUTH_CLIENT_SECRET bindings and only their dedicated retired OAuth client may then be removed. Subsequent password/passkey releases preserve saved login methods.

Apply the target Server template's assets.run_worker_first routing array: ["/", "!/assets/", "!/branding/*"]. Keep html_handling and not_found_handling set to "none", and deploy public/_headers with the assets. Public JS/CSS/branding files are served directly by Cloudflare; API and explicit page routes still run through the Worker, with no automatic HTML fallback for unknown API paths.

Server now automatically removes durable request receipts, answer deduplication and response routes after RECORD_RETENTION_DAYS (default 30). Preserve any chosen value in the actual Worker configuration. Existing development receipts keep their creation dates; old interaction records without timestamps start at adoption. Reducing retention applies to remaining records and can make them immediately eligible for deletion. After deletion, old request IDs no longer deduplicate; inspect native state before retrying unknown work. Native Codex tasks and conversations are not deleted. Existing subscription/retry lifecycle cleanup is unchanged. See the version-matched bundled docs for executable steps.