Bloks 2.5.11

A security fix, a pile of community fixes, and steadier remote replies

Security

• An unrecognised credential is refused. A request from the same machine that carried an Authorization header the server did not recognise was treated as if it had no header, so it got the owner's local access. It is now refused with 401. Found, fixed and reported privately by Roman Pavlovskyi (@rpavlovs). Thank you, Roman. Please update.

From the community (thank you, @grantterra and @rpavlovs)

• A better model picker. It scrolls with long catalogs, opens at the model you picked, wraps long names to two lines with the full name on hover, and has a search box for engines with more than eight models. (#92, #96, #97)
• Pi uses the model you pick. Bloks now switches Pi's model the way pi-acp expects, stops the turn with an error if a switch is refused, and full access no longer turns Pi's thinking off. Pi's startup listing no longer shows up as the start of a reply. (#93, #94)
• Windows. npm-installed engines such as Pi now start, and no console window flashes when an engine runs. (#91, #95)
• Codex. A model picked mid-conversation now takes effect on the next turn, and a turn the provider refuses says why instead of ending in silence. (#100, #101)
• Rooms. A room message for an agent that is mid-turn now waits and is delivered when its turn ends, and archived rooms are left out of the MCP room list. (#87, #99)

Fixes

• Late permission requests are answered. A Claude Code background task that asked for permission after its turn ended was logged as allowed but never answered. It now gets its answer, and a decision that cannot be delivered is said in the chat instead of being recorded as allowed. (#102)
• Replies through Bloks Cloud stay put. A streamed reply no longer disappears when the turn ends or shows twice. (#89, #90)
• Change cards leave ignored files out. Logs and build output your repository ignores are no longer listed, and Undo no longer touches them. (#88)
• Apply keeps your later edits to big files. A rehearsal's Apply no longer overwrites a large file you changed after it began. (#86)
• A rename sticks. A slow answer to a conversation action no longer puts an agent's old name back. (#85)