v1.3.2-upstream8.0.23

v1.3.2-upstream8.0.23 - 2026-10-14

Summary

• Improve cross-provider compatibility and credential concurrency through selective absorption of upstream v8.0.23, preserving the fork's responses-tools authorization and exact tool identity handling.
• Correct tool-call ID replay, image-model routing, stream termination and usage reporting without a configuration migration or public request-converter signature change.
• Publishing this release does not install a binary, update operator configuration or restart a running service.

Upstream alignment

• Upstream release: v8.0.23
• Previous baseline: v8.0.16
• Intake record: absorbed.md
• Ported: 26 individually reviewed upstream commits from v8.0.16 through v8.0.23, including 25 ports with production changes and one regression port for an equivalent existing xAI fix. PR #28 merged the verified intake into main at 63aa6004.
• Skipped: 15 non-merge commits were deferred or inapplicable, and six merge wrappers had no independent behavior. The ledger records every SHA and reason. Deferred work includes the attachment/error-converter chain, public converter signature migration, TTS, global GitHub credentials, the npm version updater, Vertex native Interactions, Responses WebSocket interrupt and Claude Responses compaction. This is selective alignment, not incorporation of the whole upstream release.

Breaking changes

• None for supported requests and configurations. Existing converter signatures, configuration fields and installed services are retained.

Added

• No new public API endpoint or configuration option. Package-level regression tests cover the compatibility fixes and retained fork contracts.

Changed

• xAI keepalive test fixtures wait for the complete request after Pong delivery before sending the terminal response, removing a premature-close race without changing production WebSocket behavior.
• Claude system-instruction placement follows OAuth and conversation layout while retaining fork CLI detection, session-date pinning, cache behavior and OAuth tool aliases.
• OpenAI-compatible streaming TTFT observes effective token frames before translation or downstream backpressure, rather than counting an early empty or role-only frame as a token.
• Disabled or unselected plugins are detached during configuration application. The v8 configuration API renders collections and mapping keys consistently in YAML.

Fixed

• In-flight token refreshes and late execution results no longer overwrite or penalize credentials updated concurrently; active quota cooldowns survive successful refreshes, and batch model registration reconciles concurrent auth changes.
• Gemini-to-Claude translation preserves camelCase system instructions, refusal reasons and signed visible-text/tool-call carriers while retaining exact tool-name restoration.
• Vertex streams do not record client cancellation as failure after a terminal chunk has actually been delivered. Real read failures still cannot synthesize successful completion.
• Muse Responses requests preserve foreign reasoning ciphertext. Claude missing-thread errors support plain and structured bodies, JSON SSE errors remain on one line, and model output defaults respect registered limits.
• Claude rate-limit parsing excludes overage billing reset times, and trailing stream usage remains authoritative. Antigravity completion-token counts include thinking tokens.
• Devin tool-call IDs are encoded reversibly and restored for upstream history. Claude repairs non-portable legacy call/result IDs with collision handling before final generation payload rules; explicit overrides and filters remain authoritative. Native and local token-count paths also repair ID pairs.
• Direct OpenAI image requests preserve resolved upstream model identities across JSON and multipart requests; payload rules are applied once after normalization.
• Home-dispatched credentials bypass redundant local availability filtering. Existing Home protocol fields remain unchanged.
• xAI replacement-connection terminal cleanup matches upstream; the upstream regression test now covers the existing equivalent fork fix without adding a second implementation.

Security

• Preserve final outbound tool-contract checks, exact identity restoration and availability-neutral handling of preparation failures. Credential-version and registration guards also cover fork-specific stream failure paths.
• Gateway protocol validation continues to complement client and MCP execution authorization; it does not replace those permissions. No new credential source or default permission is introduced.

Validation

• The final v1.3.2 candidate passed the full seven-stage Go 1.26.4 maintenance gate after the fixture fix, including the full Go suite, all seven race-sensitive packages and the server build.
• The unpublished v1.3.1-upstream8.0.23 release gate exposed a sessionless xAI keepalive fixture race. The unchanged test reproduced locally in 100 runs. Both corrected xAI keepalive tests passed 100 repetitions each, with and without the race detector; their assertions still require Pong delivery while the payload write is held. The failed tag remains unchanged.
• The clean baseline 5349958c and production candidate 439e9f12 passed GOTOOLCHAIN=go1.26.4 bash ops/upstream-intake/verify-absorb.sh: maintenance tooling, pinned gofmt, vet, responses-tools invariants, the full Go suite, seven race-sensitive packages and server build.
• PR #28 CI and post-merge main CI passed. The intake merged with the verified PR tree. Subsequent release preparation changes only the two xAI keepalive fixtures and release notes; production source remains unchanged.
• Identical frozen inputs on complete baseline and candidate source trees cover four leaf cases: camelCase Gemini system instructions, JSON SSE errors, and Antigravity token accounting with and without visible output tokens. All four fail on the expected baseline assertions and pass on the candidate.
• A temporary mutation removing pre-policy Claude ID repair makes both Execute and ExecuteStream ordering regressions fail; the unmodified candidate passes. Vertex API-key/service-account and Home dispatch tests use isolated local fixtures.
• Release CI repeats the full maintenance gate and publishes only after all ten platform archives and the downloaded assets' SHA256 checksums are verified. Platform builds do not certify real client behavior on every operating system.

Known issues

• This intake adds no live official-client/provider performance run or new task success-rate, token-saving or cost-saving claim. Earlier tool-loading reports retain their original versions and measurement limits.
• Responses WebSocket interrupt, Claude Responses compaction, native Vertex Interactions and the deferred attachment-rejection/error-converter contracts are not included. The existing public request-converter return type is retained.
• Finalizer-only payload-rule behavior for Devin and count_tokens, live Home deployment behavior, complete dynamic permission revocation and broad cancellation coverage are not certified by this release. See the intake ledger for the exact deferred dependencies and replay boundary.

Release assets

• CLIProxyAPI_<version>_linux_<arch>.tar.gz is the default Linux build. It supports dynamic library plugins and targets a GLIBC 2.17 baseline.
• CLIProxyAPI_<version>_linux_<arch>_no-plugin.tar.gz is the portable Linux build for musl-based or older systems such as OpenWrt. It does not support dynamic library plugins.
• CLIProxyAPI_<version>_freebsd_aarch64_no-plugin.tar.gz is the FreeBSD arm64 build. It is built without CGO and does not support dynamic library plugins.

Full changelog

Compare v1.3.0-upstream8.0.16...v1.3.2-upstream8.0.23