Windows Pro gratis!: Die Home-Edition von Windows 11 bietet weniger Funktionen als die Pro-Edition. Statt eines kostenpflichtigen Upgrades auf Pro können Sie auch die kostenlosen Programme nutzen, die Sie auf der Heft-DVD finden.

Software bequem aufspielen & updaten: Installieren und aktualisieren Sie die PC-Software genauso einfach wie Ihre Apps am Smartphone: auswählen, anklicken – und fertig. Möglich machen dies die sogenannten Paketmanager zusammen mit einem Tool, das auf jedem Rechner Pflicht sein sollte.

Sicher downloaden: Downloads aus dem Internet gehören zu den großen Einfallstoren für Viren und andere Schädlinge. Doch Sie können viel tun, um beim Herunterladen von Programmen keine blinden Passagiere auf Ihren PC zu lassen.

Das und vieles mehr finden Sie in der neuen PC-WELT 9/2026. Jetzt am Kiosk und im PC-WELT-Shop.

Eine Auswahl der Themen in der neuen PC-WELT 9/2026:

• Windows Pro gratis! Kostenlos und ohne Risiko: So aktivieren Sie versteckte Pro-Funktionen in Windows Home
• Software bequem aufspielen und updaten. Windows, Programme, Apps: Wie Sie alles schnell auf den neuesten Stand bringen
• Sicher downloaden. Hacker-Angriffe mit manipulierter Software: So erkennen Sie schädliche Programme sofort
• Windows optimieren und beschleunigen. So läuft das System problemlos auch auf älterer Hardware
• Das optimale Windows-Konto. Als Standardnutzer arbeiten – und schnell auf Admin-Rechte umschalten können
• WLAN-Schutz von innen. Fremde Geräte finden: So durchleuchten Sie Ihr Heimnetz mit Profi-Tools
• Alle KI-Funktionen vom PC entfernen. Copilot & Co. lassen sich ganz einfach aus System und Programmen entfernen
• Ihr Recht auf Reparatur. Was sich jetzt für Verbraucher, Hersteller und Händler ändert
• Achtung: Ihre Daten im Netz Mit dem Diebstahl der Identität. einer Person gelangen Kriminelle an Zugangsdaten aller Art. Mit diesen Tipps schützen Sie sich und handeln richtig, wenn Kriminelle bereits zugeschlagen haben
• Durchblick im Dateienwust. Die Dateienflut wird immer größer. Ordnung auf dem PC lohnt sich langfristig. Spezialtools unterstützen Sie auf dem Weg zum cleveren Dateimanagement
• Sonderzeichen einfach eingeben. Mit passenden Tastaturkürzeln und Tools lassen sich auch Sonderzeichen schnell einfügen
• Der beste Internetanschluss. So gelingt der Umstieg auf Glasfaser ohne Probleme
• PC & Notebook optimal kühlen
• …

Das lesen Sie nur im Plus-Teil der neuen PC-WELT 9/2026 – WLAN-Tuning – Profi-Tricks für mehr Tempo & Reichweite

• Mehr Tempo im Netzwerk. Ein schnelles Netzwerk ist vor allem bei der Übertragung größerer Datenmengen wünschenswert. Wirklich schnell geht es nur mit LAN-Kabeln, die auch mehr als ein Gigabit pro Sekunde übertragen
• WLAN & Heimnetz clever erweitern. Wollen Sie auch in Arbeitszimmer, Hobbykeller oder Garten stabilen Empfang haben, sollten Sie das Heimnetz gezielt und mit der passenden Technik erweitern
• Getrennte WLANs für bessere Sicherheit. Indem Sie Clients in verschiedenen, voneinander getrennten Netzen unterbringen, verhindern Sie, dass eine Sicherheitslücke bei einem Gerät alle anderen gefährdet
• WLAN unterwegs sicher nutzen. Kostenlose WLAN-Hotspots außerhalb der eigenen vier Wände sind eine tolle Sache – sie können aber auch gefährlich sein. Treffen Sie deshalb Sicherheitsvorkehrungen, bevor Sie öffentliche Internetzugänge nutzen
• Die besten Tools für Fritzbox & Co. Bei aktuellen Routern können Sie viel einstellen. Doch manchmal nicht genug: Dann helfen clevere Profi-Tools, schnell an versteckte Infos zu gelangen oder einzelne Funktionen zu erweitern
• Notebook aufrüsten mit Wi-Fi 7. Nach dem Umstieg auf Windows 11 sollte das WLAN-Upgrade für Ihren Laptop folgen. Mit günstiger Hardware zum Einbauen oder Anstecken nutzen Sie sofort das schnelle Wi-Fi 7
• Alles zu Wi-Fi 8. Erste Geräte mit Wi-Fi 8 werden wohl nicht vor 2028 auf den Markt kommen. Der ROG NeoCore WiFi 8 von Asus ist eine erste Konzeptstudie

Diese Programme finden Sie auf der Heft-DVD:

• Abelssoft Anti Browser Spy. Schnüffelfunktionen des Internet-Browsers abschalten (nur PLUS-Ausgabe)
• Ascomp Guardian Of Data Pro. Dateien verschlüsseln und komprimieren
• Ashampoo Uninstaller 15. Software entfernen
• Audials Music 2026 Special Edition. Musik aufnehmen und verwalten
• Ergonis Popchar. Sonderzeichen einfach einfügen
• JMMG Fotowerkzeuge 6. Fotos verwalten, bearbeiten und optimieren
• Lopesoft Lope Edit Pro. Texteditor
• M+T Tipptrainer 10 Professional. 10-Finger-Schreiben lernen
• …

PC-WELT 9/2026 gibt es in drei Varianten:

• als Plus-Ausgabe mit Extra-Heft und einer Zusatz-Doppel-DVD für 8,99 Euro
• als DVD-Ausgabe für 6,99 Euro und
• als reines Magazin ohne Datenträger für 4,99 Euro

Sie können die Plus-Ausgabe auch direkt im PC-WELT-Shop bestellen – als gedruckte Ausgabe oder für 3,99 Euro als ePaper. Hier finden Sie die Jahres-Abo-Varianten PC-WELT Plus.

The post Prime Intellect Releases Prime Agent: An Open-Source RLM Harness Where Sub-Agents Are Function Calls Inside Persistent IPython Kernel appeared first on MarkTechPost.

"Releasing Muse Code in beta today," Meta CEO Mark Zuckerberg wrote in a post on rival social network X (under his longtime handle @finkd). "It's a terminal coding agent that takes on complete software engineering tasks across large repos: planning changes, writing code, validating the results."

The launch marks Meta's most serious entry yet into a category it has largely watched from the sidelines.

While Anthropic and OpenAI turned their coding agents into flagship products — and startups like Cursor built billion-dollar businesses on the workflow — Meta's developer story long centered on Llama, the open-weight model family it gave away to the tune of more than a billion downloads.

Muse Code changes that in more ways than one: it's a full harness, installable on macOS or Linux with a single curl command, co-trained with the model that powers it — and, like the Muse Spark models behind it, entirely proprietary.

Developers and prospective users can install it now on their Terminal using the following one-line command — but be warned, if that's you, you'll need to log in with a Meta account and provide billing details first in order to begin: curl -fsSL https://dev.meta.ai/install.sh | bash

Persistent background agents and parallel worktrees

Muse Code's headline architectural bet is what Meta calls async background agents.

Rather than spawning helper agents fresh for each task — the pattern most rival harnesses use — Muse Code keeps a set of specialized background agents alive for the entire session.

According to Meta's blog post, these agents "remain active throughout each session, rather than being spawned for individual tasks, helping avoid redundant information gathering," carrying out next steps on their own and choosing when to report back to the main agent.

The practical pitch is less latency and less babysitting: an agent that already knows the repository doesn't have to re-explore it every time the developer asks for something new.

When a job is large enough, Muse Code fans out to separate sub-agents working in parallel, each in its own isolated git worktree, so the developer's working copy is never touched.

"In testing we had it build six features for a game simultaneously with no collisions," Zuckerberg wrote on X.

Worktree isolation and parallel sub-agents exist in competing tools, but Meta is leaning on the combination of persistence plus parallelism as its differentiator.

The second notable design choice is auditability. Every model call, tool run, approval, and edit is appended to a local event log before it executes — a single source of truth that Meta says makes the runtime "replay-exact and restart-safe."

If Muse Code crashes 20 hours into a long-running task, it resumes precisely where it stopped, with no lost work and no re-prompting. For engineering leaders who have been burned by opaque agent runs, a complete local audit trail may prove to be the feature that matters most in enterprise evaluations.

Muse Code also ships with bundled "skills" that will look familiar to users of rival tools: /plan turns a task into an approval-gated plan, /grill stress-tests that plan until it holds up, and /goal drives the agent toward completion of a stated objective.

Muse Spark 1.2: co-trained with its own harness

Under the hood is Muse Spark 1.2, which Meta describes as a coding-focused update to Muse Spark 1.1 with "significantly scaled up training compute on coding tasks" and broader training environment diversity, improving code generation, complex debugging, and codebase understanding while maintaining general agentic capability.

The update lands squarely on the Muse family's weakest flank. When the original Muse Spark debuted in April, it vaulted Meta back into the top five on frontier reasoning and vision benchmarks — but trailed on the agentic coding evaluations that matter most to this market, scoring 77.4 on SWE-Bench Verified against Claude Opus 4.6's 80.8 and Gemini 3.1 Pro's 80.6, and lagging well behind GPT-5.4 on GDPval's measure of long-horizon work tasks.

Four months later, a coding-specialized checkpoint paired with a purpose-built harness reads as Meta's direct answer to that gap.

Two training details stand out. First, Meta co-trained the model with Muse Code itself, using rejection-sampled harness trajectories and recipe optimizations for goals, context compaction, and sub-agents — meaning the model was explicitly tuned to perform best inside this particular tool. That mirrors an industry-wide shift away from treating models and harnesses as separable products.

Second, Meta used a self-improvement loop: Muse Spark 1.1 generated challenging coding environments and instruction-following templates, then graded candidate solutions against those requirements, producing a scalable training dataset for its successor. Meta credits the loop with making 1.2 measurably better at following complex instructions.

Meta published benchmark charts comparing Muse Spark 1.2 against other coding models on Terminal-Bench 2.1, DeepSWE 1.1, and an internal Meta coding benchmark, pointing readers to a separate methodology report for details — though the company did not headline specific scores in the announcement itself, a notable omission in a field where rivals trumpet leaderboard placement.

The company's most striking demonstration is a long-horizon case study: Meta pointed Muse Spark 1.2 at GPU kernel optimization and let it run for more than 1,000 tool calls over up to 24 hours on NVIDIA Hopper hardware.

Working in Triton and barred from simply wrapping existing third-party kernel libraries, the agent wrote, compiled, and profiled its way to what Meta calls "substantial improvements" over baseline implementations of KDA and MLA kernels — including genuinely non-obvious optimizations like re-centering gated cumulative decay at a chunk midpoint.

"It kept finding substantial improvements well beyond the initial exploration phase," Zuckerberg wrote. Sustained improvement over a 24-hour autonomous run, if it holds up outside Meta's demos, addresses one of the most persistent criticisms of coding agents: that they plateau or drift once past their initial burst of progress.

Your data for a discount?

The pricing structure may be the most consequential — and most scrutinized — part of the launch. Meta is offering Muse Spark 1.2 through its Meta Model API in two tiers.

The standard tier is priced at $1.25 per million input tokens and $4.25 per million output tokens (with cached input at $0.15), and Meta commits that prompts and completions on this tier are not used to train its models. There is no long-context premium, and rate limits run to 3,000 requests and 4 million tokens per minute, per team. It's about mid-range price, compared to other leading AI models available over API.

The contributor tier is where Meta's strategy diverges sharply from its rivals: $0.10 per million input tokens and $0.20 per million output tokens — roughly 12x and 21x cheaper than standard, respectively, with cached input at a near-free $0.002 — in exchange for explicit permission to use your prompts and completions to train future Meta models. It's the cheapest available on the market, but you pay with your data — as described below.

This is the tier Zuckerberg is steering new users toward: "It's easy and low-cost to get started," he wrote. "Install Muse Code with one line and you can start on our contributor tier."

In VentureBeat's own testing on a Mac mini, the one-line installer worked as advertised — a 97 MB download and a sign-in — but the agent stopped short of running anything, reporting that no models were visible and that payment was "required to finish setting up your account."

In other words, even the heavily discounted contributor tier requires a payment method on file before Muse Code will do any work: low-cost is accurate, but free is not.

Meta frames the contributor tier as lowering the barrier for prototyping and experimentation "where training on your data is acceptable."

But it also means the default on-ramp for Muse Code sends developers' code and prompts into Meta's training pipeline — a tradeoff enterprises with proprietary codebases will need to consciously opt out of by moving to standard pricing.

The contributor tier also carries much tighter rate limits (60 requests per minute versus 3,000), a clear signal it's aimed at individuals and small experiments rather than production workloads.

The approach is classically Meta: subsidize access, harvest data at scale, and use it to close the gap with the frontier. Zuckerberg made no secret of the ambition, calling Muse Spark 1.2 "our next step as we push toward frontier, with larger, more capable models on the way."

However, for developers and enterprises who want or are required legally to keep their code secure, the tradeoff may not be one they're willing or able to make.

No Llama in sight

What today's announcement conspicuously lacks is any mention of open source — a striking omission from the company that spent three years positioning itself as the standard-bearer of open AI.

From the original LLaMA's debut in February 2023 — whose weights famously leaked onto 4chan within weeks, inadvertently kickstarting the movement to run capable models on consumer hardware — through Llama 2's commercially usable license, the coding-specialized Code Llama, and the 405-billion-parameter Llama 3.1, which Zuckerberg launched in July 2024 with a manifesto titled "Open Source AI Is the Path Forward," Meta's entire pitch to developers was that frontier-class weights should be free to download, self-host, and fine-tune.

The strategy worked: by early 2026, the Llama family had been downloaded roughly 1.2 billion times, averaging about a million downloads a day, with self-hosting offering enterprises cost reductions VentureBeat has previously reported at as much as 88% versus proprietary API providers.

Then came the unraveling. Llama 4 debuted in April 2025 to mixed reviews and, eventually, admissions that its benchmark results had been fudged — while Chinese open-weight rivals from DeepSeek, Alibaba, and Zhipu AI surged to account for some 41% of downloads on Hugging Face by late 2025, eroding Llama's claim to leadership of the very movement it started. The rocky rollout spurred Zuckerberg's summer 2025 overhaul of Meta's AI operations into Meta Superintelligence Labs (MSL), with Scale AI co-founder Alexandr Wang recruited as chief AI officer.

The Llama era effectively ended this past April 8, when MSL shipped the original Muse Spark — "the most powerful model that meta has released," in Wang's words — as Meta's first proprietary model: cloud-only, with no downloadable weights and no self-hosting, initially confined to Meta's apps and a private API preview.

Asked directly at the time whether Llama development would continue, a Meta spokesperson told VentureBeat only that "our current Llama models will continue to be available as open source" — pointedly silent on future ones.

Wang, for his part, said bigger models were already in development "with plans to open-source future versions" — but four months on, today's release does nothing to advance that promise: no weights, no license, and neither the blog post nor Zuckerberg's thread so much as uses the word "open."

The reversal is all the sharper because Meta's rivals have been moving in the opposite direction. OpenAI released its Codex CLI as open source under the permissive, enterprise-friendly Apache 2.0 license and followed with its gpt-oss open-weight models; Google's Gemini CLI harness is likewise Apache-licensed.

With Muse Code, Meta lands closest to the posture of Anthropic — whose Claude Code remains proprietary — while the company that once argued open source was the path forward now asks developers to pay per token for a model they cannot inspect, or to subsidize that access with their own data.

Seen in that light, the contributor tier reads as the successor to the Llama strategy itself: the ecosystem flywheel is no longer free weights in exchange for mindshare, but cheap tokens in exchange for training data.

Why it matters

Terminal coding agents have become the fastest-growing surface in enterprise AI, and until today the category has effectively been a two-horse race between Anthropic and OpenAI, with Google and a crowd of startups in pursuit.

Meta's entry brings a genuinely different architecture (persistent background agents, an append-only local event log), a credible long-horizon demo, and an aggressive pricing wedge.

The open questions are the ones benchmarks charts can't answer: whether Muse Spark 1.2 actually matches Claude and GPT-class models on real-world repositories, whether developers trust Meta with their code, and whether the contributor tier's discount is enough to make them stop asking. Muse Code is available in beta today; Muse Spark 1.2 is live in the Meta Model API with expanded global access.

If you’ve ever simplified an interaction just to make a prototype manageable, you’ve probably felt the tension between what you designed and what the prototype could actually support. The risk is that when a design fails in usability testing, you can’t always tell why. Was the experience itself the problem, or was it really the prototype getting in the way: a missing connection, a laggy transition, a path you didn’t build?

I ran into this while working on Report Broken Site for Firefox Android, and it led me to a different way of prototyping: building directly inside the real app with AI (Claude), so the test reflects native fidelity rather than a simulation of it. That’s when I started worrying just about the design failing, and not the prototype.

Feature: Report Broken Site

Reaching limits of walled prototypes

In tools like Figma, prototyping requires anticipating every possible interaction and defining it explicitly. For the user to feel the true experience, each path needs to be connected, each transition set, and each variation accounted for. As complexity grows, it tends to increase the cost of maintaining it: screens multiply, connections become fragile, and animations become tedious to maintain.

At some point, you’re no longer designing the experience. You’re managing the prototype. 

E.g. Changing the animation for one node, requires updating it everywhere manually.

To cope, we simplify the prototype. We reduce the number of paths, guide users through predefined flows, and limit what they can do on the prototype. The result is what I’ve started thinking of as a walled prototype — like a walled garden: a bounded space where users can move, but only within the paths we’ve pre-defined.

Some designers might argue that Figma’s recent additions of variables and advanced logic solve this problem. However, even with these tools, the designer is still building and managing the prototype. Figma prototypes simulate a system; it is not the system itself or a part of it. These prototypes have been useful, but they have also shaped the participant testing experience in ways that haven’t always been obvious.

When the logic of a feature is handled by manual connections, the canvas quickly turns into spaghetti of fragile dependencies.

Prototypes shape participant behavior

This becomes especially noticeable in usability testing. Test participants tend to recognize when they are interacting with a prototype, and that awareness can change how they behave. They may hesitate to explore, follow the perceived intent of the task, or tap around when they get stuck.

For example, to keep a prototype manageable, I might only make a few issue types selectable. But then participants are doing two things at once: deciding what they want to do and guessing what the prototype will allow. Their feedback can become shaped by the prototype’s limits, not just the design —  like a visitor to the walled garden checking which paths are actually open to them.

That constraint can be useful in early concept testing, where a narrower path helps focus the conversation. It becomes more limiting when we are trying to understand how the full experience behaves.

Research and practice have long acknowledged that prototype fidelity and testing setup can influence participant behavior. But in practice, many workflows still rely on constrained, screen-to-screen simulations.

I’ve often wondered:

How a user’s perceived experience might change if they weren’t encountering the feature in the isolation of a walled prototype?

From walled to native fidelity prototypes

Designing and prototyping is often described in terms of fidelity — from low-fidelity sketches to high-fidelity designs ready for dev handoff. That framing focuses on how closely we represent the product, but not necessarily how the experience itself behaves.

As building realistic interactions becomes easier using AI, it may now be possible to move beyond simulating flows in Figma and towards observing how people actually behave. So, alongside designing it in Figma, I built the feature directly into a local version of the Firefox Android app using Claude. It wasn’t straightforward at first, but even the friction of getting it working revealed things I wouldn’t have seen in a Figma prototype.

When I did this, I noticed there were no predefined paths to manage or fragile connections to maintain. The experience felt more continuous, allowing users to move more freely, not just within the feature, but within the app itself. I started thinking of these as prototypes with native fidelity — native to the app, native to the device, and aligned with how users expect interactions to behave.

When prototypes need to handle dynamic behavior

The difference between the two types of prototypes is not just theoretical; it starts to change what the experience can support. In walled prototypes, content is often fixed, and interactions move users between predefined screens. While this works for simple flows, it becomes harder to represent how interfaces behave when content needs to update dynamically based on user interaction.

In the Report Broken Site feature, this was important. A walled prototype struggles with:

• Capturing website data: Depending on the browsing tab, metadata like the URL, screenshot, browser info, and tracking data needs to be captured and reflected back to the user.
• URL editing: Simulating real text entry, cursor movement, and auto-correct behavior.
• Branching logic: If a user selects “Site doesn’t load” as issue type, the details are optional, but if they choose “Something else,” details become required.
• Error handling: For “Something else,” the system must validate input length in the description box and show an error if it’s insufficient.

Have you ever run into interactions like these and found yourself simplifying them, just to make the prototype manageable?

When I built it directly using Claude, the native fidelity prototype was able to handle metadata capture, text input, and branching logic more naturally.

The native fidelity prototype inherits native behaviors like metadata capture, keyboard interactions, and dynamic state changes.

The environment is part of the experience

Another challenge is the environment in which the prototype is experienced. In walled prototypes, layouts are often fixed, and responsiveness is limited. Differences in device size, orientation, or performance can introduce inconsistencies that don’t reflect the intended final experience.

In practice, this can show up as:

• Oversized UI elements on larger devices as the prototype was created for an average phone size.
• Laggy interactions on slower networks as Figma prototypes fail to be responsive sometimes.
• Layouts that don’t adapt as expected because of the constraints of the prototyping environment.

When the interaction is built directly in the app, the experience inherits the native environment of the device. Layouts respond to screen size, interactions feel more consistent, and the overall experience is closer to what users would encounter in the final product. This could reduce the likelihood of testing interfaces being mistaken for design issues.

Tradeoffs and new realities

This approach introduces its own challenges. First time setup for a designer is complex, and navigating the codebase and working through unfamiliar tools takes effort.

Using Claude on the Firefox for Android codebase in Android Studio to build the prototype.

Adopting this approach requires a shift in the UX designer’s toolkit. It raises the barrier to entry by requiring baseline comfort with the terminal, build environments, and IDEs. But it also allows designers to move beyond “faking the experience” in Figma prototypes and start building directly in the app.

Building the prototype this way also changes how the work evolves. Instead of worrying about defining everything upfront, requirements tend to emerge through interaction —i.e. edge cases, missing states, and unclear behaviors as the experience is built. In Figma, many of these details are easy to overlook; when you create a prototype by building directly, they become easier to find.

Of course, this realism has its limits. While the experience feels like a continuous system rather than a sequence of steps, I haven’t yet connected it to a backend, pulled in APIs, or tested cross-device capabilities across mobile, tablet, and desktop. I’m still at the start of this exploration. What I want to understand next is how native fidelity prototypes change the testing environment itself: whether participants explore differently, whether failures are easier to interpret, and what new friction this approach introduces for designers and teams.

Start failing for the right reasons

To put it simply: if prototypes constrain user behavior, they may also shape the insights we get from usability testing.

For Report Broken Site, the value of the native prototype was not just that it handled more states. It gave me a more honest way to sit with the experience before putting it in front of participants. I could edit the URL, switch issue types, trigger validation, and move around the app as the feature would exist in context. Because this was a mobile experience, that context mattered: I could test it on a real device, with real navigation patterns, real input behavior, and the surrounding app experience intact. Those details helped me look past whether the prototype was working and focus more directly on whether the experience was working.

That is what I mean by letting the design fail for the right reasons: understanding whether an experience fails because of the design itself, not because of a missing screen-to-screen connection, bad transition, or laggy Figma prototype. The next step is to test whether this translates into different participant behavior and more useful usability insights.

Originally published on medium.com.

With this update, there will now be multiple ways to create and use rubrics in Classroom:

• [New] Draft relevant Classroom rubrics from the assignment creation page: Within the “Rubrics” section, generate a new Classroom-ready rubric with help from Gemini based on their assignment. Educators can review and edit the proposed rubric criteria before adding it to the assignment, saving valuable prep time. 
• Convert existing rubrics files from the assignment creation page: Within the “Rubrics” section, educators can select an existing rubric they have and instantly convert it to a Classroom-ready rubric.
• Create rubric files from the Gemini tab: When planning their lessons, educators can collaborate with Gemini to draft a rubric based on information that they provide. They can then export the rubric to Sheets or Docs before attaching it to their class.

Note: This feature is only available for users over age 18.

Streamline grading setup by instantly generating custom rubrics directly within the assignment creation workflow.

