Skip to content

v1.0.0-rc.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 20:06
v1.0.0-rc.1
dfff46c

1.0.0-rc.1 — 2026-08-09

Bug Fixes

  • Create the SBOM manifest dir before generating the envelope (release) (dfff46c)
  • Don't expect the unpublished linux legacy feed in the draft (release) (e380e82)
  • Keep the python3 token out of the build-pack comment (ci) (308a7e1)
  • Invoke verify_release_artifacts.py via python on the Windows leg (ci) (f490b37)
  • Exclude platform-specific bundler native binaries from disclosure (licenses) (f0e31cc)
  • Pin pnpm version in release.yml Setup pnpm step (ci) (ec3b6af)
  • Skip local warm for cloud-routed models (invocation) (d78e122)
  • Verify complete tutorial paths (onboarding) (c160ecf)
  • Harden optional tutorial flows (onboarding) (81ea9f6)
  • Make packaged AppImage launch from any working directory (linux) (3aa6f70)
  • Make launcher entry synchronous + persist startup diagnostics (win) (a50f0d3)
  • Don't crash host shutdown when the shutdown token cancels (mcp) (21e8e37)
  • Call VelopackApp.Build().Run() in the launcher (packaged main exe) (win) (a010009)
  • Vendor apphost license files instead of sourcing from SDK pack (win) (3fbc766)
  • Resolve apphost license pack from the SDK-chosen apphost path (#8) (win) (5284058)
  • Address Codex review — proxy SSRF bypass, -- arg corruption, header substitution (custom-tools) (589f7cf)
  • Message-size cap — 256KB inbound-only with a legible rejection (chat) (ad83ae0)
  • Close final release compliance gaps (b64b49c)
  • Let the effective runtime window raise the context budget, not only shrink it (invocation) (616fda5)
  • Exclude runtime state from publish globs (a6a76b3)
  • Pooled roles yield cap slots to chat; explicit --cache-ram; refresh b9692 provenance (llama) (4f8f791)
  • Fail closed on access tokens missing the security stamp (auth) (fb043a1)
  • Invalidate access tokens on password reset/change via security stamp (auth) (60eddac)
  • Notify parent of Codex sign-in state from an effect, not during render (react) (5c1521a)
  • Report form dirty state from a values-watching effect, not during render (react) (06c3538)

Build System

  • Bump the actions-weekly group with 7 updates (#2) (deps) (abc7585)
  • Regenerate frontend license manifest for nanoid 3.3.17 (client) (037978a)
  • Raise JS budget to 3.8MB and patch nanoid GHSA-2v37-7h3g-55p8 (client) (55aba25)

CI

  • Fix pnpm version resolution and gpu-smoke no-aspire preflight (3d21764)
  • Fetch previous release before pack for delta packages (release) (766d0b3)
  • Trigger on v* tags and publish to this repo (release) (a035137)
  • Scope workflows to develop and drop scheduled runs (1159a4c)

Dependencies

  • Pause Dependabot version updates for the v1.0.0-rc.1 release (#6) (deps) (6414ee9)

Features

  • Add gpt-5.6 sol/terra/luna models, default to terra (codex) (7f2a86b)
  • Add optional progressive tutorials (onboarding) (95054a2)
  • Add framework-dependent Windows launcher (496fa15)
  • Composer size pre-check + delete dead MaxSignalRMessageSizeKb config (chat) (5fcecd8)
  • Expose CustomToolsEnabled node-settings toggle (custom-tools) (26be68f)
  • P6 agent-config — lock approval switch for custom tools (custom-tools) (ac4669d)
  • P4 runtime wiring + approval extension (custom-tools) (67dc2f5)
  • P5 React management UI + danger warnings (custom-tools) (126b8ed)
  • P3 API — CRUD endpoints, validation, executable-probe, OpenAPI regen (custom-tools) (c7505f1)
  • P2 executors + catalog/registry (security core) (custom-tools) (3d744bd)
  • P1 persistence — CustomTool entity, store, migration, AEAD encryption (custom-tools) (0832ef3)
  • Prepare portable open-source releases (85c01eb)
  • Streaming budget — delta-only protocol, O(delta) persistence, bounded channels, disconnect grace (chat) (606dba1)
  • Add local CLI admin password reset (forgot-password recovery) (auth) (526948c)
  • Add custom slash commands (bd3318e)
  • Add durable read-only agent delegation (mcp) (bb48fa2)

Miscellaneous

  • Reformat and cleanup (dede31a)
  • Remove unused validation exports (frontend) (9729a90)
  • Add local Windows RC build script (no publish) (#7) (9896dd0)
  • Resolve all 9 release-authority decisions to approved (1696565)
  • Bump version identity to 1.0.0-rc.1 (ad8e7e4)
  • Reformat and cleanup (11e00d1)
  • Reformat and cleanup (7f756c8)
  • P2 security-review follow-ups (custom-tools) (1f6d76c)
  • Reformat and cleanup (de2aa55)
  • Untrack runtime lock file and opencode.jsonc (061bb01)
  • Repoint tester channel + reflect consolidation in docs (update) (7308217)
  • Point main update channel at this repo (update) (426f31f)
  • Migrate tester issue templates into this repo (github) (e1065b0)
  • Relicense to Apache-2.0; untrack internal tooling (license) (e397e82)

Performance

  • Wave-2 team pass — speculation contract, supervisor gates, read-side caps + streaming redesign doc (inference) (55f6cee)
  • Team pass over the v2 audit's open findings (§3.7, §3.10-§3.12) (inference) (cd45436)

Refactor

  • Rely on global exception handling; add Entra precondition exception (errors) (cb5082a)
  • Fold DTOs/mappers/validators into V1 subfolders (endpoints) (d8e49c9)
  • Extract ImageModelManager sub-components and draft models (images) (83cca9c)
  • ToSorted immutable sort, lazy ref init, drop unused export (655e6d6)
  • Extract StableDiffusionSourceCommandRunner into its own file (sdcpp) (ca8ce39)
  • Move DevelopmentContainerRuntimeMapper into DevelopmentContracts (development) (6415c55)
  • Extract service models into *ServiceModels.cs siblings (development) (57cdca6)
  • Centralize InvocationState.Clone (events) (1a93ede)
  • Extract shared GgufFileSelector to dedupe SelectBestFittingFile (modelfit) (9f9e306)
  • Consolidate duplicated SetsidLocator into Abstractions (providers) (269ee2e)
  • Consolidate duplicated formatBytesAsGb into core (react) (423b6f2)
  • Extract shared ReasoningOptionsResolver (ai-agent) (95b5625)
  • Move shared ReasoningEffort type into core (react) (4a58694)
  • Move capability DTOs out of Implementation (capabilities) (2338d3f)
  • Extract LaunchPolicyFingerprint contracts into their own file (inference) (316b588)
  • Extract MemoryFitEstimator contract types into MemoryFitEstimatorContracts (modelfit) (df6da54)
  • Extract public exception types into their own files (invocation) (b18f97f)
  • Split ICodexAuthService and ICodexTokenStore into own files (providers/codexoauth) (930cf69)
  • Move DriveInfoFreeSpaceProbe into Implementation (providers/huggingface) (63bd1e8)
  • Remove orphaned CUDA-build subsystem (node-settings) (d3fd74d)

⚠️ Windows: the app window flashes and closes instantly?

The Windows portable build is framework-dependent — it doesn't bundle .NET — so it needs the x64 ASP.NET Core Runtime 10.0.10 (or a newer .NET 10 servicing patch). If that runtime is missing, the app can't start and the window just flashes and closes, with no error and an empty logs folder. It's not a crash — the runtime simply isn't there.

Fix: install the x64 ASP.NET Core Runtime 10.0 from the .NET 10 download page — under Run apps → ASP.NET Core Runtime, take the x64 installer. The full x64 .NET 10 SDK works too (it includes the ASP.NET Core runtime), so if you already have it or want it anyway, that's fine. Then start the app again.

Check what you have with dotnet --list-runtimes: you need a line beginning Microsoft.AspNetCore.App 10.0.10 (or higher). Full details are in the FAQ.

Assets 12
Loading