v0.43.0

Changelog

Features

• b15d967: feat(#2823)!: implement named privilege levels under agent roles (@fullsend-ai-coder[bot])
• 10ad2a8: feat(#6214): add keep_history config option for sticky comments (@fullsend-ai-coder[bot])
• 7260ca8: feat(#6458): export eval measurement scores via OTLP (@ascerra)
• 9e029bd: feat(#6684): add --gitlab-url flag to repos install (@fullsend-ai-coder[bot])
• 85aa6de: feat(#6948): make nextwork markdown output self-describing and ordered (@fullsend-ai-coder[bot])
• 587a6ad: feat(#7065): add --fullsend-binary and --fullsend-source flags to repos install (@fullsend-ai-coder[bot])
• 16fc67c: feat(#996): log dropped permissions on role-level downscoping (@fullsend-ai-coder[bot])
• b73ee1a: feat(site): serve a custom 404 page for unmatched URLs (@rh-hemartin)

Bug Fixes

• bb15574: fix(#2187): normalize fix instruction line endings (@shairevivo)
• f822037: fix(#325): wait for app page before opening browser during install (@fullsend-ai-coder[bot])
• 06ca7e2: fix(#6425): make isTimeoutError self-contained against context errors (@fullsend-ai-coder[bot])
• 2ee14c9: fix(#6452): propagate org-level allowed_remote_resources to URL resolution (@fullsend-ai-coder[bot])
• 20ee2ff: fix(#6458): accumulate OTLP batch export errors (@ascerra)
• 911b9bf: fix(#6458): address Wayne review on OTLP score export (@ascerra)
• 807faa1: fix(#6458): address Wayne round-2 OTLP score export review (@ascerra)
• 8278aee: fix(#6458): address Wayne round-3 OTLP score export review (@ascerra)
• c530e9d: fix(#6458): address Wayne round-4 OTLP score export review (@ascerra)
• d8a2eda: fix(#6458): bound eval explanation independently of content-capture SpanLimits (@ascerra)
• a7fbd16: fix(#6458): harden OTLP score export (@ascerra)
• 17e3154: fix(#6458): harden OTLP score export after review (@ascerra)
• 19687fb: fix(#6458): make awaitCreation/Deletion honor canceled ctx before zero-delay backoff (@ascerra)
• e947baa: fix(#6458): skip empty OTLP score batches (@ascerra)
• 8e75d55: fix(#6684): explicitly infer --forge=gitlab when --gitlab-url is set (@fullsend-ai-coder[bot])
• 52c1c9b: fix(#6798): resolve base forge/overlays per-layer before merging into child (@ggallen)
• 87da18e: fix(#7059): preserve provider cancellation errors (@shairevivo)
• c5db93b: fix(#7069): add --fullsend-ref flag to github setup command (@fullsend-ai-coder[bot])
• 973b78b: fix(#7089): use standard token resolution in lookupAppID (@fullsend-ai-coder[bot])
• 45d6603: fix(#7127): accept nested GitLab group paths in repos install (@fullsend-ai-coder[bot])
• bc26c9e: fix(#7127): address review feedback on test adequacy, API shape, and docs (@fullsend-ai-coder[bot])
• 39976a4: fix(#7127): propagate forge-aware validation to uninstall and docs (@fullsend-ai-coder[bot])
• 15f5f0d: fix(#7127): update splitOwnerRepo error message and add uninstall docs for nested GitLab paths (@fullsend-ai-coder[bot])
• e274a1e: fix(#827): dismiss stale bot approvals (@shairevivo)
• b50abd7: fix(#827): preserve approval on review failure (@shairevivo)
• e8bb94c: fix(action): restore stderr redirect for first retry_curl workflow commands (@fullsend-ai-coder[bot])
• 1301b62: fix(appsetup): propagate parent context cancellation in ensureInstalled (@fullsend-ai-coder[bot])
• 7f08f50: fix(appsetup): return ctx.Err() from waitForAppReady on parent cancellation (@fullsend-ai-coder[bot])
• 7f8ba53: fix(appsetup): use errors.Is for context error comparison (@fullsend-ai-coder[bot])
