Backpack Runtime v0.2.0-alpha.9

Backpack Runtime v0.2.0-alpha.9

This prerelease fixes Claude App relaunch and current Windows MSIX discovery.

Install or update

backpack update --prerelease

Fixes

• Accepts normal Claude-owned additions such as preferences and Cowork paths in
  the shared third-party-mode configuration while continuing to reject changes
  to Backpack-owned security and routing fields.
• Preserves Claude-owned additions during reconfiguration and restore instead
  of replacing the entire shared configuration file.
• Opens current Windows MSIX installations through Claude's registered
  claude:// protocol when no traditional executable path exists.
• Allows rerunning backpack launch claude-app to ensure the persistent local
  daemon is available again after a reboot or daemon restart.

Claude App routing remains experimental. The authenticated provider profile and
its loopback token retain strict drift protection.

Backpack Runtime v0.2.0-alpha.8

Backpack Runtime v0.2.0-alpha.8

This prerelease aligns the local Cloud proxy with Backpack Cloud's hardened
provider-failure contract.

Install or update

irm https://backpack.run/install.ps1 | iex

Existing alpha.7 installations can also use the repaired self-updater:

backpack update --prerelease

Improvements

• Preserves structured HTTP 503 cloud_inference_unavailable errors instead of
  collapsing them into a generic local runtime error.
• Preserves safe Retry-After, X-Request-ID, and
  X-Provider-Request-ID headers returned by Backpack Cloud.
• Uses the provider request ID when reporting an unexpectedly interrupted SSE
  stream, improving safe correlation with RunPod worker logs.
• Keeps entitlement failures translated into the existing private-preview
  product message without exposing internal account state.

Cloud and coding-agent integrations remain experimental. Cloud authentication
does not by itself grant hosted-inference entitlement.

Backpack Runtime v0.2.0-alpha.7

Backpack Runtime v0.2.0-alpha.7

This prerelease fixes Windows self-update activation. It otherwise contains the
same Cloud coding-agent hardening and qualification delivered in alpha.6.

Install or recover from an alpha.6 staged-update error

irm https://backpack.run/install.ps1 | iex

The installer independently verifies the release checksum and replaces the
installed binary. Users who encountered verified staged update already exists
do not need to run or trust the abandoned side-by-side executable.

Fix

• Windows updates now rename the currently mapped executable to a timestamped
  rollback backup and activate the verified replacement before the update
  command exits.
• A legacy target-specific .update-* file from alpha.6 or earlier is removed
  safely instead of making every retry fail.
• The activation path retains rollback behavior if replacing the executable
  fails after the backup rename.

Windows amd64 remains the supported alpha platform. Linux amd64 and macOS arm64
remain previews. Cloud and coding-agent integrations remain experimental.

Backpack Runtime v0.2.0-alpha.6

Backpack Runtime v0.2.0-alpha.6

This prerelease hardens Cloud coding-agent tool execution on Windows. Agent
launch, Cloud, and desktop compatibility remain experimental.

Install

Windows x64:

irm https://backpack.run/install.ps1 | iex

Linux x64 and macOS arm64 preview:

curl -fsSL https://backpack.run/install.sh | sh

Existing prerelease installations can update with:

backpack update --prerelease

Highlights

• Bounds coding-agent output reservations to one quarter of the advertised
  context, capped at 8192 tokens, preserving input space for instructions,
  tool schemas, history, and tool results.
• Enforces that output ceiling in the authenticated Anthropic Messages proxy,
  preventing stale clients from requesting an impossible output allocation.
• Uses OpenAI Codex's documented per-launch windows.sandbox="unelevated"
  fallback on native Windows when current Codex elevated-sandbox setup fails.
  The override does not modify the user's Codex configuration.
• Passes real Qwen3-Coder 30B A3B Cloud tool loops with installed Codex and
  Claude Code binaries on Windows.
• Continues deriving model context from the live Cloud catalog. The worker is
  qualified at 262,144 tokens, while production currently advertises 32,768;
  Runtime will adopt 262,144 automatically when that catalog is promoted.

Security note

The Codex unelevated Windows sandbox retains ACL-based filesystem restrictions
but has weaker user and network isolation than Codex's preferred elevated
sandbox. Backpack prints this warning at launch. Agent permission and approval
controls remain active, and Backpack never adds permission-bypass flags.

