0.11.0 RELEASED - faster, lower memory, much better support for windows, image editing, new models OH MY

[acoliver]

Release v0.11.0

Six weeks and 355 commits after v0.10.0. This release is about long sessions: memory that plateaus instead of climbing into gigabytes, requests that hit provider caches instead of re-uploading your history, and context estimates accurate enough to trust before the API ever reports usage. Along the way it picks up mid-turn steering, image generation with gpt-image-2, GPT-6 Astra, Codex over WebSockets, and clipboard copy that finally works from inside the sandbox. If you tried LLxprt Code before and bounced off memory growth or slow long-running sessions, or maybe it borked a bit on Windows: this is the release to retry.

Installation

Install or upgrade LLxprt Code using npm:

npm install -g @vybestack/llxprt-code

Or use directly with npx:

npx @vybestack/llxprt-code

The Headlines

Memory stops growing with uptime. In 0.10.x, retained memory tracked session age, not session work. On the machine that motivated this effort, a 128 GiB host was driven to 64 MB free, and the two sessions holding the most memory were the two most idle. 0.11.0 bounds retention at every layer that accumulated. Streamed model output is held per-token delta and released. Thinking blocks are coalesced instead of retained per stream event. Per-turn stream state is released when the turn ends; an ordering bug had made that cleanup unreachable on every turn. Conversation history is served as a read-only view instead of being deep-cloned on every call. Shell output, tool results, subprocess output, workspace analysis, recorded sessions, error reports, and the telemetry log are all capped and rotated. Sessions now plateau: leave one open overnight and it stays where it started.

Steer the agent mid-turn with Ctrl+Enter. While the model is streaming or running tools, type a correction and press Ctrl+Enter. Your message is injected at the next tool-call boundary, after the in-flight tool results close, so the conversation stays well-formed on Gemini, Anthropic, and OpenAI wire formats alike. Multiple steers accumulate and drain together. A steer sent while the model is finishing its answer forces one more turn. Newlines remain on Shift+Enter, Ctrl+J, and Cmd+Enter.

Generate and edit images with gpt-image-2. Image generation now has three entry points: the generate_image tool, so the model can create and edit images as part of its work; the /image slash command; and non-interactive CLI flags for scripting (llxprt -O out.png -P "a watercolor fox", add -I input.png to edit, repeatable for composites). It runs on your Codex account (ChatGPT Plus/Pro OAuth, /auth codex enable) and is independent of whichever provider you chat with: talk to Anthropic, z.ai, Gemini, or a local model and generate images anyway. Pasted images are resized to your model's input limits instead of failing, image tokens count against the context window per provider, and an oversized image can no longer wedge a session.

GPT-6 Astra, and Claude Fable 5.1. gpt-6-astra (released September 3) is selectable today through the codex alias on ChatGPT OAuth, with 872K usable input context (the backend's 1M-token window reserves 128K for output), Responses API routing, and real o200k tokenizer accounting. The sampling parameters Astra rejects are stripped before the wire, so requests don't 400 on temperature and friends. The codex default stays gpt-5.6-sol while Astra's rollout is staged. Claude Fable 5.1 (claude-fable-5-1) also joins the Anthropic roster.

Codex streams over WebSockets and stops resending your history. The Codex Responses transport now speaks WebSocket v2: one live socket is reused across requests, HTTP/SSE remains a fallback, and an interrupted socket recovers mid-session instead of breaking the turn. Stateful responses are on by default, so each turn sends previous_response_id plus only the new items instead of the entire conversation. Long sessions get lower bandwidth per turn, faster responses, and cache-friendly requests.

Compression no longer destroys your prompt cache. Middle-out compression used to recompute its preserved head every time, so a later compression could delete content an earlier one had kept, eroding exactly the stable prefix that provider prompt caches match against. 0.11.0 tracks the preserved-head boundary across successive compressions for Codex and OpenAI (implicit prefix caching) and places an Anthropic cache breakpoint at that boundary (explicit caching). Cache hits survive compression, so long sessions get cheaper as they run. This also fixes small context windows triggering compression on every send.

The Bun migration is finished, and startup is 2x faster. 0.10.0 moved the runtime to Bun. 0.11.0 completes the job: every workspace runs its tests on bun:test (Vitest is fully removed), all remaining JavaScript is now strict TypeScript, and the published package loads a prebuilt bundle instead of transpiling the module graph on every launch. Median startup drops from 3216 ms to 1569 ms, and run-to-run spread drops from 1233 ms to 572 ms, which pulls in the slow tail that could trip launcher timeouts.

