v2.9.0

Published to npm as @bitkyc08/opencodex@2.9.0 with dist-tag latest.

What's Changed

New Features

• feat(providers): add DeepInfra preset by @olddonkey in #747
• feat(providers): add Hyperbolic preset by @olddonkey in #751
• feat(providers): add Volcengine Ark provider presets by @yrooogerg in #611
• feat(issues): add orthogonal area labels for triage by @Wibias in #830
• feat(export): client config export for Pi and OpenCode by @lidge-jun in #852

Bug Fixes

• fix(service): make Windows scheduler stop actually stop the proxy by @Wibias in #780
• fix(providers): add China Coding Plan baseUrl choice for Alibaba by @Wibias in #776
• fix(openai-chat): complete streams that end after output without terminal by @Wibias in #793
• fix(providers): default DeepSeek V4 Flash to Responses by @estelledc in #808
• fix(cursor): support current Grok 4.5 Fast wire IDs by @jbaehova in #797
• fix(service): bake WinSW admin env and retry stop-path probes by @Wibias in #805
• fix(logs): raise in-memory log buffer and support limit/offset by @Wibias in #784
• fix(providers): manage default provider safely by @eachann1024 in #810
• fix(codex): persist refreshed pool account plans by @luvs01 in #750
• fix(storage): await Worker exit before isolate reclaim on Windows by @Wibias in #813
• fix(security): allow TLS terminator Origin scheme skew for management by @Wibias in #779
• fix(security): retry required ACL harden after soft timeout by @Wibias in #782
• fix(catalog): prioritize model names in picker labels by @songwunil in #763
• fix(codex): preserve auto-compaction limit on inject by @Ingwannu in #832
• fix(cli): authenticate Codex health with admin token by @Ingwannu in #835
• fix(catalog): preserve on-disk rows on default sync by @Ingwannu in #836
• fix(oauth): normalize Antigravity refresh margin by @Ingwannu in #831
• fix(router): pin Codex auto review to OpenAI by @Ingwannu in #833
• fix(codex): distinguish exhausted quota from unknown by @Ingwannu in #834
• fix(gui): stop revisit flashes and layout shift across dashboard tabs by @Wibias in #824
• fix(storage): await Worker join in test beforeEach under isolate by @Wibias in #827
• fix(update): recover Windows dashboard proxy after self-update by @Wibias in #838

Documentation

• docs(providers): name the Volcengine maintenance owner and record its evidence by @lidge-jun in #826

Chores

• test(windows): retry one transient CIM enumeration timeout by @luvs01 in #801
• test(storage): cap macOS isolate worker churn to avoid Bun segfault by @Wibias in #849

Other Changes

• Zero-leak state stores: hard caps, durable spill, and generation-fenced sweeping by @lidge-jun in #829

New Contributors

• @estelledc made their first contribution in #808
• @jbaehova made their first contribution in #797
• @yrooogerg made their first contribution in #611
• @songwunil made their first contribution in #763

