Skip to content

v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 07:42
Immutable release. Only release title and notes can be modified.
v0.1.3
cb6a0b8
This commit was signed with the committer’s verified signature.
possible055 apparition
GPG key ID: B9D9F056E55655C3
Verified
Learn about vigilant mode.

codexshim 0.1.3

Release date: 2026-08-15

First stable release of the capability-aware MCP repository toolset for Codex and Cursor. Supersedes the 0.1.3-alpha.1 through 0.1.3-alpha.8 prereleases. Headline additions over 0.1.2: PDF reading, direct program and bash execution, exact model-token budgeting, Cursor support, and a hardened search and process runtime.

Breaking changes

Review before upgrading from 0.1.2.

  • Text-only tool output. Successful read, grep, and glob responses are bounded text only. structuredContent and outputSchema are gone from successful results; structured diagnostics remain only for errors and timeouts.
  • PDF API. Default pdf_mode is now auto (was text). Continuations use an opaque pdf_cursor instead of pdf_source_id + pdf_text_offset. PageClass / classify_page replaced by assess_page_text / assess_page_visual.
  • Search defaults. grep and glob now include gitignored files by default. Set CODEXSHIM_RESPECT_GITIGNORE=true or pass include_ignored to restore filtering. .git and common large dirs (node_modules, target, .venv, venv, dist, build, __pycache__) stay excluded either way.
  • Program allowlist removed. --allow-programs and CODEXSHIM_ALLOW_PROGRAMS are no longer recognized; run_program executes any single program directly. Programs inherit the server user's full filesystem access — use an OS sandbox for real isolation.
  • Prebuilt targets reduced. Release assets cover Linux x86-64, Linux ARM64, macOS Apple Silicon, and Windows x86-64. Windows ARM64 and macOS Intel are no longer published.

Upgrade notes

  1. Tool output. Clients parsing structuredContent / outputSchema from successful read, grep, or glob must switch to the text result.
  2. PDF parameters. Replace pdf_source_id and pdf_text_offset with the pdf_cursor from the previous response.
  3. Search scope. If you assumed gitignore filtering, set CODEXSHIM_RESPECT_GITIGNORE=true or pass include_ignored.
  4. Program allowlist. Remove any --allow-programs / CODEXSHIM_ALLOW_PROGRAMS configuration.
  5. Release assets. Build from source for Windows ARM64 or macOS Intel, or switch to the validated x86-64 / Apple Silicon assets.

New features

  • PDF reading. read detects PDFs by content and returns page Markdown or PNG content blocks with source-bound continuation cursors, scanned-page guidance, and per-call memory/concurrency/timeout limits. One concurrent PDF call per instance; a second returns retryable resource_busy.
  • run_program and bash****. run_program runs one executable with a literal argv (no shell). bash runs a POSIX command line with merged stdout/stderr and detached execution (detach + log_path, 16-live-tree cap). Windows msys_argument_conversion: disabled keeps slash switches literal under Git Bash.
  • Exact token budgets. A bounded o200k tokenizer enforces per-call and aggregate burst limits across success, timeout, and error responses, preserving pagination and head/tail context on dense output. Successful responses are compacted; server/discover and initialize work across known MCP versions without an env gate.
  • Cursor support. --client-profile selects codex (16,384 burst tokens, default) or cursor (32,768); both share an 8,192 per-call ceiling. Discovery and tool delivery traced with bounded opaque correlations; active limits shown in startup and doctor output.
  • Search runtime. Capability-aware parallel traversal with ordered output, panic-safe worker retirement, skip reporting (path-reason rows with a true total), and soft memory targets that skip or truncate one file instead of failing the call. glob supports file, directory, and any entry types.
  • Configurable timeout shelf. CODEXSHIM_TOOL_TIMEOUT_SHELF (15-3600s, default 600) sets the ceiling the server stays below so the client's tool_timeout_sec fires after the server's own Timeout (effective max = shelf − 10s). Per-call timeouts clamped to the active max and advertised in tool schemas.
  • Release tooling. Cross-platform SemVer preparation scripts and a release workflow gated on a successful main CI run, four native packages, and asset + installer validation.

Performance

  • Reworked grep runtime: bounded file-work lanes, ordered pagination, prefiltered parallel traversal, and worker retirement once a page fills.
  • Fatal candidate/memory ceilings replaced with soft targets and a direct reader fallback.

Bug fixes

  • Preserve open-handle validation after Unix unlink in read.
  • Validate Unix archive manifests so valid packages no longer fail the release gate.
  • Stop the rmcp service loop on stdout write failures; remove the stdin EOF race from the stdout failure test.
  • Bound Windows process I/O cleanup: cancel blocked I/O threads before joining, treat aborted pipe ops as successful shutdown.
  • Honor client timeout shelves with profile-specific defaults and per-call clamping.
  • Stabilize replacement corpus bytes with a repository-owned LF seed; repin the pwsh degradation baseline catalog hash.

Internal

Large module splits (shared infrastructure, repository services, PDF core, token gating, test/benchmark suites) improve testability without changing the public API or runtime behavior. Module ownership boundaries documented for the gigatoken and PDF upstream forks.

Dependencies and CI

  • Bumped actions/upload-artifact 6.0.0 → 7.0.1 and actions/download-artifact 6.0.0 → 8.0.1.
  • Streamlined workspace quality gates, refined Rust test target validation, added optional Linux/macOS validation jobs, slimmed dev debug info, and added pyright config for evals and scripts.

Full changelog

v0.1.2...v0.1.3

Assets 14
Loading