Context estimates you can trust before usage data arrives. Token counts were character-based guesses for most models. 0.11.0 ships pinned, checksum-verified official BPE tokenizers for Kimi K3, GLM 5.2, and MiniMax M3, offline with no network access; calibrated local estimators for Claude Opus 5 and Fable 5; exact accounting for GPT-5.6; and estimation of the finalized prompt envelope (system prompt, tool schemas, and everything actually sent) rather than just the visible text. Compression triggers when it should, and the context-remaining number in the UI now corresponds to reality.

Copy and paste works from inside the sandbox. /copy and mouse-selection copy inside docker/podman containers or the macOS seatbelt sandbox used to vanish silently: they targeted a clipboard that does not exist there. Those copies now route through OSC-52 terminal escape sequences, which pass through the sandbox PTY to your host terminal, which sets the host clipboard. No container mounts, no daemon, nothing to configure.

Also New

• Model config screen (/model): after picking a model, edit temperature, top_p, and friends, plus reasoning effort, context limit, streaming, and prompt caching inline, instead of stacking /set modelparam commands (Model Config Screen #125).
• Managed background shell jobs: is_background and a trailing & now produce real managed jobs with stable ids. Status, output, and cancellation are available to the model and to you via check_async_tasks, /task list, and /task end. Works on Windows too (Evaluate adopting upstream's is_background parameter for the shell tool #1995, Windows equivalent for run_shell_command is_background (Start-Process based) #2981).
• Recording-native checkpoints: /chat save creates a named branch point, /continue can fork a session from it into a self-contained child session, and /chat resume and the session browser share one model. Legacy standalone checkpoint files are no longer read (Recording-native checkpoints and session branching: unify /chat save with /continue (part of #2614) #2625).
• /policies dialog for managing rules interactively (Interactive /policies dialog for managing rules #641), and /permissions can now manage trust for arbitrary folders (Allow adding arbitrary folder trusts from /permissions dialog #638).
• /mcp reload hot-applies MCP config changes without a restart (Hotload MCP config changes #2326), and opt-in lazy MCP schema loading cuts startup time with large MCP servers (MCP lazy-loading or partial loading to context #2327).
• @subagent suggestions and a task-tool nudge in the prompt input (feat(ui): @subagent suggestions and task-tool nudge in prompt input #2887).
• Clickable file paths detected in model output (make file paths render as links #2848), and links in model output and OAuth prompts are autoformatted to be clickable (Autoformat links to be clickable #611).
• /perf: opt-in, local-only performance and memory telemetry with /perf report and /perf inspect for trends (Measure llxprt's own performance: client-side time accounting, memory trend, and a bounded per-turn perf log #3167).
• Unicode rendering fallback for Windows and other non-Unicode terminals (Windows/PowerShell: corner characters for drawn elements (tool boxes, input box) render as '?' #2552).
• The github tool runs gh from inside the sandbox without exposing your token (system for gh for sandboxes #1663), no longer swallows search queries, and answers ordinary questions in one call (ax gh tool sometimes the agent get errors with a specific query #3407).
• Subagent liveness heartbeat, so a synchronous task subagent doesn't look dead during a long turn (Synchronous subagents need liveness heartbeats during long-running tool waits #2540).
• Stable chronology markers in chat history (Need stable chronology markers in chat history to trace request/response ordering across retries and tool round-trips #1721).
• The user docs were rewritten and deduplicated around actual tasks (Docs audit phase 2: user-perspective rewrites and deduplication (follow-up to #2654) #2685).

Fixes You May Have Hit on 0.10.x

macOS Keychain and auth

• The Keychain prompt storm is fixed. A denied or cancelled Keychain access used to be indistinguishable from "not authenticated", so LLxprt kept re-prompting on every call. Failures now surface as themselves, and an opt-out switches to the file-based keyring fallback (SecureStore cannot distinguish Keychain denial from absence: native error collapse, no session degrade, no keyring opt-out #2928, macOS Keychain password-prompt storm when the running Bun runtime is deleted by an in-place reinstall (fast-fail instead of storming) #2926).
• Credentials are never deleted on a read-back mismatch, and writes are serialized per item (Concurrent credential writes can delete another process's Keychain item (silent credential loss + ACL reset) #2927). A discarded Keychain grant is surfaced instead of vanishing (Keychain items are written with an empty change_acl list, making credential grants permanently unrecoverable after any runtime identity change #3020). Abandoned OAuth locks recover instead of wedging auth (codex token locks #2819).
• Upgrading via npm while LLxprt is running no longer orphans the bundled Bun on macOS (false positives are disabling authentication #2962), and Claude Code OAuth can start lazily on interactive startup instead of blocking first run (/auth claudecode broken on windows #2891).