Getting started

• Admins: This feature will be available by default if Gemini in Classroom is enabled. Visit the Help Center to learn more about managing access to Gemini in Classroom.
• End users: Visit the Help Center to learn more about creating and reusing rubrics for an assignment.

Rollout pace

• Rapid Release and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on August 5, 2026

Availability

• Education: Education Fundamentals, Standard, and Plus

Resources

• Google Classroom Help: Create or reuse a rubric for an assignment
• Google Workspace Admin Help: Manage access to Gemini in Classroom

--------------------

01 Introduction

In a response to a post on a previous episode, I said that I would take a look at ID3 tags.

ID3 tags are text information that is added to an MP3 audio file, such as the author, date, name, and other information.

02

While I am at it I will also look at Vorbis comments, which perform a similar function for vorbis, the container format for "ogg" audio files.

As example audio files, I will use a recent HPR episode, hpr4678 in both mp3 and vorbis formats plus also one from another podcast as well.

03

There is Free Software which you can use to view, edit, or remove both types of tags or comments, and I will describe how to use it in this episode.

04

I will cover how to view tags and extract the text information, as well as how to strip the tags from a file and why you may wish to do so under certain very specific circumstances.

I won't cover how to add to or edit tags in an MP3 or OGG file, as that is a more involved subject that I don't have much experience with.

05

I will mainly talk about ID3 MP3 tags rather than vorbis comments for the simple reason that the situation with MP3 files is an utter mess while vorbis comments are very straightforward and so there isn't as much to say about them.

06

As often happens when researching a subject to write a podcast script, I have learned quite a bit that I didn't know previously, and discovered that things that I thought I did know were wrong.

I hope that you may learn a few things from this episode that you didn't know previously either.

--------------------

07 Background

I won't go over the detailed history of ID3 tags, as I don't have a reliable source for this.

Briefly however, so far as I can determine, there is no official independent standard for ID3 tags or vorbis comments.

Both seem to be more in the nature of a convention that was created by an unofficial group of contributors rather than something issued by a standards body.

08

However, I don't see the lack of a conventional standards body as necessarily a problem with respect to the use of ID3 tags or vorbis comments.

I just am not familiar enough with the industry to know who to regard as being an authoritative source when it comes to the history and development of them

Since I am unsure as who to credit with what developments, I will avoid that sort of detail.

09 ID3 Tags

There is a web site with the URL of ID3.org that seems to have the best reference material on the topic of ID3 tags.

According to this site, the term "ID3" means "IDentify an MP3".

10 Vorbis Comments

For vorbis, the reference site seems to be xiph.org.

Although the implementation details may differ from ID3, from our perspective as podcast listeners, they can be seen as more or less equivalent in terms of what I am going to address here.

--------------------

11 ID3 Details

Versions

One of the problems with ID3 is that there are multiple incompatible versions, particularly from the very early days.

ID3v1 tags are located at the end of the audio file in the last 128 bytes.

This was done for compatibility reasons to allow early MP3 players to simply ignore the tags if they didn't know how to deal with them.

The tags would simply appear as a short burst of static from the perspective of these early players.

12

ID3v2 moved the tags to the start of the MP3 file to allow players to scan the tags for information such as titles without having to read to the end of the file to find them.

There are far fewer limits on the amount of information that can be placed in ID3v2 tags.

13

ID3v1 is obsolete and only very old players will require it.

However, it is still used by some publishers for backward compatibility reasons.

ID3v1 included numerical musical "genre" category codes which apparently turned out to be a very bad idea in practice.

14

Furthermore, all genre categories above 70 were defined by an audio software company called Nullsoft who created software such as Winamp.

These codes were never actually part of the ID3 standard, although there was never really a standard to begin with.

15

The current ID3 version is 2.3. There is a version 2.4, but apparently it is not actually generally accepted and may be a developmental dead end.

16

The id3.org web site contains a copy of the ID3v2.3 standard, but I am not going to address the technical details here.

This would only be of interest to someone who was creating software to read and write ID3 tags.

17 ID3v2 Frames

The ID3v2 information is encoded into what are called "frames".

The text information is contained in text information frames.

18

Text information frames start with a set of four character identifiers, all starting with the capital letter 'T'.

Examples

"TALB" is the "Album/Movie/Show title" frame.

"TIT2" is the "Title/Songname/Content description" frame.

"TYER" is the "Year" frame.

There are many more, but I won't go into more detail here.

19 HPR ID3 Tags

HPR makes an interesting case study because they use both ID3v1 and ID3v2 in the same file.

This can cause some interesting problems with software that tries to read those tags.

This is because most software appears to expect one or the other, but not both.

However, so long as this does not cause problems with anything that actually plays the files, this is not a problem so far as people who just want to listen to podcasts are concerned.

It does mean though that we have more to talk about than we would otherwise would have had.

--------------------

20 Vorbis Comment Fields

The situation with Vorbis comments is much simpler, as there seems to be just one standard that was adhered to from the start rather than a succession of hacks.

Information is stored in "fields", which xiph describes as being like Unix environment variables.

These consist of a field name followed by an equal sign and then the information intended for that field.

Field names are case insensitive.

21

The field names are not firmly defined at this stage, but there is a list of recommended names.

Examples are

"TITLE" is the Track or Work name.

"ARTIST" is the person responsible for the work.

"LICENSE" is the license information.

22

You can see the complete list for yourself on the comment field and header specification page at xiph.org

--------------------

23 Software for Listing, Adding, and Modifying Tags and Fields

There are three software packages that I will now describe which allow you to list, add, modify, and remove tags and fields.

There are other packages which can do the same, including some which offer a GUI interface.

However, I will limit myself to describing these three.

The principles should be the same for others.

24 ffprobe

ffprobe is part of the ffmpeg package.

If you have listened to my previous episodes on audio, you will have heard me talk about ffmpeg.

ffprobe is used to display information about media files rather than for modifying them.

ffprobe is licensed under the GPLv2 or later.

ffprobe can be used to display information about both MP3 and OGG Vorbis files.

25 ID3v2

The next is the rather aptly named id3v2 and works with MP3 files.

On Linux systems, this should be provided by the id3v2 package.

On Debian derivatives this can be installed as follows

sudo apt install id3v2

26

This also installs a man page which provides a brief list of the options.

According to the README file in the source tarball, this is published under the LGPL

ID3v2 is particularly useful for displaying ID3v1 tags.

27 vorbiscomment

The third is "vorbiscomment" and works with OGG files.

On Linux systems this should be provided by the "vorbis-tools" package.

On Debian derivatives this can be installed as follows

sudo apt install vorbis-tools

28

The vorbiscomment program is used to list or edit comments in Ogg Vorbis files.

This also installs a man page which provides a brief list of the options.

According to the license.lgpl file in the source tarball, this is published under the LGPL version2.

29

The display format for vorbiscomment follows the data definition format in the vorbis standard, whereas ffprobe re-formats it to match its own preferred appearance.

--------------------

30 Examples from HPR

With the background out of the way, I will now give several examples of how to list the tags or fields.

31 Listing ID3v1 Tags

As previously mentioned HPR uses both ID3v1 and ID3v2 tags in the same file.

However, so far as I can tell, most software seems to look for ID3v2 tags first, and don't display the ID3v1 tags if both are present.

32

The ID3v2 program however seems to do the opposite, at least with HPR podcasts.

However, the number of samples that I have which have both are rather limited, so I can't be sure if this is always the case or if this is a side effect of something else.

I did mention that ID3 tags were a mess, didn't I?

33

Let's go on to our example however.

If we want to see the ID3v1 tags, then using hpr4678 as an example, if we type

id3v2 -l hpr4678.mp3

=

we get the following result.

34

id3v1 tag info for hpr4678.mp3:

Title : High Resolution Elapsed Time i Artist: Whiskeyjack

Album : Hacker Public Radio Year: 2026, Genre: Unknown (186)

Comment: https://hackerpublicradio.or Track: 0

hpr4678.mp3: No ID3v2 tag

35

The first line tells us that this information is ID3v1 tags.

The last line tells us that there are no ID3v2 tags.

This last line is incorrect, but we will come back to that later.

36

In between are three lines of text.

The first line contains the title and the artist.

The title is the name of the HPR episode, or at least part of it.

The artist is the HPR contributor who made that episode.

37

The second line contains the album name, the year, and the genre.

The album name is this case is simply Hacker Public Radio, as the concept of an album doesn't really fit a podcast.

The year is the year that the episode was recorded, or at least the year in which the MP3 file was assembled with the HPR intro and the tags added.

38

The genre is listed as "unknown 186".

Recall that with ID3v1 tags there is a one byte numeric genre code, but that no genres above 70 were ever officially assigned.

It seems to be a general convention though to use a code 186 for podcasts.

39

The third line contain a comment and track number.

The comment in this case is the HPR web site URL.

The track is zero.

"Track" would appear to serve no useful purpose in this instance.

However, it may be there for reasons of compatibility that I am unaware of, so I would be very reluctant to remove that without very good reason.

40

If we look at the above information in detail we can see that two of the tags appear to have cut their text information off short.

The title is cut off in mid word after the 30th character.

The final "g" in "hackerpublicradio.org" is cut off in the comment.

41 Alternative Method for ID3v1

We can confirm whether the text being cut short is due to a problem with the id3v2 program, or whether it really represents the data in the file by using a rather simple check.

42

Recall that ID3v1 tags are simply the last 128 bytes of the MP3 file.

All we need to do is to extract the last 128 bytes of the file.

We can do this using the standard tail command.

tail -c128 hpr4678.mp3 | tr '\0' ' ' | tr -c '[:print:]' 'x'

43

The -c128 option used with tail tells it to extract the last 128 bytes of the file.

We then pass the result through the "tr" command and tell it to replace null bytes with new line characters.

Then we replace any remaining non-printable characters with an 'x'.

When we do that we get the following

44

TAGHigh Resolution Elapsed Time iWhiskeyjack Hacker Public Radio 2026https://hackerpublicradio.or x

45

The first three characters are capital TAG.

This is a flag which indicates that what follows are ID3 tags.

46

Next, we have 30 characters which specify the title.

The next 30 characters specify the artist.

The next 30 characters are the album, or in this case just "Hacker Public Radio".

The next 4 characters are the year.

The next 30 characters are a comment, or in this case the HPR URL, except for the final "g".

The last character is the genre code, which we have replaced with an "x" because it is otherwise non-printable.

47

Taken together, these add up to 128 bytes.

We can see that the field lengths are of fixed length with pre-defined meanings based on position.

--------------------

48 ID3v2 Using ffprobe

Now lets move on to ID3v2 tags, which is probably more useful for most people.

For this, we will switch to using ffprobe.

The command for this is

ffprobe -hide_banner hpr4678.mp3

The -hide_banner option suppresses extra data about the codecs which doesn't interest us much and leaves mainly the tag information plus a few other things.

49

The output gives us the full data that is associated with the podcast episode from the HPR web site.

This includes the episode number, year, full title, author, license, and full summary text.

You can see a full copy of this in the show notes.

Input #0, mp3, from 'hpr4678.mp3':

Metadata:

track : 4678

year : 2026

title : High Resolution Elapsed Time in Shell Scripts

author : Whiskeyjack

copyright : CC-BY-SA

artist : Whiskeyjack

album : Hacker Public Radio

comment : https://hackerpublicradio.org Clean; Surprises encountered when measuring elapsed time in shell scripts The license is CC-BY-SA

genre : Podcast

encoder : Lavf61.7.103

date : 2026

Duration: 00:30:10.18, start: 0.023021, bitrate: 64 kb/s

Stream #0:0: Audio: mp3, 48000 Hz, mono, fltp, 64 kb/s

50

The ID3v2 tag version contains all of the information which was provided by the author, including the full title and description without the 30 character limit of ID3V1.

If you want any of this information for some reason you should be able to extract it from the MP3 file using a combination of ffprobe, grep, and cut rather than trying to scrape the HPR web site and matching it to the MP3 later.

--------------------

51 ID3v1 Using ffprobe

I previously mentioned that HPR MP3 files have both ID3v1 and ID3v2 tags in the same file, and that ffprobe will default to using ID3v2 tags if present.

However, what happens if we remove the ID3v2 tags and leave the ID3v1 tags?

I will describe how to strip tags later on in this episode, but let's just assume for now that I have done this.

If we then use ffprobe to read the ID3 tags using the same command as before, we get the following output.

52

We get a series of lines in the same format as with ID3v2, but with each data element limited to at most 30 bytes.

These include title, artist, album, date, comment, and genre.

You can see the full output in the show notes.

Input #0, mp3, from 'test.mp3':

Metadata:

title : High Resolution Elapsed Time i

artist : Whiskeyjack

album : Hacker Public Radio

date : 2026

comment : https://hackerpublicradio.or

genre : Podcast

Duration: 00:30:10.18, start: 0.023021, bitrate: 64 kb/s

Stream #0:0: Audio: mp3, 48000 Hz, mono, fltp, 64 kb/s

53

The information is the same as when read by the id3v2 program, but formatted for display in the manner that ffprobe uses.

This shows that ffprobe can indeed read ID3v1 tags if they are the only ones present.

--------------------

54 Reading Vorbis Comments

Now let us turn our attention to vorbis comments, which are the equivalent to tags for ogg files.

We will look at this using two methods.

55 Using vorbiscomment

The first method we will look at is using the vorbiscomment package.

The command is

vorbiscomment -l hpr4678.ogg

56

The output of this is a series of lines with key value pairs separated by equal signs.

The output is also exactly the same as the MP3 file, except that there is an additional "language" field, "track" becomes "TRACKNUMBER", and there is no "date" field.

You can see the full output in the show notes.

encoder=Lavc61.19.101 libvorbis

TRACKNUMBER=4678

year=2026

language=English

title=High Resolution Elapsed Time in Shell Scripts

author=Whiskeyjack

copyright=CC-BY-SA

artist=Whiskeyjack

album=Hacker Public Radio

DESCRIPTION=https://hackerpublicradio.org Clean; Surprises encountered when measuring elapsed time in shell scripts The license is CC-BY-SA

genre=Podcast

57 Using ffprobe

Now lets do the same again using ffprobe.

The command for this is

ffprobe -hide_banner hpr4678.ogg

58

The output content is the same of course, but the field names have all been forced to lower case, and instead of an equal sign as a separator between the key and value, this has been replaced by a colon and white space has been added to make the output look a bit nicer.

You can see the full output in the show notes.

Input #0, ogg, from 'hpr4678.ogg':

Duration: 00:30:10.14, start: 0.000000, bitrate: 86 kb/s

Stream #0:0(English): Audio: vorbis, 192000 Hz, mono, fltp, 4294967 kb/s

Metadata:

encoder : Lavc61.19.101 libvorbis

track : 4678

year : 2026

title : High Resolution Elapsed Time in Shell Scripts

author : Whiskeyjack

copyright : CC-BY-SA

artist : Whiskeyjack

album : Hacker Public Radio

comment : https://hackerpublicradio.org Clean; Surprises encountered when measuring elapsed time in shell scripts The license is CC-BY-SA

genre : Podcast

--------------------

59 Another Example from Another Podcast

The above is interesting, but it's a sample of one podcast. Let's look at another different one altogether.

For this test I used two episodes of the Linux Matters podcast, episodes 68 and 82. As to why I am using two different episodes I will explain in a moment.

60 Episode 68

We will start with examining episode 68

Using id3v2

The command using id3v2 is

id3v2 -l LMP68.mp3

61

This provides output as a series of lines containing the official 4 character identifiers from the standard, a description of the identifiers, and the text provided by the authors.

The identifiers include TIT2 indicating title, TALB indicating show title, TRCK indicating track number, and a number of others.

You can see the full output in the show notes.

id3v2 tag info for LMP68.mp3:

TIT2 (Title/songname/content description): 68: Frameworks, Filesystems and Fixes

TPE1 (Lead performer(s)/Soloist(s)): Linux Matters

TALB (Album/Movie/Show title): Linux Matters

TYER (Year): 2025

TRCK (Track number/Position in set): 68

COMM (Comments): ()[]: https://linuxmatters.sh/

APIC (Attached picture): (LMP-3000-moon.jpg)[, 3]: image/jpeg, 554576 bytes

LMP68.mp3: No ID3v1 tag

62

From this we can see what the id3v2 program would normally do with ID3v2 tags.

Note that it outputs the actual 4 character identifiers, plus a description of what they mean, and then the actual data.

This helps when trying to understand the actual encoding of the data.

63 Using ffprobe

Now let's try that with ffprobe.

The command is

ffprobe -hide_banner LMP68.mp3

64

This provides the same publisher provided data as before.

However it does not display the 4 character identifiers but instead uses its own format for display.

Also note in both cases that there is a picture embedded in the MP3 file which is used to generate an icon for display in your file manager.

With ffprobe this results in there being two keys called "title" and two keys called "comment".

This makes grepping for the metadata more complicated, but it should still be possible.

You can see the full output in the show notes.

Input #0, mp3, from 'LMP68.mp3':

Metadata:

title : 68: Frameworks, Filesystems and Fixes

artist : Linux Matters

album : Linux Matters

comment : https://linuxmatters.sh/

track : 68

date : 2025

Duration: 00:28:12.45, start: 0.025056, bitrate: 114 kb/s

Stream #0:0: Audio: mp3, 44100 Hz, mono, fltp, 112 kb/s

Metadata:

encoder : LAME3.100

Stream #0:1: Video: mjpeg (Progressive), yuvj444p(pc, bt470bg/unknown/unknown), 4166x4166 [SAR 72:72 DAR 1:1], 90k tbr, 90k tbn (attached pic)

Metadata:

title : LMP-3000-moon.jpg

comment : Cover (front)

65 Episode 82

Now lets try that again with a different episode, 82.

Using id3v2

The command for id3v2 is

id3v2 -l LMP82.mp3

This results in id3v2 saying

LMP82.mp3: No ID3 tag

What happened here?

66 Using ffprobe

Let's try that again with ffprobe.

The command

ffprobe -hide_banner LMP82.mp3

provides the expected output.

Input #0, mp3, from 'LMP82.mp3':

Metadata:

date : 2026-05

title : 82: Ditching Grammarly for Open Sauce

album : Linux Matters

track : 82

artist : Linux Matters

comment : https://linuxmatters.sh

Duration: 00:33:37.83, start: 0.025056, bitrate: 113 kb/s

Stream #0:0: Audio: mp3, 44100 Hz, mono, fltp, 112 kb/s

Stream #0:1: Video: png, rgb24(pc, gbr/unknown/unknown), 3000x3000, 90k tbr, 90k tbn (attached pic)

Metadata:

title : Linux Matters Logo

comment : Cover (front)

67

This results in a few minor changes from episode 68, but otherwise it looks the same.

So there are ID3 tags, but for some reason id3v2 couldn't recognize them.

A bit more research and experimentation shows that this change appears to have happened right after episode 68, when they changed hosting and processing arrangements.

I suspect that something changed with respect to the ID3v2 tag formatting somewhere along the way in the change over, and this in turn has affected the ability of the id3v2 program to recognize the tags.

I will come back to the implications of this later in my conclusions.

--------------------

68 Stripping ID3 Tags

Now let's turn to a differen topic.

Stripping ID3 tags refers to removing the ID3 tags from the audio file.

I will start off by emphasizing that normally, you don't want to do this.

You should only be doing it if you suspect the ID3 tags are causing a problem with the playback or ordering of the files.

69

In my case I do it when I have problems with my MP3 player when playing certain podcasts.

This MP3 player orders files according to ID3 tags rather than by file name.

This can result in the podcasts being played in an unpredictable order which I find undesirable.

This is particularly a problem with podcasts from certain publishers where the title data does not follow any consistent pattern, but is whatever someone felt like doing that day.

70

I also often have to normalize the files from the same publishers to get a consistent audio loudness.

See my series on Simple Podcasting for information on how to use ffmpeg to normalize the audio loudness.

The solution to the inconsistent tag formats in these cases is to simply strip the ID3 tags altogether.

The player then falls back on using the file names, and I can readily rename the files to a consistent format.

I have never had these sorts of problems with HPR podcasts.

If you are not having any problems of this nature, then as I said, don't bother stripping the tags.

71

To strip the ID3 tags from an MP3 file use the following.

id3v2 -D hpr4678.mp3

id3v2 will strip the tags and overwrite the existing file.

If you wish to keep a copy with the tags, be sure to keep a backup before you try things.

72

When it comes to stripping tags, the options are

"-s" deletes ID3v1 tags.

"-d" deletes ID3v2 tags.

"-D" deletes both v1 and v2 tags.

--------------------

73 Conclusions

In this episode we took a very brief look at ID3 tags and vorbis comments and ways of reading them.

74

ID3 tags and Vorbis comments provide a means of allowing information about an MP3 or OGG Vorbis file to be embedded in the file itself.

Podcast publishers very often use this to label the file with information such as title, publisher, and author.

We can read this information using Fee Software tools such as ffprobe, ID3v2, and vorbiscomment.

75

ID3 tags seem to be a mess with more than one incompatible versions, and difficulties in reading them even within the same version.

They are difficult to test for because there is so much hardware out there of varying ages, much of which you will never have heard of let alone had access to.

If you are recording episodes for HPR you do not have to worry about this, as HPR will do this behind the scenes for you.

However, if you are responsible for producing a podcast or other similar audio and you have a setup that works, it is probably best not to change anything without good reason.

76

Vorbis comments seem to be much less of a problem.

However, there are far fewer devices which can play OGG files compared to MP3, so simply switching to OGG may not be a realistic solution to the ID3 tag problem.

77

If you wish to have one tool that can read ID3 tags of all sorts and vorbis comments, then ffprobe is your obvious choice.

78

The ID3v2 program will provide more information about the ID3 tags, including the actual identifiers used. However, it does not work in all cases.

79

The vorbiscomment program will read Vorbis comments from OGG files in a manner which is closer to the actual vorbis format than ffprobe does, which uses its own display format.

80

HPR includes both ID3v1 and ID3v2 tags in its MP3 files.

ffprobe can be used to read the ID3v2 tags, and the id3v2 program can be used to read the ID3v1 tags.

You can also read the ID3v1 tags using the tail command.

81

I have barely scratched the surface of this subject and have not talked at all about creating tags or comments.

If anyone else would like to take up the challenge of providing more detail, or of correcting any mistakes that have made, please send in a podcast episode on the subject.

If you have any comments you would like to make, leave them in the comment section below this episode on the HPR web site.

82

I hope to see you all again in future in another episode of HPR.

--------------------

References

https://id3.org/Introduction

https://www.xiph.org/

https://wiki.xiph.org/VorbisComment

--------------------

Provide feedback on this episode.

