v0.0.6

fx is now a provider-independent BYOK distribution with one context-compaction pipeline, Codex-style Unified Exec, direct ACP provider control, visible reasoning, and substantially stronger long-session lifecycle guarantees.

Breaking Changes

• Vercel product surface: The BYOK distribution no longer includes Vercel setup, account onboarding, login, gateway defaults, hosted upgrade channels, CDN backfill, or development-release flows. Generic provider contracts remain where they serve direct API-key, Codex, Grok, ACP, or SDK use.
• Terminal presentation: /appearance, /input, and /maxxing have been removed along with their saved settings. fx now uses the same input and transcript layout everywhere.
• Model execution tools: The old model-facing terminal action is removed. Use exec_command for shell commands and write_stdin to poll or provide input to a long-running session.

New Features

• Unified Exec commands: Model turns now use separate exec_command and write_stdin tools with numeric sessions for long-running and interactive commands. Output remains bounded while processes survive turn boundaries until they finish or the session closes.

• Unified context compaction: Manual /compact, automatic threshold compaction, context-overflow recovery, TUI, and ACP now use one strategy module. Eligible Responses routes use native remote compaction first, other providers use the active model for a structured full-history summary, and a bounded deterministic summary remains available when provider compaction cannot complete.

• Visible reasoning and replay: Reasoning-capable models stream reasoning as a separate TUI and ACP surface by default. Signed reasoning is preserved for within-turn tool continuation, provider summaries remain available after resume, and mixed reasoning, text, and tool calls serialize through one valid request path.

• Codex account services: fx usage --codex reports subscription limits, while authenticated Codex sessions expose the web.run search, open, click, and find workflow with bounded verified context.

• Linux and WSL clipboard images: Ctrl+V and /paste can attach clipboard images through wl-paste, xclip, or the WSL PowerShell bridge in addition to the native macOS pasteboard.

• ACP provider control: Native ACP clients can start and monitor Codex or Grok login, switch providers, and configure a connection-scoped Responses base URL and API key without restarting fx.

• ACP image prompts: Native ACP sessions accept standard base64 image blocks for vision-capable models and persist the verified bounded snapshot with the session.

• Remote MCP servers: /mcp add --transport http <name> <url> now saves or replaces a remote Streamable HTTP server and reloads MCP immediately. The existing local stdio form is unchanged.

• Retained command output: Captured command output can now be read later with read_tool_result, including after a saved session resumes. With --no-save, output remains available until fx exits.

Improvements

• Non-blocking compaction and streaming: Manual and automatic compaction run outside the TUI event loop, keep the composer responsive, queue the next prompt safely, persist the settled replacement before reporting success, and preserve immediate streamed token rendering while compacting activity is visible.

• Compaction portability: Remote checkpoints remain bound to the exact provider identity, endpoint, and wire model, while a portable local summary is stored beside opaque provider state. Switching accounts or endpoints never replays an opaque checkpoint to the wrong provider.

• Long-session resource bounds: Durable file-edit presentation bodies, compaction projections, recovery snapshots, and command output are bounded so large edits and long sessions do not repeatedly inflate checkpoints or replay state.

• Event-driven TUI cadence: Native worker delivery wakes the event loop directly. The short polling cadence is retained only for active response pacing, while idle and network-wait states use a lower-frequency path to reduce CPU use without delaying streamed tokens.

• Codex-style activity: Active turns use a rotating Working status with elapsed time and token counts, the terminal title reflects ongoing work, queued prompts remain visible for the next turn, and redundant activity disappears once streamed assistant text becomes the progress surface.

• Reasoning presentation: Long reasoning summaries stay visually bounded without truncating the provider-owned body used for continuation, and reasoning updates are always marshaled onto the UI thread before transcript mutation.

• Auto mode review prompts: Auto mode now uses fewer tokens when reviewing unresolved actions.

• Native release builds: Every supported archive is produced directly from the same stripped ReleaseSafe build profile.

• Provider model preferences: Gateway, Codex, and Grok now keep separate saved model selections, so switching providers no longer replaces another provider's preferred model.

• Responsive provider switching: Provider credential refresh and catalog loading no longer block TUI input or ACP control messages. /provider is now the direct interactive provider command, while /login remains focused on authentication.

• Subscription session longevity: Codex and Grok sessions remain usable beyond 64 consecutive requests.

• Usage tracking: Rejected completions no longer appear in usage tracking, and duplicate completion callbacks are recorded once.

• MCP discovery: MCP searches still find the selected tool when a request includes surrounding context, and another server's authentication failure no longer replaces an empty search result.

• MCP authentication: MCP authentication stays responsive while configuration reloads or logout is in progress, and pending authentication stops when MCP reloads or fx exits.

• Linked skill errors: Linked skill errors now distinguish an unavailable linked directory from an unreadable SKILL.md and explain whether to repair, remove, or authorize the link.

