codegraff v0.2.15

codegraff v0.2.15

Released 2026-06-03

This release is about reach and resilience. codegraff gains a native desktop
app (a Tauri GUI with first-class slash commands) to sit alongside the CLI and
TUI, so the agent is now usable from a window as well as a terminal. Under the
hood, 0.2.15 lands the full context engineering stack — a two-tier
reversible tool-result offload, a lean tools_list that cuts the tool
catalog from ~46 KB to ~11.5 KB, live-turn preservation so compaction stops
re-answering the first prompt, and MCP-server globs surfaced as first-class
tools (codedb included). It fixes the long-standing papercut where @-mentioning
a PDF or other binary errored out — those mentions now reflect the file's
absolute path so the read tool takes over. The SDKs keep hardening
(TypeScript can never publish without its native loader again, Python gains
JSON-schema / structured-output mode, agent selection, and headless MCP trust),
and codex gpt-5.5 moves to a 1,000,000-token context window.

macOS binaries for this release are signed with a Developer ID Application
certificate (hardened runtime) and notarized by Apple, and every platform's
assets are versioned 1:1 with the v0.2.15 tag so install.sh resolves them
cleanly.

Highlights

• New Tauri desktop app (codegraff-gui) with desktop slash commands — a
  windowed coding-agent interface powered by the same core as the CLI/TUI.
• @-mentioning a PDF or binary no longer errors. The mention now reflects
  the file's absolute path as a <file_reference>, handing the agent off to
  the read tool instead of failing with "Binary files are not supported".
• Two-tier reversible tool-result offload for compaction — large tool
  results are offloaded in tiers and can be brought back, instead of being lost.
• Lean tools_list: one-line tool summaries shrink the tool catalog from
  ~46 KB to ~11.5 KB, leaving far more room for real work.
• Live-turn preservation in compaction — the agent no longer re-answers the
  first prompt after a compaction.
• MCP-server globs are now first-class tools, so specific MCP servers (e.g.
  codedb) surface their tools directly rather than hiding behind a generic
  wrapper.
• codex gpt-5.5 context window raised to 1,000,000 tokens.
• TypeScript SDK never ships without its N-API loader again — a publish-time
  guarantee that @codegraff/sdk always includes the native binding it needs.
• Python SDK gains JSON-schema / structured-output mode, agent selection,
  per-call prompt/temperature overrides, and a headless MCP-trust fix.
• Signed + notarized macOS binaries (arm64 and x86_64), version-matched to
  the release so the installer never 404s.

Desktop app (codegraff-gui)

• A new Tauri-based desktop application lands under gui/, giving codegraff a
  native windowed interface in addition to the CLI and TUI. It is built on the
  same forge_* core crates as the rest of the project (consumed as path
  dependencies), so behavior stays consistent across surfaces.
• Desktop slash commands bring the familiar slash-command workflow into the
  GUI.
• The GUI is its own decoupled cargo workspace (gui/src-tauri) so its build
  artifacts and lockfile stay isolated from the CLI workspace, and it is versioned
  in lockstep with the CLI (now 0.2.15).

Attachments & @-mentions

• Binary / PDF @-mentions are no longer a dead end. Previously, mentioning a
  non-text file (a PDF, an image, any binary) returned "Binary files are not
  supported" and stopped there. Now the mention reflects the file's absolute
  path and emits a <file_reference path=… mime_type=…> marker, which routes the
  agent to the read tool — the correct handler for that content — instead of
  erroring.

Context engineering & compaction

This release completes the context stack that 0.2.14 began:

• Two-tier reversible tool-result offload. Oversized tool results are offloaded
  in two tiers and remain recoverable, so compaction reclaims context without
  permanently dropping information the agent may still need.
• Live-turn preservation. Compaction now protects the in-flight turn, fixing
  the bug where the agent would re-answer the very first prompt after
  compacting.
• Lean tools_list. Tool definitions are summarized to one line each,
  taking the serialized tool catalog from ~46 KB down to ~11.5 KB — a large
  reduction in fixed per-request overhead.
• MCP-server globs as first-class tools. Specific MCP servers' tools (such as
  codedb's) are now surfaced directly in the tool list rather than behind a
  single generic glob, so they're discoverable and callable like any built-in.

