[WRONG BRANCH] release: promote dev to main for v2.40.0 - #3261

Merged

lidge-jun merged 180 commits into

mainfrom

codex/promote-main-2400

Sep 2, 2026

Commits on Sep 1, 2026

chore(release): move dev to 2.40.0 after the v2.39.0 release (#3127)
lidge-jun
authored
3e0f99a
docs(devlog): record the v2.39.0 release train (#3126)
lidge-jun
authored
9c8bbbf
test(auth): pin the websocket refresh account to stop a cross-platform flake (#3128)
lidge-jun
authored
33d32b6
fix(release): call the dev version bump instead of listening for an event that never fires (#3129)
lidge-jun
authored
6f415ba
docs(devlog): record the post-release automation repairs (#3130)
lidge-jun
authored
132b557
docs(devlog): record the 2026-08-31 non-priority-70 bug triage round (#3114)
lidge-jun
authored
abcda8e
fix(openai): allow canonical fake-IP addresses on provider PATCH (#3133)

lidge-jun
and
Flowershangfromthebranches
authored
0dc01cd
fix(service): Windows cold-start budget and code-page-mangled scheduler paths (rebase of #3104) (#3134)
lidge-jun
authored
b14b741
test(auth): close the startup-prime window that rotates the credential mid-fixture (#3139)
lidge-jun
authored
c8c8dc3
fix(minimax): align split-reasoning wire schema with the official reasoning_details contract (#3132)

lidge-jun
and
cursoragent
authored
b81c435
test: probe for a free pid instead of assuming 4242 is dead (#3137)

authored
58be3c5
docs(devlog): close merge train round 3 (#3140)
lidge-jun
authored
15b0f70
test(auth): seed the pool quota after the clock is pinned (#3147)

lidge-jun
and
jun
authored
4086526
docs(devlog): remote hub mode — research, design draft, phased roadmap

jun
authored and
jun
committed
4f527e6
docs(devlog): fold 5 audit blockers — drop header-only trusted-tailnet, add identity allowlist, name session consumers and /v1/catalog admission

jun
authored and
jun
committed
83dd53c
docs(devlog): interview record — full-scope stacked delivery, dogfood compat, per-machine usage requirement

jun
authored and
jun
committed
66dcb29
docs(devlog): interview round 3 — per-client key auto-issue via token file, protocol compat floor, contradictions closed

jun
authored and
jun
committed
a7d49f3
docs(devlog): interview round 4 — usage renders from whichever store served the traffic; no mirroring

jun
authored and
jun
committed
3920954
docs(devlog): remote hub decade docs 030-080 — diff-level roadmap for all six phases

jun
authored and
jun
committed
d225b2d
docs(devlog): fold roadmap audit r1 — 10 blockers closed across 010-080 (synthesis in 002)

jun
authored and
jun
committed
fca0a7b
feat(remote): add protocol metadata and runtime role

jun
authored and
jun
committed
d25cbc0
docs(devlog): fold roadmap audit r2 — 7 blockers closed (synthesis in 003)

jun
authored and
jun
committed
ca1114f
feat(remote): serve authenticated catalog snapshots

jun
authored and
jun
committed
3d983d5
docs(devlog): fold roadmap audit r3 — pairing form mount chain + orphan .prev crash-window recovery

jun
authored and
jun
committed
a938448
fix(remote): derive management origin from request host

jun
authored and
jun
committed
1bb9828
fix(design): close five trust-boundary defects in the remote hub contract
jun
committed
5eb58b7
test(remote): cover phase one protocol and catalog contract

jun
authored and
jun
committed
825800e
fix(design): finish removing insecure-http pairing across the unit
jun
committed
2da2d73
fix(remote): type catalog bytes over ArrayBuffer and scope the key-id warn assertion

jun
authored and
jun
committed
8980430
fix(design): close the review findings the first D-fix pass left open
jun
committed
4080bdb
fix(remote): reconcile the phase-one catalog contract with the landed /v1/catalog
jun
committed
4fdd54d
feat(connect): persist fail-closed client ownership

jun
authored and
jun
committed
863a88e
feat(connect): add durable remote routing target

jun
authored and
jun
committed
6d9aed2
feat(connect): add remote hub CLI and sync