Known limitations

• Backpack Cloud is a private alpha and requires an entitled account.
• Agent launch and desktop-app routing remain experimental.
• OpenCode and both desktop-app paths require broader real-application
  qualification.
• The public Cloud catalog remains authoritative; production continues to
  advertise 32,768 tokens until the pending control-plane deployment occurs.
• Windows amd64 is the supported alpha platform. Linux amd64 and macOS arm64
  remain previews.

Include sanitized backpack doctor --json output in bug reports. Report
vulnerabilities privately through GitHub Security Advisories.

Backpack Runtime v0.2.0-alpha.5

Full Changelog: v0.2.0-alpha.4...v0.2.0-alpha.5

Backpack Runtime v0.2.0-alpha.4

Backpack Runtime v0.2.0-alpha.4

This prerelease hardens Backpack Cloud integrations for coding agents and adds
experimental Claude Desktop support. Interfaces and behavior remain subject to
change before beta.

Install

Windows x64:

irm https://backpack.run/install.ps1 | iex

Linux x64 and macOS arm64 preview:

curl -fsSL https://backpack.run/install.sh | sh

Existing prerelease installations can update with:

backpack update --prerelease

Highlights

• Preserves the normal Codex home and native OpenAI model catalog while routing
  only the selected Backpack model through the local authenticated gateway.
• Accepts compressed Codex App requests and reports prematurely terminated
  provider streams as explicit protocol failures instead of silent success.
• Uses each model's maximum execution-qualified context by default. --context
  remains available to select a smaller window when required by the workload or
  compute target.
• Adds experimental backpack launch claude-app / claude-desktop support with
  private backups, drift-safe restoration, authenticated loopback routing, model
  mapping, and token-count compatibility.
• Improves Claude Code auto-compaction configuration and retains experimental
  OpenCode routing through the same generic model/provider contract.
• Detects unreadable Windows DPAPI cloud credentials and gives an actionable
  backpack logout then backpack login recovery path.
• Avoids orphaned daemon upgrade state and preserves stopped-session semantics
  across upgrades.

Agent commands

backpack launch codex --model qwen3-coder-30b-a3b-instruct:cloud
backpack launch codex-app --model qwen3-coder-30b-a3b-instruct:cloud
backpack launch claude --model qwen3-coder-30b-a3b-instruct:cloud
backpack launch claude-app --model qwen3-coder-30b-a3b-instruct:cloud
backpack launch opencode --model qwen3-coder-30b-a3b-instruct:cloud

Use the corresponding --restore command for persistent desktop profiles.
Backpack does not install third-party agents; install Codex, Claude, or OpenCode
from their official distribution first.

Cloud qualification

The public Backpack Cloud Responses path, Responses streaming, Anthropic
Messages path, and structured tool calling were requalified against the current
Qwen3-Coder 30B A3B worker before this release. A scale-from-zero start can take
several minutes. Warm requests complete normally.

The upstream RunPod non-streaming Chat Completions aggregation path can still
return HTTP 500 even when the worker's local vLLM request completed with HTTP
200. Streaming Chat Completions is qualified and is the preferred path for
OpenCode and other Chat Completions clients in this alpha.

Known limitations

• Agent launch and Claude Desktop support remain experimental. Codex protocols
  have deterministic coverage; Claude Desktop and OpenCode still require wider
  real-application qualification.
• Backpack Cloud is a private alpha and requires an entitled account.
• Cold starts may exceed a client application's reconnect window while the
  30B model is loaded. Retry after the worker has warmed.
• Windows amd64 remains the supported alpha platform. Linux amd64 and macOS
  arm64 remain previews as documented in the compatibility matrix.
• API and CLI behavior remains pre-1.0 and follows the documented alpha
  compatibility policy.

Include sanitized backpack doctor --json output in bug reports. Report
vulnerabilities privately through GitHub Security Advisories.

Backpack Runtime v0.2.0-alpha.3

Backpack Runtime v0.2.0-alpha.3 is a public prerelease focused on secure coding-agent integration.

