Release v0.1.0-beta.2 by ThomasK33 · Pull Request #44 · coder/libghostty-vt-node

ThomasK33 · 2026-10-30T02:06:41Z

Why

Ship the changes merged since 0.1.0-beta.1 to npm. They include mode-aware mouse encoding (#12), the new snapshot attributes and cursorVisible (#17, #38), and Ghostty v1.4.0 with DECSTR support (#43).

What changed

package.json and package-lock.json go from 0.1.0-beta.1 to 0.1.0-beta.2. The branch name matches the version, so publish.yml creates v0.1.0-beta.2 after merge.
The release-changelog workflow adds the CHANGELOG entry to this branch.
communique.toml raises max_tokens to 16384. With Communique 1.0.3's default of 4096, generating these notes failed twice with "submit_release_notes was malformed 3 times". The next run succeeded.
prepare-release-changelog.mjs now detects Communique's ## [vX](url) - date heading. Before, every push regenerated the entry over hand edits.
I corrected the generated entry. cursorVisible and encodeMouse first ship in this release, so they are listed as Added, not as changes or fixes.

Blast Radius

The merge publishes 0.1.0-beta.2 to npm under the beta dist-tag. latest stays on 0.1.0-beta.0. Consumers that build a TerminalSnapshot themselves must now set cursorVisible (#38).

Verification

RELEASE_BRANCH_NAME=release/v0.1.0-beta.2 node .github/scripts/prepare-release-changelog.mjs origin/main prints should_generate=true and tag_name=v0.1.0-beta.2. resolve-npm-publish-tag.mjs prints beta.
npm run typecheck and npm test (73 passed).
Three independent verifier passes, the last PASS+NOTES on the head. They check every CHANGELOG bullet against the v0.1.0-beta.1 tag and confirm that the packed tarball loads its addon from prebuilds/.
The local linux-x64 prebuild steps from mise run release-prebuilds pass: build:libghostty, build, build:prebuild, verify:prebuilds and npm pack --dry-run.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

_Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I33025b77f36fe1aa07caf6d235625e3179ece212 Signed-off-by: Thomas Kosiewski <tk@coder.com>

Communique 1.0.3 defaults to 4096 tokens per response. Generating the v0.1.0-beta.2 notes failed twice with "submit_release_notes was malformed 3 times". Communique 1.2.2 raised its own default to 16384 for this failure. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: Ib949fba4b692fbf9280e4c52b39e5c4da3b8ce6c Signed-off-by: Thomas Kosiewski <tk@coder.com>

ThomasK33 · 2026-10-30T02:18:46Z

@codex review

ThomasK33 · 2026-10-30T02:18:51Z

@codex security review

chatgpt-codex-connector · 2026-10-30T02:18:59Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T02:34:23.375438Z	`1678613`	Manual request
🔒 Security Review	✅ Completed 2026-10-30T02:35:25.950239Z	`1678613`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-30T02:20:20Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 431c20ff6e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-30T02:21:05Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 431c20ff6e

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-10-30T02:23:45Z

FAIL

Independent pre-merge verification of release PR #44 (0.1.0-beta.1 to 0.1.0-beta.2). I did not write this code. Packaging, versions, npm dist-tag and tag state are correct. One CHANGELOG bullet makes a false claim about published history, so this verdict is FAIL until that bullet is fixed.

PR head: 431c20ff6e98f7bc103b62aa35613f767b46b1ac (matched gh api .../pulls/44 --jq .head.sha before the checks and again before posting)
Base origin/main: 83d79f78b1831f770e3ff045cacf7f5ed564dd96 (also the merge base)
Tag v0.1.0-beta.1: 08607e8029e0e30c7975018e64156b9b34d7f450

