v0.1.5

Added

• Added bundled third-party license notices to published package artifacts.
• Added the codex-limits agents command group with named, interactive, and all-agent integration installation while keeping the existing init syntax supported.

Changed

• Changed CI to run source checks once and validate packed artifacts across Node.js 20, 22, and 24 on Linux and Windows.
• Changed CLI parsing and help to use one command definition source, with generated nested help and order-independent supported options.

Fixed

• Fixed authenticated request cancellation when a caller abort coincided with request startup.
• Fixed CLI help to describe credential overrides for both live usage and reset-credit requests.
• Fixed very small text dashboards to stay within the available terminal rows when coupon entries are truncated.
• Fixed Windows checkouts to preserve LF line endings so local formatting checks remain stable.
• Fixed weekly-only usage data to use declared window durations across live and local sources, avoid stale local fallback for recognized live windows, and omit unavailable 5-hour sections from terminal dashboards and the OpenCode integration.
• Fixed clean production builds and kept terminal rendering compatible with Node.js 20.

Security

• Refused symbolic-link files and path-replacement races when reading bounded local files, including agent configurations.
• Disabled dependency lifecycle scripts during CI installs, pinned workflow actions to immutable commits, and explicitly requested npm provenance for published packages.
• Shortened agent configuration paths under the user home to ~/... and redacted paths outside it before printing installation results.
• Sanitized and bounded command and agent errors, and rejected control characters in command metadata before terminal output.