v2.1.4

GO-with-conditions resolved

All remaining Medium/Low conditions from the v2.1.3 security audit are now addressed.

• Connect timeout: connectTimeoutMs (default 30s) covers DNS, TCP, TLS, and response header stalls via AbortSignal.timeout
• Native catalog: supports_parallel_tool_calls preserved from upstream template for native OpenAI models; only routed entries forced to false
• Reasoning summary: suppressed when reasoning.summary is undefined (not just "none"), matching the Responses API spec
• Regression tests: 7 new bridge tests — output order, custom/search tool types, error status, MCP namespace round-trip, hideThinkingSummary SSE + non-stream

v2.1.3

Security fixes (GO-with-conditions)

External GPT Pro security re-audit passed. All High/Blocker findings resolved.

Round 1-2 (prior commits on main)

• OpenAI API-key URL double /v1 fix
• Azure Responses v1 endpoint handling
• WebSocket Origin allowlist
• openUrl() command injection → spawn() + shell:false
• config.json atomic writes with 0o600
• parallel_tool_calls catalog guard

Round 3 — this release

• auth.json permission migration: atomicWriteFile() + hardenExistingSecret() at load time ensures existing 0644 files are fixed to 0600 on first startup
• Directory hardening: hardenConfigDir() fixes existing 0755 → 0700 at all entry points
• Non-streaming tool output: buildResponseJSON() now handles tool_call_start/delta/end, preserves output order, distinguishes function_call/custom_tool_call/tool_search_call, and propagates error events
• Reasoning summary suppression: hideThinkingSummary now consumed in both SSE and non-streaming paths, including web-search sidecar
• MCP namespace round-trip: Anthropic/Google adapters flatten namespace via namespacedToolName(), Zod schema preserves namespace field, findToolById() propagates namespace to tool results
• Upstream parallel_tool_calls:false: openai-chat adapter explicitly sends the field when tools are present
• Stall detection fix: upstream activity tracked on event receipt, not emission — prevents false response.incomplete when thinking_delta is suppressed

Remaining conditions (v2.1.4 candidates)

• Pre-header connect timeout (Medium)
• Native catalog parallel_tool_calls preservation (Low)
• reasoning.summary undefined handling (Medium)
• Regression test coverage for new paths (Medium)

v2.1.1

Published to npm as @bitkyc08/opencodex@2.1.1 with dist-tag latest.

Commit log

Changes since v2.0.2:

• feat: detect and repair stale Codex autostart shim (f4b3d44)
• fix: preserve Codex updates during shim repair (d33beb1)
• test: extend shim tests — marker detection, bypass env, round-trip write (9c938e8)
• docs: add autostart shim documentation (service vs shim comparison) (93145fd)
• security: bind to 127.0.0.1 by default + restrict CORS to localhost (6862700)
• feat: per-model wire protocol override for OpenCode Go MiniMax/Qwen (2d10361)
• fix: emit response.incomplete on adapter EOF and heartbeat stall (b678a5f)
• security: disable unsafe /api/config PUT endpoint (af6ae66)
• [agent] docs: devlog/210 plan — Anthropic SDK adapter port (b087075)
• [agent] docs: devlog/210 plan — Anthropic SDK adapter port (367c642)
• fix: detect Windows Codex updates that bypass .cmd shim via PATHEXT (1b626e4)
• ci: add GUI build, dev branch trigger, crash restart hard failure (be0b620)
• [agent] feat: Anthropic SDK adapter — executeStream via @anthropic-ai/sdk (96146d2)
• [agent] feat: add anthropic-sdk adapter as separate adapter type (2021560)
• [agent] revert: remove anthropic-sdk adapter — Agent SDK path not viable, raw fetch is correct (121c0f2)
• [agent] chore: remove devlog/210 — anthropic-sdk adapter plan cancelled (a08c768)
• fix(ci): install GUI dependencies before build step (85fa43d)

Full diff

v2.0.2

Published to npm as @bitkyc08/opencodex@2.0.2 with dist-tag latest.