#	Check	Result
1	Diff is only the version bump, `max_tokens = 16384`, and the CHANGELOG entry	Pass. 4 files, 28 insertions, 3 deletions: `package.json` and `package-lock.json` (2 version lines), one line in `communique.toml`, 24 CHANGELOG lines.
2	CHANGELOG accuracy and coverage	Fail. One bullet is wrong (details below). The other 13 bullets match their PRs. All 13 PR links point at the PR they describe. Every PR merged after the tag is covered, or left out because it is internal: #16 and #35 change only the lockfile, #24, #25 and #32 are agent skills, #33 is CI, #40 is a dead-code refactor.
3	Release prebuild steps at the head (linux-x64, Node v26.12.1, Zig 0.17.0, Ghostty `83fb95624` "Bump version to 1.4.0")	Pass. `npm ci`, `build:libghostty`, `build`, `build:prebuild`, `verify:prebuilds` and `npm pack --dry-run` exit 0. `verify:prebuilds` reports `packageVersion` `0.1.0-beta.2` and loads the addon from `prebuilds/linux-x64/`. The tarball is `coder-libghostty-vt-node-0.1.0-beta.2.tgz` with 31 files, 3.7 MB. The worktree stays clean and `mise.lock` is unchanged.
3b	Consumer install of the packed tarball	Pass. The installed `package.json` and `getNativeInfo().packageVersion` both read `0.1.0-beta.2`. `/proc/self/maps` shows `.../node_modules/@coder/libghostty-vt-node/prebuilds/linux-x64/@coder+libghostty-vt-node.node`, and the package has no `build/` dir. Smoke: after `ESC[?25l ESC[7mA`, `cursorVisible` is `false` and A has `inverse: true`. After `ESC[!pX`, `cursorVisible` is `true` and X is `{"text":"X","width":1}` with no `inverse`.
4a	`node scripts/resolve-npm-publish-tag.mjs`	Pass. It prints `beta`.
4b	`RELEASE_BRANCH_NAME=release/v0.1.0-beta.2 node .github/scripts/prepare-release-changelog.mjs origin/main`	Unexpected output, does not block the merge. It prints `should_generate=true`, `reason=version-changed`, `base_version=0.1.0-beta.1`, `package_version=0.1.0-beta.2`, `tag_name=v0.1.0-beta.2`. See note 2.
5	Tag and npm version are free	Pass. `git ls-remote --tags origin` lists only `v0.1.0-beta.0` and `v0.1.0-beta.1`. npm versions are `["0.1.0-beta.0","0.1.0-beta.1"]`, and the dist-tags are `beta` = `0.1.0-beta.1`, `latest` = `0.1.0-beta.0`.

Wrong CHANGELOG claim (blocker)

Under ## Changed, this bullet is wrong:

TerminalSnapshot.cursorVisible is now a required boolean in the published types. The native binding has always set it; code that constructs its own snapshots must now include the field (#38).

v0.1.0-beta.1 has no cursorVisible at all (git grep cursorVisible v0.1.0-beta.1 finds 0 files, and its TerminalSnapshot has no such field). #17 added the field as optional and #38 made it required, both in this release. PR #38 says so itself: "No published release has cursorVisible yet". So "now required" and "has always set it" describe a change between two unreleased commits, and they are false for anyone upgrading from beta.1. The ## Added bullet already introduces the field.

Fix: delete that ## Changed bullet and replace the ## Added bullet for cursorVisible with:

- `TerminalSnapshot.cursorVisible: boolean` reflects DECTCEM state (`ESC[?25h` / `ESC[?25l`). The field is required, so code that constructs its own `TerminalSnapshot` objects must set it ([#17](https://github.com/coder/libghostty-vt-node/pull/17), [#38](https://github.com/coder/libghostty-vt-node/pull/38)).

Notes (not blockers)

Optional cleanup: the ## Fixed bullet for test: skip the mouse-safety suite when the addon does not load #39 describes a test-only change (test/mouse-safety.test.ts plus two READMEs). communique.toml asks Communique not to inflate internal work. Deleting this line is reasonable:
- Skip the mouse-safety test suite when the native addon is not loadable, matching the other native suites ([#39](https://github.com/coder/libghostty-vt-node/pull/39)).
prepare-release-changelog.mjs never detects a Communique entry. Its pattern ^##\s+(?:\[?(?:0\.1\.0-beta\.2|v0\.1\.0-beta\.2)\]?)(?:\s|$) needs whitespace after ]. The heading Communique writes is ## [v0.1.0-beta.2](https://...) - 2026-10-30, so ( follows the ]. The beta.1 heading does not match either. This script is unchanged on main and release-changelog.yml does not run on merge, so publishing is not affected. The impact is this: every push to release/v0.1.0-beta.2, including a push of the fix above, reruns communique generate --changelog. That rerun can rewrite a hand edit. Communique 1.0.3 has an "Existing CHANGELOG.md Entry" prompt, so I infer that it rewrites the entry instead of adding a second one. I did not run it. After you push the fix, check the CHANGELOG again once the release-changelog run finishes. Also, the release-changelog run at 431c20f (run 40990885524) is waiting on approval (action_required). Approving it runs generation again.
publish.yml generates the GitHub release body with a separate communique generate call at publish time. That body is not the CHANGELOG text, so I could not check it before the merge. It can repeat the cursorVisible framing. Read the GitHub release after it is created.
Local prebuild coverage is linux-x64 only. The publish workflow builds linux-arm64 and macos-arm64 in CI.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Communique writes "## [v0.1.0-beta.2](url) - date". The entry check required whitespace after "]", so it never saw an existing entry and every push to a release branch regenerated the notes over hand edits. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: Ia23261661b60dcf63f73914409e025a5d57b80b3 Signed-off-by: Thomas Kosiewski <tk@coder.com>

