v1.4.0 Compaction Reliability, Persistence Consistency, OAuth Hardening & Configuration Safety

1.4.0 (2026-09-07)

Features

• Adds per-provider enabled configuration, allowing the built-in openai provider to be disabled without changing the existing deep-merge behavior.
• Adds effective configuration diagnostics through OPENCODE_OPENAI_COMPACT_DEBUG=1, including configuration sources, overridden fields, active providers, database path, retention scope, ignored settings,
  and deprecated fields.
• Normalizes equivalent fetch() request inputs consistently across strings, Request objects, typed arrays, ArrayBuffer, and Blob bodies.
• Adds schema parity coverage between the Zod configuration schema and configSchema.json.

Fixes

• Preserves complete compaction input across retries, including the original request body, target endpoint, model, reasoning settings, instructions, attachments, and structured history.
• Preserves full tool output and attachment context when rebuilding structured compaction input.
• Filters compaction continuation turns across tool turns without removing genuine user text that happens to match internal control text.
• Isolates compaction captures and state across providers, preventing stale or unsupported callbacks from consuming another provider's state.
• Rejects overlapping compaction operations and prevents stale asynchronous work from writing after cancellation, deletion, revert, or session reset.
• Filters internal compaction control messages by verified message identity instead of text or position alone.
• Makes SQLite the checkpoint commit boundary and adds revision-aware persistence for checkpoints, control messages, fork state, session invalidation, and tombstones.
• Prevents stale runtime state from being reused when SQLite refresh fails.
• Normalizes fetch wrapper request semantics before routing, checkpoint injection, compaction preparation, OAuth handling, and retry processing.
• Strengthens OpenAI OAuth lifecycle handling:
  • Binds the callback server to localhost.
  • Validates callback and cancellation state before processing the request.
  • Adds safe plain-text callback responses and security headers.
  • Adds browser/device-flow deadlines, request timeouts, disposal cleanup, and actionable port errors.
  • Validates token responses and applies a refresh safety margin.
  • Coordinates concurrent token refreshes within the process.
  • Retries only explicit OAuth invalid_token responses, at most once per request.
• Rejects whitespace-only and root endpoint paths after normalization.
• Validates internal header names, rejects reserved protocol and authentication headers, and prevents case-insensitive name collisions.
• Rejects unknown fields in nested configuration objects instead of silently applying defaults.
• Reports JSONC parse errors with line and column information.

Maintenance

• Updates @opencode-ai/plugin to 1.18.29.
• Updates zod to 4.5.4.
• Updates @types/node to 26.4.1.
• Updates vitest to 5.0.0.
• Updates pnpm to 12.3.4 in the project and CI/release workflows.
• Adds AJV coverage for configuration schema parity.
• Adds regression coverage for compaction retries, provider isolation, SQLite consistency, fetch normalization, OAuth lifecycle handling, configuration validation, and provider enablement.

Full Changelog: v1.3.2...v1.4.0