v0.12.15

Bug Fixes

• codex: Match a multi-line command record to its exec script
  (#227,
  b3242f9)

• codex: Read a sub-agent's commands from its rollout records
  (#227,
  b3242f9)

• codex: Recover v2 sub-agent tool calls (#227,
  b3242f9)

• deps: Bump aiohttp 3.14.3 -> 3.14.4 for CVE-2026-111063 and CVE-2026-111064
  (#227,
  b3242f9)

• deps: Bump certifi and virtualenv to clear pip-audit advisories
  (#232,
  7628641)

• deps: Bump mcp 1.28.1 -> 1.30.0 for CVE-2026-59951
  (#228,
  ea0e436)

• deps: Bump next to 15.5.28 (Next.js security update, Oct 14 2026)
  (#226,
  872f857)

• deps: Bump next to patched release (Next.js security update, Oct 14 2026)
  (#226,
  872f857)

• deps: Pin evalboard sharp to 0.35.5 and clear prod audit findings
  (#226,
  872f857)

• docker: Pin uv in the agent image — 0.12.11+ copies cross-fs ~40x slower
  (#209,
  634005d)