What's changed

• Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type
• Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
• Fixed /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
• Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
• Fixed "Connection closed mid-response" errors being reported on responses that had actually completed
• Fixed /usage overattributing usage to MCP servers: a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
• Fixed sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API
• Fixed org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model instead of stepping down to the newest org-allowed model in the family
• Fixed stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire
• Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — they now show a /login hint instead
• Fixed tool errors not being displayed for tools no longer available locally, for example after an MCP server is removed
• Fixed SendMessage rejecting a long summary — it now truncates instead, so sends no longer fail on a character limit
• Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own effort: setting
• Fixed rare crashes when a file watcher hit a filesystem error or during file-watcher teardown
• Fixed screen readers re-reading the whole input line on every backspace in --ax-screen-reader mode — end-of-line deletions now echo just the deleted characters
• Fixed host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set
• Improved auto mode safety: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch
• Improved the refusal when Claude tries to invoke a skill with disable-model-invocation: Claude is now told to ask you to run the skill instead of replicating its workflow
• Improved the /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions to use raw git blob content, ignoring workspace-configured diff drivers and textconv
• Changed Remote Control auto-start so repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable it at user scope via /config
• Removed ultraplan feature

12.21 - 2026-08-03

⛰️ Features

• Create opt-in option for displaying columns in database tree - (f492bed)
• Enhance order of items in completion proposal, so exact matches are at the top - (c1b817b)
• For keyboard navigation on the completion proposal, wrap around the item list - (db952f8)
• First attempt to create a user manager for PostgreSQL - (f0d7103)
• Show index icons on columns in tree, and the data type text color - (e6e90aa)
• Auto-adjust width of various combo boxes - (ca9b748)
• Show table columns in tree, as child nodes - (0e20e70)
• Query size of all indexes in one query - (c5201eb)
• Display size of each index and paint a color bar behind it - (48a93d2)
• Make custom proposal popup interval effective - (500c529)
• Icons, colors and padding in completion proposal - (3d1254d)

🐛 Bug Fixes

• (ui) Exchange icon for "column" and its variants for add, delete, edit - (08558f9)
• Sporadic crash in DBtreePaintText with columns - (f76c54f)
• Enable foreign key drop down on grid field in MS SQL mode - (9f83561)
• Remove column nodes from tree in table tools dialog - (b09823e)
• Empty command line part for sshpass on FreeBSD - (ed881b3)
• Handle MONEY column types as float - (67521d4)
• Hang and wrong check states in data grid column selection on macOS - (6c5b66c)
• Invalid folder path for SQL export cannot be created if it contains a duplicated path delimiter - (4555274)
• Various CVEs regarding libssl and libcrypto - (379d28a)
• Context menu does not appear at right-click on a tree node text - (8befce3)
• Crash when opening textfile import dialog, with 0 tables in database - (83c4947)
• Crash when cancelling session manager while a session rename is active - (1da8683)
• Prevent crashes from SetFocus on various controls - (bf46821)
• Data grid header keeps showing previous table's columns on macOS - (255695d)
• Prevent SQL error "Property 'MS_Description' already exists" - (ac50b73)
• Enhance anchors on some of the table editors controls - (bfebd9e)
• Bad width of collation combo box - (a90f73c)
• File > "New window" does nothing on macOS - (0583a4e)
• Still wrong proposal background color in dark mode - (e62c47f)
• Wrong proposal background color in dark mode - (eec978c)
• Crash when opening a table, due to using the TCanvas member of a not yet visible form or frame - (bfe29c1)
• Give the trees and grids more height for the header - (568098a)
• Widen many TSpinEditEx instances to either 80px or align them with neighbor controls - (5964be6)
• Some trees have their own OnContextMenu logic set at design time, do not overwrite - (7c2870a)
• Work around unused Header.PopupMenu menu on Linux when a tree has a PopupMenu - (2030a91)
• DPI related scale glitches, mainly on completion proposal - (905b126)
• Do not paint size bar in nodes of level 2, and do not show "-" text there neither - (3e678bc)
• Bad text color for selected item in proposal - (1c46db7)
• Propose items when editor already contains a leading backtick quote - (8f12b3e)
• Missing support for custom keyboard shortcut for executing completion popup - (79f1d38)
• Glitches with padding in completion proposal, and non-restored width - (cf67d11)
• EXPLAIN actions either disabled or non-working for PostgreSQL and SQLite - (2572681)
• Hanging in a loop over result nodes by right-click on query result - (bc8f903)
• Detect release version string from Lazarus project file, and insert into Contents/Info.plist of macOS bundle - (2171b58)
• Crash during refresh on disconnected session - (0b0106d)
• When parsing the command line, make use of Application.GetOptionValue and friends, instead of ParamStr(x) with regular expressions - (f436354)
• Use default library of connection when the one from a stored session contains an invalid path/file - (51023c3)
• Refresh session tree after import per More > Import settings file - (cfca46f)
• CAS(x AS CHAR) not supported by MySQL below v4.0.2 - (e9e5263)
• Always enable release link label on update check dialog, which points to the general download page - (2d475d2)
• Prepend database name to the trigger name at the correct position, when newer MariaDB versions use IF NOT EXISTS - (27a3a51)

🚜 Refactor

• Prefer Delphi friendly SysUtils.PathDelim over System.DirectorySeparator - (84104d0)

⚡ Performance

• Avoid full string scans in StrEllipsis - (32f3bd0)

⚙️ Miscellaneous Tasks

• Update SQLite libraries to v3.53.4 - (7bfd91d)
• Ignore auto-created IntelliJ project files - (64613cf)
• Prefer macos-15 over macos-15-arm64, due to better availability of the Intel runners - (c3be9d4)
• Stick to macOS 15, because the FPC package is only officially qualified up to macOS 11 and uses a package format Apple has tightened in newer releases, so it no longer installs on the macos 26 runners. - (0c969da)

Cleanup

• TbsSeparator TToolButton's now seem to have a default width of 8px (was 6px at some point), and TStatusBar's height now has a default height of 23px (was 28px) - (660c82d)

Localize

• Update compiled .mo translation files - (3480cf4)

Note

For a list of all the changes up to date, please read CHANGELOG.md.

Malleable C2 Profiles

One of the most requested capabilities in modern red-team engagements is the ability to blend Meterpreter's network traffic into legitimate-looking patterns. Metasploit Pro 5.1 brings full Malleable C2 profile support, powered by Metasploit Framework 6.5, directly into the Pro UI — no command-line knowledge required.

Malleable C2 profiles let you load a standard profile and reshape Meterpreter's HTTP(S) traffic to emulate legitimate services, browser sessions, or any other traffic pattern you need. All Meterpreter flavours — Windows, Linux, Java, Python, and PHP — are supported, including stageless and staged payloads (e.g. meterpreter/reverse_https and meterpreter_reverse_https). This functionality is compatible with publicly available profile libraries.

Profile support across the Pro UI

Malleable C2 profiles are now available in every part of the workflow where a payload is configured:

• Single Module Run: The module options page now includes a Malleable C2 section.
• Listeners (New & Edit): You can now choose from profiles already uploaded to the server or upload a new .profile file directly from your browser.
• Payload Generator: The standalone payload generator also exposes the profile picker, so standalone payloads can carry the same C2 profile as the rest of your operation.
  

Figure 1 Malleable Profiles

Improved Payload Section

Alongside the Malleable C2 integration, the payload selector has been overhauled across the Listener, Module Run, and Payload Generator pages. You can now filter payloads by platform and stage, making it much faster to find the right payload in large lists.

Figure 2: Advanced Payload Options

Figure 3: Additional Payload Options

Service Hierarchy Tracking Support

The Discovered Services table has been overhauled with a cleaner, more capable interface consistent with the rest of Pro 5.1.

• Service hierarchy visibility: The most significant new capability. Services can have parent-child relationships - for example, an HTTP service running over TCP, or a tunnelled protocol layered over another. The new table exposes this hierarchy directly with dedicated columns showing each service's parent and child services, so you can immediately understand how discovered services relate to one another without drilling into individual records.
• Search and sort across all columns: You can now search across host name, host address, service name, protocol, port, and info in a single query. All major columns are sortable, including parent services.
• Inline editing: Service fields (name, port, protocol, state, resource) can be edited directly from the table without navigating away.

Figure 4: Service Options

Figure 5: Service Hierarchy Display

Network Topology Enhancements

Building on Metasploit Pro 5.0's improvements to the Network Topology, we've added additional support and functionality for exploring your internal infrastructure. Previously, each node in the graph provided a high level summary of the host details when hovering over the node. This has now been moved into a dedicated side panel that surfaces everything you know about a host without leaving the topology view.

Rich host information panels

Click any node in the topology graph and the side panel now shows a consolidated summary of everything Metasploit knows about that host:

• Sessions: all sessions (open and closed) opened against the host, including session type, exploit used, payload, and timestamps.
• Loot: captured loot items associated with the host, including type, name, and content type.
• Credentials: cracked and captured credentials organised by service, de-duplicated and sorted with successful logins first.
• Modules run: a list of every module that has been executed against the host.
• Tags: any tags applied to the host or its sessions.

Figure 6: Network Topology Display

New filter options

The topology graph toolbar has three new filters to help focus on the hosts that matter:

• Filter by bruteforce - highlight services that can be bruteforced remotely on a host.
• Filter by tag - narrow the graph to hosts carrying a specific session or host tag.
• Filter by username - show only hosts where a particular user account has been compromised.
• Filter by module - surface hosts that have had a specific module run against them.

Figure 7: Network Topology Graph Filter Options

Discovered Vulnerabilities - Modern UI

The Discovered Vulnerabilities table has been fully rewritten, bringing it in line with the UI overhaul introduced across the rest of Pro in 5.0.

Key improvements:

• High level view and granular views - Each registered vulnerability provides a high view such as references and affected services, as well as a more granular expandable breakdown view.
• Inline editing - vulnerability details can be edited directly from the table without navigating to a separate page.
• Nexpose integration preserved - all existing InsightVM/Nexpose push and pull workflows are retained in the new implementation.

Figure 8: Discovered Vulnerabilities Modern UI

Attack technique filtering support

MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. Metasploit Pro now supports searching for modules by these techniques:

Figure 9: Attack Technique Filtering Search

Upgrading

Existing Pro installations can be upgraded through the standard update mechanism. Full upgrade instructions are available in the Metasploit Pro documentation.

These features are available in Metasploit Pro 5.1.0 onwards. We're proud to collaborate with our customers, who are often the source of inspiration for product evolution. Ideas for improvements or enhancements can be shared with our Support team to help refine and submit them to the Product team on your behalf.

@oh-my-pi/pi-agent-core

Breaking Changes

• Tool examples embedded in tool descriptions now always render in Python call syntax, and the exampleDialect option has been removed from AppendOnlyContextManager build options.
• Updated normalizeTools to accept a NormalizeToolsOptions configuration object ({ injectIntent, pruneDescriptions }) instead of positional booleans.

Fixed

• Fixed an issue where runs would fail with an error if an Anthropic stream was truncated after complete tool calls were streamed; the agent now recovers and executes those tool calls.
• Fixed an issue where artifact recovery reads could be incorrectly elided during compaction.

@oh-my-pi/pi-ai

Changed

• Standardized tool-call examples in renderToolExamples and renderToolInventory to use Python keyword-argument syntax (name(key="value")) across all models, removing the model-specific dialect parameter and the DialectRenderOptions.example flag.
• Updated renderToolInventory to render the tool catalog as a unified OpenAI-Harmony-style ## functions block using TypeScript type declarations and comments, replacing the previous per-tool Markdown sections.
• Added a style: "harmony" option to jsonSchemaToTypeScript for generating compact, comma-delimited TypeScript definitions.

Fixed

• Fixed a session-blocking issue where unescaped Harmony control tokens in replayed assistant responses and tool inputs caused subsequent requests to be rejected with invalid_prompt errors.
• Fixed an issue where Codex Responses dropped native image-generation results from assistant content and replays due to stale generating statuses.
• Fixed Anthropic stream truncation handling where unexpected connection closures were incorrectly treated as clean stops, causing the agent loop to halt silently mid-sentence.
• Optimized Anthropic prompt caching to prevent unnecessary cache invalidation of the entire system prefix when volatile project footer details (such as current working directory, date, or workspace tree) change.

@oh-my-pi/browser-relay

Added

• Initial release of the Chrome MV3 extension, enabling the omp browser tool to attach to and drive existing browser tabs via chrome.debugger.
• Added automatic, robust tab management that groups active agent-driven tabs into a dedicated per-window "omp" tab group and ensures clean dissolution upon disconnect.

@oh-my-pi/pi-catalog

Fixed

• Fixed an issue where newly advertised chat models were dropped during dynamic discovery for the alibaba-token-plan provider.
• Fixed a 400 error when forcing a specific tool with DeepSeek reasoning models on OpenCode Zen/Go gateways by automatically downgrading the tool selection mode to auto while keeping the tool advertised.

@oh-my-pi/pi-coding-agent

Breaking Changes

• Replaced the computer tool's coordinate-batch schema with persistent JavaScript runs, and removed computer.backend and model-specific controller switching.
• Changed the edit tool's replace mode from a multi-edit batch schema to a single-edit schema ({ path, old_string, new_string, replace_all? }).

Added

• Added a relay browser mode to drive local Chrome tabs via the OMP Browser Relay extension, supporting automatic daemon startup and tab grouping.
• Added a scriptable desktop session featuring window-targeted capture and input, native accessibility trees, clipboard access, and streamed screenshots.
• Added broker-shared language servers (controlled by the lsp.shared setting) to multiplex LSP servers across multiple instances in a project, reducing cold-start times and resource usage.
• Added optional timeoutMs to discovery configuration in provider options to configure custom HTTP probe timeouts for llama.cpp, Ollama, and OpenAI-compatible endpoints.
• Added a cross-platform, in-process ps shell builtin with custom columns, sorting, and process metrics.
• Added the --service-tier flag to override the OpenAI service tier for a session.
• Added a configurable per-request web search timeout via providers.webSearchTimeoutSeconds.
• Added turn-aware /tree navigation shortcuts (Alt+Up/Alt+Down, Home/End, PageUp/PageDown) to traverse user and assistant turns.
• Added display.hideToolActivity and a Ctrl+Shift+O shortcut to toggle the visibility of model-initiated tool calls and results.

Changed

• Exposed the script-driven computer schema to all models, including those with provider-native Computer Use support.
• Reduced omp --help cold-start latency and memory usage by rendering lightweight command metadata.

Fixed

• Fixed durability of session transcripts to prevent data loss on process crashes.
• Fixed a bug on Windows where a timed-out bash command could terminate the main omp process.
• Fixed headless runs hanging or leaving background workers alive after completion.
• Fixed a crash when opening the Agent Hub after resuming a session.
• Fixed /mcp reauth environment variable expansion and token validation.
• Fixed fuzzy replace-all edits re-matching replacement text indefinitely, which could freeze the TUI.
• Fixed inspect_image ignoring configured thinking effort for vision models.
• Fixed compiled binaries dropping certain extensions with complex CommonJS/ESM dependency graphs.
• Fixed template argument substitution executing recursive placeholder expansion when positional arguments contain literal $@ or $ARGUMENTS tokens.
• Fixed project-scoped session directories using leading-hyphen names and collapsing distinct paths.
• Fixed manual /shake leaving the context budget anchored to stale pre-shake token counts.
• Fixed Mnemopi scoped recall reporting "No relevant memories found" when individual targets fail internally.
• Fixed skill:// resolution ignoring custom directories when a same-named skill exists in a default path.
• Fixed image paste failing on Wayland-only Linux sessions.
• Fixed prewalk switching to the fast model during read-only investigations.
• Fixed self-update misclassifying glibc Linux hosts with an installed musl loader as musl hosts.
• Fixed omp setup python to validate the correct interpreter used by the Python eval runtime.
• Fixed the terminal-tab title dropping to idle while an unsuppressed async job was still running.
• Fixed redirected stdin being ignored when Bun reports a pipe with an undefined isTTY.
• Fixed a literal API key configured via /login being hijacked on Windows by case-differing system environment variables.
• Fixed Esc during a streaming /loop iteration pausing the loop instead of aborting the current turn.
• Fixed heavily branched conversation trees shifting linear continuations into disconnected columns.
• Fixed plugin installation validation failures for legacy compatibility shims.
• Removed hard-coded references to disabled or absent agents in system and tool prompts.

@oh-my-pi/pi-natives

Breaking Changes

• Replaced DesktopSession.execute(actions, window) and action batches with dedicated per-operation methods for capture, pointer, keyboard, window, and accessibility. Capture capabilities now apply per call, and coordinate input requires a prior frame for the same target.

Added

• Added a cross-platform, in-process ps shell builtin supporting BSD/procps selection forms, custom output columns, sorting, process metrics, and header suppression.
• Added unified desktop backends for macOS, Win32, X11, and Wayland behind a single session API, featuring capture-free window discovery, isolated capture, explicit background/foreground delivery, native accessibility trees (AX/UIA/AT-SPI) with generational references, and structured errors for unsupported background input.

Fixed

• Fixed accessibility snapshots incorrectly marking a window root as focused based on its app-local AXFocused attribute when another application held global focus; the root annotation now correctly reflects the global window-roster focus flag.
• Improved coordinate-frame error messages for pointer input before capture, out-of-frame coordinates, and between-display points to clearly explain the capture-frame contract and remedy instead of throwing a generic bounds check.
• Fixed duplicated characters in AppKit targets on macOS caused by background keyboard events being posted through both CoreGraphics and SkyLight; events are now delivered once via the authenticated SkyLight route.

@oh-my-pi/pi-tui

Fixed

• Fixed Kitty and Ghostty keyboard shortcuts on non-Latin keyboard layouts by requesting base-layout key reporting from the terminal.

@oh-my-pi/pi-utils

Added

• Added utility functions parseFlag(), getBrowserRelayDir(), and getGlobalDaemonRuntimeDir() to support browser relay mode and global daemon runtime directory resolution.

Changed

• Updated the lightweight CLI runner to support static command metadata, allowing root help to render without importing full command implementations.

What's Changed

• perf(cli): keep root help off runtime graph by @eggpeat in #7205
• fix(coding-agent): let customDirectories skills win over default-path duplicates by @zhang17-24 in #7246
• fix(omp): refresh context budget after shake by @oleksoleksoleks in #7310
• fix(agent): skip prewalk switch on read-only xd:// device calls by @roboomp in #7314
• fix(catalog): downgrade forced tool choice for deepseek reasoning models by @roboomp in #7317
• fix(coding-agent): support Wayland image paste by @roboomp in #7318
• fix(tui): requested base-layout keys for shortcuts by @roboomp in #7321
• fix(ai): cache stable system prefix across cwd/date footer changes by @roboomp in #7326
• fix(compaction): stop shake from re-eliding artifact recovery reads by @jwmacd in #7327
• fix(tui): preserve loop after cancelling iteration by @roboomp in #7331
• fix(tui): compact linear branch continuations by @roboomp in #7333
• test(vibe): fix kill-before-init race with a worker-ready handshake by @szavadsky in #7340
• fix(agent): stop leaking scout into prompts when it is disabled by @szavadsky in #7344
• fix(eval): preserve console for ConPTY Python kernels by @roboomp in #7350
• fix(mnemopi): bound locked retention during teardown by @roboomp in #7355
• fix(mnemopi): bound embed worker IPC and reap on timeout by @roboomp in #7356
• fix(auth): guard config-value resolvers against case-insensitive env hijack by @roboomp in #7362
• fix(mnemopi): surface scoped recall failures by @roboomp in #7367
• docs: document role-backed task agents by @fatihaziz in #7371
• fix(cli): restore piped custom session persistence by @roboomp in #7382
• test(browser): stop gating chromium tests on a top-level-await export by @paralin in #7384
• fix(coding-agent): keep focused status bar caps bright by @art-wiedzmin in #7385
• fix(tui): keep working title across non-terminal agent_end by @roboomp in #7387
• fix(setup): align Python setup probe with eval by @paolofraz in #7390
• fix(catalog): admit discovered Token Plan chat models by @roboomp in #7392
• fix(update): detect active Linux libc by @BrianHotopp in #7394
• fix(postmortem): resolve native hard-exit per call by @roboomp in #7395
• fix(session): make project directories safe and unique by @roboomp in #7397
• feat(omp): navigate conversation turns in tree by @oleksoleksoleks in #7126
• feat(coding-agent): configure web search timeout by @will-bogusz in #7197
• fix(edit): prevent fuzzy replace-all self-matching by @roboomp in #7437
• fix(mcp): expand env vars in reauth OAuth credentials and reject empty tokens by @roboomp in #7441
• fix(coding-agent): keep completed session entries durable across crashes by @olegpulatov in #7444
• fix(openai): preserve Codex native image results by @roboomp in #7447
• feat(tui): add hidden tool activity mode by @dannyboy-ai in #7342
• fix(extensions): resolve compiled dependency graphs by @roboomp in #7405
• fix(coding-agent): restore legacy compaction exports by @roboomp in #7406

New Contributors

• @zhang17-24 made their first contribution in #7246
• @jwmacd made their first contribution in #7327
• @fatihaziz made their first contribution in #7371
• @paolofraz made their first contribution in #7390
• @BrianHotopp made their first contribution in #7394
• @dannyboy-ai made their first contribution in #7342

Full Changelog: v17.2.4...v17.2.5

In the coming weeks, we’re starting the rollout of visual screenshots for the ‘Take notes for me’ feature in Google Meet. Visual screenshots automatically capture presented content (such as slides, diagrams, and charts) directly into the generated meeting notes document, ensuring critical visual context is preserved alongside spoken summaries and transcripts. | Learn more.

Streamline collaboration in Google Docs with Gemini-powered comment workflows

We’re introducing Gemini-powered comment workflows in Google Docs to help you quickly understand and respond to collaborator feedback. These new features enable Gemini to read, summarize, and act on comments throughout your document, saving you time and streamlining collaboration. | Learn more.

Generate and edit visuals with Gemini in Google Docs

You can now create and edit images, diagrams, and infographics directly alongside your text using Gemini in Google Docs. These images leverage the context of your document, so you can generate relevant visuals to accompany your writing without ever leaving Docs or relying on external tools. Plus, you can refine your existing visuals and graphics using simple natural language prompts. | Learn more.

Updated options to better view Google Calendar on large monitors

To provide users with more control over their viewing experience, we’re updating information density options for the calendar grid. These updates allow users to customize how calendar events scale on their screens to accommodate various monitor sizes and personal preferences. | Learn more.

Create and import scatter charts with multiple x-series in Google Sheets

Google Sheets now supports creating and editing scatter charts with multiple independent x-series. This update allows users to map separate data series to their own unique x-axis, rather than forcing all series in a single chart to share the same horizontal axis domain. | Learn more.

Use Gemini in Google Forms to quickly create a new quiz

Help me create in Google Forms now supports generating quizzes. With this launch, you can quickly create a quiz by writing a specific prompt for Help me create describing the quiz you want to create. Your prompt can reference Google Drive files like Docs, Slides or PDFs to use as sources for the quiz, should you choose. | Learn more.

Prevent accidental disclosures with new Reply All BCC warnings in Gmail

To help protect your privacy and ensure intentional communication, we are introducing a new caution notification in Gmail. This feature is designed to prevent accidental information disclosure by alerting users when they are about to "Reply All" to a thread where they were originally BCC’ed. | Learn more.

The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

Previously, users might inadvertently reveal their presence on a confidential thread by hitting "Reply All" while BCC'ed. With this update, Gmail will now display a prominent warning prompt to confirm your intent before the message is sent to all recipients, ensuring that your participation remains private unless you choose otherwise.

Getting started

• Admins: This feature is available by default.
• End users: This feature is available by default and will trigger automatically when a BCC'ed recipient attempts to "Reply All" on a thread.

Rollout pace

• Rapid Release and Scheduled Release domains: Available now

Availability

• Available to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts.

Additionally, this feature improves import and export compatibility with Microsoft Excel. Previously, importing Excel files with multiple x-series scatter charts into Google Sheets would drop the extra axes and revert to a single x-axis. Now, these configurations are accurately preserved when moving spreadsheets between platforms.

User creating a scatter chart with multiple x-series in Google Sheets

Getting started

• Admins: There is no admin control for this feature.
• End users: Visit the Help Center to learn more about adding and editing a chart in Google Sheets.

Rollout pace

• Rapid Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 29, 2026 
• Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on August 14, 2026

Availability

• Available to all Google Workspace customers and users with personal Google accounts

Resources

• Google Docs Editors Help: Add & edit a chart or graph

With this new functionality, you can:

• Create rich infographics or diagrams summarizing your docs: Ask Gemini to "Add a diagram providing an overview of the proposal at the top of my doc" or "Create a rich infographic visually summarizing my doc."
• Refine existing visuals: Use natural language to "Change the aspect ratio to 16:9" or "Make the style more aesthetic to match the rest of the document."
• Create or edit multiple visuals at once: Ask Gemini to add infographics in each key section, or update the style of multiple visuals at once.

You can access these capabilities from the bottom bar or the Gemini side panel in Google Docs.

Note: This feature is currently supported on the web only.

Getting started

• Admins: These features are available by default if Gemini for Workspace in Drive is enabled. Visit the Help Center to learn more about managing access to Gemini features in Google Workspace.
• End users: You must have Workspace smart features enabled to use these features. Visit the Help Center to learn more about creating personalized documents with Gemini in Google Docs.

Rollout pace

• Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 28, 2026

Availability

• Business: Business Standard and Plus
• Enterprise: Enterprise Standard, and Plus
• Education: Education Plus
• Consumer: Google AI Pro and Ultra
• Education Add-ons: Google AI Pro for Education; Teaching and Learning

Resources

• Google Workspace Admin Help: Manage Gemini for Google Workspace
• Google Docs Editors Help: Create personalized documents with Gemini in Google Docs
• Google Docs Editors Help: Learn how Gemini in Gmail, Calendar, Chat, Docs, Drive, Sheets, Slides, Meet & Vids protects your data

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui
binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.3

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.
• Extract the archive for your machine: codewhale-windows-x64.zip or
  codewhale-windows-arm64.zip
• Run install.bat (copies to %USERPROFILE%\bin)
• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.3

This is the Codewhale v0.9.3 source candidate. It is not a published release
until the matching tag, packages, checksums, and release assets exist.