• Live permission modes: Shift+Tab permission-mode changes now apply to later tool calls in the current turn. Actions already in progress keep the mode under which they were admitted.

• Tool action summaries: Denied and deferred tool rows now show the actual command or target, and those details and denial labels survive session resume.

Bug Fixes

• Codex Responses routing: ChatGPT OAuth uses the shared Responses request path, keeps account-bound headers and compaction state, and always sends valid input, including a synthetic continuation when recovery leaves only system context.
• Compaction failures: Rejected or unavailable remote compaction now falls through to active-model compaction before the deterministic fallback. Manual and automatic compaction share the same installation, persistence, cancellation, and stale-result checks in both TUI and ACP.
• ACP process control: Direct Unified Exec writes, output polls, and termination remain responsive even while a model-side output poll is waiting, without consuming output intended for the model.
• ACP provider bindings: Connection-scoped BYOK endpoints keep their matching API key across temporary provider switches and now apply consistently to model requests, automatic permission reviews, remote compaction, and persistent subagent turns. Reconfiguring the connection cannot redirect or invalidate a child turn already in progress.
• Provider logout: Signing out immediately invalidates a matching provider switch already loading in the background, leaves unrelated provider activation alone, and keeps durable credential removal off the TUI event loop while an in-flight refresh releases its session lock.
• Terminal resize: Terminal resizing no longer leaves empty scrollback behind.
• Subscription sign-in: Codex and Grok sign-ins now survive unrelated, stalled, reset, or stale browser connections. Grok authorization codes can also be pasted when the browser cannot return to fx.
• OAuth callback pages: OAuth callbacks now show a completion or failure page after returning from the browser.
• Nested rebuilds: Interactive terminal helpers continue working after a nested rebuild replaces the fx binary on disk.
• Escaped command descendants: Captured commands and subagent-owned processes track and reap descendants that escape the original process group, including shutdown and cancellation paths.
• Terminal recovery: fx recovery no longer pauses commands already running in tmux.
• Terminal cancellation: Terminal cancellation no longer reports failure when the command exits during cancellation.
• MCP resource compatibility: MCP resources and prompts no longer fail on servers that require their configured name.
• MCP credential recovery: MCP credentials with no advertised scopes remain usable after restart. Malformed stored entries no longer prevent valid servers from loading and are removed on the next successful credential write.
• MCP stdio environments: Configured MCP stdio environment variables now override inherited values without discarding the rest of the child environment.
• Captured command failures: Captured command output remains readable after timeout or cancellation. Output-capture failures now fail the tool call instead of returning an incomplete result.
• Resumed review labels: The Safety caution and Review unavailable labels now survive session resume.

Fork and Release Maintenance

• Smaller supported surface: Removed Vercel-only runtime, setup, account, updater, telemetry, gateway protocol, credential storage, SDK login, release-channel, and obsolete test/eval code that conflicted with the BYOK product direction. Generic Responses, provider, MCP, ACP, image, SDK, and permission boundaries remain supported.
• Focused regression ownership: Kept deterministic coverage for real crashes, recovery, resource limits, security boundaries, provider routing, streaming, TUI rendering, ACP, and process lifecycle while removing brittle layout counts, duplicate scenarios, and tests owned only by removed features.
• Release workflow: Full CI runs once on the exact feature commit and is not repeated after the squash merge. Stable releases only compile, sign, checksum, and package the four native ReleaseSafe binaries; PGSO qualification remains an independently dispatchable size-optimization workflow rather than a release blocker.
• Download integrity: Stable releases provide stripped ReleaseSafe archives for Linux and macOS on x86_64 and arm64, with a SHA-256 file beside every downloadable package. macOS binaries use Developer ID signing and notarization when Apple credentials are configured; fork releases without those credentials use a verified ad-hoc signature and state that notarization was skipped.

Security

• Exact-action reviews: Auto mode reviews each unresolved action against the current request and relevant results from the current turn. A clear review applies only to that exact unchanged action and is checked again before execution.
• Blocked cautions: Cautioned or unavailable actions remain blocked without opening a permission prompt or ending the turn.
• Untrusted tool output: Actions copied from untrusted tool output remain blocked unless the user's request independently authorizes them.
• Current-branch pushes: Explicit pushes to the current branch use the branch reported by the local Git checkout rather than repository text.
• Provider recovery authority: After restart, fx continues unfinished Codex or Grok work only for the account that started it. If that account cannot be verified, fx preserves completed work and sends nothing.
• Sensitive command output: Command output flagged as sensitive is not saved with the session, including secrets split across output chunks or oversized lines.
• OAuth callback validation: OAuth authorization denials and successes apply only when the callback state matches the active sign-in attempt, and Grok browser callbacks accept only the expected xAI origin.
• MCP issuer validation: MCP sign-in stops before exchanging a token or saving credentials when the authorization response comes from a different issuer than the server advertised.