v0.49.0

Breaking changes / upgrade notes. This release pins the interpreter, PATH and settings in agent sandboxes, and custom sandbox images may need changes. python3, the hook tools (tirith, gitleaks), the agent CLIs and node are now looked up only in directories the agent user cannot write. If they aren't there, runs fail closed. With hooks on, that pinned python3 must be 3.11 or newer. The pi and codex CLI scripts must start through node or have the exact first line #!/usr/bin/env node; any other env shebang exits 127. The agent-writable .env is read as data at launch, so only plain assignments work. For Claude runs, hook settings come from the harness config and .env cannot change them. The generated --settings document pins disableAllHooks and those env names, so a repository's .claude/settings.json values for those keys have no effect. CLAUDE_CODE_SUBPROCESS_ENV_SCRUB, CLAUDE_CODE_SAFE_MODE, CLAUDE_CODE_SIMPLE and CLAUDE_CODE_SHELL_PREFIX are cleared when set through env.sandbox or .env.

env.sandbox now refuses 25 more reserved names, such as HTTPS_PROXY, SSL_CERT_FILE, GIT_SSH_COMMAND and NODE_OPTIONS, and matches all reserved names regardless of case. fullsend run and fullsend lock list the affected keys, and these names still work as runner secrets. fullsend run now sets GITHUB_TOKEN as well as GH_TOKEN to the minted agent token, so pre- and post-scripts that read GITHUB_TOKEN get the App token instead of the job token. The shared dispatch workflow no longer skips a run when a PR already exists. The code agent's pre-script does that check now, so those runs take a little longer.

On GitLab, once dispatch activation is recorded, the managed polling schedules and webhook run as the trigger-only account. Older CLIs then refuse repos install and repos uninstall, so upgrade the installer and the project's pinned fullsend_ref first, and don't delete the schedules by hand. GitLab runner VMs now take each job's OpenShell version from the job image's verified Fullsend revision, so one VM can serve several releases. Custom or rebuilt job images are rejected; use the official runner image or a byte-identical mirror.

fullsend issues create is a new command that creates issues on GitHub, GitLab and Jira, including Jira sub-tasks, and prints the new issue as JSON:

fullsend issues create --tracker jira --project PROJ \
  --type Sub-task --parent PROJ-12 --title "Split parser" --body -

fullsend repos install no longer stops the whole run when a repository still needs adoption. It skips that repository, prints guidance, lists it as FAILED and installs the rest, but still exits non-zero. Managed config.yaml files now record their HTTPS manifest source in a # Source manifest: comment. On GitLab, install and --dry-run check the project's push-rule branch-name regex before writing anything. GitLab triage now starts one triage run when an authorized user opens an issue, and the poller picks up issue opens that the webhook missed. Trigger-account rotation moves the schedules in a single run, and install retires superseded Poller generations.

The token mint now emits OpenTelemetry spans for standalone, Cloudflare and GCP deployments, and fullsend mint deploy can configure tracing. Also in this release: fresh GitHub installs let Retro file issues in both fullsend-ai/fullsend and fullsend-ai/agents. The 12-second OpenShell settle wait is gone from every run. OpenAI and gateway tokens refresh correctly after the host sleeps. OpenCode adds @default to bare Vertex model ids. Cancelled GitHub reviews now say how to retry. fullsend admin install prints a deprecation warning that names the commands to use instead. The sandbox image ships pi-inference-gateway 0.1.4, which resolves prefixed, date-suffixed and mixed-case gateway model ids from the catalog.

---

Changelog

Breaking Changes

• 2b036cf: feat(#8508)!: run GitLab polling schedules as trigger account (@ggallen)
• 51a30a5: feat(#8509)!: route GitLab webhook through trigger account (@ggallen)
• cfe8945: fix(#3373)!: block credential-class env vars set via env.sandbox (@tpouyer)
• eeadc03: fix(#8498)!: interpreter/PATH pinning (@fullsend-ai-coder[bot])
• 7cffeb4: fix(#8530)!: mint replaces GITHUB_TOKEN as well as GH_TOKEN (@fullsend-ai-coder[bot])
• 86425f7: fix(#8564)!: let GitLab runners serve multiple OpenShell pins (@ggallen)
• 7a15c24: fix(#8574)!: interpreter/PATH pinning (@fullsend-ai-coder[bot])
• ea2b8d9: fix(#8575)!: interpreter/PATH pinning (@waynesun09)
• 540deae: fix(#8626)!: interpreter/PATH pinning (@fullsend-ai-coder[bot])
• 04acf48: fix(hooks)!: interpreter/PATH pinning (@waynesun09)
• 7f2f73d: refactor(workflow)!: remove existing-pr gate on the workflow (@rh-hemartin)