cursorVisible first ships in this release, so it was never optional in a published version. The #39 bullet only changed a test. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I9407e114ee961f9392f37b4afecafe2a774a0c4c Signed-off-by: Thomas Kosiewski <tk@coder.com>

ThomasK33 · 2026-10-30T02:25:59Z

@codex review

ThomasK33 · 2026-10-30T02:26:04Z

@codex security review

chatgpt-codex-connector · 2026-10-30T02:27:43Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: b9b631adc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-30T02:27:58Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: b9b631adc4

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-10-30T02:30:44Z

FAIL

Independent pre-merge verification of release PR #44 (0.1.0-beta.1 to 0.1.0-beta.2) at the new head. I did not write this code. Both findings from the earlier FAIL are fixed. Packaging, version, dist-tag and tag state are still correct. Two ## Fixed bullets make the same kind of false history claim as the old cursorVisible bullet, so this verdict is FAIL until they are folded into the encodeMouse Added bullet.

PR head: b9b631adc4054a518aa4813cc2edb95fca48a161 (matched gh api .../pulls/44 --jq .head.sha before the checks and again before posting)
Base origin/main: 83d79f78b1831f770e3ff045cacf7f5ed564dd96 (also the merge base)
Previous verdict head: 431c20ff6e98f7bc103b62aa35613f767b46b1ac
Tag v0.1.0-beta.1: 08607e8029e0e30c7975018e64156b9b34d7f450

#	Check	Result
1	Diff `431c20f..b9b631a` is only the two described commits	Pass. 2 files, 2 insertions, 4 deletions. `35b240a` changes one line, the `entryPattern` in `.github/scripts/prepare-release-changelog.mjs`. `b9b631a` rewrites the `cursorVisible` Added bullet and deletes the false `## Changed` bullet and the #39 `## Fixed` bullet in `CHANGELOG.md`.
2	Every bullet of the v0.1.0-beta.2 entry is true against its PR and against what beta.1 shipped	Fail. 10 of 12 bullets are true. The #41 and #42 `## Fixed` bullets describe fixes to `encodeMouse`, which beta.1 does not have (details below). The rewritten `cursorVisible` bullet is now true.
3a	`RELEASE_BRANCH_NAME=release/v0.1.0-beta.2 node .github/scripts/prepare-release-changelog.mjs origin/main` at the head	Pass. `should_generate=false`, `reason=changelog-entry-exists`.
3b	Same command in a throwaway worktree with the beta.2 entry removed	Pass. `should_generate=true`, `reason=version-changed`.
3c	Pattern table, built from the script's own source lines for tag `v0.1.0-beta.2`	Pass, 9 of 9. No match: `## [v0.1.0-beta.20](x)`, `## [v0.1.0-beta.20](x) - 2026-10-30`, `## v0.1.0-beta.21`, `## v0.1.0-beta.2.1`, `## [v0.1.0-beta.1](x) - d`. Match: `## v0.1.0-beta.2 - 2026-10-30`, `## [v0.1.0-beta.2](https://x) - 2026-10-30`, `## [0.1.0-beta.2] - 2026-10-30`, `## 0.1.0-beta.2`. The real beta.1 heading now matches for tag `v0.1.0-beta.1` too.
3d	`release-changelog` run on the head did not push	Pass. Run 40991572209 (`pull_request`, head `b9b631a`) concluded `success`. "Check release version" logged `changelog-entry-exists`. "Generate CHANGELOG.md entry", "Commit changelog update" and "Dispatch CI" were `skipped`. The remote branch still points at `b9b631a`.
4	Packaged content	Pass. `git diff 431c20f b9b631a` touches no packaged path except `CHANGELOG.md`, so I did not rerun the prebuild lane. `npm pack` at the head gives `@coder/libghostty-vt-node@0.1.0-beta.2`. The packed `CHANGELOG.md` is byte-identical to the head file (4552 bytes) and contains neither "has always set" nor `#39`. The file count is 18 because this worktree has no `dist/` or `prebuilds/` build.
5	Tag, npm version and dist-tag (recheck)	Pass. Remote tags are only `v0.1.0-beta.0` and `v0.1.0-beta.1`. npm versions are `["0.1.0-beta.0","0.1.0-beta.1"]`, dist-tags `beta` = `0.1.0-beta.1`, `latest` = `0.1.0-beta.0`. `node scripts/resolve-npm-publish-tag.mjs` prints `beta`.