jun
authored and
jun
committed
91a4f6c
test(connect): cover transaction and client routing

jun
authored and
jun
committed
db95f8f
fix(connect): narrow client type boundaries

jun
authored and
jun
committed
9d46ca3
fix(connect): preserve catalog conditional fetch

jun
authored and
jun
committed
6fdaaf8
feat(remote-gui): add remote session issuance and pairing

jun
authored and
jun
committed
abf0f81
fix(connect): preserve sync wiring contract

jun
authored and
jun
committed
3d9184d
fix(remote-gui): harden identity and capability replay checks

jun
authored and
jun
committed
a68e95c
fix(connect): preserve malformed client state fail-closed

jun
authored and
jun
committed
753f097
test(remote-gui): cover remote session consent boundaries

jun
authored and
jun
committed
8906173
test(connect): align audited phase three matrix

jun
authored and
jun
committed
fd27c1e
fix(remote-gui): enforce exact bootstrap destination

jun
authored and
jun
committed
e6c6e78
fix(connect): reconcile client journal before lifecycle

jun
authored and
jun
committed
4ae8fa4
test(remote-gui): lock replay and expiry negatives

jun
authored and
jun
committed
5397019
test(connect): cover sync and disconnect conflicts

jun
authored and
jun
committed
886c26e
fix(remote-gui): preserve renewal and mutation origin checks

jun
authored and
jun
committed
bf382c0
fix(connect): a process-owned journal is ours to unwind, not a conflict
jun
committed
acdac3f
fix(remote-gui): drop plaintext pairing and bound the unauthenticated exchange body
jun
committed
dbec900
fix(connect): preserve the sync handler exit code on the connected branch
jun
committed
af95d59
test(remote-gui): stub the prompt happy-dom does not implement
jun
committed
dad1712
fix(connect): restore the catalog the user had, and stop calling a stuck profile a clean restore
jun
committed
20f3c11
feat(two-plane): filter hub usage by client key

jun
authored and
jun
committed
1d99dd5
feat(two-plane): add client machine and hub GUI planes

jun
authored and
jun
committed
872b945
test(two-plane): cover machine relay and GUI routing

jun
authored and
jun
committed
90c7e8f
feat(deploy): add loopback hub management ingress

jun
authored and
jun
committed
fcd79c4
test(two-plane): align shared-base shell assertions

jun
authored and
jun
committed
ccf319c
test(deploy): cover hub management ingress boundaries

jun
authored and
jun
committed
6999656
feat(two-plane): harden relay and offline target states

jun
authored and
jun
committed
4f27ee8
feat(deploy): harden management ingress allowlist

jun
authored and
jun
committed
a8fdcf6
fix(two-plane): repair remote verification failures

jun
authored and
jun
committed
e3f6cf8
docs(deploy): add remote hub deployment guide

jun
authored and
jun
committed
7d8b878
fix(two-plane): unblock client start and GUI verification

jun
authored and
jun
committed
a3fe759
fix(client): a hub without client state is disconnected, not mismatched (first oracle dogfood boot)

jun
authored and
jun
committed
5cdef72
docs(devlog): phase-4 gui screenshot evidence

jun
authored and
jun
committed
61710ef
fix(hub): the hub role never rewrites its host client configs on start (oracle dogfood)

jun
authored and
jun
committed
bf221bc
fix(two-plane): declare the machine plane, enable relay, and finish the D1/D2 client side
jun
committed
fedbe0a
fix(connect): seed default config on a fresh machine instead of refusing the commit (dogfood)

jun
authored and
jun
committed
0a73858
fix(two-plane): authenticate the relayed pairing exchange and isolate its test
jun
committed
16ddd3e
docs(devlog): clisu-oracle dogfood record — full connect lifecycle proven live

jun
authored and
jun
committed
7bf2823
fix(two-plane): a standalone install neither probes nor announces the machine plane
jun
committed
95639f0
test(deploy): assert the ingress role rule where the message is actually reachable
jun
committed
76257cc
feat(hardening): add recoverable data key rotation API

jun
authored and
jun
committed
25c784f
feat(hardening): bound pairing attempts and add session logout

jun
authored and
jun
committed
b829320
feat(hardening): validate remote protocol catalog and relay