DeepSeek V4 Flash is now a first-class Codewhale route, and the agent-facing
tool surface has been reduced to the canonical action tools that current
models actually need. This release also hardens credential, authorization,
durability, compaction, and macOS File Provider boundaries while deleting
stale runtime and dependency surface.

Added

• Native deepseek-v4-flash support over DeepSeek's Responses API, including
  stateless reasoning-item replay, semantic SSE terminal events, structured
  function calls and outputs, apply_patch, and model-aware wire-format
  selection. Exact current Flash IDs use Responses; future direct
  deepseek-vN-* model IDs inherit that route conservatively, while custom
  DeepSeek-compatible endpoints retain Chat Completions unless configured
  otherwise.
• A pipe-only codewhale auth print-api-key handoff for explicitly selected
  providers. It shares Codewhale's home-scoped credential authority, refuses
  terminal output, and prevents sentinel placeholders from becoming live
  credentials.
• Per-turn max_tool_calls enforcement at the engine admission gate, plus a
  named-file write scope with a separate read seam. The runtime now rejects
  over-budget calls before execution and keeps the operator's write boundary
  explicit (#4415).
• Runtime-contract, source-structure, and persistence-backlog ratchets that
  name drift instead of allowing large ownership surfaces to grow silently
  (#3921, #4785).

Changed

• Model-visible built-ins now use the canonical Bash, File, and Run
  action schemas. apply_patch remains available as the one direct custom
  edit tool supported by DeepSeek Responses. The bundled stop-ship workflow,
  Fleet fixtures, shell shortcut, and engine tests use the same canonical
  vocabulary.
• Canonical File { action: "write" } requests now pass through the same
  semantic repo-law checks as the former write path. Approval, Full Access,
  and workflow execution cannot bypass the repository safety floor by choosing
  the canonical schema.
• Codewhale home resolution is shared across the CLI, TUI, state, and secret
  stores. doctor is offline by default, distinguishes credential source from
  availability, and reports one consistent path snapshot.
• Durable runtime event writes are serialized across simultaneous processes,
  blocking history waits move off async workers, and provider quota exhaustion
  remains typed and retryable through compaction (#4522).
• Skill discovery caches the merged catalog behind watched-mtime validation;
  large skill, engine, subagent, UI, and ambient-ocean test blocks now live in
  owned test seams.
• Reasoning summaries stay in the user's language, complete jellyfish
  silhouettes relocate around transcript text, and cached ocean frames include
  their palette identity (#4807).
• The authorization-order contract now documents and tests how modes, hooks,
  permission rules, safety floors, repo law, approvals, and sandboxing compose
  (PR #4980).

Fixed

• macOS sandbox extensions cover CloudStorage/File Provider workspaces without
  broadening unrelated paths; thanks @Watcher24 for the #4085 report and
  reproduction.
• Foreground shell state detaches before steering, so an interrupted command
  cannot keep owning the composer (PR #4979).
• MCP application-level failures and malformed error envelopes fail closed
  instead of looking like successful tool output.
• Optional PDF failures are truthful and PDF classification no longer misses
  supported inputs.
• Bracketed-paste contents are redacted from traces, and credential diagnostics
  never treat placeholder sentinels as usable keys.

Removed

• The legacy callable aliases exec_shell, run_shell_command, read_file,
  write_file, list_dir, grep_files, file_search, and the duplicate
  Work/RLM registrations. Historical transcript and policy semantics remain
  readable, but new model turns receive only the canonical action surface.
• The bundled PDF parser dependency chain, replacing it with the smaller
  optional extraction boundary tracked by #4382.

Contributors

• Turisla (@greyfreedom) documented and
  locked the authorization-order contract in PR #4980.
• Nightt (@nightt5879) fixed foreground
  shell detachment before steering in PR #4979.
• Watcher24 (@Watcher24) provided the macOS
  File Provider report and reproduction for #4085.
• Fred Leitz (@fleitz) retains required
  source-candidate credit for the canonical Bash workspace fix from PR #4673
  and issue #4674.

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.

Codewhale is the public product from Shannon Labs. The codewhale
command, npm package, and release-asset names remain lowercase technical
identifiers. The legacy npm package deepseek-tui is deprecated and
receives no further releases. Users coming from v0.8.x legacy deepseek /
deepseek-tui names should migrate with docs/REBRAND.md.

Install

Recommended — npm (one command, all three entrypoints)

npm install -g codewhale

The wrapper downloads the matched codewhale, codew, and codewhale-tui
binaries from this Release and places them in the same directory.

Docker / GHCR

docker run --rm -it \
  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
  -v codewhale-home:/home/codewhale/.codewhale \
  ghcr.io/hmbown/codewhale:v0.9.2

The image ships the codewhale dispatcher, codew shim, and codewhale-tui runtime. The latest tag is also updated on release.

Cargo (Linux / macOS)

cargo install codewhale-cli codewhale-tui --locked

Both crates are required — codewhale-cli produces the codewhale dispatcher and codew shim, while codewhale-tui produces the interactive runtime that the dispatcher delegates to. Installing only one crate will fail at runtime with a MISSING_COMPANION_BINARY error.

Manual download — platform archives (recommended)

Each archive below contains the codewhale dispatcher, codew shim, and codewhale-tui runtime, plus an install script:

Unix (Linux / macOS):

tar xzf codewhale-<platform>.tar.gz
cd codewhale-<platform>
./install.sh

Windows:

• For the installer path, run CodeWhaleSetup.exe; it installs codewhale.exe, codew.exe, and codewhale-tui.exe under %LOCALAPPDATA%\Programs\CodeWhale\bin and adds that directory to the current-user PATH.
• Extract the archive for your machine: codewhale-windows-x64.zip or
  codewhale-windows-arm64.zip
• Run install.bat (copies to %USERPROFILE%\bin)
• Add %USERPROFILE%\bin to your PATH

The portable Windows archive skips the install script — extract and run from any directory. The NSIS installer is currently unsigned and may trigger Windows SmartScreen until a signing certificate is wired into the release pipeline.

Each platform also has bare, unarchived binaries attached below (codewhale-<platform>, codew-<platform>, and codewhale-tui-<platform>) — the npm wrapper and the in-app codewhale update download the matched runtime binaries, whereas the .tar.gz / .zip archives above are the recommended manual download and additionally bundle an install script. The legacy npm package deepseek-tui is deprecated and is not republished. For migration from v0.8.x legacy binary names, see docs/REBRAND.md.

Verify (recommended)

Download the checksum manifests from this Release and verify:

# Linux — archive bundles
sha256sum -c codewhale-bundles-sha256.txt --ignore-missing

# Linux — individual binaries
sha256sum -c codewhale-artifacts-sha256.txt --ignore-missing

# macOS
shasum -a 256 -c codewhale-bundles-sha256.txt --ignore-missing
shasum -a 256 -c codewhale-artifacts-sha256.txt --ignore-missing

What's in v0.9.2

This is the Codewhale v0.9.2 source candidate. It is not a published release
until the matching tag, packages, checksums, and release assets exist.

Changed — behavior

• Legacy model = auto no longer elects a network classifier on its own.
  Holding a DeepSeek API key used to silently select deepseek-v4-flash as the
  classifier for every Auto turn — a per-turn cost on a route nobody asked for,
  and one provider privileged over the rest. Auto now stays local and free
  unless an explicit [auto.router] block names a provider and model.

  If you relied on the implicit default, restore it explicitly:

  [auto.router]
  provider = "deepseek"
  model = "deepseek-v4-flash"

  [auto.router] remains legacy model = auto configuration. It is unrelated
  to a Fleet's Adaptive Reasoning Router, which is a saved service referenced by
  name from a Fleet file and decides only how hard an already-frozen route
  thinks.

Landed since v0.9.1, not yet released. A cluster of defects found by a
read-through audit of the policy engine, the MCP proxy, the session index,
and the app-server bridge — several of them cases where the wrong outcome
was reached silently, behind a response or a log line that looked fine. The
release also adds opt-in session, reasoning, localization, and inspectability
surfaces; existing defaults remain stable unless an entry below explicitly
says otherwise.

Added

• /permissions now lists the active user permission-rule source, each rule's
  effective matcher and global/repository scope, and whether that scope applies
  in the current workspace. /permissions remove <number> previews deletion
  and requires a snapshot-bound confirmation token, so a concurrent edit
  cannot move a different rule under the confirmed index. Appends and removals
  share one adjacent lock, preserve unrelated TOML formatting and comments,
  atomically replace permissions.toml, and reload the live user ruleset
  without clearing session-only approvals. /config ask-rules remains a
  compatibility entry; rule creation, glob/directory rules, and deny
  persistence remain out of scope (#1186, PR #4960 by @greyfreedom).

• /preview-request (aliases /dryrun and /preview_request) is a human-only,
  provider-free inspection of the next primary turn. Production dispatch and
  preview share one prepared-request seam across Chat Completions, Anthropic
  Messages, and OpenAI Responses, so the manifest reads the final wire model,
  reasoning controls, tool choice, tool schemas, and body hash from the same
  value production sends. Route, tool, or body facts that require Auto's
  provider classifier, an MCP connection, mutable hooks, compaction, or queued
  runtime injections remain typed unavailable. The manifest reports exact
  primary role/lane identity, upstream route-source provenance, requested and
  effective reasoning, canonical JSON sizes, conservative offline estimates,
  and provider-reported usage as unavailable because no request ran. It never
  adds a model-visible tool, sends a provider call, or prints prompt, message,
  credential, endpoint-path, or workspace-path content. The explicit
  /preview-request base-prompt mode prints only the exact effective base
  prompt; effective system text remains protected behind its final hash. The
  exact body includes the same authoritative transient Work/To-do tail used by
  production, including graph-backed state newer than the legacy projection.
  Preflight preserves production's separately framed base-plus-Work estimate,
  and fails closed when the authoritative projection is unavailable. An
  exhausted active goal token budget also produces a typed unavailable result
  before any outbound request is built.
  (#1004, #3928; dry-run concept harvested from PR #1099 by @GTC2080 / TaoMu.)

• Slash commands, hotbar actions, and CLI entrypoints for the same Lane/Fleet
  lifecycle operation now share one typed control-plane contract
  (codewhale-lane::control): a stable <domain>.<verb> id, read-vs-write
  authority, persistence scope, exact-identity target selection, retryability,
  lifecycle outcome, and one bounded, sanitized receipt. docs/COMMAND_CONTROL_PLANE.md
  documents it (#1888).

• /lane [list|status|interrupt|restart|resume] — durable Lane control from the
  composer, backed by the same executor codewhale lane … calls. codewhale lane interrupt|restart|resume are the matching CLI verbs; lane stop stays as
  a compatibility spelling of lane interrupt. Appending @<lifecycle-seq> to a
  lane id fences a write to the exact durable generation you observed, so a
  concurrent transition is rejected as a conflict rather than acted on (#1888).

• codewhale fleet list and /fleet [list|status|interrupt|resume] — durable
  Fleet run inspection and control from either surface, through shared DTOs that
  carry the exact provider, provider-table id, model, effective reasoning tier,
  and route source when the ledger records them, and a typed not_recorded /
  not_applicable / redacted reason when it does not. Requested-vs-effective
  reasoning is never back-filled: the ledger persists the effective tier only, so
  the requested tier reports not_recorded (#4022).

• The bundled skill pack now ships a help skill (catalog generation 7). It is
  invocation: explicit-only, so it never enters the model's ambient catalogue
  and costs no prompt budget. Its body is a routing card that points at the
  surfaces this build actually exposes — /help and /help <command>,
  /skills and /skills inspect, /config, doctor, and the docs/ tree
  when the workspace is a Codewhale checkout — and explicitly forbids pasting a
  command list or settings table into context (#4698).

• crates/tui/assets/skills-catalog-matrix.json: an authored, provider-free
  expectation matrix covering every bundled skill (tier, invocation, aliases,
  ambient-catalogue eligibility, shadowed aliases). Contract tests in
  crates/tui/src/skills/catalog_matrix.rs assert a bijection between the
  fixture and the shipped bundle, so the starter pack cannot change without an
  explicit fixture update. The matrix covers positive eligibility and explicit
  load, non-activation negatives, alias resolution, explicit-only exclusion,
  alias-vs-canonical collision precedence, and prompt-budget invariants (no
  duplicate catalogue entries, no aliases as extra entries, and the shipped
  pack fitting inside the 12 000-char budget with no omitted-skills line). These
  are deterministic registry/catalog/resolver assertions and make no claim about
  semantic model routing (#4698).

• Locale-routing coverage for the complete bundled catalog across every shipped
  locale (en, ja, zh-Hans, zh-Hant, pt-BR, es-419, vi, ko). No
  bundled skill ships a localized routing description and none was invented;
  the tested contract is deterministic fallback to the canonical English
  description, with the rendered catalogue byte-identical across locales.
  Exact-tag match, primary-subtag fallback, and English fallback are covered
  against a synthetic authored fixture, and the parity test fails if a bundled
  skill ever gains localized metadata without source-backed coverage (#4698).

• docs/LIVE_SMOKE.md: copy-pasteable, opt-in live-smoke instructions for Kimi
  K3 and a second provider/model (DeepSeek). The runs are manual only — nothing
  in CI, tests, or skills invokes them. They use env -i plus a throwaway
  CODEWHALE_HOME; HOME is left unset rather than repurposed, and ambient
  provider variables are not forwarded. The operator names the credential
  variable explicitly, and the isolated child reads its value with echo off,
  restores the prior terminal state on exit or interruption, and never persists
  the value or puts it in a command argument. The page states the expected
  route/model/reasoning/tool receipt fields while treating provider errors as
  unclassified until provider configuration, authentication/entitlement, and
  harness behavior have been corroborated independently (#4698).

• Approval cards can now remember eligible safe shell and file-write approvals
  as exact allow rules scoped to the current repository. Remembered shell
  commands use complete-command matching, validated file and patch paths remain
  workspace-relative, and dangerous, critical, or repo-law-held requests stay
  ineligible and continue to require review.

• tui.header_items (array of strings, optional, default []): an opt-in
  header chip showing cumulative session token usage as input / cache-hit /
  output. Set header_items = ["tokens"] under [tui] to enable it. The
  chip is the only elidable element of the header — the git label, context
  meter, and version stamp keep their space, and narrow terminals drop the
  chip rather than the baseline chrome. Unknown entries are warned about and
  skipped so configs written by newer builds stay loadable by older ones
  (#4520 requested by @eugenicum; PR #4610 by @XhesicaFrost, harvested with
  co-authorship).

• thinking_default_expanded lets reasoning blocks start open while keeping
  Space as the per-block toggle. The setting is persisted, available through
  native and runtime configuration, and documented for SSH/tmux accessibility
  (issue #4925 and PR #4928 by @M-Maciej).

• The transcript renders a conservative subset of LaTeX math as readable
  Unicode without rewriting fenced/inline code, ordinary currency, escaped
  dollars, or unknown commands. The contribution from PR #4973 by
  @SparkofSpike was hardened and landed through PR #4974; reported by
  @antarikshraya in #4957.

• Session control now includes a sessions rail, shared archive projection,
  picker archive controls, and opt-in interactive auto-resume with explicit
  handoff behavior. The work closes the remaining session-browsing direction
  from #2934; thanks @cy2311 for the original report.

• The bundled contributor-onboarding skill can sync contribution context,
  select the appropriate gate, and prepare a digest without inflating the
  ambient skill catalog. It follows the contributor-navigation request in
  #4227 by @JayBeest.

• Bahasa Indonesia now has a complete repository documentation suite and a
  registered website dictionary alongside the shipped TUI locale (PRs #4962
  and #4972 by @atmosuwiryo, closing #4789).

• Reasoning content can keep its rail, italics, cursor, and expansion controls
  while disabling only the warm background highlight. The independent setting
  is persisted and localized (#4089; reported by @elijahchan2019).

• StepFun setup now asks whether a key belongs to PAYG or Step Plan, keeps the
  two endpoint/billing routes distinct, and localizes the choice across the
  complete packs (#4526; reported by @whp233).

• OpenCode Zen is a separate model-aware API-key provider. Its curated catalog
  selects Responses, Anthropic Messages, or Chat Completions per model;
  unsupported Gemini and unknown models fail closed, and missing Zen
  credentials never fall through to ChatGPT/Codex OAuth guidance. The
  implementation from closed PR #4467 by @snail-vs (snailoniu) is preserved in
  the candidate.

• Markdown exports correlate prompts with stable workspace restore-point ids
  and say when correlation is unavailable or ambiguous, completing the
  remaining restoration/export direction from #2494 by @wywsoor.

Fixed

• Permission setup now consistently presents the product postures Ask,
  Auto-Review, and Full Access instead of leaking the internal never token.
  The same resolved sandbox policy now drives execution and UI receipts: Plan
  stays read-only, Ask and Auto-Review stay workspace-scoped, and Full Access
  is actually unsandboxed unless a stricter effective configuration wins.

• Fleet setup no longer stalls when a user explicitly selects a configured
  Codex or Grok external-consent route. The selected route is activated and
  validated before saving, roster roles open directly on their Model step,
  Review saves on the first Enter, and new profiles default to the personal
  profile directory that the roster loads on the next session.

• Provider credential dialogs now share one wrapping, secret-safe API-key
  surface across every non-OAuth provider. A key already present in durable
  storage is reported as configured without rendering it, typing or pasting is
  clearly framed as replacement, narrow help text remains visible, and Codex
  and Grok OAuth flows remain token-free in this modal.

• Ctrl+O again opens the complete recorded reasoning detail for the selected,
  active, or latest reasoning block. The whole-turn Turn Inspector moved to
  Ctrl+Alt+O and /turn inspect, removing the shortcut collision while keeping
  raw leaf detail and post-flush reasoning discoverable.

• Failed child agents now deliver a distinct high-priority failure receipt to
  their owning parent with a sanitized failure class, elapsed work, and a full
  transcript handle. Parent-to-child message, follow-up, and interrupt tools
  now use one hierarchy-checked mailbox path, and persisted nested completion
  envelopes remain safely restorable across instruction-text revisions.

• Background-shell completion events now carry only bounded tails plus a
  retrievable exact-evidence handle. Terminal foreground Bash results are
  acknowledged at the direct tool-result boundary and are no longer emitted a
  second time as background completion artifacts.

• Providerless Fleet and child-agent fixed-model routes now reject only
  high-confidence foreign-provider model ids before creating a worktree, while
  explicit provider/model pairs, custom and local endpoints, unknown ids, and
  aggregator wire-id resolution retain their intended behavior.

• Manual compaction now preserves and reports the supplied provider failure
  class instead of replacing it with an opaque generic error. This does not
  infer quota exhaustion when the recorded failure does not prove it.

• The ambient jellyfish keep complete, readable silhouettes while animating,
  and the website favicon now uses the Signal Current desktop tile instead of
  the legacy whale mark.

• ACP JSON-RPC responses preserve numeric request ids for avante.nvim while
  retaining the negotiated string-id exception for Zed (PR #4929 by
  @atmosuwiryo).

• Restored shell cells whose job no longer exists stop displaying live
  spinners and settle into a truthful stale/no-output state across transcript,
  phase strip, and sidebar (PR #4937 by @LI-Jialu, closing #4547).

• Interrupted checkpoints and timed recovery snapshots remain checkpoints
  instead of being promoted into orphan session files, preventing duplicate
  /resume entries (PR #4963 by @SparkofSpike).

• Every shipped locale is admitted by the typed settings schema and native
  chooser, with complete/partial status kept independent and tested (PR #4856
  by @nightt5879, closing #4786). Context-menu hover hit-testing also accounts
  for its title row (PR #4897 by @XhesicaFrost; reported by @SparkofSpike in
  #4803).

• OSC 52 and SSH/tmux clipboard transport run on one bounded background worker
  rather than blocking input and rendering on the TUI loop; late transport
  failures still surface through the status path (PR #4896 by @nightt5879,
  closing #4159).

• Non-streaming model calls receive a generation-length response budget rather
  than the SSE header-open timeout, while actual SSE opens share the bounded
  cross-provider transport seam. The equivalent fix direction came from
  closed PR #4743 by @vibecoding-skills.

• Resumed sessions diagnose a deleted inherited workspace before shell launch
  instead of failing as an opaque Windows process error (report #4100 by
  @redjade75723). DeepSeek native tool-call wrapper tokens are also scrubbed
  from visible streaming and completed output as a grounded fail-soft follow-up
  to report #3880 by @hardy922; that report's exact emitted marker remained
  unconfirmed.

• Auto model routing now preserves the user's requested reasoning effort
  through startup, provider/model changes, session restore, the picker,
  Ctrl+T, and Hotbar actions. The tier is normalized only after the concrete
  provider route is known instead of being silently replaced by Auto
  (#4941, PR #4961 by @nightt5879).

• Auto-compaction now defaults on for every known model context window,
  including Kimi K3's 1,048,576-token routes. Persisting only an
  auto_compact_threshold or auto_compact_threshold_percent now counts as
  opt-in intent, while an explicit auto_compact = false remains authoritative.
  /config reports the effective state, percentage, and computed token trigger.

• Per-provider context_window overrides are now documented and visible in
  /config, provider setup help, diagnostics, and the example configuration.
  The effective override consistently drives preflight budgeting, the context
  meter, and compaction; this lets a user cap a 1M Kimi route to 256K when their
  Coding Plan tier has the smaller window.

• Agent Details now projects status, model, elapsed time, and step counts from
  the same row snapshot as the primary agents list, eliminating contradictory
  worker state between the two surfaces.

• Composer submission and its hints now share one state machine. Portable
  terminals use Enter to queue during a running turn and Enter again to steer;
  Ctrl/Cmd+Enter is accepted only when an enhanced terminal reports it and is
  no longer advertised as universally available.

• edit_file now matches LF-only model search text against CRLF files,
  preserves the file's line-ending style for replacement text, and still
  rejects newline-normalized duplicate matches as non-unique (#4764).
  Implemented in PR #4942 by @nightt5879; reported and root-caused by
  @LmeSzinc.

• /fleet status read the current TUI session's sub-agents while codewhale fleet status read the durable .codewhale/fleet.jsonl ledger — two different
  things wearing one name, so a run started by codewhale fleet run never
  appeared in the TUI. /fleet status now reads the durable ledger through the
  same code path as the CLI; the session view keeps its own name as
  /fleet workers (/subagents and n still work). When a workspace has no
  ledger, both surfaces report a typed no_fleet_ledger reason instead of an
  empty-looking "all clear", and neither creates the ledger as a side effect of
  reading it (#4022).

• codewhale fleet status (and list/interrupt/resume) created
  .codewhale/fleet.jsonl as a side effect of opening the manager, then
  reported no_fleet_ledger for the file it had just made — so the second
  invocation showed an empty Fleet where none existed. The CLI now refuses
  those verbs before the manager is constructed, matching /fleet (#4022).

• fleet resume <run-id> accepted any string. An id absent from the ledger
  reconciled nothing but still wrote a run-status record keyed by whatever was
  typed, and reported no_change. Unknown ids are now refused as not_found
  before any durable write (#4022).

• lane interrupt reported transitioned even when it changed nothing —
  another process's stop looked like our own. The Runtime backend now reports
  whether this call performed the transition, and a no-op is no_change.
  The @<lifecycle-seq> fence is also evaluated inside the registry's per-Lane
  lock rather than before it, so a stale fence refuses without running Runtime
  teardown instead of racing between the check and the stop (#1888).

• /lane no longer runs Runtime teardown on the TUI composer thread. Reads on
  the slash surface skip reconciliation (which probes tmux and takes a lock)
  and say so on the receipt instead of implying freshness; lane interrupt is
  CLI-only until that work runs off-thread, and reports
  surface_not_supported naming codewhale lane interrupt (#4022).

• The hotbar is no longer modelled as a third control surface. A slot binds a
  slash command and fires it with no argument, so it runs as the slash
  surface; the contract now declares which verb a bare press actually reaches
  (hotbar_bare_dispatch, true only for lane.list) instead of advertising
  target-taking verbs as hotbar-reachable (#1888).

• codewhale lane list --json and lane status --json keep emitting the
  LaneRecord shape they always have — the receipt did not replace it. The
  human lane status output also regained branch, session, socket,
  attach, and log, which the first cut of the shared DTO had dropped
  (#1888).