False CHANGELOG claims (blocker)

These two ## Fixed bullets describe a change between two unreleased commits:

encodeMouse now accepts UTF-8 mouse rows above U+FFFF (rows 65503-65534) in mode 1005 rather than throwing a spurious RangeError; surrogate guards remain (fix(native): accept UTF-8 mouse rows above U+FFFF #42).

encodeMouse now reads each caller field exactly once, so hostile getters cannot pass TypeScript validation with one value and forward another to the native layer (fix(src): read each encodeMouse field once #41).

v0.1.0-beta.1 has no encodeMouse (git grep -l encodeMouse v0.1.0-beta.1 -- src native finds 0 files). #12 added it in this release, and #41 and #42 fixed it before any release. Both PR bodies call themselves follow-ups to #12. "Now accepts ... rather than throwing" tells a beta.1 user that a shipped function changed, which is false. The behavior itself is real and worth keeping, so move it into the Added bullet.

Fix: delete both bullets above, and replace the encodeMouse bullet under ## Added with:

- `encodeMouse(event, options)` on every terminal, backed by Ghostty's mouse-protocol encoder with validation of grid geometry, surface coordinates, and pressed-button state. It reads each caller field once, so the value it validates is the value it encodes. In UTF-8 mouse mode (1005), rows whose encoded value is above U+FFFF encode as 4-byte UTF-8, and cells whose encoded value would be a Unicode surrogate throw a `RangeError`. A new `supportsMouseInput` capability marker lets consumers probe at import time ([#12](https://github.com/coder/libghostty-vt-node/pull/12), [#41](https://github.com/coder/libghostty-vt-node/pull/41), [#42](https://github.com/coder/libghostty-vt-node/pull/42)).

Source for each added sentence: #41 destructures every caller field once in normalizeMouseOptions and normalizeMouseEvent. ValidateUtf8MouseCoordinate in native/terminal.cc at the head throws only for code points 0xd800 to 0xdfff.

The ## Fixed section keeps the #23 and #30 bullets. Both fix code that beta.1 shipped: beta.1 native/terminal.cc has the process-wide Napi::FunctionReference TerminalWrap::constructor and PositiveUint16/NonNegativeSize with no isfinite check.

Bullets I checked and found true

feat: add mode-aware mouse encoding #12 supportsMouseInput is export const supportsMouseInput = true in src/index.ts. Beta.1 has no mouse API.
feat: expose inverse, strikethrough, faint, invisible and cursorVisible in snapshots #17 faint, inverse, invisible, strikethrough are optional in src/types.ts and set only when true in native/terminal.cc. Beta.1 has none of them.
feat: expose inverse, strikethrough, faint, invisible and cursorVisible in snapshots #17/fix(types): make TerminalSnapshot.cursorVisible required, document DECSTR limit #38 cursorVisible: boolean is required in src/types.ts. Beta.1 has no cursorVisible.
docs: add EGM contract READMEs for src, native, scripts, and examples #29 adds the four READMEs and five sections at the end of the root README. native/README.md and scripts/README.md are in the packed tarball.
feat: pin Ghostty v1.4.0 so DECSTR soft resets apply #43 pins Ghostty 83fb95624 (beta.1 48ccec18) and Zig 0.17.0 (beta.1 0.15.2). Each listed upstream change appears in the feat: pin Ghostty v1.4.0 so DECSTR soft resets apply #43 body.
fix(scripts): make the release checks fail closed #31 changes scripts that beta.1 shipped. Beta.1 verify-prebuilds.mjs has no PREBUILDS_ONLY.
[codex] Remove macOS x64 prebuild docs #4 removes the "macOS x64" line that the beta.1 README has.
chore: upgrade Node to 26.12.1 (CVE-2026-111497) #21 leaves engines.node at >=20.19, and package.json differs from beta.1 only in version.

