v1.55.0

Behavioral compatibility notes

The following merged PRs were labeled release-note-required and are called out explicitly in this release:

• #5660 fix(agent-server): treat an empty OH_SECRET_KEY as unset (@enyst)

What's Changed

• fix(agent-server): reject blank and redacted secret values by @Fieldnote-Echo in #5682
• ci: upgrade integration matrix to DeepSeek V4.1 Flash by @neubig in #5614
• test(integration): make token condensation deterministic by @neubig in #5675
• fix(llm): don't send stop words to OpenAI models on Bedrock by @kimnamu in #5291
• fix(agent-server): keep sockets and /v1 closed until deferred init completes by @enyst in #5661
• fix(llm): keep verified OpenRouter models discoverable by @enyst in #5703
• fix(agent-server): gate ingress during deferred initialization by @Fieldnote-Echo in #5700
• fix(mcp): recover after HTTP session failure by @Shimada666 in #4838
• fix: support GPT-6 Sol, Luna and GPT-6.1 Sol subscriptions by @viblo-majority in #5436
• fix(terminal): notice a finished command within milliseconds instead of at the next 0.5 s poll by @simonrosenberg in #5715
• fix(agent-server): reap Canvas backend descendants after leader exit by @Fieldnote-Echo in #5689
• fix(sdk): recognize Haiku 5.5 prompt caching without model metadata by @smolpaws in #5587
• fix(agent-server): ignore empty session API keys by @enyst in #5659
• fix(llm): keep provider credentials out of completion logs by @enyst in #5657
• Add verify-agent-server: an executable feature map and control CLI for the Agent Server API by @enyst in #5621
• Replace policy rail regexes with shell AST analysis by @Fieldnote-Echo in #5724
• fix(agent-server): treat an empty OH_SECRET_KEY as unset by @enyst in #5660
• fix(subagent): let scoped sub-agents keep conversation-local tools like task_tracker by @simonrosenberg in #5520
• fix(profiles): preserve disabled skills when seeding default by @simonrosenberg in #5744
• feat: launch inline Agent Profiles and per-launch LLM overrides by @simonrosenberg in #5409
• feat(agent-server): accept additional skills when launching an agent by @simonrosenberg in #4960
• verify-agent-server: a daily maintenance pass by @enyst in #5727
• verify-agent-server: a known bug reproduces only with its documented failure by @enyst in #5728
• fix(sdk): skip sub-agents whose skill is missing instead of failing by @enyst in #5754
• fix(agent-server): re-probe a Canvas App backend after a missed health probe by @enyst in #5759
• fix(sdk): keep fork titles out of local conversation tags by @BSmick6 in #4814
• Add newly released LLM models to verified lists by @all-hands-bot in #5478
• docs(acp): clarify client surfacing contract by @simonrosenberg in #4926
• feat(sdk): let Agent Profiles select public skills, read them locally and use the global critic key by @simonrosenberg in #5981
• fix(subagent): sub-agents inherit exactly the parent's MCP servers by @simonrosenberg in #5747
• fix(agent-server): read an unreachable OpenAI refresh as disconnected by @enyst in #5926
• fix(agent-server): forward ?path= on the bare Canvas app-backend root route by @enyst in #5923
• fix(agent-server): stop bridging to a crashed Canvas backend by @enyst in #5920
• fix(agent-server): report a failed skills sync fetch as an error by @enyst in #5944
• fix(agent-server): re-vendor pip's urllib3 and msgpack to patched versions by @aivong-openhands in #5725
• fix(git): keep Azure DevOps clone URLs without a .git suffix by @ak684 in #5986
• fix(agent-server): tie uvicorn proxy_headers to trust_forwarded_headers by @enyst in #5929
• fix(sdk): accept the documented github:owner/repo/ install source by @enyst in #5909
• fix(agent-server): remove the per-server TMUX_TMPDIR on shutdown by @enyst in #5945
• fix(agent-server): keep the client's body framing in proxied requests by @enyst in #5918
• fix(agent-server): don't advertise a VS Code URL while VS Code is not running by @enyst in #5907
• fix(agent-server): treat IPv6 loopback Host as a secure context by @enyst in #5787
• fix(agent-server): reap Canvas backends orphaned by a crashed server by @enyst in #5774
• fix(sdk): keep edge whitespace on the original side of a git diff by @enyst in #5891
• fix(agent-server): clear the skills marketplace cache on sync by @enyst in #5903
• fix(sdk): name a manifest-less git repository plugin after the repository by @enyst in #5905
• fix(agent-server): leave web-researcher out of sub-agents when the browser is disabled by @enyst in #5921
• fix(agent-server): answer uploads onto a directory or below a file with 400 by @enyst in #5931
• fix(agent-server): apply enable_browser to /server_info usable_tools by @enyst in #5924
• refactor(agent-profiles): remove inline profile launches and keep a profile active by @simonrosenberg in #5983
• fix(agent-server): stop startup tmux cleanup killing live sibling sessions by @all-hands-bot in #5589
• fix(task_tracker): accept common task status names by @ak684 in #6003
• fix(plugin): load plugins whose root plugin.json has no $schema with the Claude Code layout by @ak684 in #5990
• refactor(agent-profiles): deprecate the legacy profile resolver by @simonrosenberg in #5984
• Release v1.55.0 by @all-hands-bot in #6007

New Contributors

• @viblo-majority made their first contribution in #5436
• @BSmick6 made their first contribution in #4814

Full Changelog: v1.54.0...v1.55.0