• No surface advertises a backend it does not have. lane restart and
  lane resume have no implementation — a Lane is re-created by
  codewhale lane start, and a stopped Lane's Runtime session is gone — so all
  three surfaces refuse them with backend_not_implemented and say why.
  fleet restart drives the manager loop to completion, which only the CLI
  runs, so /fleet restart reports surface_not_supported and names the CLI
  command rather than quietly doing a smaller thing (#1888).

• Deny rules in permissions.toml no longer miss a command because of an
  intervening flag: deny matching is token-based with flag-skipping and
  backtracking, so a git push rule still catches
  git -c foo=bar push. Path matching folds case only on platforms whose
  filesystems are case-insensitive, and the default approval branch no
  longer proposes the working directory as a network host.

• MCP tool calls run once. A failed call is no longer retried as if it
  were a failed lookup, qualified-name resolution collects every match and
  reports an ambiguity instead of taking whichever the hash map yielded
  first, and registering a server whose name collides with an existing one
  after sanitization is now an error rather than a silent overwrite.
  The equivalent call-once fix direction came from closed PR #4756 by
  @adity982.

• The session index survives a torn line: an unparseable entry is skipped
  rather than aborting the whole read, appends carry their data through to
  disk, and appends and compaction share a lock so a compaction can no
  longer race an append into a lost record.

• Edit counts as a write tool for workflow elevation, and the TUI's
  write/shell classification now delegates to one shared allowlist rather
  than keeping a second copy that could drift.

• A rejected app/config/set stays a no-op. Previously an invalid value
  still tore down the cached runtime bridge, killing the child runtime and
  orphaning every other in-flight stdio thread behind a response that
  correctly reported failure.

• A malformed project config.toml is no longer indistinguishable from
  having no project config. Because a project config may only tighten
  approval and sandbox policy, silently discarding a broken one dropped a
  repository's restrictions back to the looser user defaults; the setup
  wizard now says so, naming the file but never quoting its contents.

• An expired lane worktree no longer leaves its branch behind, which made
  reusing the same lane name fail with "branch already exists". A branch
  still carrying unmerged commits is kept — a TTL lapsing is not consent
  to delete someone's work.

• An in-flight thread/message turn can be stopped. The stdio loop keeps
  reading while a turn streams, so the new thread/interrupt request (and
  shutdown) can reach a runaway turn instead of waiting on the very turn
  they were meant to stop.

• Precedence is stated only in the constitution's "Whose word wins" section.
  Memory hygiene no longer ships an inverted Tier list that put the
  constitution above the user's current request; approval, compaction, and
  personality overlays describe behavior without rank vocabulary; and the
  authority recap points at the single source rather than restating a second
  ladder.

• <turn_meta> carries facts (mode, posture, model, workspace), not mode
  doctrine or permission-question essays re-asserted every user message.

• The project context pack (pretty-printed workspace tree) is off by default
  and opt-in via [context] project_pack = true. Language law is compressed
  while keeping the English-constitution / user-language-reply contract.

• Modal lists and config pickers wrap selection at both ends (Down past the
  last row returns to the top). Home-directory resolution prefers
  HOME/USERPROFILE via effective_home_dir across remaining call sites so
  Windows tests that fake the home env vars match production paths. The
  equivalent home-directory sweep came from closed PR #4760 by
  @EvanProgramming.

Changed

• Prefix-cache tool catalog entries store only the SHA-256 digest, not the
  joined catalog string. Unused plan-transition validation helpers are removed.

• Settings sections now hold only what they claim (#4751). Fleet keeps
  Fleet/member concerns; /goal moved to a Session section and Workflow
  orchestration to its own Workflow section. The inert DeepSeek-only
  default_model fallback moved out of Model settings into an explicit
  Legacy section — exact-Fleet users switch Fleets, not fallback models;
  the config field is retained because the runtime still reads it. This is
  presentation only: the persisted keys (goal_command, workflow,
  default_model), their values, scopes, and runtime behavior are unchanged.

• Auto model routing is scoped to the active provider. The classifier
  inventory no longer discloses other providers' runnable routes (or the fact
  that their credentials exist), a classifier reply naming another provider is
  refused, the local heuristic no longer falls back to a different provider
  when the active one is unusable, and the implicit DeepSeek-flash classifier
  is skipped for non-DeepSeek sessions. Auto receipts and the model picker
  hint report the active-provider-only scope instead of "runnable providers".
  Cross-provider Auto is available only through the persisted [auto] cross_provider = true opt-in (an explicit [auto.router] route remains its
  own opt-in for the classifier call). Same-provider strong/fast selection and
  [auto] cost_saving are unchanged.

• The QA pseudo-terminal acceptance harness now parses frames with rio-vt
  behind its existing neutral frame/color surface, retaining the assertions
  while removing the vt100 dependency (PR #4931 by @raphamorim).

• Anthropic Messages and OpenAI Responses stream opening now share the
  client/stream_entry.rs seam already used by Chat Completions: one bounded
  response-header wait, shared dual/HTTP-1.1 policy selection, at most one
  HTTP/1.1 fallback on a classified HTTP/2 header stall, and common idle-timeout
  diagnostics. Wire-specific authentication, headers, endpoints, decoding, and
  rate-limit behavior remain at each adapter edge. The timeout-placement
  diagnosis and fix direction came from closed PR #4743 by
  @vibecoding-skills.

Security

• Release containers now publish an SBOM attestation and pin maximum-mode
  provenance explicitly so supply-chain metadata cannot silently weaken with a
  builder-default change (PR #4958 by @kobihikri).

Contributors

Thank you to the contributors whose code, reports, and reviews shaped v0.9.2:

• @greyfreedom — exact repository-scoped
  allow grants and cross-platform path semantics (PR #4761), plus safe
  permission-rule listing and snapshot-bound removal (PR #4960).
• @nightt5879 — off-event-loop clipboard
  writes (PR #4896), complete locale exposure in settings (PR #4856), CRLF-safe
  edits (PR #4942), and reasoning-effort preservation across automatic model
  routing (PR #4961).
• @XhesicaFrost — the configurable
  session-token header (PR #4610) and context-menu hover alignment (PR #4897).
• @cyq1017 — the hooks configuration/executor
  split from PR #4087.
• @snail-vs (snailoniu) — OpenCode Zen's
  model-aware routes, authentication, documentation, and test isolation from
  closed PR #4467, whose contributor commits are preserved in the candidate.
• @SparkofSpike — the zh-Hans translation
  quality review harvested from PR #4908, duplicate-session fix in PR #4963,
  LaTeX implementation from PR #4973 landed through #4974, and the context-menu
  reproduction in #4803.
• @GTC2080 — the request-preview concept from
  PR #1099.
• @h3c-hexin — non-UTF-8 fetch_url
  decoding direction from PR #4909.
• @fleitz — required source-candidate credit for
  the canonical Bash no-cwd workspace fix and regression in PR #4673
  (issue #4674).
• @LmeSzinc — the Windows CRLF edit_file
  reproduction, root-cause analysis, and affected-code anchors in issue #4764.
• @atmosuwiryo — ACP numeric-id compatibility
  (PR #4929) and the Indonesian documentation and website locale (PRs #4962
  and #4972).
• @M-Maciej — the expanded-by-default reasoning
  setting and its original report (PR #4928, issue #4925).
• @raphamorim — migration of the QA PTY frame
  parser to rio-vt (PR #4931).
• @LI-Jialu — truthful finalization of restored
  stale shell cells (PR #4937).
• @kobihikri — release-container SBOM and
  explicit provenance mode (PR #4958).
• @EvanProgramming,
  @adity982, and
  @vibecoding-skills — equivalent fix
  direction for the effective-home sweep (#4760), MCP call-once behavior
  (#4756), and streaming/non-streaming timeout split (#4743).
• @antarikshraya — the LaTeX transcript
  rendering report in #4957.
• @eugenicum — the token-header request and
  output-presentation measurements in #4520 and #4468.
• @whp233 — the StepFun/OpenCode subscription-route
  request in #4526.
• @redjade75723,
  @hardy922,
  @JayBeest,
  @elijahchan2019,
  @cy2311, and
  @wywsoor — reports and product direction behind
  the stale-workspace diagnosis (#4100), native-tool-token filtering (#3880),
  contributor onboarding (#4227), optional reasoning highlight (#4089),
  session control (#2934), and export/restore correlation (#2494).

See CHANGELOG.md for full notes and docs/CHANGELOG_ARCHIVE.md for older releases.

This release addresses collection data loss in personal workspaces and request loss in imported large team collections, adds fallback to initial values for empty environment variables and configurable connection timeouts on the Desktop App, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-7-0.

What's Changed

• chore(agent): bump portable config to v0.1.18 by @CuriousCorrelation in #6508
• feat(common): implement current env value fallback to initial value by @anwarulislam in #6503
• chore: security patch for the dependency chain v2026.7.0 by @mirarifhasan in #6533
• fix(common): drop ctrl+backspace, ctrl+delete by @CuriousCorrelation in #6541
• feat(desktop): connection timeout bounds by @CuriousCorrelation in #6524
• chore(native): pin plugin git deps by rev by @CuriousCorrelation in #6542
• fix(desktop): hide native Edit menu bar on Linux by @Souheyl7Gouadria in #6456
• fix(common): personal workspace possible data loss issue by @anwarulislam in #6510
• fix(backend): prevent request loss in large team collections by @Jurager in #6072
• fix(backend): bump deprecated backend Dockerfile to node:22 by @mirarifhasan in #6552

New Contributors

• @Souheyl7Gouadria made their first contribution in #6456
• @Jurager made their first contribution in #6072

Full Changelog: 2026.6.1...2026.7.0

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@me" --field "Status" --field "Priority"

What's Changed

✨ Features

• Add name-based resolution to gh project item-edit by @zwick in #13807
• Add named field columns to gh project item-list by @zwick in #13823
• Add Grok skill host support by @tommaso-moro in #13864
• Replace Windsurf with Devin in gh skill agents by @tommaso-moro in #13987

🐛 Fixes

• Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by @malancas in #13624
• Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by @kofuk in #13787
• Fix skill picker label wrapping by @tommaso-moro in #13967

📚 Docs & Chores

• Bump Go to 1.26.5 by @github-actions[bot] in #13817
• Add OWNER/REPO format hint to the gh search --repo flag by @BagToad in #13922
• Present by-name item-edit as the first-class project flow in docs by @Solaris-star in #13927
• Add a macOS keyring security doc by @williammartin in #13960
• Add a code review agent skill by @BagToad in #14003
• Establish a pull request template for scale by @BagToad in #14004
• Add an agentic issue-triage workflow by @lukewar in #13777
• Use the Actions token for Copilot inference in the issue-triage workflow by @tidy-dev in #13830
• Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by @alondahari in #13949
• Add a dependabot-triage agentic workflow by @williammartin in #13985
• Harden the deployment workflow by @niik in #13780
• Replace SITE_DEPLOY_PAT with the gh-cli-site-deployer App by @williammartin in #13492
• Group CodeQL Dependabot updates by @williammartin in #13943
• Remove a dead CODEOWNERS rule for the non-existent pkg/cmd/release/attestation/ by @kobihikri in #13886
• Fix typos in code and documentation by @pstoeckle in #13940
• Fix duplicated-word typos in comments by @SORBELLOSTEFANIE in #13900

Dependencies

• chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by @dependabot in #13790
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot in #13789
• chore(deps): bump https://github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot in #13791
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by @dependabot in #13800
• chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by @dependabot in #13812
• chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot in #13821
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot in #13801
• chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by @dependabot in #13832
• chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by @dependabot in #13813
• chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot in #13822
• chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by @dependabot in #13843
• chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by @dependabot in #13841
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot in #13867
• chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by @dependabot in #13869
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot in #13868
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by @dependabot in #13870
• chore(deps): bump https://github.com/yuin/goldmark from 1.8.2 to 1.8.4 by @dependabot in #13888
• chore(deps): bump https://github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 by @dependabot in #13842
• chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by @dependabot in #13877
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot in #13933
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot in #13934
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot in #13936
• chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by @dependabot in #13935
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.22 to 0.0.23 by @dependabot in #13937
• chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by @dependabot in #13938
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #13941
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot in #13942
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.14 by @dependabot in #13944
• chore(deps): bump nodeselector/setup-apple-codesign from ab275d0 to 309922b by @dependabot in #13878
• chore(deps): bump https://github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot in #13950
• chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by @dependabot in #13951
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13965
• chore(deps): bump https://github.com/mattn/go-isatty from 0.0.23 to 0.0.24 by @dependabot in #13977
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot in #13978
• chore(deps): bump https://github.com/gabriel-vasile/mimetype from 1.4.14 to 1.4.15 by @dependabot in #13976
• chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by @dependabot in #13979
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by @dependabot in #13980
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot in #13981
• chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by @dependabot in #13995
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by @dependabot in #13996
• chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by @dependabot in #14018

New Contributors

• @lukewar made their first contribution in #13777
• @niik made their first contribution in #13780
• @kofuk made their first contribution in #13787
• @zwick made their first contribution in #13807
• @kobihikri made their first contribution in #13886
• @pstoeckle made their first contribution in #13940
• @Solaris-star made their first contribution in #13927
• @SORBELLOSTEFANIE made their first contribution in #13900
• @alondahari made their first contribution in #13949

Full Changelog: v2.96.0...v2.97.0

• Edit any earlier message in a conversation — the app forks the session at that point, rewinds the workspace to that run's checkpoint, and re-runs from your edited prompt. Restores are transactional and workspace-atomic, so a failed restore won't leave you half-rewound.
• Fixed long-running chat turns timing out mid-response.
• Checkpoints are now created reliably — including after a restart, after compaction, and on the first turn of a resumed session — and restoring one rewinds the whole workspace, not just the conversation.
• Fixed checkpoint restores failing after you closed and reopened a session.
• Reasoning controls (effort, thinking budget, on/off) now come from the shared model catalog, so each model gets exactly the reasoning options it actually supports instead of provider-specific guesses.
• Errors from upstream providers forwarded through the gateway now show the real message (e.g. "This model's maximum context length is 40960 tokens…") instead of a raw validation dump or [object Object].
• Ollama: empty responses are retried automatically, and the response-start timeout is raised to 5 minutes so cold model loads don't error out.
• OpenRouter now defaults to Anthropic Claude Sonnet 5.
• Model pickers show proper display names for Cline free models and recommended models.
• MCP servers now honor their configured per-server timeout.
• Fixed API keys for several providers being lost when migrating from an older install — all secret-backed providers now migrate correctly.
• Unknown or removed legacy model IDs now fall back to the default Cline model instead of failing.
• Fixed agentic compaction not persisting reliably, so long conversations resume in the right state.
• Fixed a .clinerules single file (the older format) aborting the whole rules and config scan.
• Fixed video input being dropped for models that support it.
• Fixed the workspace hint being sent for filesystem-root paths.
• Custom model info for OpenAI-Compatible providers now carries over into the seeded model catalog.
• Removed the "Enable R1 messages format" option from the OpenAI-Compatible provider.

Full Changelog: desktop-v0.0.7...desktop-v0.0.8

If yes, then you are in the right place.

MOV format is native to apple devices and all the videos recorded on them are saved as .mov files by default.

But still, this file format is not widely used, and not every media player supports these files also known as QuickTime videos.

Due to this most of the Windows 11 users are unable to play these files and to fix this problem, you need a MOV file player that fully supports all the codecs used to encode these files.

Normal users and professionals have their own distinct needs and expectation from these applications or software.

And that’s why we have listed some of the best video players that can easily run or open MOV files on Windows 11.

So, without further ado, let’s get started…

7 Best MOV Player For Windows 11 [ Top Free Picks ]

In light of frequent queries from our readers about this new Windows 11 operating system and MOV files, we have prepared this article.

Also, we have ranked these players according to their abilities to play these video files with various encodings and the key features that make them unique and different from each other.

But it is still important to select the finest one which suits your need. Therefore, we have prepared this list of the best MOV video player for Windows 11 which is absolutely free.

So, let’s get started…

1. Windows Media Player

Windows Media Player is the default player that comes with every Windows operating system. But recently, Microsoft has launched its new Windows 11 media player with a fresh design and built-in support for multiple file formats. And if you want to install it then you can easily download it from Microsoft Store or from the above link.

But even after updating it, this native video and audio player is unable to support most of the file formats. And that’s why we have created a detailed post on how to play MOV files on Windows 11 after installing the video extension and the codecs that are required for playing these video files. So, simply go through the post if you want to run MOV videos using this default media player.

Pros

• Comes pre-installed on Windows OS.
• Available on Windows 7, 8, 10, 11 ( Updated version )
• The new version has a beautiful user interface.
• Supports multiple audio and video file formats.
• Browse music and video files & your own create playlists.

Cons

• Needs codecs to open MOV files.
• Lags while playing high-resolution videos.

2. VLC Media Player

VLC media player is an open-source utility that is most downloaded in the world. It has a very versatile and simple UI which is preferred by most of Windows users. Apart from that, this video player can easily play MOV video files without extra codec installation or any extension.

And the best part, it supports all major video & audio file formats and is compatible with most platforms like iOS, Mac, Android, Linux, etc. Also, if you want to download it then visit the given link and I recommend you to always use the official VLC website to avoid malware and viruses.

Pros

• No ads and tracking.
• Customizable and adaptive.
• Compatible with all major platforms.
• Can run almost all audio and video formats.
• Support for codecs like MPEG-2, MPEG-4, H.264, WMV, and more

Cons

• Recently got banned in India.
• 4K videos are not played properly.
• Sometimes takes more RAM to process files.

3. QuickTime Player

QuickTime is one of the best free MOV player for Windows 11 OS. Everyone knows that it is also the default application for apple devices if you want to play MOV files on them. And the best part is that it is not only limited to mac devices but also comes in Windows version.

Moreover, QuickTime is not only built for .mov format but also supports .mp4 by default and includes some editing features that you can use to edit your recorded MOV videos. Apart from that, you can also use this player to view photos and stream media from the internet. And if you are a Final Cut Pro editing software then you are definitely gonna love this application.

Pros

• Lightweight.
• Convert MOV files to other formats.
• Play, Record, Edit, and Share video files.
• Stream videos from online services.

Cons

• Doesn’t support all other video formats.
• Not a good interface for the Windows version.

4. PotPlayer

PotPlayer is a modern media player developed in South Korea. Along with supporting MOV video format, it also supports 360-degree videos and 3D videos. This player also has overlay support and Direct3D9 Ex Flip Mode. If you are searching for a MOV video player with advanced features, this is the player you may want to consider using.

It supports TV, HDTV, DVD devices and all the major file formats such as .MOV, .MP4, .WMV, .AVI, .FLV, .MKV and more. This player can also easily play 4K Ultra HD files, considering the hardware is capable. Since this player is very advanced and offers various customization options, it can be overwhelming for simple uses.

Pros

• Lightweight and built-in OpenCodec.
• Able to play 4K and 8K MOV files with ease.
• Advanced features and support for 3D and 360-degree videos.
• Offers scene customization and full-screen playback.

Cons

• Complicated and Confusing interface.
• Less Support if any error comes up.

5. KMPlayer

KMPlayer is another best .mov player for Windows 11, which can play various file formats such as AVI, MPEG, TS, FLV, OGM, RM, WMV, MKV, MP4, WEBM, MOV, 3GP, 3G2, MP3, etc. In addition, this media player has a 64X version which can play 4K, 8K, UHD, and 60FPS videos with capable hardware.

Along with supporting MOV file formats, it also supports Blu-Ray Disc and DVDs. One of the unique features of this player is the ability to download YouTube directly. Simply enter the YouTube URL and play or download the video. You can also create a GIF file from the MOV video that you have recorded using this player.

Pros

• Multi-language support and no ads.
• In-built high-quality video codecs [ HEVC ( h.265 ), h.264, VP9 ]
• Supports multiple subtitle formats.
• Other features like Screen capture, noise reduction, audio-video synchronization, screen rotation, and more.

Cons

• Installer has some unwanted software.
• Takes a lot of CPU space while playing high-resolution videos.

6. RealPlayer

You may remember RealPlayer from the early days of the internet. It is one of the oldest and most versatile media players with support ranging from MOV, MP4, FLV, AVI, and WMV to online video streaming.

RealPlayer also has various plugins that you can use to extend its functionality, such as directly uploading your MOV files to social media, streaming online videos, and many more. It also has a browser extension that lets you download online videos.

Pros

• Online MOV video downloads.
• Convert video into different formats.
• Access videos from various devices like Windows, Mobile, etc.
• Organize and browse videos, create playlists, and can upload videos to the internet.

Cons

• Interface feels bloated
• Premium subscription for all add-ons & features.

7. iToolShare Blu-ray Player

If you are searching for a versatile and lightweight media player for Windows 11, iToolShare Blu-ray Player is an excellent choice that goes beyond standard MOV video playback. Designed with smooth hardware acceleration, it easily handles high-definition MOV, MP4, MKV, AVI, and 4K UHD videos without lagging or straining your CPU.

In addition to its free video playback capabilities for local file formats like MOV, iToolShare stands out by offering full interactive BD-J and HDMV menu navigation for commercial Blu-ray and DVD discs, ISO image files, and BDMV folders. Combined with studio-grade audio passthrough (Dolby TrueHD, DTS-HD Master Audio), it serves as a complete home theater solution for Windows 11 users.

Pros

• 100% Free Video Playback: Completely free to play MOV, MP4, MKV, AVI, WMV, and other common digital video formats on Windows 11.
• GPU Hardware Acceleration: Utilizes NVIDIA, AMD, and Intel hardware decoding for smooth, lag-free 4K/8K UHD video playback.
• Full Disc & ISO Menu Controls: Native interactive BD-J and HDMV menu support for commercial Blu-ray discs, DVDs, BDMV folders, and ISO files.
• Lossless Audio Passthrough: Crisp surround sound output supporting Dolby TrueHD, DTS-HD Master Audio, and multi-channel audio.

Cons

• Advanced commercial disc playback features require a premium license.

That’s it for now…

Conclusion

So, that’s all about the best free video player that you can use to play or open MOV files on your Windows 11 PC, Laptop, or Computer. Also, we have tried to cover all pros & cons and also the features that make them different. So, go through this list and find the best choice for yourself.

Moreover, I would recommend you to choose the program after analyzing what you expect from a player and what task you want to accomplish with it.

Stay tuned for the latest posts…

Feel free to share your thoughts via comments and also tell us about this post on 7 Best MOV Player For Windows 11 [ Top Free Picks ].

If you liked this post, don’t forget to share it.

@oh-my-pi/pi-agent-core

Fixed

• Fixed an issue where response-only usage records were incorrectly treated as authoritative context anchors, while ensuring prompt and total-only provider telemetry remains preserved.
• Fixed context compaction summaries growing excessively with large context windows by capping the summary output budget to 16,384 tokens, ensuring conversations are properly compressed rather than duplicated.

@oh-my-pi/pi-ai

Added

• Added support for the gmi-cloud provider registry, including API-key paste login validation and integration with @oh-my-pi/pi-catalog.

Changed

• Updated AuthStorage.redeemResetCredit to prioritize spending the soonest-expiring available saved reset credit, and improved error handling to distinguish between transport failures (credit_list_failed) and a genuine lack of credits.
• Exported SENSITIVE_TOKEN_RE from providers/transform-messages to allow hosts to route credential shapes through reversible obfuscation instead of irreversible redaction.

Fixed

• Fixed an issue where Cursor conversation checkpoints were incorrectly recorded as billable output tokens, ensuring accurate usage totals.
• Fixed an issue in AuthStorage.refreshStoredOAuthCredential where expired OAuth credentials were returned without being refreshed when a credential mismatch occurred, which previously resulted in misleading "No API key found" errors.
• Fixed Cursor history replay issues by preserving structured message order for assistant tool calls/results, retaining Kimi K3 thinking blocks, and preventing unsafe mid-session switches to K3.

@oh-my-pi/pi-catalog

Added

• Added support for the GMI Cloud provider (gmi-cloud), an OpenAI-compatible inference gateway with dynamic model discovery and API-key authentication via the GMI_API_KEY environment variable.
• Added optional authoritative context occupancy to usage records for providers with separate checkpoint telemetry and billable token buckets.