Providers & models

• codex gpt-5.5 is configured with a 1,000,000-token context window,
  unlocking long-context runs on that model.

TypeScript SDK (@codegraff/sdk)

• Never publish without the native loader. The publish pipeline now guarantees
  @codegraff/sdk ships with its N-API loader every time — the package can no
  longer be released in a broken, loader-less state.
• Publishing fixes to ensure the main @codegraff/sdk package is the one that
  goes out, with the SDK moving to 0.2.4.
• response_format plumbing added to the core so the 0.1.3 Python SDK's
  structured-output mode has the support it depends on.

Python SDK (codegraff)

• JSON-schema / structured-output mode (SDK 0.1.3): constrain model output
  to a schema for reliable structured results.
• Agent selection plus per-call prompt and temperature overrides.
• Headless MCP-trust fix, so MCP servers work correctly in non-interactive
  (SDK/headless) usage.
• BYOK fix: extra_params are now passed through to upsert_credential in the
  BYOK constructor.
• Packaging & CI: full-matrix PyPI release, pyo3 upgraded 0.24 → 0.28 for
  Python 3.14 / 3.14t, protoc installed inside the manylinux container,
  aarch64-linux built on a native arm64 runner, a PyPI readme field so the
  package renders its README, and an honest platform-support note
  (mac-arm64 wheels today, no sdist).

CI, telemetry & docs

• GRAFF_TRAJECTORY_ENDPOINT is baked into release builds from a CI secret, so
  released binaries point at the correct trajectory endpoint.
• README rewritten around the CLI + SDKs, with in-depth TypeScript and
  Python guides.
• Housekeeping: forge.md renamed to codegraff.md, and duplicate pipeline
  tests dropped.

Install

curl -fsSL https://github.com/justrach/codegraff/releases/latest/download/install.sh | sh

The installer detects your platform and pulls the matching graff and codegraff
binaries plus fzf and codedb. To pin this exact version:

curl -fsSL https://github.com/justrach/codegraff/releases/download/v0.2.15/install.sh | sh v0.2.15

Platforms & artifacts

Platform	Targets
macOS	aarch64-apple-darwin, x86_64-apple-darwin (signed + notarized)
Linux	x86_64/aarch64, both gnu and musl
Windows	x86_64/aarch64 (pc-windows-msvc)
Android	aarch64-linux-android (graff only)

macOS signing & notarization

• The macOS graff and codegraff binaries are codesigned with the Developer ID
  Application: Rachit Pradhan (Team WWP9DLJ27P) certificate using a hardened
  runtime and a secure timestamp, then notarized by Apple.
• Because they are bare CLI executables (not .app/.dmg/.pkg bundles), the
  notarization ticket is validated online by Gatekeeper on first run; there is
  nothing to staple. The install.sh path additionally clears the quarantine
  attribute on the installed binary.
• Each tool is published both as a raw binary (e.g. graff-aarch64-apple-darwin,
  consumed by install.sh) and as a .zip (e.g. graff-aarch64-apple-darwin.zip,
  the notarized archive). All four binaries (graff/codegraff × arm64/x86_64)
  report version 0.2.15, matching the v0.2.15 tag so install.sh — whether it
  resolves latest or a pinned v0.2.15 — always finds the right asset.

Upgrade notes

• This is a non-breaking release; existing configuration and credentials carry
  over. Re-run the installer (above) or download the new binaries from the release
  assets.
• The full runbook for cutting the signed + notarized macOS artifacts lives at
  docs/releases/macos-build-and-notarize.md.