Commit log

Changes since v2.0.1:

• fix(ci): reset exit code in windows schtasks uninstall step (d0b5989)

Full diff

v2.0.1

Published to npm as @bitkyc08/opencodex@2.0.1 with dist-tag latest.

Commit log

Changes since v2.0.0:

• [agent] feat: simplify Add Provider modal for presets + rename ZAI/MiniMax labels (f15b5e5)
• [agent] feat: add setup guide dropdown in Add Provider modal for presets (171f6e9)
• Add Codex autostart shim (#4) (d591c4f)
• feat: refresh Codex cache after provider changes (#3) (0157ffe)

Full diff

v2.0.0

Published to npm as @bitkyc08/opencodex@2.0.0 with dist-tag latest.

Commit log

Changes since v1.9.5:

• fix: move star prompt to start flow (54ffbe7)
• Add Neuralwatt effort routing (f71be19)
• docs: scaffold 160 dashboard redesign + media models devlog (7689d85)
• ci: add cross-platform release gate (956fa59)
• docs: document ci and release workflows (d7453af)
• feat: hide image/video generation models from routed catalog (7593e45)
• feat(gui): redesign dashboard with light/dark themes (d21eceb)
• feat(gui): refine dashboard — drop Auth column, group models, lighten boxes, fix mobile tabs (5280c00)
• fix(gui): resolve mobile horizontal overflow + table scroll + accent checkboxes (3e7a983)
• [agent] docs: add ima2-generated brand assets and apply to README, docs-site, OG meta (27d597b)
• fix(gui): auto-refresh Models list for lazily-loaded providers (fd275f4)
• fix: report real npm version + restore logo visibility in light mode (637d201)
• [agent] test: add negative test — verify 'max' is stripped from Codex catalog efforts (cc7ffc8)
• feat(gui): add en/ko/zh language router + translate the dashboard (dd128a6)
• [agent] docs: rewrite all READMEs — add provider guide, model routing, richer highlights (db87055)
• docs: record dashboard i18n language router (160.14) (e40b323)
• [agent] fix: ocx stop now disarms service manager before killing process (03397c7)
• [agent] docs: add 4-line hero tagline above banner (2eec93c)
• [agent] fix: center-align README tagline + fix Windows CI schtasks query exit code (88050b4)
• [agent] docs: add Codex App model picker screenshot to README and docs-site (e2b64d0)
• [agent] feat: dashboard Stop button + /api/stop endpoint + clean-exit docs (b43554b)
• [agent] feat: move Stop button to sidebar — power icon, red accent, confirm dialog (2af2649)
• [agent] fix(gui): align brand logo, name, and version badge vertically (6a5cdcc)
• [agent] docs: sync structure/ and GitHub Pages with recent changes (02042d1)
• [agent] fix(gui): remove background radial gradient glow (17f9306)

Full diff

v1.9.5

Published to npm as @bitkyc08/opencodex@1.9.5 with dist-tag latest.

Commit log

Changes since v1.9.4:

• fix: avoid missing codex catalog injection (7937340)

Full diff

v1.9.4

Published to npm as @bitkyc08/opencodex@1.9.4 with dist-tag latest.

Commit log

Changes since v1.9.3:

• docs: refresh opencodex documentation (ef2cf1c)
• docs: flatten structure source of truth (db28385)
• docs: record opencode go official contract retry (a8eeec0)
• docs: use scoped opencodex install spec (67ef97c)

Full diff

v1.9.3

Published to npm as @bitkyc08/opencodex@1.9.3 with dist-tag latest.

Commit log

Changes since v1.9.2:

• Fix native reasoning passthrough history (706eb2f)

Full diff

v1.9.2

Published to npm as @bitkyc08/opencodex@1.9.2 with dist-tag latest.

Commit log

Changes since v1.9.1:

• Fix strict Codex catalog regeneration (41e75ba)
• Fix orphan chat tool results (f8b3d82)
• Disable websocket transport by default (e804ba5)

Full diff