Commits

• release: v2.9.0 (0ab92b8)
• feat(export): client config export for Pi and OpenCode (#852) (eeef701)
• Merge pull request #849 from Wibias/fix/macos-isolate-worker-segfault (18352b4)
• test(storage): budget multi-satellite quarantine restore on Windows (9e7cc30)
• fix(storage): lengthen Windows Worker OS-join settle under isolate (4d7ee28)
• Merge remote-tracking branch 'upstream/dev' into fix/macos-isolate-worker-segfault (ebdf535)
• Merge pull request #838 from Wibias/fix/update-proxy-recovery (6a09cb7)
• test(storage): budget satellite restore-failure cleanup on Windows (8ddf196)
• merge(dev): sync tip before full-review verdict (daf9c59)
• merge(dev): absorb #827 isolate settle and ACL stub fixes (b031cd1)
• Merge pull request #827 from Wibias/fix/storage-worker-isolate-beforeeach (a1ed691)
• Merge remote-tracking branch 'upstream/dev' into fix/macos-isolate-worker-segfault (a7cb033)
• merge(dev): resolve isolate settle and ACL stub conflicts (9931337)
• fix(update): reject stub Bun probes and re-kill reused reclaim PIDs (5dd670f)
• merge(dev): sync fix/update-proxy-recovery with tip for full review (8e732a8)
• Merge pull request #824 from Wibias/fix/gui-ux-bugs (63735af)
• merge(dev): clear conflicts so Cross-platform CI can run again (c12838f)
• merge(dev): sync tip Windows budgets and management-auth fixtures (d0b44e7)
• test(ci): budget the server-bind and tsc-spawn cases the windows runner measured over 5s (aae9426)
• test(win): scope ACL timeout fakes (6cb641c)
• ci: note that runner groups are unavailable on a user-owned repo (429fa3b)
• ci: correct the security claim in the windows routing comment (7279a6f)
• fix(test): narrow management-auth icacls stubs for real win32 (f1fa464)
• merge(dev): restore mergeability so Cross-platform CI can run (54aa3ed)
• ci: nudge Cross-platform CI after missed synchronize runs (7c5b49d)
• merge(dev): pick up darwin worker OS-join settle (ffb9782)
• test: cover dir-fsync failure path and clear oauth race deadline (34a1ac4)
• merge(dev): sync base for isolate hang fixes and Windows runner select (2d82ddf)
• test(ci): budget OAuth CAS and translator typecheck under windows load (649fdf9)
• fix(storage): settle the OS Worker join on darwin too, and cap isolate churn (58be730)
• merge(dev): sync tip Windows drain/ACL fixes into update recovery (bf8b015)
• ci: touch config ACL helper comment to retrigger path-filtered CI (60fd91c)
• ci: retrigger Cross-platform CI after missed synchronize (aeee841)
• fix(ci): stop Windows suite hang and ACL-timeout start abort (bb4c4a4)
• test(config): expect config-mutation ACL timeoutMemoKey (14a73cf)
• fix(shells): ref the kill-grace timer so Windows shutdown drain can finish (1ed2d70)
• test(ci): count the windows runner-selector job in the bounded-jobs gate (1ace71a)
• fix(auth): stop management ACL timeout tests from poisoning startServer (7e041d7)
• ci: route the windows leg to a self-hosted runner on trusted events only (aeb7423)
• fix(win): record the fsync attempt and degrade coordination-path ACL stalls (320814a)
• fix(test): skip isolate Worker hammers off Windows (f27ed58)
• fix(ci): skip isolate worker-spawn hammers on linux (15534e0)
• merge(dev): keep oauth wait-timer and shell grace-timer isolate fixes (94628ec)
• test(ci): pin Cross-platform timeout ownership per job (f3bbc60)
• Merge remote-tracking branch 'upstream/dev' into fix/storage-worker-isolate-beforeeach (56d1f8d)
• fix(cursor): keep background-shell term-grace timers ref'd under isolate (a3f2fbc)
• test(storage): drop unused darwin settle sleeps in teardown isolate (aacbf89)
• fix(responses): record dir-fsync after best-effort attempt on Windows (ed92918)
• revert(ci): keep Windows Cross-platform job at 30m (b6c39ac)
• fix(oauth): keep short mutation wait timers ref'd on Windows (60be0c5)
• test(ci): stop the OAuth queue tests from stalling the Windows runner (675eb6a)
• ci: raise Windows Cross-platform job timeout to 45m (584d381)