jun
authored and
jun
committed
10a3198
feat(hardening): recover client key rotation through token backup

jun
authored and
jun
committed
2ea6313
feat(hardening): add api key rotation controls

jun
authored and
jun
committed
b12093b
test(hardening): cover rotation pairing catalog and relay negatives

jun
authored and
jun
committed
be2ee7d
docs(i18n): synchronize remote hub hardening across locales

jun
authored and
jun
committed
913d2a5
fix(hardening): gate startup on rotation recovery state

jun
authored and
jun
committed
88d9889
feat(hardening): expose remote session logout control

jun
authored and
jun
committed
9bded9c
fix(hardening): keep one-time rotation secret visible

jun
authored and
jun
committed
ad7acdb
fix(hardening): reject mismatched catalog validators

jun
authored and
jun
committed
c693700
test(hardening): cover subprocess protocol skew matrix

jun
authored and
jun
committed
e5bca8d
test(hardening): reject rotation secrets and revoke ids in argv

jun
authored and
jun
committed
bd0064d
fix(hardening): bound remote session logout request

jun
authored and
jun
committed
9088d60
test(hardening): keep rotation evidence secret-free

jun
authored and
jun
committed
54d799c
fix(hardening): drop a stray import fragment and guard an undefined rotation response

jun
authored and
jun
committed
c22792e
fix(hardening): repair phase six full-suite regressions

jun
authored and
jun
committed
5da9f17
fix(hardening): confirm the abort before rewinding, and never delete an in-flight backup
jun
committed
6a71a41
fix(hardening): declare the four routes this phase adds
jun
committed
0e443d8
feat(cli): declare ocx connect rotate as a capability
jun
committed
dd8c3e6
fix(hardening): keep the remaining two-plane UI off a standalone install
jun
committed
efefe36
Merge pull request #2771 from lidge-jun/codex/remote-hub-design
lidge-jun
authored
278fd61
Merge pull request #2772 from lidge-jun/codex/remote-hub-p1
lidge-jun
authored
87459f8
Merge pull request #2776 from lidge-jun/codex/remote-hub-p2
lidge-jun
authored
39e5aef
Merge pull request #2777 from lidge-jun/codex/remote-hub-p3
lidge-jun
authored
fd8b6b8
Merge pull request #2781 from lidge-jun/codex/remote-hub-p4
lidge-jun
authored
163feb6
Merge pull request #2786 from lidge-jun/codex/remote-hub-p5
lidge-jun
authored
6d732d3
Merge pull request #2789 from lidge-jun/codex/remote-hub-p6
lidge-jun
authored
9232df0
docs(devlog): remote hub restack planning unit (#3149)

lidge-jun
and
jun
authored
3275b5a
docs(devlog): close out the remote hub merge train (#3159)

lidge-jun
and
jun
authored
b27bab0
docs(devlog): record the objective closeout and worktree realignment (#3160)

lidge-jun
and
jun
authored
c692831
docs(devlog): verify the four review fixes reached dev (#3161)

lidge-jun
and
jun
authored
75d9ada
docs(devlog): close the remote hub restack unit (#3162)

lidge-jun
and
jun
authored
7ac4c9f
docs(skill): teach ocx the remote hub roles, pairing boundary, and disconnect halves (#3165)

lidge-jun
and
jun
authored
2f2629f
fix(catalog): read Copilot context window limits (#3163)
Ingwannu
authored
e236c36
fix(codex): preserve request-owned main pins (#3166)
Ingwannu
authored
75090d4
fix(client): tell the dashboard it is a client (#3169)

lidge-jun
and
jun
authored
e40245e
fix(cli): route ocx models new-policy and new-arrivals to the runtime module (#3171)

lidge-jun
and
jun
authored
e92aa33
fix(combo): apply the combo default effort the target can actually reach (#3172)

lidge-jun
and
jun
authored
7386b52
docs(reference): document the readyz protocol fields and the remote-hub config keys (#3173)

lidge-jun
and
jun
authored
0d8147c
test(combo): update the failover e2e assertion the effort fix invalidated (#3175)

lidge-jun
and
jun
authored
22a643a
fix(gui): stop the mobile topbar and integration cards overflowing (#3174)