Fixed

• Fixed classification of dynamically discovered Cursor Kimi K3 effort variants as non-reasoning models when thinkingDetails is omitted.
• Fixed Google AI Studio OpenAI-compatible requests failing with HTTP 400 by omitting the unsupported store field.
• Fixed Synthetic models losing capabilities (such as reasoning/thinking selectors, vision input, output limits, and pricing) by correcting how the discovery mapper parses Synthetic's advertised features, effort vocabularies, and pricing structures.
• Fixed Cursor model discovery to correctly expose the 1M-token context window for supported models (including Claude, GPT, Kimi K3, and GLM 5.2+ families) instead of defaulting to 200k.
• Fixed GitHub Copilot routing for grok-4.5 to use the correct Responses endpoint instead of the unsupported Chat Completions endpoint.

@oh-my-pi/pi-coding-agent

Added

• Added an app.live.toggle keybinding (default Ctrl+L) to start or stop live voice mode.
• Added ctx.invokeTool(params, options?) to extension contexts, allowing wrappers to run native tools while inheriting context, abort signals, and progress updates.

Changed

• Moved the display-reset default keybinding (app.display.reset) from Ctrl+L to Alt+L to accommodate the new live-mode toggle.
• Updated the hashline edit tool, streaming preview, and plan-mode guidance to support the unified PUT/CUT grammar, .= ranges, and named registers.
• Improved startup performance by moving subagent model-registry refresh and session-file opening off the launch critical path.
• Optimized session file writing performance by batching same-turn file-session appends.
• Rewrote the Codex saved-reset auto-redeem algorithm to be pool-wide, window-exact, and expiry-aware, ensuring banked resets are automatically and reliably redeemed across multi-account setups before they expire.

Fixed

• Fixed a crash in Kitty terminals when rendering non-PNG tool-result images if PNG conversion fails.
• Fixed subagent evaluation resets (reset: true) wiping the shared kernel inherited from the parent session; resets from non-exclusive owners now fork into a private per-owner kernel.
• Fixed the copy selector and ask dialog rendering raw key IDs instead of human-readable keybinding labels.
• Fixed CLI positional initial messages bypassing automatic session-title generation.
• Fixed the environment-variable reference omitting Kitty Unicode placeholder controls and tmux placement caveats.
• Fixed extension validation failures during omp plugin install for extensions importing compact from @earendil-works/pi-coding-agent by adding the missing re-export.
• Fixed Bash interceptor rules to inspect unquoted/unescaped compound command fragments (e.g., &&, ||, ;, |, &, and newlines) instead of only matching the complete command input.
• Fixed ExtensionContext.cwd staying pinned to the initial session directory; it now dynamically tracks the active session's current working directory.
• Fixed the web-search provider picker description for xAI/Grok to clarify that it supports SuperGrok/X Premium+ OAuth sign-ins.
• Fixed /reload-plugins failing to reconnect MCP servers or refresh MCP tool and prompt-command registries.
• Enforced the centralized artifact spill threshold on oversized read results, persisting them as recoverable session artifacts.
• Fixed DuckDuckGo web search under-returning results above the first-page limit by automatically submitting continuation forms.
• Fixed DuckDuckGo web search ignoring after: and before: date bounds by correctly parsing and filtering result timestamps.
• Fixed env-driven OTLP trace export ignoring OTEL_RESOURCE_ATTRIBUTES.
• Fixed a fresh session with deferred MCP discovery injecting the newly mounted xd:// tool catalog twice into the first model request.
• Fixed the bash tool failing with EACCES permission errors on multi-user machines by scoping the snapshot directory per user ID.
• Fixed LSP write batching replaying stale whole-file snapshots over newer external changes made before the batch flushed.
• Fixed ctx.ui.editor() in ACP mode always resolving to undefined by routing it through the elicitation bridge.
• Fixed omp commit failing to resolve extension-provided models in both agentic and legacy pipelines.
• Fixed RPC hosts receiving no subagent lifecycle or progress frames when an IRC message revives an idle or parked keep-alive subagent.
• Fixed copied fenced-code body rows in assistant messages retaining component and container margins.
• Fixed mid-turn auto-compaction repeating dead-end rescue work and warnings at every tool boundary within a single oversized turn.
• Fixed automatic terminal appearance changes clearing native scrollback and snapping readers away from their current scroll position.
• Fixed exact-match edits failing on files containing credential-shaped tokens when secrets.enabled is active by using reversible placeholders instead of irreversible redactions.
• Fixed context usage collapsing to the latest response size for Cursor models that omit prompt-token usage.
• Fixed the browser tool crashing with EBUSY errors on Windows when a headless Chromium profile is locked during cleanup.
• Fixed the Python RPC client dropping context, compaction, OAuth URL, and terminal-settlement fields.
• Fixed the browser tool ignoring the url parameter when opening a new tab on an attached browser.
• Fixed browser automation disrupting attached browsers by adopting the active foreground tab and avoiding raising new tabs during screenshots.

@oh-my-pi/collab-web

Fixed

• Fixed an issue where the guest UI could incorrectly appear idle (such as the loading spinner disappearing) while the host agent was still running after a reconnection, and ensured tool cards are properly cleared if a connection drop occurs.

@oh-my-pi/hashline

Breaking Changes

• Replaced legacy SWAP, INS, and PASTE syntax with unified PUT and CUT hunks

Added

• Added named register support (@reg) and span paste capabilities to clipboard operations
• Added conservative recovery for uniformly omitted replacement indents near brace openers, preserving intentional indentation-only edits

Changed

• Made .= the canonical inclusive range separator while retaining legacy separator variants as lenient input
• Unified replacement, insertion, register paste, block, head/tail, move, and removal headers under a composable PUT, CUT, MV, and REM grammar

Fixed

• Improved resilience against common model output formatting errors, including numbered read rows, summarized ranges, diff-style old/new rows, empty PUT deletes, harmless CUT colons, and single-line span shorthand

@oh-my-pi/pi-mnemopi

Fixed

• Fixed a resource leak where SQLite prepared statements were not properly released, keeping the database connection alive after calling close(). This resolves file locking issues on Windows (which prevented deleting, moving, or rotating database files) and silent file handle leaks on POSIX systems.

@oh-my-pi/pi-natives

Changed

• Updated native HTML-to-Markdown rendering to html-to-markdown-rs 3.9.2 defaults, which may result in formatting differences (such as fenced code blocks and cycling nested-list bullets) compared to version 2.30.0.

Fixed

• Fixed a heap corruption crash when opening PulseAudio on Linux ARM64 by shipping target-specific miniaudio Rust layouts for GNU and musl native addons.
• Fixed local Bazel addon builds on NixOS by exposing system CMake tools to sandboxed build scripts and correctly bundling Opus.
• Fixed workspace native addon loading to correctly prefer the workspace build over an installed leaf package.
• Fixed process crashes caused by pathological HTML inputs; conversions that exceed the native-stack DOM depth limit now reject instead of returning silently truncated Markdown.

@oh-my-pi/pi-tui

Added

• Added request tokens to explicit OSC 11 appearance refreshes to allow consumers to correlate responses across queued and coalesced terminal probes.

Fixed

• Fixed the event-loop watchdog incorrectly reporting system sleep or suspension as a synchronous ui.loop-blocked stall.
• Fixed terminal copies of fenced-code blocks retaining margins from components, lists, or blockquotes in assistant messages (#7055 by @GratefulDave).

What's Changed

• Add GMI Cloud as a first-class provider by @definitelynotguru in #5884
• fix(natives): correct miniaudio layouts on Linux ARM64 by @olegpulatov in #7138
• fix(ai): refresh expired oauth credential on observed mismatch by @roboomp in #7180
• fix(coding-agent): reload MCP servers on /reload-plugins by @roboomp in #7192
• feat(extensions): add ctx.invokeTool for native built-in delegation by @psyrendust in #6840
• fix(collab-web): make host state authoritative for guest liveness by @metaphorics in #6990
• fix(tools): stop browser automation from stealing focus in an attached browser by @terrxo in #7006
• fix(compaction): cap the generated summary output budget by @terrxo in #7008
• fix(tui): preserve literal code block rows by @GratefulDave in #7055
• fix(browser): own headless Chromium profile dir to survive Windows EBUSY cleanup by @roboomp in #7060
• test(coding-agent): avoid MCP startup race by @GratefulDave in #7063
• fix(secrets): exact-match edits failing on files with credential-shaped tokens by @iacore in #7067
• fix(coding-agent): prevent stale LSP batch writes by @Ant39140 in #7069
• feat(cursor): expose 1M context windows in model discovery by @mmmeff in #7072
• acp: wire ctx.ui.editor through elicitFromAcpClient by @marton78 in #7079
• fix(mnemopi): release one-shot prepared statements by @Cyrus580529 in #7084
• fix(rpc): harden Python protocol compatibility by @wolfiesch in #7088
• fix(catalog): route Copilot Grok 4.5 to Responses by @roboomp in #7097
• fix(commit): load extension-provided models by @roboomp in #7100
• fix(test): gave CLI-spawning tests explicit timeouts by @psyrendust in #7103
• fix(rpc): restore frames for IRC-revived subagents by @roboomp in #7108
• fix(web-search): honor lang: directive in DuckDuckGo kl param by @roboomp in #7111
• fix(tui): ignore system sleep in loop watchdog by @wolfiesch in #7113
• fix(coding-agent): spill oversized read results to artifacts by @wolfiesch in #7117
• fix(search): paginate DuckDuckGo HTML results by @roboomp in #7121
• fix(web-search): extract duckduckgo result timestamps for date bounds by @roboomp in #7122
• perf(task): defer subagent launch setup by @wolfiesch in #7124
• perf(tui): batch persistence work off the render path by @wolfiesch in #7129
• fix(telemetry): merge OTEL_RESOURCE_ATTRIBUTES into export resource by @roboomp in #7135
• fix(agent): suppress redundant xd:// mount notice after catalog rebuild by @roboomp in #7140
• fix(bash): scope shell snapshots per uid so shared-/tmp accounts don't EACCES by @dangreco in #7141
• fix(natives): prevent deep HTML crashes and silent truncation by @br411 in #7143
• docs: Add link to LSP config docs in README by @jorisw in #7152
• fix(session): stop repeated mid-turn compaction dead ends by @roboomp in #7153
• test(ai): stop bedrock payload suites from needing ambient AWS auth by @wolfiesch in #7155
• fix(catalog): read Synthetic's advertised model capabilities by @Gareth-Rouse in #7159
• fix(tui): contain synchronous image conversion failures by @roboomp in #7161
• fix(session): reconstruct context without prompt usage by @harshav167 in #7163
• fix(tui): format selector keybinding hints by @roboomp in #7165
• fix(cli): generate titles for positional initial messages by @roboomp in #7167
• docs: document Kitty placeholder environment controls by @roboomp in #7173
• fix(coding-agent): re-export compact from legacy pi shim by @roboomp in #7175
• fix(coding-agent): inspect compound Bash commands in interceptor by @Vincent-Huang-2000 in #7176
• fix(coding-agent): keep ExtensionContext.cwd live across /move by @KennethHoff in #7177
• fix(web-search): surface xai-oauth support in Grok search provider label by @smoldrago in #7178
• fix(cursor): preserve structured K3 history replay by @roboomp in #7186
• fix(coding-agent): preserve scrollback on appearance changes by @Sairen777 in #7188
• fix(catalog): disable store field for Google AI Studio openai-compat host by @yevman in #7191
• fix(tools): navigate to the requested url when opening an attached browser tab by @terrxo in #7005

New Contributors

• @definitelynotguru made their first contribution in #5884
• @olegpulatov made their first contribution in #7138
• @mmmeff made their first contribution in #7072
• @marton78 made their first contribution in #7079
• @Cyrus580529 made their first contribution in #7084
• @dangreco made their first contribution in #7141
• @br411 made their first contribution in #7143
• @jorisw made their first contribution in #7152
• @harshav167 made their first contribution in #7163
• @Vincent-Huang-2000 made their first contribution in #7176
• @KennethHoff made their first contribution in #7177
• @smoldrago made their first contribution in #7178
• @Sairen777 made their first contribution in #7188
• @yevman made their first contribution in #7191

Full Changelog: v17.2.1...v17.2.2

@oh-my-pi/pi-ai

Added

• Added exact OAuth credential-row resolution by durable credential id. The targeted path refreshes only that row and never ranks, rotates, or falls back to sibling accounts.

Changed

• Anthropic OAuth requests now reproduce Cowork's current claude-desktop request profile, including client/runtime metadata, beta selection, system and billing attestation, the 64K output cap, and stable HTTP/1.1 header ordering.

@oh-my-pi/pi-catalog

Fixed

• Fixed Ollama model-manager caches being reused after the configured base URL changed by scoping cache namespaces to the normalized native discovery endpoint, including reverse-proxy path prefixes (#7087).

@oh-my-pi/pi-coding-agent

Added

• Added --from-claude and --from-codex session imports, also available from /resume @claude and /resume @codex.
• Added an opt-in OMP-native software-security workflow (security.enabled, default off) with immutable scan plans, exact-account Codex subscription affinity, native task-worker review, canonical findings/coverage/SARIF publication, project-scoped history, explicit dispositions, producer-differential comparison, and the read-only security:// resource namespace. Generic SARIF and official Codex Security bundles normalize into the same OMP-owned store.
• Added explicit Codex Security cloud operations to the opt-in security workflow: list and start account-pinned cloud scans, inspect their progress, and import current findings into OMP's canonical store and security:// namespace without changing the native scan engine or spoofing official runtime attribution.

Changed

• Reserved security:// from RPC host URI shadowing so vendor adapters cannot replace OMP's canonical security-analysis namespace.

Fixed

• Fixed remote or LAN local-engine endpoints being ignored during model discovery: the llama.cpp and Ollama probes used timeouts tuned for loopback, so a host reached over the network could exceed them and return no models, while changing OLLAMA_BASE_URL/OLLAMA_HOST could keep reusing a fresh cache from the previous endpoint. Non-loopback hosts now get a generous discovery timeout, and Ollama cache rows are scoped to the normalized endpoint (#7087).
• Fixed omp install failing extension validation for pi extensions that import createEditTool or createWriteTool (e.g. gentle-pi) — the legacy @oh-my-pi/pi-coding-agent shim exported the read/bash/grep/find/ls tool factories but omitted the edit and write ones, so a named import threw Bun's static "Export named X not found" error. Added createEditTool/createEditToolDefinition and createWriteTool/createWriteToolDefinition to match the upstream pi surface (#7094).
• Fixed Python eval's loopback tool bridge being routed through macOS system HTTP proxies, which caused parallel() tool reads to fail with ConnectionRefusedError after a local proxy stopped.

@oh-my-pi/pi-natives

Fixed

• Fixed the computer tool advertising Wayland support that never worked: on the default rootless XWayland (GNOME/KDE/sway) the X11 root window has no readable pixmap, so root GetImage failed on every screenshot with a raw BadMatch protocol dump. Monitor::all now probes root drawability at initialization and fails fast with an actionable DESKTOP_BACKEND_UNAVAILABLE message naming the rootless-XWayland constraint, and docs/computer-use.md now lists rootless XWayland as unsupported (#7085).

@oh-my-pi/pi-utils

Added

• Added a postmortem.quit configuration option to safely handle shutdown paths when the terminal output has already disconnected.
• Added project-keyed OMP security-state directory helpers under the user state root.

What's Changed

• feat(security): add OMP-native security scan subsystem by @kmccleary3301 in #7048
• fix(natives): fail fast on uncapturable rootless XWayland root by @roboomp in #7086
• fix(coding-agent): honor remote llama.cpp/ollama discovery base urls by @roboomp in #7090
• fix(coding-agent): add createEditTool/createWriteTool to legacy pi shim by @roboomp in #7095

New Contributors

• @kmccleary3301 made their first contribution in #7048

Full Changelog: v17.2.0...v17.2.1

@oh-my-pi/pi-agent-core

Fixed

• Provider-native compaction failures now surface their transport error instead of silently switching to generic summarization; streaming V2 still falls back to native V1 when available.

@oh-my-pi/pi-ai

Added

• Added first-class parentTurnId support for nested Codex requests, allowing stream options and metadata helpers to accept and safely propagate the initiating turn's ID.
• Added preservation of the Codex encrypted_function_args plaintext-collaboration marker on replayed function calls, keeping server-marked plaintext tool arguments from being reinterpreted as encrypted on subsequent turns.
• Added interactive Exa API-key login through /login exa, opening the official API-key dashboard and saving pasted keys to the credential store (#1798).
• Cursor's modern exec wire protocol is now handled end to end. agent.proto models the frames current Cursor CLI builds emit — the seven Pi tools (ExecServerMessage 45-51), hooks, subagents, allowlist prechecks, MCP state, smart-mode classification, canvas diagnostics, conversation search, agent-store conflicts and git diff — and every one of them gets a typed answer. The Pi frames run their local equivalents (read/bash/edit/write/grep/glob); the rest answer with the error, not-found or empty-but-valid variant that is actually true of this client. Frames this build cannot name at all now raise ExecClientControlMessage.throw with unknown_exec_variant, and recognised frames with no truthful answer (git_diff_request, whose GetDiffResponse has no error variant) raise exec_variant_unsupported, instead of a silent ack that leaves the server waiting.
• lsp is advertised in the MCP tool catalog again. It was filtered out as a Cursor-native tool, but the native diagnostics frame covers one of roughly ten LSP actions, so the other nine were unreachable.
• Added pinSessionOAuthAccount support for backdating the sticky's last-use timestamp (options.lastUsedAtMs), so pins restored from persisted sessions keep the provider's warm-window semantics: resumes inside the prompt-cache TTL reuse the account, stale resumes still re-rank.

Changed

• Codex turn metadata now reserves the codex-rs code_mode_tool_names key, preventing caller-supplied client metadata extras from colliding with the core-owned field.
• Codex SSE requests to the official endpoint now use zstd-compressed bodies by default to match the official client, which can be disabled with PI_CODEX_ZSTD=0.
• API-key validation now preserves provider HTTP status and retry headers, allowing authentication, rate-limit, and server failures to retain their original error classifications.
• The Cursor Pi arg translation (piReadPath, piJoinPath, piLsPath, piEscapeRegexLiteral, piLimit) moved to providers/cursor-pi-args, re-exported from providers/cursor/exec-modern so existing imports are unaffected. The legacy pi shim shares these helpers and is compiled into the bundled virtual module registry, where a nested providers/<dir>/<mod> specifier is unresolvable under bunfs — and importing them from the exec module would drag the whole protobuf graph in for two string functions.

Fixed

• Fixed Novita login rejecting valid API keys belonging to Developer and Basic team members by validating against the chat completions endpoint instead of the billing balance endpoint.
• Fixed Cursor resource_exhausted errors being incorrectly classified as QUOTA_EXHAUSTED (which caused 30-minute credential blocks), mapping them to MODEL_CAPACITY_EXHAUSTED with a shorter backoff instead.
• Fixed a crash in Amazon Bedrock and Devin providers when Context.systemPrompt is passed as a bare string.
• Fixed aborted usage-limit recovery incorrectly blocking credentials or waiting on local usage fetches after the session had already changed.
• Fixed Codex WebSocket sessions echoing stale or missing turn states by capturing x-codex-turn-state refreshes from response metadata event headers.
• Fixed Harmony-dialect models (e.g., gpt-5.x, openai-codex) failing with invalid_prompt or "Request blocked" errors by escaping reserved control tokens in untrusted user and tool-result text.
• Fixed named forced tool_choice not being enforced on string-only OpenAI-compatible hosts (such as llama.cpp and LM Studio) by narrowing the advertised tools to the forced tool.
• Fixed direct Anthropic Claude Opus requests failing with HTTP 400 when the endpoint rejects strict tool fields.
• Fixed usage-based credential ranking for Anthropic accounts where a missing long-window (7-day) metric was incorrectly treated as a short-window metric.
• Fixed legacy Codex usage blocks continuing to gate all models after per-meter backoff was introduced, splitting the old shared scope into independent chat and spark blocks while maintaining backward compatibility with older clients and database schemas.
• Fixed Anthropic retry loops ignoring maxRetryDelayMs for long server retry-after hints, so over-budget delays surface immediately without losing response details or abort cleanup (#7003).
• Added interactive xAI API-key login with key validation through the xAI models endpoint.
• Fixed Google Gemini and Vertex tool declarations carrying numeric, boolean, object-valued, or mixed enum arrays that the Google Schema wire type cannot represent. Unsupported enums are omitted while valid string enums remain constrained.
• Umans usage provider: fetches GET /v1/usage and surfaces the rolling 5h request window + concurrency limits in /usage, omp usage, and the TUI status bar.
• Fixed ranged legacy Cursor reads reporting the returned window byte length as the full file size.
• Updated the Cursor client build advertisement to activate the modern exec-frame protocol handled by this provider.
• Fixed a windowed Cursor read reporting the window's line count as the file's. total_lines and file_size were derived from the payload, which is the whole file only for an unranged read — a 20-line page of a 100-line file answered total_lines: 20, which a paginating server reads as the end of the file. The count now comes from the read's own record of the file (details.meta.truncation.totalLines), falling back to counting the payload when the read returned the file whole.
• Fixed a pi_grep that hit the native backend's internal match ceiling answering as an unqualified success. GrepTool folds that cap into the flat details.truncated alone, setting neither details.truncation nor perFileLimitReached — the two fields the Pi result was built from — so the one truncation a caller can neither detect nor page around was the one it was never told about. The flat flag is now translated into a PiTruncation, and only when no specific cap already reported itself.
• Fixed a pi_grep frame's context and limit vanishing from the transcript. The bridge honors both by building a scoped grep, but neither is expressible in the model-facing schema, so the synthesized block recorded a plain pattern/path search — replaying a context-widened or capped search as an ordinary grep sitting beside output no ordinary grep produces. Both are now recorded on the block.
• Fixed a Cursor MCP resource listing shrinking to a count in the transcript. The full URI/name/mime catalog goes out on the wire, but the paired local result recorded Listed N MCP resource(s) — and rebuilt history is serialized from that result, so one reload later the model knew it had seen N resources and could name none of them. The paired result now lists what the answer carried.
• Fixed the pi_read range translation padding the slice it asks for. piReadPath composed a plain :N+K selector, which the local read tool expands by one leading and three trailing context line — so a frame naming offset 5/limit 20 received lines 4-27. Ranged Pi reads now compose :raw:N+K; the wire result is an opaque output string, so the line-number gutter raw also drops carries nothing the contract needs.
• Fixed four Cursor exec frames answering with a result whose oneof was never set. In proto3 that is not an empty result — the server reads it as "the tool ran and produced nothing", indistinguishable from real success. listMcpResourcesExecResult, readMcpResourceExecResult, recordScreenResult and computerUseResult now send ListMcpResourcesSuccess{resources: []}, ReadMcpResourceNotFound{uri}, RecordScreenFailure and ComputerUseError respectively.
• The MCP resource frames now answer from the host instead of a fixed verdict. CursorExecHandlers gained listMcpResources/readMcpResource, so a host holding live MCP connections advertises them; the empty catalog and not_found above remain the answer when no handler is supplied. A handler that throws surfaces as ListMcpResourcesError/ReadMcpResourceError rather than collapsing into "none exist", which the model cannot retry. A read carrying download_path forwards it and answers with ReadMcpResourceSuccess.download_path and no content, which is what that mode means.
• Fixed Cursor connect_scm calls losing their repository and settling on a fabricated verdict. The target rides in the ConnectScmArgs.target oneof, so reading a flat github property always saw undefined; and the authoritative success/error/rejected result only arrives on the completion frame, so answering at the announcement persisted a fixed failure for every call — including the ones the server went on to accept. The block now opens on the start frame and settles from the completion's decoded result.
• Fixed interleaved Cursor tool calls corrupting each other. The stream decoder tracked a single "current" block and settled it on any toolCallCompleted, ignoring the envelope's call_id: a completion for one call closed whichever block happened to be open and paired it with the wrong result, and start A, start B orphaned A entirely so its own completion settled B while A was never paired — which strips the whole interaction from every rebuilt transcript. Open blocks are now retained per envelope call_id, and end-of-stream closes all of them rather than only the last.
• Fixed a Cursor search_conversations call leaving no transcript block. The frame is answered from a fixed verdict, so nothing downstream pairs a result for it, and an unpaired call takes its whole interaction out of every rebuilt transcript.
• Fixed a Cursor read_mcp_resource call leaving no transcript block. The frame runs locally — and in download mode writes a workspace file — but synthesized no tool call and paired no result, so the read was invisible in the UI and absent from every rebuilt history; a resource download could mutate the workspace with nothing on record. The frame now synthesizes a read_mcp_resource block (not read: it is a remote MCP operation, and the name drives rendering and prune semantics) and pairs a result on success, not-found and error alike. Frames answered without a handler still synthesize nothing, since nothing ran.
• Fixed a Cursor list_mcp_resources call leaving no transcript block. The model consumed the catalog, but the frame synthesized no tool call and paired no result — its streamed ListMcpResourcesToolCall announcement was equally unrecognized — so the listing was invisible in the UI and absent from every rebuilt history. Frames a handler answered now synthesize a list_mcp_resources block and pair a result derived from the same answer that went on the wire; frames answered from the fixed no-handler catalog still synthesize nothing, since nothing ran.
• Fixed an unavailable pi_edit/pi_write answering with the error variant. Both results model refusal and failure as separate oneof cases, and a denial reported as error reads as "the tool ran and broke" — inviting a retry of an operation that was never permitted. A frame whose tool is not granted, or whose handler produced nothing, now answers with PiEditExecRejected/PiWriteExecRejected; execution failures keep the error variant.
• Fixed a Cursor MCP approval probe actually running the tool. A modern mcpArgs frame carrying smart_mode_approval_only asks only whether a call would be permitted, not for the call itself. The decoder dropped the flag, so the frame ran a side-effecting MCP tool the user had not been asked about, then ran it again when the real call followed. The flag is now carried through and the probe is answered from the host's policy without executing: approved only for a definite allow, refused for a deny, for a mode that demands a prompt the frame cannot raise, and for a tool the session does not have. No transcript block is synthesized either, since nothing ran.
• Fixed the Cursor stream's end-of-transport cleanup erasing the arguments of every block still open. Blocks whose args arrive whole (todo, connect-SCM, MCP) never feed the streamed partial-JSON buffer, and reparsing an absent buffer yields {}, so a truncated or disconnected turn rebuilt those calls with no arguments at all. Only blocks that actually streamed their args are reparsed now.
• Fixed a Cursor stream dying mid-turn stranding the call it left open. connect_scm and native todo blocks are stamped resolved the moment they open, so the agent loop synthesizes no placeholder and only their completion frame pairs a result — a transport that closed first left the card animating and the call unpaired, which takes the whole interaction out of every rebuilt transcript. The terminal-error path now closes open blocks and pairs those server-owned calls with an interrupted result; the flush ran only on clean completion before, which is not the path a dying stream takes. Exec-settled MCP blocks are left alone, since the dispatch that ran them owns their result.
• Fixed the Pi exec frames displaying a different operation than the one they run. The provider synthesized its transcript block from a second, hand-rolled translation of the frame args, so pi_read's offset/limit were shown as a whole-file read, pi_grep's literal pattern as an unescaped regex, and pi_find's path/glob join differed from the executed one. Both sides now share a single translation.
• Fixed the streamed pi_*_tool_call announcements that modern builds send alongside each exec frame being unrecognized. The exec channel already synthesizes those blocks when it runs the tool; the duplicate was avoided only because the decoder recognized none of the variants, which would have started double-rendering as soon as any one was added.
• Fixed pi_bash results reaching Cursor clipped with no truncation notice. Two truncation records exist locally: read/grep set details.truncation, which carries an explicit truncated flag, while bash sets details.meta.truncation, whose record has no such flag — its presence is the signal. piTruncation read only the first shape and required the flag, so every real Bash truncation was dropped and the server was told the clipped output was complete. Both shapes now translate, and an explicit truncated: false still suppresses the field.