Highlights

• Launch OpenAI Codex App with Backpack local or Cloud coding models.
• Launch Codex CLI, Claude Code, and OpenCode through Backpack's loopback API.
• Authenticate Backpack Cloud with backpack login and list available models with backpack cloud models.
• Keep Codex App credentials separate: Backpack does not read or modify Codex auth.json.
• Route Codex App requests through a per-installation, tokenized loopback URL.
• Back up and safely restore Codex App configuration with drift and symlink protection.
• Coordinate daemon upgrades safely so CLI and daemon versions do not become mixed.

Install on Windows

irm https://backpack.run/install.ps1 | iex
backpack --version

Try Codex App with Backpack Cloud

backpack login
backpack cloud models
backpack launch codex-app --model qwen3-coder-30b-a3b-instruct:cloud

If Codex App is already open, quit and reopen it so the managed model catalog is loaded. Restore the prior Codex App configuration with:

backpack launch codex-app --restore

Platforms

• Windows amd64: validated alpha platform.
• Linux amd64 and macOS arm64: experimental release archives.
• Codex App integration is available on Windows and macOS.

Known limitations

• Backpack Cloud and coding-agent launch integrations remain experimental.
• An alpha.2 daemon with active model sessions must have those sessions stopped before alpha.3 can replace it.
• Large local GGUF, SSH compute, vision, image, and video support remain experimental or package-work-required as documented in the compatibility matrix.

All release archives are accompanied by SHA-256 checksums. Please report issues at https://github.com/backpack-run/backpack-runtime/issues.

Full changelog: v0.2.0-alpha.2...v0.2.0-alpha.3

Backpack Runtime v0.2.0-alpha.2

Full Changelog: v0.2.0-alpha.1...v0.2.0-alpha.2

Backpack Runtime v0.2.0-alpha.1

Backpack Runtime v0.2.0-alpha.1

This is the second public alpha. Interfaces and behavior remain subject to change before beta.

Install

Windows x64:

irm https://backpack.run/install.ps1 | iex

Linux x64 and macOS arm64 preview:

curl -fsSL https://backpack.run/install.sh | sh

Highlights

• Experimental Codex CLI, Claude Code, and OpenCode launch integrations with child-only provider routing and isolated configuration.
• OpenAI Responses and Anthropic Messages compatibility subsets with structured streaming and tool-result continuation tests.
• A secure explicit backpack update command with stable/prerelease/exact-version selection, SHA-256 verification, bounded archive extraction, Unix rollback, and safe Windows staging.
• Schema-versioned model, compute-target, session, and job state with deterministic legacy migration, backups, atomic replacement, and future-version refusal.
• Expanded backpack models, backpack model show, interactive landing, and sanitized doctor diagnostics.
• GitHub artifact attestations for tagged release archives and checksums.
• Deployed hardened, channel-aware installers at backpack.run/install.sh and backpack.run/install.ps1, with idempotent user PATH configuration and an explicit opt-out.
• Explicit opt-in qualification jobs for real macOS arm64, Codex/model, and SSH execution.
• Resumable model downloads with exact HTTP range validation, size/SHA-256 verification, and atomic finalization. An 18.56 GB Qwen3-Coder transfer recovered from three real upstream resets.
• Execution-qualified Qwen3-Coder 30B A3B chat, structured tool-result continuation, and streaming tool arguments through managed llama.cpp b10618 on Windows CPU.
• Backpack Cloud private-alpha login, live model discovery, and secured Chat Completions/Responses/Messages proxying. The qualified Cloud model completed both a direct inference smoke and a real Codex CLI launch.

Compatibility status

Windows amd64 remains the supported alpha platform. Linux amd64 remains an experimental preview with real CPU GGUF qualification. macOS arm64 remains an archive/build preview until the opt-in Apple Silicon execution gate passes.

Agent launch is experimental. Qwen3-Coder 30B A3B and the Backpack chat API passed a real structured tool-result continuation, while the installed Codex binary and Responses compatibility protocol passed deterministic tool-loop qualification. A combined real-model Codex run connected and emitted tool requests, but the nested qualification host enforced read-only execution; the edit/test gate therefore remains pending. Claude Code and OpenCode binaries were unavailable on the qualification host. SSH has deterministic implementation coverage but no configured real host qualification.

Backpack Cloud is a private alpha. Use backpack login, inspect backpack cloud models, and pass an advertised :cloud ID to backpack launch. The live API currently qualifies qwen3-coder-30b-a3b-instruct:cloud; it does not advertise qwen3-coder-next:cloud. Device private keys remain local, Cloud access tokens remain in memory, and third-party agents receive only a random local-daemon credential.