lidge-jun
and
jun
authored
e582aee
fix(codex): rotate accounts on wrapped quota failures (#3176)
Vadevious
authored
2e2da87
fix(responses): surface provider 413 as terminal context overflow (#3177)
Ingwannu
authored
0d6424f
fix(export): preserve Hermes vision capabilities (#3178)

lidge-jun
and
Ingwannu
authored
51c4917
fix(remote): restore authenticated GUI health (#3179)

lidge-jun
and
Ingwannu
authored
eceb02d
fix(codex): retry caller main after pool rejection (carry of #3135) (#3180)

lidge-jun
and
luvs01
authored
634d9e5
fix(claude): keep proxy admission keys out of subscription launches (carry of #3148) (#3182)

authored
865a36e
docs(devlog): close the multiplatform QA and GUI unit (#3181)

lidge-jun
and
jun
authored
3b9cddf
fix(codex): serialize native-main refresh on the CODEX_HOME claim (rebase of #3112) (#3183)
lidge-jun
authored
fecb77a
fix(compact): route combo compact requests through the failover path (rebase of #3109) (#3184)

lidge-jun
and
x3M3x
authored
afd5b46
fix(codex): throttle repeated failed pool quota primes (rebase of #3003) (#3185)

authored
fe766e1
fix(service): report the wait that was actually spent, not the budget (#3186)

lidge-jun
and
ntdatt812
authored
ea29e25
fix duplicate Codex restore after graceful stop (#3187)

lidge-jun
and
x3M3x
authored
d335570
fix(cli): let an explicit different --port start a sibling (rebase of #3144) (#3188)

authored
5ccf7c8
fix(openai): exclude user-owned alias overlays from canonical seed validation (rebase of #3121) (#3189)

lidge-jun
and
Flowershangfromthebranches
authored
5557772
fix(usage): price aggregator models spelled vendor/model (#3194)

lidge-jun
and
jun
authored
c870714
fix(responses): strip ChatGPT citation control markers before the client (#3195)

lidge-jun
and
jun
authored
f3bcc67
docs(devlog): drop remote home-path citations the privacy scanner flags (#3197)

lidge-jun
and
jun
authored
4be4326
fix(capacity): count uncalibrated Codex plans instead of excluding them (#3198)

lidge-jun
and
jun
authored
ef6a163
feat(combo): adapt reasoning effort to target capabilities (#2731) (#3190)

lidge-jun
and
jun
authored
88c4275
fix(codex): verify auth.json identity, not just content, before publishing (#3199)

lidge-jun
and
jun
authored
c17bc94
feat(responses): opt-in ceiling for oversized outbound passthrough bodies (#3196)

lidge-jun
and
jun
authored
52d9416
feat(router): summarize compaction on the default provider when no canonical openai route exists (#3201)

lidge-jun
and
jun
authored
c7f3f6f
docs(codex): explain why routed models are gated during reserve mode (#3202)

lidge-jun
and
jun
authored
59449fa
feat(anthropic): add claude-fable-5-1 with official Fable 5.1 pricing (#3203)

lidge-jun
and
jun
authored
55400ef
test(quota): move the malformed-plan pool test onto the #3198 contract (#3200)

olddonkey
and
claude
authored
fcf0da2
fix(server): allow POST /v1/alpha/search on the loopback listener (#3205)

authored
53c09a2
feat(catalog): per-provider retainModels opt-in (#1690, carries #2860) (#3206)

authored
6a6efa9
feat(images): relay Codex image_gen to xAI Imagine with Grok OAuth (carry of #2083) (#2986)

authored
0d73d65
feat(codex): opt-in authless Codex Desktop routing mode (#1107) (#3207)

lidge-jun
and
jun
authored
4a382be
docs(cli): explain shim-free Codex token injection boundaries (#2713) (#3208)

lidge-jun
and
jun
authored
e1eb8c5
feat(proxy): startup Windows system-proxy discovery behind proxy "auto" (#1525) (#3209)

lidge-jun
and
jun
authored
5bc6939
feat(providers): opt-in OS keychain storage for provider API keys (#1221) (#3210)

lidge-jun
and
jun
authored
941cb45
feat(cursor): seed claude-fable-5-1 at 1M ahead of the Cursor lineup update (#3211)

lidge-jun
and
jun
authored
5fc7d07
feat(catalog): durable display names for discovered models (#2201, carry of #2715) (#3212)

authored
d975fea
feat(quota): per-account Gem/Cla quota for Google Antigravity (#1082) (#3213)

lidge-jun
and
jun
authored
ef7b3c9
feat(oauth): generic pool-settings contract for OAuth providers (#695 slice 1) (#3214)

lidge-jun
and
jun
authored
356e495
fix(ci): declare the provider keychain capability and refresh the Cursor seed count (#3215)

lidge-jun
and
jun
authored
f84dbf9
feat(responses): opt-in upstream Responses WebSocket transport (#2816, carry of #2817) (#3216)

authored
6fe4631
feat(codex): opt-in reset-credit auto-redemption before expiry (#822) (#3219)

lidge-jun
and
jun
authored
519bba7
devlog: wp14 carry record and wp15 disposition (#3221)

lidge-jun
and
jun
authored
85f7ef9
fix(responses): keep the reserved functions group intact for codex-spark (#3217) (#3224)

lidge-jun
and
jun
authored
d23eab4

Commits on Sep 2, 2026

fix(responses): scope the self-named namespace scrub to declared bare tools (carry of #3226) (#3234)

authored
b732b0d
fix(cli): stop a sibling start from persisting its port into config.port (#3232)

lidge-jun
and
jun
authored
261b7e0
docs(readme): stack the four demo gifs one per row so they stop getting clipped (#3235)

lidge-jun
and
jun
authored
86dee69
fix: fail over zero-output incomplete combo streams (#3236)

lidge-jun
and
RHODIZSECURITY
authored
1c8278b
docs(readme): shrink the stacked demo gifs to 560px (#3237)

lidge-jun
and
jun
authored
98444a5
docs(readme): orca-style feature rows — caption left, gif right (#3238)

lidge-jun
and
jun
authored
e4d4815
fix(subagents): auto-fallback encrypted V2 spawns to native Codex without a configured chain (#3239)

authored
744d12d
fix(subagents): let encrypted-task recovery run before the synthesized native chain (#3240)

lidge-jun
and
jun
authored
7f00d0e
fix(agents): allow Codexless V2 task recovery (#3241)

authored
b54508c
revert(subagents): drop the synthesized native chain for encrypted spawns (#3239, #3240) (#3242)

lidge-jun
and
jun
authored
2cb5921
feat(cursor): derive the picker seed from the capability table and label every row (#3222)

lidge-jun
and
jun
authored
7aa64bb
feat(server): advertise api_types and capabilities on the raw /v1/models list (#3230)

lidge-jun
and
jun
authored
f607233
docs: Cursor Private Inference connector guide (#3231)

lidge-jun
and
jun
authored
72a7c4a
feat(cursor): let the Codex Fast toggle reach Cursor's fast variant (#3225)

lidge-jun
and
jun
authored
83838e7
docs(devlog): bug-label drawdown campaign record and main->dev regression audit (#3218)

lidge-jun
and
jun
authored
8a7d003
feat(cursor): expose -fast identities to clients without a Fast toggle (#3233)

lidge-jun
and
jun
authored
8d2dd66
docs(cursor): record the stack landing SHAs and close residual R5 (#3243)

lidge-jun
and
jun
authored
21416a7
docs(cursor): closeout verification on the landed dev (#3244)

lidge-jun
and
jun
authored
8fb4e6e
feat(cursor): read-only Private Inference status route for the dashboard (#3247)

lidge-jun
and
jun
authored
fd5ccab
feat(gui): Cursor integration tab, overview card, DSH label (#3248)

lidge-jun
and
jun
authored
879d748
docs(cursor): dashboard section and read-only surface note (#3249)

lidge-jun
and
jun
authored
7d25f99
fix(windows): server.stop drains the config-dir ACL flight; retrying test teardown (#3257)

lidge-jun
and
jun
authored
19b0157
fix(windows): writable fsync handles, hermetic ACL test lanes, teardown codemod (#3258)

lidge-jun
and
jun
authored
a6ee24f
merge dev into main for the v2.40.0 release
jun
committed
847f4f1