@oh-my-pi/pi-catalog

Added

• Regenerated the Cursor agent protobufs (discovery/cursor-gen/agent_pb.ts) against the modern agent.proto, adding the message and enum families current Cursor CLI builds emit: Pi tool exec frames, hook queries and responses, subagents, allowlist prechecks, MCP state, smart-mode classification, canvas diagnostics, conversation search, agent-store conflicts and git diff. Purely additive — no existing exported symbol changed shape.

Fixed

• Fixed an issue where LM Studio first turns failed with a 400 Invalid tool_choice error when a named tool was forced, by using the supported tool_choice: "required" string selector.

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed the DEL, DEL.BLK, COPY, and COPY.BLK hashline edit operations. Use CUT / CUT.BLK for deletion; removed content remains available to PASTE.

Added

• Added server-name autocomplete for /mcp commands (enable, disable, test, remove, reconnect, reauth, unauth) using configured and runtime-discovered MCP servers.
• Added CUT and PASTE ops to the hashline edit tool for moving code without retyping it: CUT N.=M (and .BLK block forms) capture lines into a clipboard register, and PASTE operations insert them. The register flows across sections within a patch (cross-file moves) and persists across edit calls per session.
• Added --from-claude and --from-codex session imports (including compaction state for Codex), also available from /resume @claude and /resume @codex.
• Added interactive Exa API-key onboarding through /login exa, opening the official key dashboard and saving pasted keys for authenticated web search while preserving EXA_API_KEY and explicit-selection public MCP fallback behavior (#1798).
• Added ExtensionContext.getAsyncJobSnapshot() so extensions can read the owning session's async-job state without relying on process-global job-manager identity
• Added opt-in tui.codexResetFireworks celebrations for unscheduled Codex weekly usage resets and newly banked saved resets, shown in a theme-aware top-third modal until Escape (#6858 by @joshrzemien).
• The Cursor exec bridge serves the seven modern Pi tool frames, mapping each to its local equivalent: pi_read/pi_ls → read, pi_bash → bash, pi_edit → edit, pi_write → write, pi_grep → grep, and pi_find → glob. The frames are a separate wire family from the legacy args, not aliases, so each mapping is a real translation — pi_grep's ignore_case is the inverse of the local tool's case-sensitivity flag, pi_find searches filenames rather than contents, and pi_edit's replacements are renamed to the local snake_case pairs.
• providers.autoThinkingMaxEffort (xhigh | max, default xhigh) raises the ceiling of the auto thinking classifier. max became a first-class effort tier after the classifier prompt was written, so auto could never reach it on models that expose the tier — only the ultrathink keyword could. Opting in adds max to the classifier's vocabulary, gated on the target model actually supporting it; the default keeps today's prompt byte-for-byte. The ceiling is enforced inside the effort clamp rather than on the classifier's answer, so a sparse ladder cannot snap an excluded request back up, and the Low floor is still resolved against the model's own ladder. The on-device 3-bucket classifier stays capped at xhigh regardless of the setting. The ceiling governs what auto resolves: a ladder with nothing underneath it yields no auto level, and a thinking.requiresEffort model still gets its lowest supported effort from the transport.

Changed

• Improved grouped read-call layout by nesting each request's usage metrics beneath its final path.
• Improved turn recovery to prevent duplicate output streaming during credential rotation or model fallback when visible text has already been streamed.
• Optimized tool guidance for bash, grep, and glob to be more concise while clarifying shell boundaries and search timeouts.
• Optimized models configuration resource probing to run in a single child process, reducing startup contention.
• Startup release notes now default to a compact change-count summary. Use startup.changelogMode (summary | expanded | hidden) to control them; legacy collapseChangelog choices migrate automatically (#6771).

Fixed

• Fixed Anthropic prompt-cache cold misses on session resume with multiple OAuth accounts: the account that served a session is now recorded in the session file (as a credential_pin sha-256 of the account + org/project scope, so exports carry no plaintext identity) and re-pinned on resume with the session's effective last-use time, so a fresh process no longer re-ranks accounts by usage headroom — which systematically routed away from the just-used account and cold-missed the entire account-scoped cache prefix. Sticky routing was previously stored only in the auth store's KV cache, which is in-memory when a remote auth broker is configured.
• Fixed Anthropic prompt-cache cold misses on session resume with multiple OAuth accounts: the account that served a session is now recorded in the session file (as a PII-free credential_pin hash) and re-pinned on resume, so a fresh process no longer re-ranks accounts by usage headroom — which systematically routed away from the just-used account and cold-missed the entire account-scoped cache prefix. Sticky routing was previously stored only in the auth store's KV cache, which is in-memory when a remote auth broker is configured.
• Fixed concurrent createAgentSession calls with the default agent id failing initialization with Agent "Main" was replaced during session initialization — each in-process embedder (e.g. the edit benchmark runner) can now pass a private registry via the newly exported AgentRegistry, keeping every top-level session's "Main" out of the process-global roster race.
• Fixed task tool blocks duplicating their per-agent progress rows into terminal scrollback on every update: live task frames now pin the transcript live region so mid-run rows are never recorded as frozen snapshots, and a detached background task freezes its progress the moment any of its rows commit to scrollback instead of mutating committed history.
• Fixed Codex reset fireworks comparing different quota tiers or plans, preventing false celebrations when usage reports switch between Spark and base weekly limits.
• Fixed Cursor ranged-read results losing the full file byte size after applying the requested window.
• Fixed empty Codex final-stop recovery discarding an earlier commentary message when both messages shared response metadata.
• Fixed Advisor availability with providers that refuse echoed reasoning by retrying once with primary thinking stripped and surfacing persistent refusals immediately.
• Fixed /tan agents being unable to read parent-session local:// attachments by correctly resolving local protocol options against the parent session's artifacts.
• Fixed Codex web search silently returning plain completions when the hosted web search tool was skipped.
• Fixed TUI collaboration guest loader not starting when joining or reconnecting mid-turn.
• Fixed multi-second TUI freezes in reftable-format repositories by moving branch resolution off the render path and adding a timeout to synchronous git spawns.
• Fixed xd:// device summaries containing control characters and exceeding size budgets by stripping control characters and bounding summaries by UTF-8 bytes.
• Fixed task.softRequestBudget configuration having no effect on bundled scout and sonic subagents.
• Fixed quick LSP server exits being misreported as reader failures and resolved an issue where explicit reloads were blocked by initialization backoff.
• Forced Git subprocesses to use the stable C locale to ensure predictable, non-interactive command output.
• Fixed compatibility replay issues for pre-upgrade launch brokers evaluating xterm inside the client process.
• Fixed Advisor cost tracking in the status line across conversation boundaries, ensuring session transitions, forks, and resumes correctly restore or isolate conversation spend.
• Fixed validation failures for legacy extensions importing from the package root, which previously blocked installations.
• Fixed ACP clients (such as Zed), TUI status lines, and collaboration guests not updating when model changes occur dynamically within the agent loop.
• Fixed assistant-facing resource summaries omitting parameterized MCP resource templates, ensuring failed reads list templates alongside concrete resources.
• Fixed redundant xd:// mount notices and prompt-cache invalidation when resuming sessions or reconnecting devices.
• Fixed the model picker displaying placeholder model lists instead of the actual credential-aware catalog resolved at registration.
• Fixed file corruption and snapshot mismatches when writing files through the ACP client bridge by verifying the final on-disk content after client-side post-save formatting.
• Fixed omp ttsr test silently evaluating source files as prose when their extensions were missing from the allowlist, and expanded the allowlist to support .NET, Shell, SQL, Zig, Dart, Scala, Elixir, and Protobuf files.
• Fixed automatic light/dark theme switching in direct WezTerm sessions on macOS when DEC Mode 2031 is unsupported, and improved theme-change color responsiveness.
• Fixed configured retry.maxDelayMs not being forwarded into Anthropic retry handling, so over-budget server retry delays fail fast.
• Added tokens-per-second throughput to RPC get_state responses for non-TUI clients.
• Added the RPC set_fast_mode command and typed TypeScript/Python client methods for live fast-mode control.
• Added fastModeEnabled and fastModeActive to RPC get_state responses.
• Fixed RPC fast-mode state reporting after direct Anthropic rejects speed: "fast", while allowing explicit re-enable requests to retry priority service.
• Added opt-in subagent access to checkpoint, rewind, learn, and manage_skill when explicitly listed in an agent definition's tools: frontmatter. Listing one of checkpoint/rewind auto-includes the other. Settings (checkpoint.enabled, autolearn.enabled) remain master toggles.
• Added a browser.cdpUrl setting that points browser automation at an already-running CDP endpoint by default, so app.cdp_url no longer has to be repeated on every call. Explicit app options still take precedence.
• Native compaction preserves provider-native success and non-authentication failure semantics while retaining authenticated cross-provider fallback when the native provider rejects credentials.
• Fixed the Cursor Pi exec bridge silently dropping frame arguments. pi_read's offset/limit were ignored, so a ranged read returned the whole file; pi_grep's literal was ignored, so a fixed-string search ran as a regex and matched the wrong lines; and the path/glob join produced a ./-prefixed spec. Ranges are now composed onto read's :N+K inline selector, literal patterns are escaped, and the join uses node:path. These are optional int32 fields, so a present 0 is honored rather than folded into a default: pi_read with limit: 0 answers with empty output instead of the entire file, and pi_find with limit: 0 clamps to 1 the way the reference client does.
• pi_grep's context and limit are honored. Neither is expressible in the model-facing grep schema — context width comes from grep.contextBefore/grep.contextAfter fixed at tool construction — so the bridge builds a per-call grep for frames that supply them. GrepTool accepts these as constructor options; the model-facing schema is unchanged, and a frame that supplies neither keeps the shared instance and the session's defaults.
• pi_ls's limit is still not mapped, now deliberately: it caps directory entries, while the local read tool renders a depth-2 tree with per-directory caps and elision rows and applies a selector as a rendered line slice. Mapping it to :1+K would cap a different unit while appearing honored.
• The legacy pi shim's regex-literal escaper and path/glob join were verbatim copies of the modern bridge's. Both paths now call the shared helpers, so the two Pi translations cannot drift.
• Fixed every Cursor pi_edit frame failing instead of editing. Two independent causes: the session drops edit from the tool registry for Cursor so the model uses full-file write, but that registry is also the exec bridge's tool source, so the native frame — which the server sends regardless of the advertised catalog — found no tool; and the retained instance followed the session's configured edit mode, while PiEditExecArgs carries old_text/new_text pairs that only replace accepts (the default hashline takes a single input string). The bridge now resolves a replace-mode instance through its fallback resolver, still wrapped for approval.
• Fixed a pi_grep frame carrying context or limit escaping the approval gate. Honoring those fields needs a per-call grep, and the per-call instance was built raw while every registry tool is wrapped, so such calls bypassed tools.approval.grep and the exec-tier check for SSH-targeted paths. Both bridge callsites now build it through one shared factory that applies the same wrapper.
• Fixed Cursor advisors ignoring pi_grep's context and limit. Only the primary session supplied the per-call grep factory, so advisor frames silently fell back to session defaults. Advisors now receive the same factory, gated on the advisor actually having been granted grep.
• Fixed Cursor advisors failing every pi_edit. The advisor roster handed the bridge the edit instance built for the advisor's own loop, which follows the configured edit.mode (hashline by default) and rejects the frame's old_text/new_text pairs — the same mode mismatch the primary bridge already fixed, on the path it missed. The exec map now substitutes a replace-mode instance, gated on the advisor actually having been granted edit, while the advisor's own loop keeps the tool it was given.
• Fixed pi_bash killing commands that explicitly asked for no deadline. timeout is optional int32 and bash documents 0 as "disables the command deadline", but a truthiness check folded a supplied 0 into unset, applying the 300s default instead. A present 0 now passes through; negatives, which have no local meaning and would otherwise clamp to the 1s floor, still fall back to the default.
• Fixed the Cursor exec bridge granting edit and grep to sessions that withheld them. Both bridge-only tools are constructed rather than looked up, and executeTool prefers a constructed override over the registry, so a restricted tool set (toolNames without them, or restrictToolNames) still got a working pi_edit/pi_grep — native frames arrive regardless of the advertised catalog. Both are now gated on the session having actually granted the tool, matching the delete frame's existing check (issue #5680).
• Fixed Cursor advisor bridge tools bypassing approval settings. The advisor's pi_edit/pi_grep instances are approval-wrapped, but the wrapper reads tools.approvalMode, per-tool tools.approval.<tool> policies and autoApprove only from the execute-time tool context — which the advisor bridge never supplied, so every native advisor frame resolved as yolo with empty policies and ran past a configured ask or deny. Advisors now receive the same context store as the primary bridge.
• Fixed Cursor's list_mcp_resources/read_mcp_resource frames answering as though the client hosted no MCP servers. The bridge hardcoded an empty catalog and not_found, so resources from servers the session held live connections to were invisible to the model even while the same session read them through mcp://. Both frames now answer from the session's MCPManager — awaiting a server's background resource discovery rather than reading the not-yet-populated cache and reporting "advertises nothing" — and a lookup failure surfaces as an error rather than an empty catalog, which would read as "asked, none exist". A read carrying download_path writes the resource to that path and answers with the path alone, per the wire contract, instead of putting the payload back in the model's context. That path arrives from the server while the general-purpose resolver deliberately honors absolute paths and .., so downloads are confined to the workspace: the resolved target and its deepest existing ancestor must stay inside it, and a target that is itself a symlink is refused. The write then opens O_NOFOLLOW and refuses a non-regular or hard-linked file before truncating, so the final component cannot be swapped for a link or an inode shared outside after the check. A parent directory replaced by a symlink mid-write is still followed; closing that needs openat/dirfd walking, which this does not attempt.
• Fixed the Cursor native delete frame bypassing approval settings. Unlike every other frame it removes the file directly instead of running a registry tool, so no approval wrapper sat in front of it — the bridge's allowDirectFileMutation grant answers whether a mutating tool was granted, which is a different question from whether the user's policy allows the call. A configured tools.approval.delete: deny, or an always-ask session that this channel cannot prompt in, now refuses the frame and keeps the file.
• Fixed Cursor download-mode resource reads bypassing the session's mutation restrictions. A read_mcp_resource frame carrying download_path creates and overwrites workspace files without running a registry tool — the same hole the native delete frame had — so a session that withheld write/edit, or one whose write tier is deny/always-ask, still had files written. Both frames now share one grant (allowDirectFileMutation, renamed from allowNativeDelete now that it gates more than deletion) and one write-tier policy check, and the download refuses before the read so a blocked call does not fetch the resource either. The primary session derives that grant before it rewrites its registry: Cursor moves edit out of the tool map and write may be auto-registered later, so reading the map at bridge-construction time would have misjudged both.
• Fixed pi_ls never reporting that a listing was clipped. The bridge read the entry cap from a flat details.resultLimitReached, which glob sets but read — the tool serving pi_ls — does not: it records the cap through OutputMeta at details.meta.limits.resultLimit.reached. Every capped listing therefore reached Cursor with entry_limit_reached unset, reading as complete. Both shapes are now checked, the same way the truncation translation already handles its two producers.
• Fixed a mixed-content MCP resource read reaching Cursor mislabelled. The mime type was taken from the first content item while the payload came from whichever item supplied it, so an image blob followed by a text note sent the text as image/png. Each branch now reports the type of the part it actually sends.
• Fixed pi_read's offset/limit returning more lines than the frame asked for. The range is composed onto the local read tool's inline selector, and a plain :N+K deliberately pads with one leading and three trailing context lines — helpful when a human reads a snippet, wrong for a caller that named an exact range: offset 5/limit 20 handed Cursor lines 4-27. Ranged Pi reads now compose :raw:N+K, which slices exactly the requested lines.
• Fixed pi_grep returning fewer matches than it asked for when they spread across many files. The local grep windows results to the first 20 files and tells the caller to paginate with skip, but PiGrepExecArgs has no skip field — so a frame asking for 100 matches over 25 one-match files got 20, match_limit_reached unset, and advice it could not act on: output silently short and labelled complete. A search carrying a total match cap now reads enough files to satisfy it (cap+1, so a result landing exactly on the cap is distinguishable from a clipped one) and reports the cap when it actually bites.
• Fixed every native pi_edit failing after a session switched onto Cursor. The replace-mode edit instance the frame needs was built only for sessions created on Cursor, and the tool roster is not rebuilt on a model switch — so a session that started elsewhere kept its configured-mode edit in the registry, which the bridge resolves before its fallback, and the frame's old_text/new_text pairs failed validation against a hashline schema. The instance is now built from the edit grant regardless of the session's initial provider (lazily, so a session that never reaches Cursor never constructs one) and pi_edit asks for it explicitly through a dedicated accessor. A session that was never granted edit is still refused.
• Fixed the Cursor bridge's tool resolver being able to execute an unadvertised edit. That resolver doubles as the agent loop's fallback for any call outside the advertised set, so serving edit from it meant a hallucinated call — or one naming a tool the session deselected after startup — could run a replace-mode edit the model was never offered. It is device-only again; pi_edit uses its own accessor.
• Fixed the legacy Cursor read frame ignoring the offset/limit modern builds paginate with. Only the Pi variant composed a range, so every page of a legacy read returned the whole file (or its own truncation) and a model walking a large file never advanced past the first window. Both frames now translate a range through the same helper, and the answer sets range_applied to describe whether a window was actually composed.
• Fixed the legacy Cursor grep frame ignoring its pagination offset. The local grep paginates by file through skip and advertises exactly that in its own "use skip=N" advice, so an unforwarded offset re-ran the identical search and answered page one for every page. The answer now reports the offset it applied in offset_applied.
• Fixed a paginated Cursor read or grep frame being recorded as an unpaginated one. The executed call and the transcript block are built separately, so forwarding the frame's range and page fixed only the execution: the block still showed a bare path and an unskipped search, which is what a reloaded session replays and what the next turn reasons from — a slice of a file presented as the whole thing, and results from a later window presented as page one. Both are now synthesized from the same translation that runs them, including a limit: 0 read, which is recorded as the zero lines it returns rather than a whole-file read.
• Fixed Cursor advisors answering every MCP resource frame as though the client hosted no servers. Only the primary bridge received the MCPManager-backed resource adapter, so an advisor's list_mcp_resources reported an empty catalog and its read_mcp_resource a not_found even though the advisor shares the session's live connections. Advisors now receive the same adapter; it is not gated on a tool grant, since reading what a server advertises is a different permission from calling one of its tools.
• Fixed advisor tools bypassing the approval gate. They are built straight from the builtin table, outside the loop that wraps every registry tool, and both the advisor's own agent loop and its Cursor exec bridge (pi_write, pi_bash) run those instances directly — so an advisor granted write or bash executed them regardless of a configured ask or deny. They now carry the same ExtensionToolWrapper as every other tool.
• Added mcp_notification extension event and multi-listener MCPManager.addNotificationListener API. The runtime already received MCP server-initiated JSON-RPC notifications at the transport layer but had no path to forward them to extensions; every notification (including server-custom methods) is now delivered as { server, method, params } after the manager's own list/update handling. For known list-change methods (notifications/tools/list_changed, notifications/resources/list_changed, notifications/prompts/list_changed) the internal refresh promise is awaited before fanout, so a listener acting on tools/list_changed sees fresh getTools(). Notifications received before any listener attaches are buffered (bounded FIFO, cap 100, drop-oldest — matches IrcBus's MAILBOX_CAP) and drained into the first subscriber, so startup-time frames aren't lost even if the extension binds after MCP discovery. Extensions can use this to bridge push-capable MCP servers (e.g. peer messaging) into session behavior by injecting a mid-turn steer via pi.sendMessage / pi.sendUserMessage.

Removed

• Removed the dangling MCPManager.setOnNotification single-slot setter, which had no callers in the runtime. Replaced by MCPManager.addNotificationListener — multi-listener, per-listener error isolation, returns an unsubscribe function.

@oh-my-pi/collab-web

Fixed

• Fixed an issue where the agent would stop silently without a message by ensuring terminal auto-retry failures are properly surfaced as error notices.

@oh-my-pi/hashline

Breaking Changes

• Removed DEL, DEL.BLK, COPY, and COPY.BLK from the patch language. Use CUT / CUT.BLK for deletion; a cut does not require a following PASTE and leaves the removed content available to later pastes.

Added

• Added clipboard ops: CUT N.=M captures lines into a register (and deletes them), CUT.BLK N captures tree-sitter blocks, and PASTE.PRE|POST N / PASTE.HEAD|TAIL / PASTE.BLK.POST N insert the captured lines without retyping. The register flows top-to-bottom across sections, so content moves between files in one patch; PASTE does not consume it and the last capture wins.
• Added PatcherOptions.clipboard for a host-owned register that persists across Patcher.apply batches. Batches work on a fork (forkClipboard) published per landed section (commitClipboard), so failed batches never poison the register and a mid-batch write failure still preserves content already cut from disk.
• Added clipboard safety guards: a PASTE with an empty register, a capture overwriting un-pasted CUT content, and clipboard ops in same-path sections interleaved across another file's section are all rejected with targeted diagnostics. CUT ranges participate in overlap validation, the seen-lines guard, and drift recovery (every captured line must remap).