• fix(ci): harden storage worker isolate teardown against Bun segfaults (cdff5be)
• fix(oauth): keep mutation wait timers ref'd under isolate (e07ba88)
• test(ci): budget Anthropic messages e2e for windows-latest (54a13e1)
• test(ci): expect 30-minute Cross-platform Windows job timeout (30bd1f2)
• ci: raise Windows Cross-platform job timeout to 30m (85030c7)
• fix(gui): raise client-resource-poll test timeout above waitFor (aeaf342)
• merge(dev): keep oauth admission gate cleanup with STORE_BUDGET_MS (8da1d7e)
• chore(ci): comment to retrigger Cross-platform CI on tip (ca3f025)
• test(storage): assert close-wins regression covers the registered path (63b6050)
• test(oauth): raise mutation admission case budget and always release gate (974ecc0)
• merge(dev): sync fix/update-proxy-recovery with upstream tip (96b40ec)
• merge(dev): sync PR 824 onto tip; keep Usage revisit quiet (c25fcb1)
• merge(dev): resolve drainAndShutdown conflict for isolate fix (62994c1)
• chore(ci): retrigger Cross-platform CI for tip (cd5afee)
• fix(ci): skip darwin Worker hammer cases under isolate (ebe74ce)
• merge(dev): resolve storage-worker-lifecycle test import conflict (81a010e)
• fix(storage): settle Worker join on darwin under isolate (b913fae)
• test(subagent): clarify Windows ACL hook timeout comment (1ce6a2c)
• test(subagent): raise fallback suite budget for Windows ACL hooks (1029e37)
• test(ci): budget the 128-mutation OAuth tail case for windows-latest (fa5780d)
• refactor(tests): drain storage workers before home allocation (05fc7e1)
• fix(gui): widen client-resource-poll waitFor on busy CI (687533e)
• fix(update): backend-aware Windows stop and safer restart edges (751dd8e)
• fix(storage): disarm terminate timeout before OS-join settle (0c6ef39)
• fix(gui): surface Logs failures when refresh is off and resync section tabs (660b47a)
• fix(ci): keep macOS --isolate; skip darwin Worker hammer cases (e7f4ec7)
• test(catalog): raise restore spawnSync case budget under isolate (655ecaa)
• docs(plan): sync the translator bounds doc with the shipped reservation API (09a0a18)
• refactor(gui): drop dead refs and duplicate Desktop/Debug cache reads (c0974f3)
• docs(devlog): record zero-leak proxy benchmark evidence (a7af5f5)
• refactor(update): clarify reclaim kill policy and dedupe wrapper stop (326da8f)
• fix(storage): cancel queued spawns on sync reset/abort (4ef29c8)
• fix(bench): close the eight gaps the benchmark self-audit surfaced (17faddd)
• fix(update): fail-closed reclaim and port probes after review (aa660dc)
• fix(server): await Bun Server.stop in drainAndShutdown (65043ef)
• fix(gui): keep seed revalidate across StrictMode and harden revisit UX (898cf79)
• test(ci): bind macOS isolate skip assertions to full step blocks (bef8e9c)
• fix(storage): settle Worker OS join on darwin under isolate (be8110e)
• fix(storage): clear mutation state only after Worker drain (cc08831)
• feat(shells): give every background shell an owner, a deadline, and a fenced exit (ff09467)
• docs(plan): fence the background shells before shutdown ever snapshots them (b925854)
• feat(consent): refuse agent-driven stars on every surface, not just the CLI (31b47dd)
• fix(ci): skip bun --isolate on macOS to avoid Bun 1.3.14 segfault (871e96f)
• merge(dev): sync base for storage worker isolate fix (4f45454)
• feat(translator): bound every translation buffer with a mandatory turn budget (a616078)
• test(storage): cap macOS isolate worker churn to avoid Bun segfault (58ed4c8)
• fix(gui): load Models combos through the shared resource layer (8d4122a)
• fix(gui): revalidate seeded resources and clear React Doctor blockers (9f82c64)
• Merge remote-tracking branch 'upstream/dev' into fix/gui-ux-bugs (ae7f5bd)
• docs(plan): rebuild the translator bounds around what actually retains bytes (80dd175)
• Merge remote-tracking branch 'origin/dev' into dev (d89ac53)
• docs(plan): record the wp5 budget audit rounds (dce0c02)
• fix(memory): key usage-summary age on read completion and gate enforcement single-flight (b78fc53)