• a3fcaf0: fix(cli): assert gh auth login suggestion in rate limit test (@fullsend-ai-coder[bot])
• d833225: fix(cli): remove no-op applyDeprecatedVendorBinaryFlag from repos install (@fullsend-ai-coder[bot])
• da1a04f: fix(cli): use t.Cleanup for consistent lookupTokenFn restoration (@fullsend-ai-coder[bot])
• e019624: fix(docs): add missing link for cross-cutting principle 6 reference (@fullsend-ai-coder[bot])
• 1b0892a: fix(docs): address review feedback on PR #7113 (@fullsend-ai-coder[bot])
• 971bdf1: fix(docs): address review feedback on SAFE-MCP landscape entry (@fullsend-ai-coder[bot])
• 87d484d: fix(docs): clarify ADR 0017 cross-reference in PatchPatrol entry (@fullsend-ai-coder[bot])
• 74eeaa0: fix(docs): move PatchPatrol from Major tools to Others section (@fullsend-ai-coder[bot])
• 1ee0f4a: fix(docs): move SAFE-MCP section to correct document position (@fullsend-ai-coder[bot])
• 75cd63d: fix(install): address review feedback on PR #6434 (@fullsend-ai-coder[bot])
• 21e30a7: fix(web): include Codex in landing page runtimes (@waynesun09)
• 7d0d754: fix: add [auto apply] indicator to nextwork table next-action column (@fullsend-ai-coder[bot])
• ce87d6c: fix: add resolveKeepHistory tests and config resolution to deprecated post-comment (@fullsend-ai-coder[bot])
• 2dd8c9f: fix: address remaining review feedback on PR #7087 (@fullsend-ai-coder[bot])
• fbb6ed0: fix: address review feedback on PR #6371 (@fullsend-ai-coder[bot])
• 6ac43b6: fix: address review feedback on PR #6371 (@fullsend-ai-coder[bot])
• ae6805c: fix: address review feedback on PR #6930 (@fullsend-ai-coder[bot])
• fd46432: fix: address review feedback on PR #7070 (@fullsend-ai-coder[bot])
• fdd1580: fix: address review feedback on PR #7077 (@fullsend-ai-coder[bot])
• e8c900d: fix: address review feedback on PR #7086 (@fullsend-ai-coder[bot])
• 9bea2a0: fix: address review feedback on PR #7087 (@fullsend-ai-coder[bot])
• e9a7322: fix: address review feedback on PR #7087 (@fullsend-ai-coder[bot])
• 184fa1a: fix: address review feedback on PR #7100 (@fullsend-ai-coder[bot])
• 451791d: fix: address review feedback on PR #7100 (@fullsend-ai-coder[bot])
• 31bcd3b: fix: address review feedback on PR #7100 (@fullsend-ai-coder[bot])
• 81914ee: fix: address review feedback on PR #7109 (@fullsend-ai-coder[bot])
• b770452: fix: complete --gitlab-url dry-run preview for bootstrap path (@fullsend-ai-coder[bot])
• 9c9b3dd: fix: deduplicate gitlab-url dry-run message and update stale doc reference (@fullsend-ai-coder[bot])
• 90aabf6: fix: default --fullsend-dir to $FULLSEND_DIR in post-review and post-comment (@fullsend-ai-coder[bot])
• 3edb28b: fix: document item ordering convention in SKILL.md prose guidance (@fullsend-ai-coder[bot])
• 55e49fd: fix: register --keep-history flag on issues post-comment for CLI parity (@fullsend-ai-coder[bot])
• 09fc53d: fix: rename cachedAppPermissions to loadAppPermissions (@fullsend-ai-coder[bot])
• 6a2ce2a: fix: set --gitlab-url in-memory before forge client factory creation (@fullsend-ai-coder[bot])
• a209b35: fix: set KeepHistory: true on all sticky.Config test literals (@fullsend-ai-coder[bot])
• 240a4df: fix: thread item titles through mutation pipelines in nextwork output (@fullsend-ai-coder[bot])
• ab8ad40: fix: thread kind into take_over results for typed-prefix rendering (@fullsend-ai-coder[bot])
• a57b891: fix: use distinct log prefix for dropped permissions (@fullsend-ai-coder[bot])

Refactoring

• cf9b017: refactor(#827): remove redundant review user declaration (@shairevivo)