Skip to content

CLODEx 1.16.0 Community Observed 8

Pre-release
Pre-release

Choose a tag to compare

View all tags
@mereyabdenbekuly-ctrl mereyabdenbekuly-ctrl released this 18 Jul 19:20
v1.16.0-communityobserved8
a63fc5d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CLODEx 1.16.0-communityobserved8 is a separate prerelease that permanently enables secure CLODEx.xyz account sign-in for the community-observed distribution.

This is not a stable release. The macOS application is ad-hoc signed but not Apple-notarized, Windows binaries are not Authenticode-signed, Linux packages have no CLODEx vendor signature, auto-update is excluded, and installation remains manual.

What changed since Community Observed 7

  • CLODEx.xyz sign-in is now enabled in every community-observed build by distribution policy and by the canonical build workflow.
  • The fixed desktop client identity is clodex-community-observed; build-time overrides cannot silently replace it.
  • Sign-in opens CLODEx.xyz in the system browser and returns through an RFC 8252 callback bound to exact 127.0.0.1, a dynamic local port, /auth/callback, state, and PKCE S256.
  • The browser returns a one-time opaque authorization code. The bearer session token is obtained only through the token POST endpoint and is never placed in the callback URL.
  • State, PKCE verifier, callback listener, token exchange, and durable credential commit remain in the Electron main process.
  • Concurrent login methods share one lifecycle; logout/cancellation invalidates stale login, refresh, model-token, and storage results.
  • Persisted sessions are accepted only with the expected PKCE provenance and the observed client identity.
  • The old custom-scheme bearer callback remains rejected.
  • Default OS protocol registration remains disabled.
  • community-unsigned remains account-free; this change applies only to community-observed.
  • The required first-launch anonymous-statistics choice and the existing Russian beta localization remain included.

Downloads

Platform File SHA-256
macOS Apple Silicon clodex-community-observed-1.16.0-communityobserved8-arm64.dmg d5897efbc0fb18e96c7291a00d762d78480b2828e0eb81d372e78291ac81be2e
macOS Intel clodex-community-observed-1.16.0-communityobserved8-x64.dmg c9a8d2822577b1b362992d4eeaeee828160bd901b478fe5eb0caab12732bfafc
Windows x64 clodex-community-observed-1.16.0-communityobserved8-x64-setup.exe b04862d6b9cfddf02f1aa6a7de8853c7db6d9269ea7ecfbb323fa1deb90f1938
Debian / Ubuntu x64 clodex-community-observed_1.16.0-communityobserved8_amd64.deb 808e1bfc844a81aa325b5cd6420da52757fc831d1a51ff6d73a315711a5ad6e1
Fedora / RHEL x64 clodex-community-observed-1.16.0.communityobserved8-1.x86_64.rpm 6f975e1a58a31f8d77327c703532dc1b450e0dd77f220a8c15db4c1c8dcda400
Validation evidence clodex-community-observed-1.16.0-communityobserved8-evidence.zip 9feed39f4564c82eba97d8e65be27e04a3629b7fa9799ef4f6af3874892fa63b

Download SHA256SUMS.txt from this release and verify the selected file before opening it.

First launch and account test

  1. Choose System, English, or Русский (beta).
  2. Select Allow anonymous statistics or Continue without statistics.
  3. Open Settings → Account and choose CLODEx.xyz sign-in.
  4. Complete authentication in the system browser.
  5. Return to the IDE through the loopback handoff and confirm the account, keys, and available models load.
  6. Log out, restart the IDE, and repeat sign-in once to verify lifecycle cleanup and durable session restore.

What to test

  • Browser sign-in, cancellation, logout, restart, and repeated sign-in.
  • Account keys and model visibility after authentication.
  • Provider/model selection, including available Max/Ultra-style reasoning modes.
  • English/Russian UI, terminal, browser, Git, MCP approvals, Quick Task, automations, and recovery.
  • First-launch telemetry allow/decline paths and later Settings changes.
  • Report callback failures, duplicate browser tabs, stale sessions, missing keys/models, untranslated text, or unexpected network requests without including API keys or private source code.

Build identity and evidence

  • Version: 1.16.0-communityobserved8
  • Exact source: a63fc5d79b3c6a3442e6e2a2116e575478cb96ae
  • Change: Community Observed 7 source → Community Observed 8 source
  • Canonical build: GitHub Actions run 29655325372
  • Four platform jobs passed exact-source validation, attribution, bounded assembly, package validation, and upload.
  • The byte audit passed outer artifact digests, internal checksums, source/version/platform binding, updater exclusion, notices, CycloneDX SBOMs, and the anonymous telemetry contract.
  • The authentication audit passed the hard-enabled observed policy, fixed client identity, both packaged macOS ASARs, required PKCE/loopback markers, absence of legacy callback markers, absence of OS protocol registration, and the live production start endpoint (400 for an invalid request; 302 to login for a valid observed PKCE request).

Installation safety

  • macOS: verify the checksum, open the DMG, and copy the app to Applications. If Gatekeeper warns, use Finder's per-application Control-click → Open review path.
  • Windows: verify the checksum and use the installer-specific SmartScreen review if Windows reports an unknown publisher.
  • Linux: install the DEB or RPM matching the distribution.
  • Do not disable Gatekeeper, SmartScreen, Defender, or other operating-system protections globally.
Assets 9
Loading