Features

• 9000417: feat(#7083): add fullsend issues create CLI command (@fullsend-ai-coder[bot])
• 2e37265: feat(#7274): trace Cloudflare mints deployed by fullsend mint deploy (@fullsend-ai-coder[bot])
• af49e46: feat(#7274): trace GCP Cloud Function mints deployed by fullsend mint deploy (@fullsend-ai-coder[bot])
• ace2bc7: feat(#7274): trace mint requests with OpenTelemetry spans (@fullsend-ai-coder[bot])
• d076e6c: feat(#8244): retire superseded GitLab Poller generation on install (@fullsend-ai-coder[bot])
• 13ba362: feat(#8511): skip and report repos that need adoption in repos install (@fullsend-ai-coder[bot])
• 4675f34: feat(#8553): recover missed GitLab issue opens in the poller (@ggallen)
• 51987b2: feat(#8600): check GitLab push rule branch regex before install (@fullsend-ai-coder[bot])
• 0c51ffa: feat(#8627): record source manifest URL in managed config.yaml (@fullsend-ai-coder[bot])

Bug Fixes

• 170f848: fix(#3373): correct OpenShell environment migration guidance (@tpouyer)
• f6e746a: fix(#4663): keep legacy CLI linker targets (@shairevivo)
• dfd915d: fix(#7083): address issues create review findings (@andrewevansrh)
• d88bd1e: fix(#7083): address issues create review findings (@andrewevansrh)
• 3c0f06b: fix(#7083): retry Jira rate limits for all requests (@andrewevansrh)
• 4cbc2d9: fix(#7118): address review feedback on admin install deprecation (@gklein)
• 2176ee9: fix(#7118): drop removed --forge flag from admin install deprecation (@gklein)
• 76598c4: fix(#7118): mark admin install as deprecated in cobra (@gklein)
• 9c0e47d: fix(#7118): name the full replacement flow in the deprecation warning (@gklein)
• 8b53ef3: fix(#7238): preserve cancellation guidance after slow mint (@shairevivo)
• c412f00: fix(#7238): surface incomplete reviews (@shairevivo)
• 0422151: fix(#7238): verify PR head before cancellation guidance (@shairevivo)
• 65e4f4f: fix(#7274): bind GCF mint trace endpoint to per-deploy headers secret (@fullsend-ai-coder[bot])
• 5769222: fix(#7274): report tracing as unchanged on GCP mint deploy --skip-deploy (@fullsend-ai-coder[bot])
• a30a24a: fix(#7748): refresh OpenAI credential on wall clock after host sleep (@fullsend-ai-coder[bot])
• e23d902: fix(#7823): append @default to bare Vertex ids in OpenCode model spec (@fullsend-ai-coder[bot])
• a368481: fix(#8479): ci-local also clears local Podman's config volumes and devices (@gklein)
• 6228016: fix(#8479): ci-local clears containers.conf mounts and needs Podman 4.5 (@gklein)
• f5073de: fix(#8479): ci-local maps rootful Podman to the host uid, refuses Linux remote (@gklein)
• e7173c1: fix(#8479): ci-local submodules, locale-safe digests, clean volumes (@gklein)
• 9732984: fix(#8479): ci-local treats podman-remote as Podman, refuses other engines (@gklein)
• 6e87e67: fix(#8479): ci-local turns off local Podman's config env and default mounts (@gklein)
• cd66ecf: fix(#8498): address review feedback on PR #8565 (@fullsend-ai-coder[bot])
• a4dc0e7: fix(#8498): interpreter/PATH pinning (@waynesun09)
• 7ab89dc: fix(#8498): interpreter/PATH pinning (@waynesun09)
• ac89139: fix(#8498): interpreter/PATH pinning (@fullsend-ai-coder[bot])
• 625d86d: fix(#8498): settings pinning (@waynesun09)
• ed6b064: fix(#8498): interpreter/PATH pinning (@waynesun09)
• bfc5804: fix(#8504): include agents in default issue targets (@ederign)
• 157288a: fix(#8504): keep GitLab issue targets empty (@ederign)
• f8f4898: fix(#8508): address review feedback on PR #8519 (@fullsend-ai-coder[bot])
• 3d069cc: fix(#8508): address review feedback on PR #8519 (@fullsend-ai-coder[bot])
• 4ad92bb: fix(#8508): address review feedback on PR #8519 (@fullsend-ai-coder[bot])
• c70a330: fix(#8511): count adoption-skipped repos when validating credential flags (@fullsend-ai-coder[bot])
• 2ffdea5: fix(#8539): neutralize fullsend markers on the Jira sticky path (@fullsend-ai-coder[bot])