• feat(memory): enforce an app-owned retained-state byte budget (77243d9)
• refactor(update): drop unused post-update bind wait helper (7fa2975)
• fix(update): tolerate healthz blips and skip non-elevated service reinstall (5f4a210)
• fix(update): spawn Windows GUI worker without inheriting LISTEN socket (2b80061)
• fix(update): wait out non-elevated ghost LISTEN instead of SetTcpEntry (eaa9513)
• fix(update): clear respawned listeners before pinned start (363667d)
• fix(update): require Bun bind and drop ghost TCBs before pinned start (d72e2d0)
• fix(update): retry pinned start on missing healthz after ghost ports (6b41c91)
• fix(update): retry pinned start when first post-update bind is lost (c156e87)
• fix(update): skip non-elevated service reinstall after ghost-port reclaim timeout (8b04e02)
• fix(update): wait for Node bind probe before optimistic pinned start (a381251)
• test(update): expect spawn refuse only when live port holders remain (b17fb06)
• fix(update): start after reclaim timeout when only ghost holders remain (ed2f9ba)
• fix(update): reclaim npm-rename respawns that fail ocx identity (92b1214)
• test(update): align port-reclaim expectations with allowlisted teardown kills (a5a62bb)
• fix(update): reclaim allowlisted PIDs that fail ocx identity mid-teardown (933f3e6)
• fix(update): stop Windows service wrapper respawn from blocking port reclaim (de87f49)
• fix(update): reclaim leftover ocx listeners after Windows self-update (3a56589)
• fix(update): recover dashboard proxy without requiring Background Service (b2a175f)
• Merge pull request #834 from lidge-jun/agent/fix-quota-100-classification-815 (e1fc0f2)
• Merge pull request #833 from lidge-jun/agent/fix-codex-auto-review-routing-816 (75b903a)
• Merge remote-tracking branch 'origin/dev' into dev (7b1f059)
• docs(plan): anchor the byte budget to the delivered hooks and real boundaries (b4393ad)
• docs(plan): record the wp4b audit and review adjudications (3a0b17b)
• fix(runtime): make stale disposers, aborted refresh owners, and forced shutdown lease-exact (8f33346)
• Merge pull request #831 from lidge-jun/agent/fix-antigravity-refresh-skew-828 (0d6eed2)
• Merge pull request #836 from lidge-jun/agent/fix-default-catalog-preservation-814 (2491f13)
• Merge pull request #835 from lidge-jun/agent/fix-cli-codex-health-auth-819 (030e4d6)
• Merge pull request #832 from lidge-jun/agent/fix-preserve-auto-compact-limit-817 (dd1b90f)
• test(router): cover non-OpenAI default fallthrough (514b91e)
• test(oauth): pin Antigravity expiry clock (1acc6b3)
• Merge pull request #763 from songwunil/fix/routed-picker-labels (bf7a643)
• Merge pull request #782 from Wibias/fix/766-admin-acl-opt-in (78416d9)
• Merge pull request #779 from lidge-jun/fix/760-management-origin-tls (aa924f3)
• fix(catalog): preserve on-disk rows on default sync (b52f316)
• fix(cli): authenticate Codex health with admin token (c9f18e5)
• feat(runtime): cap the registries, flights, and retained diagnostics (dd6c60b)
• fix(codex): distinguish exhausted quota from unknown (1a7ba04)
• fix(router): pin Codex auto review to OpenAI (f806372)
• fix(codex): preserve auto-compaction limit on inject (a944d3c)
• fix(oauth): normalize Antigravity refresh margin (f497c05)
• Merge pull request #830 from Wibias/feat/issue-area-labels (f182f08)
• fix(issues): run validate after translate for area heuristics (cc0ac77)
• fix(issues): harden area-label apply path after CodeRabbit review (5f5b2c4)
• test(ci): give bulk durable-IO tests a real budget and a clean memo slate (90579d4)
• fix(storage): join Workers via drainAndShutdown in isolate suites (10ab2e8)
• fix(issues): address area-label review findings (20401d3)
• fix(issues): tighten area-label heuristics against template noise (526aa03)
• docs(plan): retarget the registry caps at the owners that actually leak (6d45c2e)
• feat(issues): add orthogonal area labels for triage (05ecb40)
• docs(plan): align the B3/B4 adjudications with the repaired contracts (3ed4ca0)