Z-Image and Wan remain package-change-required; no GPU output is claimed. Qwen3-Coder 30B A3B is execution-qualified on Windows CPU; other large, split, and projector GGUF paths remain experimental or preflight-only according to the model matrix.

Upgrade and rollback

Run backpack update --check --prerelease to inspect the prerelease channel and backpack update --prerelease to update after this release exists. Windows stages the verified replacement beside the running executable and prints manual completion instructions; Unix-like systems activate it atomically while preserving a timestamped rollback binary.

Existing legacy state is migrated on first read. Backpack writes a .v0.bak copy before rewriting non-versioned state and refuses unknown future schema versions without modifying them.

Known limitations

• Custom POSIX installation directories are not written to a shell profile automatically; add a custom directory to PATH explicitly.
• macOS managed-runtime inference, Linux audio, real SSH, and real-model agent execution require external qualification infrastructure.
• API and CLI behavior remains pre-1.0 and follows the documented alpha compatibility policy.

Include sanitized backpack doctor --json output in bug reports. Report vulnerabilities privately through GitHub Security Advisories.

Backpack Runtime v0.1.0-alpha.1

Backpack Runtime v0.1.0-alpha.1

This is the first public alpha of Backpack Runtime: a standalone CLI and loopback HTTP service for running Backpack-packaged open models locally or through experimental SSH compute. Expect rough edges and API or behavior changes before beta.

Platform status

• Windows x64: supported and execution-validated alpha.
• Linux x64: experimental preview; the core GGUF path is release-qualified separately from Windows audio.
• macOS arm64: experimental preview build; real model execution is not yet validated.

Included

• Managed GGUF chat with SmolLM2 135M/1.7B and Qwen2.5 0.5B validated on Windows.
• Whisper Large v3 Turbo transcription, Qwen3-ASR 0.6B, and Kokoro 82M speech on Windows x64.
• Automatic, versioned installation of llama.cpp, whisper.cpp, uv, Python, and isolated runtime dependencies when required.
• SHA-256 verification for model packages, native runtimes, Python locks, and release archives.
• Persistent loopback runtime service, managed sessions, streaming OpenAI-compatible chat/audio endpoints, and structured Backpack management APIs.
• Experimental SSH compute, split-GGUF/projector contracts (including GLM-5.3 Flash preflight coverage), and media-job APIs.

Install

Download and review the version-pinned installer before running it. Do not pipe it directly to a shell.

Invoke-WebRequest https://raw.githubusercontent.com/backpack-run/backpack-runtime/v0.1.0-alpha.1/scripts/install.ps1 -OutFile install.ps1
Get-Content .\install.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -Version v0.1.0-alpha.1

curl --fail --proto '=https' --proto-redir '=https' --tlsv1.2 -o install.sh https://raw.githubusercontent.com/backpack-run/backpack-runtime/v0.1.0-alpha.1/scripts/install.sh
sh install.sh v0.1.0-alpha.1

First inference

backpack doctor
backpack pull smollm2-135m
backpack run smollm2-135m --prompt "Explain Backpack Runtime in one sentence."

Known limitations

• Qwen3-ASR and Kokoro managed Python environments are Windows x64 CPU only.
• Whisper Large v3 Turbo is execution-validated on Windows CPU, but even short files can take many minutes on consumer CPUs. Treat it as a correctness path, not a low-latency path.
• Linux and macOS are preview platforms; macOS inference is unvalidated.
• SSH has deterministic automated coverage but no maintained real-host qualification yet.
• Vision, large split GGUF models, Z-Image, and Wan are not supported release features.
• GLM-5.3 Flash is cataloged for contract/preflight inspection only; its 193.8 GB GGUF has no compatible execution-validated managed runtime in this release.
• The API is single-user and loopback-only; authentication and public network binding are not implemented.
• Release archives have SHA-256 checksums but are not yet independently signed.
• On Windows PowerShell 5.1, the alpha.1 installer requires a clean destination; remove the installed binary before reinstalling the same version. This is fixed on main for the next prerelease.

Report reproducible alpha bugs through GitHub Issues. Include sanitized backpack doctor --json output. Report security vulnerabilities privately through GitHub Security Advisories.