• 5409451: fix(#8543): warn about GitLab source-build settings and installer CLI minimum (@fullsend-ai-coder[bot])
• ffb696c: fix(#8543): warn about minimum installer CLI after interrupted schedule transfer (@fullsend-ai-coder[bot])
• cb06ac3: fix(#8544): keep review-findings-v2 projection marker live (@fullsend-ai-coder[bot])
• 30d71c0: fix(#8568): address sandbox review findings (@Aliciapet11)
• d8e8339: fix(#8568): harden sandbox download cleanup (@Aliciapet11)
• 6f87a6d: fix(#8568): make sandbox download retries idempotent (@Aliciapet11)
• 3e0e0f8: fix(#8574): interpreter/PATH pinning (@waynesun09)
• 058a8ab: fix(#8575): interpreter/PATH pinning (@fullsend-ai-coder[bot])
• ea7d933: fix(#8575): interpreter/PATH pinning (@waynesun09)
• c428aed: fix(#8575): interpreter/PATH pinning (@waynesun09)
• b948029: fix(#8575): interpreter/PATH pinning (@waynesun09)
• 77a3ad6: fix(#8575): interpreter/PATH pinning (@fullsend-ai-coder[bot])
• 3de4f32: fix(#8577): interpreter/PATH pinning (@waynesun09)
• 5a9b94c: fix(#8577): interpreter/PATH pinning (@fullsend-ai-coder[bot])
• 4a63864: fix(#8580): retry FORBIDDEN stale-head createCommitOnBranch errors (@fullsend-ai-coder[bot])
• aa7ed1e: fix(#8584): refresh the gateway token on the wall clock after host sleep (@fullsend-ai-coder[bot])
• 7a751b8: fix(#8585): back off OpenAI refresh rounds and stop on fatal errors (@fullsend-ai-coder[bot])
• 1a35d90: fix(#8593): clear only classified pending nonces and reject unleased create (@fullsend-ai-coder[bot])
• df8ef51: fix(#8593): consume the pending lease nonce on adoption (@fullsend-ai-coder[bot])
• 25c6dd9: fix(#8593): make slot lease adoption atomic and keep create backoff (@fullsend-ai-coder[bot])
• ed236a0: fix(#8593): recover own slot repo after an ambiguous create in Claim (@fullsend-ai-coder[bot])
• 2d03be8: fix(#8594): re-check slot ownership before resending rate-limited DELETE (@fullsend-ai-coder[bot])
• 1b0236b: fix(#8596): treat a 429 APIError interrupted by context as non-transient (@fullsend-ai-coder[bot])
• d53ca36: fix(#8597): surface ctx cancellation before rate-limit check in org pool (@fullsend-ai-coder[bot])
• ef57dc6: fix(#8600): document GitLab push rule preflight in CLI reference (@fullsend-ai-coder[bot])
• 8f447e5: fix(#8601): fall back to unmasked on generic GitLab value error (@fullsend-ai-coder[bot])
• 5cff537: fix(#8602): address review feedback on PR #8603 (@fullsend-ai-coder[bot])
• 0c7ee77: fix(#8602): document schedule ownership drift in trigger-account contract (@fullsend-ai-coder[bot])
• 3aa81ae: fix(#8602): move schedules to the rotated GitLab trigger account (@fullsend-ai-coder[bot])
• 976dd85: fix(#8635): settings pinning (@fullsend-ai-coder[bot])
• 07f882d: fix(#8636): let bare issue-update dispatcher jobs finish as no-ops (@fullsend-ai-coder[bot])
• 2e437b9: fix(#8641): settings pinning (@fullsend-ai-coder[bot])
• ba591ed: fix(#8652): back the org off before adopting after a create timeout (@waynesun09)
• 9f7c23b: fix(#8652): classify CreateRepo errors before ownership lookup (@fullsend-ai-coder[bot])
• 9a32b78: fix(#8652): keep the nonce when a create ends in a 422 (@waynesun09)
• 4e76452: fix(#8683): allow curl in generated GitLab forge profile (@fullsend-ai-coder[bot])
• 6f2f61c: fix(cli): remove the OpenShell first-poll settle wait (@fullsend-ai-coder[bot])
• dc4f33c: fix(dispatch): count prior fix commits by their Authored-by trailer too (@gwenneg)
• 6252dc0: fix(dispatch): count the Authored-by trailer only on App bot commits (@gwenneg)
• 8c7757c: fix(dispatch): handle empty messages in the fix-commit count and test the filter (@gwenneg)
• 7528e66: fix(dispatch): ship count-fix-commits.jq to vendored installs (@gwenneg)
• a427dfb: fix(hooks): interpreter/PATH pinning (@waynesun09)
• 1d497d9: fix(hooks): interpreter/PATH pinning (@waynesun09)
• e42cc53: fix(hooks): interpreter/PATH pinning (@waynesun09)