• refactor(sweep): simplify the eviction fences to the generation contract (dcad281)
• feat(sweep): reconcile every keyed store against the live topology (8489720)
• docs(plan): give reconciliation unique attempt generations and live-object triggers (c7af1dc)
• docs(plan): fence eviction against stale writers and prune by combo target (becad99)
• feat(caps): bound the blob, replay, vision, and image caches by bytes (034d320)
• docs(plan): settle the blob-cap accounting classes across three audit rounds (319542c)
• docs(plan): pin blob liveness to the request and make admission atomic (3bffd92)
• feat(responses): hard-cap continuation state with durable spill (d1408b9)
• docs(plan): lock the spill replacement to one atomic stub swap (29bcb0e)
• docs(plan): harden the continuation spill transaction through eight review rounds (4bf0844)
• docs(plan): final refinements to the continuation, blob, and benchmark phase docs (dd5af60)
• docs(plan): map the zero-leak state-store unit before touching the stores (f44abed)
• fix(storage): await Worker join in test beforeEach under isolate (4bdf451)
• Merge pull request #826 from lidge-jun/codex/pr611-owner (6d54e5f)
• docs(providers): name the Volcengine maintenance owner and record its evidence (ef5cae9)
• Merge pull request #611 from yrooogerg/feat/volcengine-providers (4548310)
• fix(gui): stop revisit flashes and layout shift across dashboard tabs (b05f017)
• fix(providers): disclose the Volcengine Plan usage restriction (688fd77)
• fix(providers): correct Volcengine Plan GLM model id to glm-5.2 (3a37dda)
• fix(providers): preserve Volcengine custom destinations (d268748)
• fix Volcengine plan provider metadata (4e7f5a5)
• fix(gui): localize Volcengine provider labels (1b777a3)
• fix(providers): curate Volcengine model catalogs (3605adc)
• feat(providers): add Volcengine Ark presets (0a3885b)
• Merge pull request #813 from Wibias/fix/ci-windows-no-isolate (7b6f4f4)
• fix(relay): keep post-cancel drain timer ref'd so silent bounds fire (797dec1)
• merge(dev): resync onto tip stream/inspection fixes (6b97879)
• docs(fin): close the DeepSeek Responses wire unit (86a8224)
• fix(ci): soft-fail OpenAI-tier backup ACL harden on Windows (8151801)
• docs(plan): record the RSS unit push and close the verification gate (a9926d0)
• docs(plan): scope the park-state finding to the probe and fix the gate ledger (5f9434a)
• docs(plan): record the DeepSeek Responses wire outcome (7a793df)
• fix(deepseek): stop sending server-state parameters to a stateless upstream (c5fc888)
• docs(plan): adjudicate the external handoff and keep the probe record honest (1eae647)
• docs(plan): fold the third audit round into the stateless sanitisation phase (a37fb49)
• Merge remote-tracking branch 'origin/dev' into dev (30fb768)
• fix(stream): make the darwin eager selector honest about tee and the probe honest about parking (d59d0c1)
• merge(dev): resync worker teardown PR onto tip (a113d33)
• feat(deepseek): pick the wire by inbound protocol instead of by model alone (9adf58a)
• docs(plan): close the second audit round on the inbound-aware wire phase (54319d1)
• Merge pull request #750 from luvs01/agent/724-refresh-pool-plan (8c88321)
• feat(stream): let macOS opt in to the eager single-reader relay (a209188)
• fix(storage): cancel queued worker spawns on teardown (93fee2f)
• fix(deepseek): route the Responses wire to the documented /responses path (2cccfda)
• docs(plan): fold the audit blockers back into the DeepSeek wire roadmap (199b344)
• fix(test): widen aborted/invalid JSON 400 auth budgets on Windows (0a05150)
• test(storage): shorten non-Windows worker churn under isolate (13bbe72)
• docs(plan): write the DeepSeek Responses wire roadmap to diff level (bafb2e3)
• fix(codex): map refresh lock timeouts and empty WHAM plans (c4c4200)
• docs(plan): map the DeepSeek Responses wire defects before touching the adapters (3b379fb)
• fix(relay-eager): close a mid-stream reset with a real response.failed tail (316497f)