Notes (not blockers)

A hand edit now sticks. With the fixed regex, a push that keeps the ## [v0.1.0-beta.2](...) heading skips Communique, as run 40991572209 shows.
Do not approve run 40990885524 (action_required, head 431c20f). It runs the old regex, so I expect it to regenerate the entry. I did not run it.
publish.yml writes the GitHub release body with a separate communique generate call. It can repeat the "now accepts" framing. Read the release after it is created.
Prebuild and load coverage comes from the earlier verdict at 431c20f (linux-x64). Nothing packaged except CHANGELOG.md changed since then.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

encodeMouse first ships in this release, so #41 and #42 did not fix a released bug. Their behavior now reads as part of the new API. _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: Ic6de3b1b21ac87d8274619c74fd8121ef0e333e0 Signed-off-by: Thomas Kosiewski <tk@coder.com>

ThomasK33 · 2026-10-30T02:31:57Z

@codex review

ThomasK33 · 2026-10-30T02:32:02Z

@codex security review

chatgpt-codex-connector · 2026-10-30T02:34:22Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 1678613fb3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ThomasK33 · 2026-10-30T02:34:47Z

PASS+NOTES

Independent pre-merge check of the release PR #44 CHANGELOG at the new head. I did not write this text. All 10 bullets in the v0.1.0-beta.2 entry are true, and each one sits in the right section against v0.1.0-beta.1. The notes below do not block the CHANGELOG.

PR head: 1678613fb3cb80d5cc1a785259c721b9127dce06 (matched gh api repos/coder/libghostty-vt-node/pulls/44 --jq .head.sha before the checks and again before posting)
Previous verdict head: b9b631adc4054a518aa4813cc2edb95fca48a161
Tag v0.1.0-beta.1: 08607e8029e0e30c7975018e64156b9b34d7f450

Check 1. Diff scope

Pass. git diff b9b631a 1678613 touches only CHANGELOG.md (1 insertion, 3 deletions). It replaces the encodeMouse Added bullet and deletes the #42 and #41 Fixed bullets. The new Added bullet is the exact text that the previous FAIL proposed. No packaged path other than CHANGELOG.md changed, so I did not rerun the prebuild lane.

Check 2. Each bullet

Beta.1 baseline: git grep -l <term> v0.1.0-beta.1 -- src native scripts README.md finds 0 files for encodeMouse, supportsMouseInput, cursorVisible, faint, inverse, invisible, strikethrough, PREBUILDS_ONLY and isfinite.

Added

encodeMouse (feat: add mode-aware mouse encoding #12, fix(src): read each encodeMouse field once #41, fix(native): accept UTF-8 mouse rows above U+FFFF #42). True, and correctly Added. Beta.1 has no encodeMouse. At the head, encodeMouse is on GhosttyVtTerminal (src/types.ts:102) and supportsMouseInput = true is exported (src/index.ts:35). normalizeMouseOptions and normalizeMouseEvent destructure each caller field once and forward only the destructured values (fix(src): read each encodeMouse field once #41). ValidateUtf8MouseCoordinate in native/terminal.cc runs only when mode 1005 is set and throws RangeError only for code points 0xD800 to 0xDFFF (fix(native): accept UTF-8 mouse rows above U+FFFF #42). test/mouse-safety.test.ts asserts that rows 65503 and 65534 encode as f0 90 80 80 and f0 90 80 9f (4-byte UTF-8), and that x or y 55263 and x 57310 (U+D800, U+DFFF) throw RangeError.
SnapshotCell faint/inverse/invisible/strikethrough (feat: expose inverse, strikethrough, faint, invisible and cursorVisible in snapshots #17). True, and correctly Added. All four are optional in src/types.ts at the head, and beta.1 has none of them.
TerminalSnapshot.cursorVisible: boolean, required (feat: expose inverse, strikethrough, faint, invisible and cursorVisible in snapshots #17, fix(types): make TerminalSnapshot.cursorVisible required, document DECSTR limit #38). True, and correctly Added. cursorVisible: boolean is required at src/types.ts:92. Beta.1 has no cursorVisible.
EGM READMEs and root README Blueprint sections (docs: add EGM contract READMEs for src, native, scripts, and examples #29). True, and correctly Added. src/, native/, scripts/ and examples/ READMEs are new since beta.1. The root README ends with System Overview, Subdirectories & System Boundaries, Global Invariants, Global Side Effects and System Verification. package.json files lists native and scripts, so both READMEs ship.

