Cumora 0.2.2

A Sign in with Apple hardening fix, and Windows BYOA agents working end to end.

Sign in with Apple — account linking (#61, @KIDA-MNESIA)

The native Apple sign-in endpoint accepted an email in the request body and used it when Apple's signed token didn't carry one. That value could reach the cross-provider auto-link lookup, which binds an Apple identity to an existing account with a matching email — client-supplied data deciding who you are.

Now only two sources can answer that question: an already-linked Apple sub resolves from the email persisted against it, and an unlinked one requires an email_verified claim in Apple's signed token. The email field is gone from the request contract entirely rather than merely ignored. Returning users are unaffected — they resolve by sub, as before, even when Apple omits the email claim.

Windows BYOA (#63, #64, @bingqilinweimaotai)

Windows agents were broken in both directions.

Prompts in. Windows always takes the one-shot codex exec path, and the prompt was appended to argv through cmd.exe, which split anything containing spaces (unexpected argument 'are') and rejected long ones outright (The command line is too long). Prompts now go through stdin, which codex exec - reads by design. Native .exe engines also skip cmd.exe now instead of routing argv through it; .cmd/.bat shims still get the shell they need, including the nvm-windows case.

Replies out. The per-agent cumora shim was written as a single extensionless Node script, which PowerShell will not resolve as a command through PATHEXT, so every cumora reply from an agent failed. A cumora.cmd launcher is now written alongside it. The injected PATH also used a hard-coded : separator, which is not what Windows uses.

---

Desktop app auto-updates. BYOA users on Windows need npm i -g cumora@latest and a daemon restart to pick up the fixes (installed services self-update within a few hours).

Cumora 0.2.1

Two fixes to things that looked like features but never worked.

Desktop sign-in

Signing in from the desktop app handed the session back over the cumora:// URL scheme and left the rest to the OS. That is fine on a clean machine and unreliable everywhere else: any other build that ever registered the scheme — an old release/ build, a mounted DMG, a stray npx electron — can win it and swallow the token, so the browser says "signed in" and the app never hears about it.

The sign-in page now hands the token straight back to the process that started the sign-in, over the loopback connection it was already served from. The URL scheme stays as a fallback for the one case that path can't cover (the app quit while the browser was still on the provider). The single-use nonce and same-origin checks are unchanged.

A sound for every Skype emoticon

The emoticon sounds were wired up end to end — viewport trigger, click to replay, the preference toggle — against audio that was never added, so the whole feature was silent from day one. Nine emoticons now use the genuine Skype event sounds ((skype) the message pop, (call) the ring, (hi) the login chime, and friends).

Classic Skype never had per-emoticon audio, so the remaining 98 are synthesized: each emoticon gets a semantic family — sparkle for the cheerful ones, a falling minor for the downcast, glass for the drinks, a fanfare for the heroes, a whoosh for the ninjas — and its own pitch within that family, so (party) and (clapping) are recognisably related without being the same sound. scripts/gen-skype-sounds.py generates the set deterministically from the catalog and ships in the repo, so it can be re-run, re-tuned, or replaced.

Turn them off under Preferences → Skype emoticons.

---

Desktop app auto-updates. No server or CLI changes in this release; cumora on npm stays at 0.2.0.

Cumora 0.2.0

First release since Cumora went open source — and what a week. 33 community PRs merged from 12 contributors.

Highlights

Two new BYOA engines

• Grok Build (#23, @storyicon) — persistent ACP stdio sessions, real-model ledger reporting (#43)
• Cursor Agent (#46, @terry-li-hm) — one-shot stream-json with --resume continuity; triage runs read-only (--mode ask)

简体中文 / i18n (#60, @always1ov)

A dependency-free locale layer with a complete Simplified Chinese translation — 1,650 keys, typed en/zh-CN parity, per-device language choice under Preferences.

Project-scoped agent memory (#54, @danielliu99)

One agent in two groups no longer leaks group A's working notes into group B. Persona, climate, pinned notes and existing memories stay global; new unpinned work is scoped to its project.

Reliability

• Message delivery idempotency — retries can't duplicate messages (#19, @Colafornia)
• WebSocket client opens exactly one socket on boot (#26), typing indicators for poll-driven turns (#51)
• A long tail of BYOA daemon fixes: resumable-session preservation (#9), stream chunk-boundary parsing (#28), orphan engine children (#31), --stop actually stopping npx-launched daemons (#37, @virgoC0der), HTTP deadlines (#40), EOF reconnect backoff (#30)
• Heartbeat classifier prompt made prefix-cacheable — agenda cache reads went ~32% → ~76% (#44)

Providers

• Novita as an LLM provider via a Responses-API translation adapter (#55, @jax-novita)

Thanks to every contributor: @Lieisyourlie, @terry-li-hm, @virgoC0der, @storyicon, @danielliu99, @Colafornia, @bingqilinweimaotai, @always1ov, @jax-novita, @Svector-anu, @ztygod, @liyd