• Merge remote-tracking branch 'upstream/dev' into pr-750-conflicts (c310f3c)
• merge(dev): resync worker teardown PR onto tip (0a8d748)
• Merge pull request #751 from olddonkey/codex/572-chutes-hyperbolic-model-apis (18545f8)
• fix(storage): hold mutation slot until worker join completes (7b6ff43)
• fix(test): drain policy job before storage mutation teardown (235d62a)
• fix(relay): bound the SSE inspector and give the tee path a real disconnect (41af616)
• merge(dev): resync worker teardown PR onto tip (63f51db)
• merge(dev): sync #751 onto tip; keep DeepInfra + Hyperbolic (5fe8afb)
• merge(dev): resolve config.ts import conflict with tip (2e10ab3)
• fix(ci): drop ineffective Bun --shard under --isolate (25e3c82)
• fix(rss-harness): clamp pauses to monotonic deadlines and split warm-gate errors (a9c5f16)
• Merge pull request #747 from olddonkey/codex/572-deepinfra-novita-model-apis (89cb08f)
• docs(plan): map the RSS retention fixes before touching the streams (976ff3a)
• fix(ci): sync workflow hardening test with isolate shards (df5fafc)
• fix(ci): widen stalled 400 body test budget; sync OAuth Copilot docs (06a974f)
• fix(storage): await Worker exit before isolate reclaim on Windows (6621ac9)
• Merge remote-tracking branch 'upstream/dev' into pr-747-full-review (6d97a9f)
• Merge pull request #810 from eachann1024/fix/provider-i18n-fallback (5ddb14c)
• fix(test): budget ocx provider CLI spawns for Windows CI (77eeb81)
• merge(dev): sync CI Windows isolate workaround onto tip (2c83d62)
• merge(dev): sync #810 onto tip before merge (2d7c7be)
• feat(api-tab): give the page back its scrollbar (56ffd7a)
• feat(api-tab): show which key did what, and say what each endpoint accepts (6f52ef8)
• feat(usage): record which key made each request (332c2f1)
• fix(gui): gate the timezone setter so a stale response cannot land (c537dac)
• feat(auth): let admission name the key it just matched (e2a5c60)
• feat(api-keys): give every key an identity you can act on (b398a7c)
• docs(plan): plan the API tab around what it gets wrong (32ceae6)
• merge(dev): sync #810 onto tip before full-review verdict (57a0968)
• fix(ci): skip bun --isolate on Windows runners (b57c062)
• fix(winsw): restore interactive install TTY guard after rebase (0538cc1)
• test(storage): budget early cleanup SQLite setup on Windows CI (045fe42)
• fix(providers): require boolean setDefault on POST (6d3990e)
• fix(security): drop accidental service.ts tip merge from ACL pivot (d2e9a87)
• fix(security): retry required ACL harden after soft timeout (2b8c82c)
• test(storage): budget spawn-edge cleanup under Windows CI load (208cbe0)
• fix(security): propagate directory ACL unverified into management auth (f1d1893)
• fix(service): propagate ACL opt-in into Windows service env (20d7201)
• test: set USERNAME in win32 ACL opt-in test on CI (9cdb0da)
• fix: address issue #766 (507604a)
• fix(security): admit TLS Origin skew only via corsAllowOrigins (bb1dcea)
• fix(security): tighten TLS skew origin port matching (efec5fd)
• fix: address issue #760 (1a64585)
• merge(dev): refresh pool-plan branch onto tip after #801 (7b22a8b)
• fix(codex): harden pool plan refresh under config lock contention (e33fece)
• fix(providers): reject disabled setDefault on POST create (9b73667)
• test(windows): retry one transient CIM timeout (#801) (33caf33)
• docs(providers): spell out enabled-only default delete guards (59a4038)
• fix(providers): skip disabled providers when reassigning default (dc6e92b)
• merge(dev): sync #810 onto tip for disabled-default delete guard (6052415)
• docs(plan): record the last three, which had three different causes (8b9347a)
• test: give slow-work budgets one home and one rule (e78fff1)
• test(server-auth): stop three tests from racing the runner instead of the clock (d2eb93d)
• docs(plan): separate the Windows CI red into three failure modes (2eb7499)
• docs(plan): adopt two corrections from the parallel Windows investigation (993e39a)
• fix(providers): manage default provider safely (1cf32f5)
• docs(plan): finish the flake taxonomy — four classes, two opposite fixes (ee7c252)
• test(claude): give the idle-ping test headroom against timer scheduling (7093459)
• test(tray): budget the socket-inheritance proof for what it actually does (81f3f68)
• Merge pull request #784 from Wibias/fix/726-log-pagination (cd46a34)
• Merge pull request #805 from lidge-jun/fix/764-winsw-env-and-liveness-probe (b1f33ab)
• fix(test): raise Windows timeout for CLI spawn smoke tests (217db04)
• test(storage): raise cleanup suite timeout for Windows CI load (3e95ba3)
• fix(liveness): bound stop probes and harden WinSW secret tests (7586a22)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (4ef32b0)
• Merge pull request #797 from jbaehova/agent/fix-cursor-grok-fast-wire-ids (cd9ad73)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (236e90a)
• Merge pull request #808 from estelledc/codex/deepseek-v4-flash-responses (4d495e9)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (f4a253b)
• Merge branch 'dev' into fix/726-log-pagination (f1231bb)
• docs(plan): the Windows red was Bun crashing, not our tests (98d2576)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (dd5ee13)
• merge(dev): sync #784 onto tip, keep upstream star-deps seam (97a5e5a)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (b1d0f8a)
• test(sidebar): stop spawning real gh in star route tests (048703e)
• fix(anthropic): treat a blank tool_use id as absent, not as an id (b79eb71)
• docs(plan): record why Windows CI was red three different ways (ebd4cdf)
• test: stop two suites from waiting on the Windows runner (a18acd6)
• feat(providers): add DeepInfra preset (75ac18d)
• fix(test): stop Windows star-route hangs and raise trash restore timeout (de60ea5)
• Merge pull request #793 from Wibias/restore/773-openai-chat-eof (679eda0)
• fix(providers): default DeepSeek V4 Flash to Responses (e743660)
• Merge remote-tracking branch 'upstream/dev' into restore/773-openai-chat-eof (7bb72e3)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (0ab7bff)
• Merge pull request #776 from Wibias/fix/756-alibaba-coding-china (e03bf35)
• test(sidebar): give github/star route tests room for gh timeouts (600ef52)
• Merge branch 'dev' into fix/756-alibaba-coding-china (2152f7a)
• Merge branch 'dev' into fix/764-winsw-env-and-liveness-probe (5e26c6f)
• test(service): assert stop-verification uses SERVICE_STOP_LIVENESS (055812e)
• fix(kiro): bound the tool catalog so large MCP sessions still generate (6e1cdb7)
• test(logs): expect /api/logs envelope in #725 timezone suite (0afd2d6)
• Merge branch 'dev' into fix/756-alibaba-coding-china (956d3b5)
• fix(winsw): never embed OPENCODEX_ADMIN_AUTH_TOKEN in service XML (29b961d)
• merge(dev): resolve openai-chat EOF conflict for #793 (4f0633f)
• merge upstream/dev into fix/764-winsw-env-and-liveness-probe (b0839ef)
• merge(dev): sync before windows flake re-run (ef84c3e)
• test(azure): expect the object root the passthrough now normalizes (f2b61ee)
• fix(kiro): give Windows users an install command they can run (760b287)
• fix(providers): stop probing a models endpoint Antigravity does not serve (c4b8369)
• fix(responses): give every function tool schema an object root (d52aa68)
• fix(bridge): cancel an open tool call on failure instead of completing it (67219b3)
• fix(service): bake WinSW admin env and retry stop-path probes (c7a74d0)
• docs(plan): map the next implementation round and close the triage unit (a91ebbd)
• docs(plan): name the six fixes we can actually land, in dependency order (365f78c)
• docs(plan): disposition all 41 open issues against dev head (e4f0b33)
• docs(plan): open the PR/issue triage round with a 27-PR disposition (6b70112)
• merge: take the v2.8.0 version bump onto dev (bf9bc1a)
• Merge pull request #780 from lidge-jun/fix/764-windows-service-stop (12eae74)
• merge upstream/dev and keep PID verification with stop polling (0ef0e08)
• fix(service): drop wait keyed on schtasks /end failure (b0dee82)
• merge: the 260731 PR round into dev (7132828)
• fix(cursor): support current Grok 4.5 Fast wire IDs (c879ec9)
• Merge remote-tracking branch 'upstream/dev' into fix/764-windows-service-stop (1df9c82)
• docs(plan): record the round outcome, including what was wrong (d380b1b)
• fix(config): serialize pool plan persistence (39c1768)
• fix(codex): persist refreshed pool account plans (e112778)
• fix(test): resolve release-helper merge conflict markers (287cbc2)
• merge(dev): take upstream Path-casing release-helper shim fix (ca8c5d3)
• test(service): pin the platform default, not just the explicit flag (c3424e9)
• fix(service): only pay the restart-window wait where a supervisor can respawn (5530b8c)
• fix(service): verify the proxy is really gone before reporting a stop (#764) (2d0c6a9)
• fix(tray): keep the Windows autostart Run entry under 260 characters (#696) (13a76a3)
• fix(providers): honour the registry private-network default at the fetch too (#758) (3f7a504)
• docs(providers): label the Ark content shape as unverified in the code itself (c4acc2e)
• fix(providers): send Ark the structured content form, not a placeholder space (2eebd92)
• fix(test): set Path on Windows so release shims win (51d9c56)
• fix(openai-chat): fail a truncated tool call before it is flushed as complete (38f711b)
• fix(providers): give Volcengine Ark non-empty assistant text on tool turns (#796) (d3abf43)
• merge(dev): sync with upstream before CI fixes (a6c22a1)
• fix(gui): render dashboard log timestamps in the server's timezone (#725) (a6d472e)
• docs(plan): scope the log-timezone fix to a no-layout-change surface (fd92e99)
• docs(plan): record why the suite moved to macmini-cf (c943955)
• fix(test): queue full-suite runs instead of warning about the contention (571f8a4)
• revert(anthropic): drop the streamed tool-argument validation, keep the rest (95d8ed7)
• fix(anthropic): keep tool argument deltas incremental and fail malformed ones (299cd2f)
• fix(anthropic): validate streamed tool arguments the same way as non-stream (05d9c48)
• fix(anthropic): normalize the messages baseUrl and harden stream quirks (#765) (decb08b)
• fix(kiro): resolve the Windows kiro-cli executable without PATH (ba77eb8)
• feat(providers): add Baseten to the free provider directory (0856b0c)
• feat(claude): opt out of native/* models in the Claude Desktop list (#767) (f726100)
• feat(api): serve the generated Codex catalog at GET /api/catalog (#709) (5d7ab0c)
• fix(cli): exit ocx init cleanly on piped stdin EOF (#754) (bfa1a59)
• docs(plan): open the PR merge round with a full 43-PR disposition (6625a3b)
• merge(dev): resolve Logs.tsx with limit+envelope loadLogs (c27e4ad)
• fix(openai-chat): harden finish-less EOF fail-closed edges (413027e)
• test(providers): expect Alibaba Coding Plan custom baseUrl choice (c712e78)
• ci: retrigger cross-platform checks (5563216)
• fix(service): remove duplicate findLiveProxy import after dev merge (5b1af43)
• merge upstream dev and dedupe findLiveProxy import (a7873a2)
• fix(providers): preserve custom Alibaba Coding base URLs (6729491)
• fix(service): harden Windows stop and verified PID kills (bb95d8c)
• fix(logs): page from newest and document API envelope (ce199d8)
• Reapply "fix(openai-chat): complete streams that end after output without terminal" (0c829dc)
• ci(enforce-target): treat fork-head stacked PRs as valid (d62abe2)
• test(logs): adapt Claude e2e tests to paginated /api/logs (4ec7d10)
• fix: address issue #726 (b7e59c0)
• fix: address issue #764 (085be23)
• fix: address issue #756 (eef4064)
• docs(providers): align OAuth catalog translations (dbf4bd1)
• feat(providers): add Hyperbolic preset (d5dd390)
• docs(codex): clarify catalog versus runtime identity (9ea993b)
• fix(catalog): disambiguate picker label collisions (4cd6e64)
• docs(codex): localize picker label behavior (5f9bb33)
• fix(catalog): prioritize model names in picker labels (2bdb897)

Full Changelog: v2.8.0...v2.9.0