Changed

Ghostty v1.4.0 and Zig 0.17.0 (feat: pin Ghostty v1.4.0 so DECSTR soft resets apply #43). True, and correctly Changed. Beta.1 pins Ghostty 48ccec182a932c2ec04c344d45a5fc553861cb13 and Zig 0.15.2. The head pins 83fb95624b0439ee660c2679b43b38c8b63769cd and Zig 0.17.0. The feat: pin Ghostty v1.4.0 so DECSTR soft resets apply #43 body lists DECSTR support and each upstream change the bullet names. The bullet leaves out the feat: pin Ghostty v1.4.0 so DECSTR soft resets apply #43 mode-1005 button 8/9 change, which is correct because beta.1 has no mouse API.
Release scripts fail closed (fix(scripts): make the release checks fail closed #31). True, and correctly Changed. Beta.1 ships all three scripts. Beta.1 create-release-tag.mjs calls ls-remote through tryGit, and the head calls git, which throws. The head assemble-prebuilds.mjs stages into ${targetRoot}.staging-${pid} and renames it into place. The head verify-prebuilds.mjs sets PREBUILDS_ONLY=1.
Docs drop macOS x64 ([codex] Remove macOS x64 prebuild docs #4). True, and correctly Changed. Beta.1 README.md:100 has - macOS x64. The head README has no macOS x64 line, and e222ffe is not an ancestor of the tag.

Fixed

TerminalWrap class reference per Node environment (fix: keep the terminal class reference per Node environment #23). True, and correctly Fixed. Beta.1 native/terminal.cc:45 has the process-wide Napi::FunctionReference TerminalWrap::constructor. The head stores the reference with env.SetInstanceData.
Range-check cols/rows/scrollbackLimit (fix(native): range-check dimensions before casting them #30). True, and correctly Fixed. Beta.1 has no isfinite in native/. The head checks std::isfinite before each cast.

Security

Node toolchain 26.12.1, engines.node unchanged (chore: upgrade Node to 26.12.1 (CVE-2026-111497) #21). True. Beta.1 mise.toml has node = "25.9", and the head has "26.12.1". git diff v0.1.0-beta.1 1678613 -- package.json changes only version, so engines.node is still >=20.19.

The Fixed section no longer has an encodeMouse bullet, and no bullet anywhere claims that encodeMouse, cursorVisible or the new cell attributes changed since beta.1.

Check 3. Links and PR numbers

Pass. The entry has 13 PR links. For every link, the #n text equals the /pull/n target. All 12 PRs (#4, #12, #17, #21, #23, #29, #30, #31, #38, #41, #42, #43) are MERGED, and each title matches its bullet. The heading links releases/tag/v0.1.0-beta.2, which will resolve once the publish creates the release. Remote tags are still only v0.1.0-beta.0 and v0.1.0-beta.1. npm still has only 0.1.0-beta.0 and 0.1.0-beta.1, with beta = 0.1.0-beta.1.

No correction text is needed.

Notes (not blockers for the CHANGELOG)

At posting time, the four ci jobs (linux-arm64, linux-x64, linux-x64-ubsan, macos-arm64) in run 40992234916 are pending on this head. update changelog passed. Wait for the required checks to pass on 1678613 before you merge.
The bullet says "rows" above U+FFFF. Columns take the same path, but the test covers only rows, so the narrower wording is accurate.
publish.yml writes the GitHub release body with a separate communique generate call. Read that release after the publish, because this check cannot cover it.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

chatgpt-codex-connector · 2026-10-30T02:35:24Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 1678613fb3

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Release v0.1.0-beta.2

ea8207f

_Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I33025b77f36fe1aa07caf6d235625e3179ece212 Signed-off-by: Thomas Kosiewski <tk@coder.com>

ThomasK33 self-assigned this Oct 30, 2026

ThomasK33 and others added 2 commits October 30, 2026 02:15

docs: update changelog for v0.1.0-beta.2

431c20f

ThomasK33 added 2 commits October 30, 2026 02:25

ThomasK33 merged commit 35a554a into main Oct 30, 2026
5 checks passed

Conversation

ThomasK33 commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Blast Radius

Verification

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Oct 30, 2026

Wrong CHANGELOG claim (blocker)

Notes (not blockers)

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Oct 30, 2026

False CHANGELOG claims (blocker)

Bullets I checked and found true

Notes (not blockers)

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

ThomasK33 commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

ThomasK33 commented Oct 30, 2026

Check 1. Diff scope

Check 2. Each bullet

Check 3. Links and PR numbers

Notes (not blockers for the CHANGELOG)

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

🛡️ Codex Security Review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ThomasK33 commented Oct 30, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading