v1.0.5

Highlights

This release adds opt-in native ChatGPT file downloads into workspaces, bounds long-running MCP session memory growth, hardens AGENTS.md symlink handling, and refreshes the workspace tool-card UI.

Added

• Added optional download_artifact to save a native MCP-host file (for example a ChatGPT attachment or generated image) directly into an open workspace (#88).
• Enable with DEVSPACE_ARTIFACTS=1; cap size with DEVSPACE_ARTIFACT_MAX_FILE_BYTES (default 100 MiB).
• Streams only from trusted OpenAI download hosts, refuses overwrites, creates parent dirs, and publishes owner-only files.
• Currently registered on Linux only (descriptor-relative filesystem ops are not available on macOS/Windows/BSD in Node).

Fixed

• Clean up idle MCP Streamable HTTP sessions after 24h of inactivity (5-minute sweep) so abandoned reconnects no longer retain transports for the life of the process (#71).
• Await MCP transport cleanup during graceful server shutdown.
• Resolve symlinked AGENTS.md context files and reject symlink targets that escape the project root (#65, #66).
• Open checkout workspaces correctly on Windows drive roots (#43).

Improved

• Align workspace tool cards with the Codex card shell: Lucide icons, normalized titles/metadata, clearer patch/delete presentation, and better mobile chevrons (#73).
• Hide unreliable glob match counts in tool cards.

Notes

• Artifact download is off by default. Enable only when you want host-native file handoff:

DEVSPACE_ARTIFACTS=1 npx @waishnav/devspace serve

• See docs/artifact-exchange.md, docs/configuration.md, and docs/security.md for the tool contract and safety model.
• Idle MCP session timeout is intentionally conservative (24h) so normal ChatGPT/Claude pauses are not disrupted; expired sessions return Unknown MCP session and clients re-initialize.

Full changelog: v1.0.4...v1.0.5