• 6aedc21: fix(jira): treat whitespace-only description as empty in CreateIssue (@andrewevansrh)
• 198a3ee: fix(release): never overwrite release notes after a failed check (@gklein)
• 9f0a08e: fix(release): prepend highlights via a checked script and group breaking changes (@gklein)
• 954c610: fix(release): stop rejecting inline $(cat ...) in highlights (@gklein)
• 1843ebc: fix(runtime): settings pinning (@waynesun09)
• 0c661fe: fix(runtime): settings pinning (@waynesun09)
• 52a2e54: fix(runtime): refuse a pi run without recorded hook settings (@waynesun09)
• 50ef625: fix(runtime): interpreter/PATH pinning (@waynesun09)
• b5d1a4f: fix(shim): keep the live per-repo shim identical to its template (@waynesun09)
• 4f6d48e: fix(skills): use a spec-valid name for the filing-issues skill (@Benkapner)
• fe2866e: fix: address review feedback on PR #8178 (@fullsend-ai-coder[bot])
• 44751f6: fix: address review feedback on PR #8178 (@fullsend-ai-coder[bot])
• afe1651: fix: address review feedback on PR #8178 (@fullsend-ai-coder[bot])
• 3f91ca2: fix: address review feedback on PR #8182 (@fullsend-ai-coder[bot])
• cb2404c: fix: address review feedback on PR #8182 (@fullsend-ai-coder[bot])
• d6352e6: fix: address review feedback on PR #8491 (@fullsend-ai-coder[bot])
• 8d399ff: fix: address review feedback on PR #8491 (@fullsend-ai-coder[bot])
• b463490: fix: address review feedback on PR #8491 (@fullsend-ai-coder[bot])
• 59e40e3: fix: address review feedback on PR #8519 (@fullsend-ai-coder[bot])
• 8f15c99: fix: address review feedback on PR #8548 (@fullsend-ai-coder[bot])
• 6a23536: fix: address review feedback on PR #8554 (@fullsend-ai-coder[bot])
• 3eae9a2: fix: address review feedback on PR #8582 (@fullsend-ai-coder[bot])
• 07e410a: fix: address review feedback on PR #8582 (@fullsend-ai-coder[bot])
• ec1d25d: fix: address review feedback on PR #8586 (@fullsend-ai-coder[bot])
• a55a05b: fix: address review feedback on PR #8586 (@fullsend-ai-coder[bot])
• c465fbe: fix: address review feedback on PR #8589 (@fullsend-ai-coder[bot])
• 765b7b2: fix: address review feedback on PR #8599 (@fullsend-ai-coder[bot])
• 0aff190: fix: address review feedback on PR #8623 (@fullsend-ai-coder[bot])
• a63f59b: fix: address review feedback on PR #8638 (@fullsend-ai-coder[bot])
• 1ee0be5: fix: address review feedback on PR #8639 (@fullsend-ai-coder[bot])
• 3fb64af: fix: address waynesun09 review threads on slotpool.go (PR #8582) (@fullsend-ai-coder[bot])
• 405b6dd: fix: do not publish shared lock into a replaced e2e-lock repo (#8623) (@fullsend-ai-coder[bot])
• d5baac5: fix: guard shared lock init commit against replacement during retry waits (#8623) (@fullsend-ai-coder[bot])
• 712b016: fix: leave APIError.RetryAfter unset for headerless interrupted rate limits (@fullsend-ai-coder[bot])
• aa3bdf3: fix: reword --type/--parent comments to not claim GitHub/GitLab lack equivalents (@andrewevansrh)

Refactoring

• 2200cde: refactor(#3373): check the credential deny-list in the env.sandbox gate (@tpouyer)
• b595552: refactor(#4663): move version/commitSHA into internal/buildinfo (@fullsend-ai-coder[bot])
• 6757115: refactor(codex): count a child's usage whatever codex's exit code (@dhshah13)
• fc09465: refactor(codex): count native child tokens in run metrics (@dhshah13)
• 949bd95: refactor(codex): count nothing for a child with more than one rollout (@dhshah13)
• 21b934d: refactor(codex): fold what a failed or torn child read returned (@dhshah13)
• fdac47a: refactor(codex): name a child by its last turn_context (@dhshah13)
• 73f0c68: refactor(codex): read a child's usage from its last token_usage_record (@dhshah13)
• 667a81d: refactor(codex): read native child usage from rollouts (@dhshah13)
• 9517fa6: refactor(codex): shorten the child-usage comments (@dhshah13)
• 6f9252f: refactor(codex): warn when a child's rollout cannot be read (@dhshah13)