FyAgent v0.4.12

FyAgent v0.4.12

This is a transitional pre-release after 0.4.10. It collects the high-priority fixes from the 0.4.11 review on top of the CC Switch 4.0.4 base. 0.4.10 remains the latest stable release.

Behavior change: local network access needs an access key

• When the local proxy listens only on this machine (127.0.0.1), nothing changes and no key is needed.
• When the local proxy listens on a local network address, every request must carry the access key; requests without it or with a wrong key are rejected. Previously other devices on the local network could use it without a key. After upgrading, set the key in the proxy settings first, then enter it on the other devices.
• The access key is kept only in memory and is not written to logs, health checks or usage records; it is masked wherever it is shown. After the program file is replaced, the key in use stays valid.

Fixes

• Proxy safety. Decompression size is bounded, upstream error bodies are redacted in logs, health and usage, and the request body limit is enforced.
• Credentials. Oversized OpenCode credentials are rejected instead of silently dropping the access token, and tokens are zeroized before validation.
• State and recovery. A failed save restores the exact previous live file, stack read errors are reported, and own __proto__ data is kept in the deep clone fallback.
• Database and MCP errors. Proxy column migration, MCP JSON conversion and OpenCode snapshot errors are propagated instead of ignored; failed MCP toggles roll back and JSON errors are redacted.
• Provider import. Shared snippet failures after manual import are reported, and raw post-processing errors are no longer shown.
• Assignment and change plan. The assignment keeps its failure stage, reason and recovery state, plain-text native errors are shown on their own line, and a plan retargeted to another provider is rejected without writing.
• Prompts. In-flight reads are cancelled before the post-write refresh, and the prompt view is reset per app (#363 #364).
• CI and docs. Toolchain versions are read from the declared contract; SECURITY.md and session manager docs are aligned.

Verification scope

• Each of the nine fix branches passed a full CI run on the fork, and the combined branch passed a full CI run on the fork before release. No manual acceptance on real Windows or macOS machines and no signed installer.

Usage notes

FyAgent must remain running for local subscription forwarding. If you reach FyAgent from another device on the local network, set the access key first.

See the changelog and Chinese notes.

Windows installer signing status

Mode: unsigned; source: e3bddc4dcb41f52f232630f764ccb1733f0058c5. The installer rows below are backed by the published signing-status.json and artifact-attestation.sigstore.json evidence.

Architecture	Installer	Authenticode	Publisher	Timestamp	SHA-256	Source SHA	Attestation
x64	FyAgent-0.4.12-Windows-x64-setup.exe	NotSigned	Not signed	None	9aba9dce435c3f71082ce95fb0188b70f977c9c96ba630bd607991e1c779176b	e3bddc4dcb41f52f232630f764ccb1733f0058c5	artifact-attestation.sigstore.json subject FyAgent-0.4.12-Windows-x64-setup.exe digest sha256:9aba9dce435c3f71082ce95fb0188b70f977c9c96ba630bd607991e1c779176b
arm64	FyAgent-0.4.12-Windows-arm64-setup.exe	NotSigned	Not signed	None	9d2a367046f3e12cea912e0cef2bf5376d0b9ade2ae87b26c486f505807ddbed	e3bddc4dcb41f52f232630f764ccb1733f0058c5	artifact-attestation.sigstore.json subject FyAgent-0.4.12-Windows-arm64-setup.exe digest sha256:9d2a367046f3e12cea912e0cef2bf5376d0b9ade2ae87b26c486f505807ddbed