Streaming and providers

• Thinking blocks left over from one endpoint no longer cause a 400 when you switch z.ai and Anthropic mid-session (swithcing from zai to sonnet can cause errors (both anthorpic provider) #1469).
• 5xx errors are retried and then failed over (Internal Server Error should be retried and then fail over #1726). Backoff is applied after an overloaded-bucket failover instead of hammering the next backend immediately (overloaded still doesn't faill over #1564). Quota-exhausted 429s fail fast instead of resending the prompt repeatedly (Quota-exhaustion 429s are retried like transient rate limits, resending the full prompt each time #3140). Provider 403s surface immediately instead of hanging (fix(providers): surface provider 403 immediately instead of hanging #3012).
• A tool-content 400 now tells the model how to retry differently instead of looping the same request (Detect tool-related 400 errors and advise the model to try a different approach (feature) #2722).
• The telemetry outfile no longer grows without bound (roughly 45 GB/day with telemetry.outfile set): bodies are redacted by default and the file rotates with bounded retention (telemetry.jsonl grows unbounded: full conversation payloads and cumulative metric dumps reached 211 GB in 4.7 days #3315).

Windows

• Child-process console isolation stops terminal corruption when shell tools run (Shell tool output sometimes escapes its rendering area and overwrites the terminal on Windows #2548). "The operation timed out." is classified transient so requests retry instead of failing (API request timeouts are not retried on Windows #2557). The sandbox proxy reconnects instead of dying (Nightly workflow failed #2908). PowerShell exit codes propagate through background jobs (Shell tool may report the wrong exit code on Windows: powershell -Command does not propagate a native program's exit status #3320). The real IDE ancestor process is found instead of a fixed-offset guess (Windows IDE connection cannot recover from stale terminal port metadata #2656).

Sessions and tools

• --continue falls back to a fresh session instead of dying on a restore failure (Continue mode can hang indefinitely after context corruption #1873). /todo list parses the envelope format (saved todos still borked #1542).
• apply_patch feedback is truthful: deletes delete, success requires evidence, and errors name the cause (apply_patch AX: delete patches silently truncate, success message is not evidence, and path/format errors misdescribe the rule #3033). A failed tool call stays failed instead of being replayed as if it succeeded (Tool failures are reported to providers as successes, and read_file's legacy execute() discards its own error shape #3063, A failed tool call still reaches OpenAI-Vercel and the ContentConverters round trip as a success #3076). Range editors stop inventing a phantom trailing newline (delete_line_range strips the trailing newline when end_line exceeds EOF; insert_at_line's documented append does not exist #3036), and same-path edits no longer lose data (replace tool: parallel same-file edits race — silent lost updates and file truncation #3239).
• Scrolling no longer bounces back after content-only model turns (Scroll bounce-back when scrolling up after content (non-tool) model output; worsens with todo panel up #2799), and queued messages drain correctly after you cancel a turn (Queued messages panel: cancel breaks session (queue stuck) and collapsed panel keeps full height #2882).
• /stats buckets report truthful usage and OAuth discovery works (Fix OAuth bucket discovery and truthful usage stats in /stats buckets #2601). Codex PDF continuation serialization is fixed (Codex PDF reads send unsupported file input and break the agent loop #2608). timeout_seconds: -1 no longer defeats the ceiling (task and shell tools: timeout_seconds gives the model no cue to set it, silently clamps large values, and lets -1 bypass the configured maximum #3031). The foreground shell wrapper is newline-safe (Shell wrapper: escaped-& / heredoc / trailing-comment breakage, unquoted temp path, and node-pty signal 0 #2980).

Sandbox and security

• Google credentials are no longer forwarded into the container (Container sandbox forwards GEMINI_API_KEY/GOOGLE_API_KEY and mounts gcloud credentials, bypassing the credential proxy #2946). In-container reads of the CLI's own memory are denied (Make the capability token unreadable from in-container processes via PR_SET_DUMPABLE #3028). Container privileges are hardened (Sandbox container privilege hardening: capability token may be readable from CLI process memory #2902) and network policy enforcement closes gaps (Sandbox hardening and security #1456). Abandoned containers are reaped on startup (Sandbox containers outlive the host CLI process: no reaper, no startup sweep #3449). An empty host SSH agent is detected during forwarding, with remediation guidance instead of a bare failure (Sandbox SSH agent forwarding should detect empty host agent and guide remediation #1699). The sandbox config mount path no longer causes repeated first-time setup (Container sandbox mounts the global config at the legacy ~/.llxprt path, so first-time setup runs on every sandboxed start #3081).

Thanks

Huge thanks to the following contributors for their pull requests in this release:

• @Ayush7614