Changed

• Simplified grammar.lark around shared target and position shapes, collapsing the concrete and block CUT forms plus the INS / PASTE position variants into their common grammar rules.

Fixed

• Prevented CPU and memory exhaustion in streaming previews by rejecting line anchors above Number.MAX_SAFE_INTEGER and ranges spanning more than 100,000 lines.
• Fixed an issue where recorded snapshot tags desynced from disk when the filesystem transformed content on write (e.g., auto-formatting on save), which previously caused subsequent edits to incorrectly reformat unrelated parts of the file. Patcher.commit now correctly keys the returned file hash and snapshot on the actual content written to disk and issues a warning when a drift is detected.

@oh-my-pi/pi-natives

Changed

• Split the native voice engine (miniaudio capture/playback, WebRTC peer, Opus media) out of the pi-natives addon crate into a napi-free pi-voice rlib. The addon keeps thin #[napi] adapters, so the JS API is unchanged; the webrtc/opus/miniaudio dependency graph now compiles once into the library and no longer rebuilds with the addon leaf (which recompiles every release via its version-sentinel edit).
• Release binaries now build in parallel with the test fan-out; npm leaf publishing moved to a dedicated post-validation job (release_native_leaves), and darwin release bazel caches are pre-warmed on native-affecting main pushes — cutting release wall time from the previous serialized tests → cold darwin build pipeline.

@oh-my-pi/pi-tui

Added

• Added response-level OSC 11 appearance subscriptions to help terminal consumers distinguish confirmed unchanged background classifications from missing replies.

Fixed

• Fixed native Windows terminal panes freezing their host during forced closure by skipping the stdout-drain wait after ConPTY disconnects.
• Fixed high CPU usage in the Loader spinner during idle waits by optimizing text wrapping and caching during frame updates.
• Fixed hash-prefixed UUIDs in prose being misclassified as 8-digit CSS colors and receiving spurious swatches.
• Fixed unbounded memory growth and potential host freezes when a PTY consumer stalls by capping the pending stdout backlog and treating undrained consumers as a disconnect.

What's Changed

• feat(coding-agent): autocomplete MCP server names in /mcp subcommands by @Mathews-Tom in #6454
• fix(tui): bound stdout backlog when the pty consumer stalls by @roboomp in #6856
• fix(coding-agent): scope Advisor cost to the active session by @paolomazzitti in #6883
• docs: clarify ttsr edit/write matcherDigest is introduced lines by @roboomp in #6886
• fix(ttsr): flag text-source inference for unlisted file extensions by @roboomp in #6888
• fix: forward parseArgs and CONFIG_DIR_NAME from the legacy pi shim by @Gy-Hu in #6907
• feat(mcp): expose server-initiated notifications to extensions via mcp_notification event by @asteriskSF in #6535
• feat(ai): add xAI API key login by @paralin in #6647
• feat(coding-agent): add opt-in max ceiling for auto thinking by @everton-dgn in #6680
• feat: add opt-in Codex reset fireworks by @joshrzemien in #6858
• feat(coding-agent): allow checkpoint/rewind/learn/manage_skill in subagents when explicitly requested by @szavadsky in #6938
• feat(extensions): expose session async job snapshots by @usr-bin-roygbiv in #6939
• feat(tools): add a browser.cdpUrl setting for the default automation target by @terrxo in #7007
• fix(ai): bound Anthropic retry-after waits by @metaphorics in #7028
• feat(rpc): expose live fast-mode control and token throughput by @fredluz in #7036
• Umans usage provider by @hpost in #4484
• feat(ai): add Exa API key login by @will-bogusz in #6652

New Contributors

• @Gy-Hu made their first contribution in #6907
• @asteriskSF made their first contribution in #6535
• @joshrzemien made their first contribution in #6858
• @szavadsky made their first contribution in #6938
• @terrxo made their first contribution in #7007
• @fredluz made their first contribution in #7036
• @hpost made their first contribution in #4484

Full Changelog: v17.1.8...v17.2.0

@oh-my-pi/pi-agent-core

Fixed

• Fixed proxy-stream clients dropping finalized provider-only content blocks, including Anthropic native web-search history, by allowing done and error events to carry terminal assistant content while retaining delta-reconstructed content from older proxy servers that omit it (#6703).

@oh-my-pi/pi-ai

Fixed

• Fixed OpenAI Responses replay treating a tool output as paired with a matching call that appeared later in the input, or a tool call as paired with an earlier output. Pair repair now respects wire order before preserving or synthesizing each side.
• Fixed adaptive-thinking Anthropic models omitting the interleaved-thinking beta on signature-enforcing proxies, which caused persisted interleaved assistant turns to fail on replay (#6717).
• Kimi Code now sends its session-stable prompt cache key on both supported transports: prompt_cache_key for OpenAI-compatible requests and metadata.user_id for Anthropic-compatible requests. Explicit keys survive side-channel session IDs, while cacheRetention: "none" still disables automatic affinity (#6049).
• Fresh encrypted auth-broker snapshot caches are revalidated within a short startup budget, so one-shot clients see newly imported or revoked credentials immediately when the broker is reachable while retaining cache fallback for transport and server failures.
• Fixed custom anthropic-messages endpoints dropping native web-search call/result blocks in the leaked-thinking wrapper, preserving signed continuation history in source order without carrying a preceding text signature onto later unsigned blocks (#6703).

@oh-my-pi/pi-catalog

Fixed

• Fixed Kimi Code (kimi-code) reporting maxTokens: 32000 for every model — its /coding/v1/models discovery mapper and the bundled catalog applied a blanket constant, truncating k3/k3-256k output at ~4x below their real 131072 ceiling and kimi-for-coding/kimi-for-coding-highspeed below their 32768 ceiling. Output caps are now derived per family, and the model cache is invalidated so upgrades drop the stale maxTokens: 32000 rows (including the discovery-only k3-256k) instead of serving them until the next network refresh (#6711).
• Fixed Anthropic model discovery 404ing when the registry derived the provider base URL from a bundled model without the /v1 suffix (https://api.anthropic.com/models instead of /v1/models), which let a stale text-only cache row shadow fresh models.dev vision metadata — surfacing as snapcompact refusing to run on claude-opus-5. Discovery now always targets /v1/models while model rows keep the provider base URL (#6563).

@oh-my-pi/pi-coding-agent

Added

• Added a configurable per-request timeout for the inspect_image tool (inspect_image.timeoutMs, default 5 minutes; set to 0 to disable) so a stalled vision-model provider fails fast with a clear error instead of blocking until manual abort (#4165).

Changed

• Reduced default startup resident memory by constructing the default-off ComputerTool ArkType schema only on first parameter access, then reusing it across tool instances without changing validation or tool behavior (#6742 by @usr-bin-roygbiv).
• Reduced startup CPU and memory by loading the bundled changelog only when needed, while preserving source, npm bundle, standalone binary, and native absolute-path fallback resolution.
• Moved PTY log replay into the shared project launch broker, so normal CLI and Hub startup no longer load the xterm runtime while launch logs return validated rendered terminal rows.

Fixed

• Fixed DeepSeek V4 Flash and Step 3.7 Flash models using hashline edit mode by default despite repeatedly misreading its range grammar; both now use the simpler replace-mode fallback unless explicitly overridden (#6671).
• Fixed an Ask form appearing while the main prompt contains a draft hiding that text and consuming the next in-flight keystroke. The draft now remains visible and keeps receiving input until it is submitted or cleared; only then do form controls activate (#6737).
• Fixed glob rejecting safe memory://root/<directory>/** patterns. Memory globs now resolve their directory prefix inside the project memory root while rejecting traversal and percent-encoded path separators across the complete glob path.
• Fixed omp --resume <id> prompting to fork sessions from another existing directory instead of switching the process and cwd-scoped settings into the resumed session's recorded directory (#6752).
• Fixed deferred CLI model roles resolving ambiguous bare model IDs to a preferred but unauthenticated provider instead of the authenticated provider selected by the eager path (#6727).
• Fixed Windows sessions crashing with an unhandled EPIPE: broken pipe, write when an LSP server closed its stdin between filesystem mutations; LSP writes now observe asynchronous FileSink.write() failures and route them through the existing request/notification failure path.
• Fixed the bash tool's stat builtin failing on native Windows with stat: unsupported on this platform (exit 1) for every invocation. The vendored uu-stat now ships a Windows-native backend that maps the GNU format directives onto std::fs::Metadata, the windows_by_handle metadata extensions (inode, hard-link count, and device via GetFileInformationByHandle), and the Win32 volume APIs for --file-system mode; Unix behavior is unchanged (#6723).
• Fixed auto-retry wedging the session after an assistant-tail removal miss: when a context rebuild recreated the failed turn's message object, the identity-keyed cleanup logged assistant removal missed but the retry still scheduled continue(), which rejected the terminal assistant error message locally (Cannot continue from message role: assistant) before any provider request — auto_retry_end never fired, the TUI kept showing retry progress, and the in-flight prompt() hung until a manual follow-up. The retry path now strips a still-failed assistant tail positionally after the backoff, and a continuation that still fails locally closes the retry saga with a failed auto_retry_end (#5382).
• Fixed native Anthropic web-search history being recursively truncated during session persistence or retained under a different user turn, preserving opaque replay bytes across reload and stripping them on reparent (#6703).
• Fixed malformed or temporarily unreadable config.yml files being treated as empty settings and then overwritten by the next setting change, which could permanently erase broker tokens, model roles, and provider configuration. Invalid YAML is now moved to a timestamped .broken-* backup, read failures abort without touching the source, pending changes remain retryable with the last successfully loaded settings, atomic writes preserve symlink targets and handle Windows EPERM replacement, concurrent startup failures are fully observed and quarantine races fail closed, and omp config set/reset waits for persistence before reporting success.
• Fixed mounted MCP tools being hard to invoke when server or plugin guidance names their original calls: sessions now include one bounded, exact original-name-to-xd:// route map for every live mounted MCP tool—including servers without initialize instructions—and refresh it as catalogs change without disabling schema virtualization.
• Fixed inspect_image blocking indefinitely when the vision-model API stalls by combining the caller's abort signal with an AbortSignal.timeout() and surfacing a distinct timeout ToolError (separate from user-triggered abort) (#4165).
• Fixed MiMo models using hashline edit mode by default despite needing the same replace-mode fallback as Kimi. (#3772)
• Fixed omp refusing to start on Windows when no bash.exe is discoverable — most visibly with scoop-installed Git, whose manifest shims sh.exe/git.exe but never bash.exe, so PATH lookup missed it. Startup threw No bash shell found while merely building the bash tool description, even though bash tool commands always execute in the embedded brush-core shell and need no host bash. Shell discovery now also checks GIT_INSTALL_ROOT, scoop and per-user Git for Windows install roots, and sh.exe on PATH, then falls back to cmd.exe for the spawn-only paths (interactive PTY, ACP client terminals) instead of failing; the cmd fallback is never used to wrap user-shell commands — brush runs the POSIX line directly.
• Added a selectable voice setting for /live realtime sessions (#6566).

@oh-my-pi/hashline

Changed

• Improved reversed-range and invalid block-anchor diagnostics with absolute endpoint corrections plus nearby syntactic opener suggestions, without auto-applying the suggested edit (#6671).
• Accepted a single dot between integer range endpoints, such as DEL 235.258, as an unambiguous range separator (#6671).

@oh-my-pi/pi-natives

Fixed

• Fixed the native sort builtin panicking with SendError(..) at chunks.rs:248 when the chunk-channel receiver disconnected early (e.g. a consumer thread stopping after an error or closed output); the reader now stops gracefully instead of unwrapping the failed send, and a panicking external-sort worker thread is surfaced as an error instead of silently emitting truncated output (#6736).

@oh-my-pi/snapcompact

Fixed

• Fixed snapcompact resume guides reporting only the HQ grid width for mixed-width foveated archives (#6712).

@oh-my-pi/pi-utils

Fixed

• getShellConfig no longer throws No bash shell found on Windows hosts without a discoverable bash. resolveWindowsShell searches Git for Windows install roots (machine, per-user, GIT_INSTALL_ROOT, scoop app dirs — scoop shims sh.exe/git.exe but never bash.exe), then bash.exe/sh.exe on PATH, and finally falls back to cmd.exe from ComSpec with /c args, so shell resolution always succeeds.

What's Changed

• fix(ai): avoid OAuth barrel import cycle by @usr-bin-roygbiv in #6645
• fix(mcp): map mounted tools to xd routes by @jeffscottward in #6670
• fix(ai): preserve custom Anthropic web-search history by @roboomp in #6706
• fix(catalog): derive kimi-code output caps per family by @roboomp in #6713
• fix(snapcompact): report all foveated frame widths by @roboomp in #6714
• fix(ai): send interleaved beta through signing proxies by @roboomp in #6718
• fix(coding-agent): handle asynchronous LSP pipe failures by @shoucandanghehe in #6719
• fix(ai): preserve Kimi Code cache affinity by @usr-bin-roygbiv in #6721
• fix(auth-broker): revalidate fresh snapshot caches by @Git-on-my-level in #6722
• fix(shell): implement native Windows stat builtin by @roboomp in #6725
• fix(coding-agent): prevented invalid configs from being overwritten by @Ant39140 in #6726
• fix(coding-agent): prefer auth in deferred model resolution by @roboomp in #6728
• fix(coding-agent): safely glob memory directories by @usr-bin-roygbiv in #6733
• fix(ai): respect Responses replay pair order by @usr-bin-roygbiv in #6735
• fix(tui): preserve prompt input while ask opens by @roboomp in #6738
• perf(coding-agent): lazily construct computer schema by @usr-bin-roygbiv in #6742
• perf(coding-agent): avoid unused compact tool metadata by @usr-bin-roygbiv in #6743
• perf(ai): lazily construct auth broker wire schemas by @usr-bin-roygbiv in #6744
• perf: lazily construct models config schema by @usr-bin-roygbiv in #6745
• perf(catalog): lazily materialize provider models by @usr-bin-roygbiv in #6746
• perf(coding-agent): replace legacy Babel traversal by @usr-bin-roygbiv in #6747
• perf(launch): isolate PTY replay in broker by @usr-bin-roygbiv in #6748
• perf(coding-agent): load changelog asset on demand by @usr-bin-roygbiv in #6749
• fix(cli): resume cross-directory sessions in place by @roboomp in #6753
• fix(agent): exclude MiMo and DeepSeek from hashline edits by @roboomp in #3773
• fix(inspect-image): bounded per-request timeout on the vision-model call by @roboomp in #4168
• feat(live): add selectable voice setting by @roboomp in #6724
• fix(natives): stopped sort panicking on disconnected receiver by @roboomp in #6760

New Contributors

• @Git-on-my-level made their first contribution in #6722

Full Changelog: v17.1.4...v17.1.5

@oh-my-pi/pi-agent-core

Changed

• Steering is now woken by an event instead of polled on a fixed interval while a tool batch runs. AgentLoopConfig.waitForSteeringMessages resolves when a steer is enqueued, so an interruption is observed as soon as it arrives rather than at the next tick, and idle batches stop burning wakeups. The interval timer remains for the IRC interrupt queue, which has no wake callback, and checks only IRC while the event watcher owns steering. Waits are raced against local abort, so a callback that does not observe its signal cannot hang batch teardown.

Fixed

• Fixed a Cursor tool result being lost when a custom cursorOnToolResult transformer was still pending as the turn closed. The provider dispatches decoded messages without awaiting them, so a message_end from the same chunk could drain the buffer before the transformer resolved, dropping the result and leaving its toolCall block to be stripped as dangling on replay. The entry is now reserved synchronously and patched in place once the transformer resolves, preserving buffer order.
• Fixed an async cursorOnToolResult transformer's rewrite being silently discarded when it resolved after the buffer drain. The reservation kept the call from dangling but the late patch mutated a detached entry, so the already-persisted message kept the pre-transform payload. The drain now awaits any transformer still in flight before persisting, matching the awaited exec-channel paths. A rejecting transformer is swallowed and the reserved payload stands in, so a failing hook cannot take the turn down or cost the result.
• Fixed Cursor tool results being dropped for hosts that pass neither cursorExecHandlers nor cursorOnToolResult. Both are optional, but the Cursor provider resolves native todo calls server-side and synthesizes exec blocks regardless, marking both as resolved so no placeholder result is emitted for them. The result buffer callback was only installed when one of the options was present, so a bare SDK host discarded the provider's paired result and every rebuilt transcript stripped the interaction. It is now installed unconditionally.
• Fixed an async cursorOnToolResult rewrite being lost when the provider errored mid-transform. The normal drain waits for a pending transformer, but the error path snapshotted the buffer without that await, so a transform still in flight patched an entry the catch path had already detached and the pre-transform payload was persisted. A provider error is exactly when a transform is most likely to be mid-flight.
• Reduced oversized OpenAI native compaction requests by replacing only trailing tool-output bodies that exceed the model context window, while preserving calls, assistant history, and reasoning.

@oh-my-pi/pi-ai

Added

• MiniMax Token Plan accounts now report quota in omp usage. GET /v1/token_plan/remains returns one bucket per plan quota, each carrying a rolling interval window and a weekly window, so minimax-code surfaces real remaining percentages instead of an empty report. A model the plan does not include comes back looking like an untouched quota; those buckets are dropped from the report and named in its metadata. The mainland id minimax-code-cn is untouched.
• OAuth logins now stamp authorizedAt (epoch ms of the interactive login) on the stored credential, and every refresh-persist path preserves it. Anthropic expires the whole OAuth grant family ~30 days after authorization regardless of refresh-token rotation (observed as invalid_grant: "Refresh token expired" on the latest rotated token, exactly 30 days after login, across four production accounts), so the login anchor is what makes re-login deadlines computable. Exported ANTHROPIC_OAUTH_GRANT_TTL_MS alongside the anthropic OAuth flow.
• Added GET /v1/credentials/disabled to the auth broker and AuthBrokerClient.listDisabledCredentials: disabled-credential tombstones (DisabledCredentialSummary — identity, verbatim disable cause, disable timestamp; never token material) so auto-disabled accounts stay visible to clients instead of silently vanishing from the snapshot. AuthStorage.listDisabledCredentials serves the same data locally from SQLite; clients of brokers predating the endpoint get an empty list (404 mapped, no error).
• Added AuthStorage.revalidateCredentials() and the optional AuthCredentialStore.refreshSnapshot hook: remote broker stores re-fetch GET /v1/snapshot on demand so callers pairing live per-credential data with stored identities (omp usage) never render against the up-to-an-hour-stale disk-cached snapshot; local SQLite stores are always current and only reload.
• Added an optional per-request codexSseMaxAttempts stream option to bound Codex SSE pre-response retries while preserving the six-attempt default when omitted.
• Fixed Cursor requests failing with Connect error internal: Unable to parse image: ... whenever the session history contained an image: rootPromptMessagesJson image parts now embed a data:<mime>;base64, URI instead of bare base64, matching the convention used by the OpenAI-completions provider (#6564).

Fixed

• Fixed OpenAI Responses native history replay sending output-only status fields back as input, preventing input[N].status failures in long-running sessions. (#6513 by @Ant39140)
• Cursor no longer discards a local tool result when the transport fails mid-execution. The provider waits for in-flight exec dispatches before pushing done, but the error path skipped that wait, so a handler decoded from the last chunk landed its result after the Agent had already finalized the call from the terminal error and cleared its buffer — losing the real outcome of a tool that may already have run side effects. Both exits now drain the same barrier.
• Cursor exec handlers returning the bare-result form no longer record a failed call as successful. When an SDK handler returns only a protocol result (no paired toolResult), the synthesized transcript entry was always "Tool produced no transcript result" with isError: false, even for a rejected or error result — so Cursor saw a failure while the rebuilt transcript showed success. The synthesized entry now derives its state and message from the result's own oneof variant — including MCP, where an application-level tool failure rides inside the success variant as is_error rather than as a separate variant.
• Fixed Cursor models silently failing to maintain the todo list. Cursor resolves its native update_todos/read_todos tools server-side, but the bridge looked for them under flattened updateTodosToolCall/readTodosToolCall properties, which a decoded agent.v1.ToolCall never has — the variant only arrives through the tool oneof — so no native todo call was ever recognized. The synthesized todo tool call was also emitted as locally runnable with a {todos} payload the local tool's schema rejects, so any update that did surface ended as a validation error and local todo state never followed Cursor's. Todo calls are now read from the oneof, both native todo blocks are marked as already-resolved, and local state is mirrored from the server's confirmed success snapshot (leaving state untouched on UpdateTodosError). TODO_STATUS_CANCELLED now maps to abandoned instead of reverting the task to pending.
• Hardened Cursor todo mirroring against partial read_todos responses: a read narrowed by status_filter/id_filter, or one returning fewer rows than the server's own total_count, is a subset rather than the list, and is no longer treated as authoritative. Previously such a response would have deleted every task it omitted.
• Fixed an empty update_todos response whose total_count is nonzero being mirrored as an authoritative clear, deleting every local task at once. The count-mismatch guard skipped empty responses entirely; only a matching zero count is a genuine clear now. An empty read_todos stays refused outright, since proto3 decodes an unset total_count as 0 and it cannot be told apart from a filtered read that matched nothing.
• Fixed a Cursor todo call being left unpaired when the completion frame carried no tool_call at all. ToolCallCompletedUpdate.tool_call is optional, but the block was already marked as server-resolved by the started frame, so nothing emitted a placeholder for it and every transcript rebuild stripped the interaction. It now settles as "nothing to mirror", the same as a refused snapshot.
• Fixed local Cursor exec calls (read/write/grep/delete/bash/lsp/MCP) vanishing from rebuilt transcripts when the tool produced no result. The assistant block is synthesized and marked server-resolved before the handler runs, so the three result-less paths — no handler installed, a handler returning nothing, and a thrown handler — left the call unpaired. Each now pairs a result carrying the same text the server receives.
• Fixed Cursor MCP tool calls being unrecognized on the wire. ToolCall.tool is a protobuf oneof, so a decoded message exposes the variant as { case, value } and never as a flat mcpToolCall property — the same trap that made native todo calls invisible while hand-shaped fixtures kept passing. Both the streamed start and the completion arg merge now go through a shared selector.
• Fixed a streamed Cursor MCP block being named from name while its paired result used toolName, so the two disagreed whenever the server sent different values. Both now prefer toolName.
• Fixed the Cursor stream emitting done while a tool handler decoded from the final chunk was still running. Server messages are dispatched fire-and-forget so the socket keeps draining, but nothing waited for them: when an exec request, turnEnded and the stream close arrived in one chunk, the turn finished before the handler produced its result, and the result missed the buffer drain that pairs it with its call. In-flight dispatches are now awaited after the transport completes.
• Fixed a server-resolved Cursor todo call leaving its transcript block stuck pending: the synthetic completion was emitted under a freshly generated id instead of the streamed call id the interactive transcript filed the block under, so the card animated indefinitely. The settled call id is now handed to the sync handler.
• Fixed server-resolved Cursor todo blocks disappearing from rebuilt transcripts: nothing produced a toolResult for them, and buildSessionContext strips any toolCall left unpaired, so the interaction vanished on reload, branch switch, or transcript rebuild. The result the host builds is now persisted verbatim — it carries the details.phases the todo renderer rebuilds the list from, which a summary-only result would have replayed as 0 tasks.
• Fixed a refused or failed Cursor todo call leaving its card animating forever. Only a successful snapshot settled the block, so a read_todos narrowed by a filter and a server UpdateTodosError both went unanswered — no tool_execution_end, and no toolResult to keep the block from being stripped on rebuild. Every completed native todo call now settles. A server error is carried through as a failed result rather than collapsed into the benign "nothing to mirror" case, which would have replayed the failure as a success.
• Hardened Cursor todo mirroring against snapshots whose rows collide on content. Cursor's wire model identifies todos by id and can represent two rows sharing the same text; the local list is keyed by content alone and the todo tool rejects a duplicate outright, so importing such a pair would leave every task-targeted done/drop/rm resolving to the first row and the second unreachable. The snapshot is now refused like any other that cannot be represented locally — local state is left untouched and the call still settles as a no-op.
• Hardened Cursor todo mirroring against ambiguous empty read_todos responses. total_count is a proto3 scalar, so an unset field decodes as 0 and is indistinguishable from a genuinely empty list; accepting todos=[] + total_count=0 would clear every local task. Empty and mismatched reads are now refused — update_todos remains the authoritative clear path.
• Fixed refused Cursor todo results claiming "No todo changes". A server-accepted update_todos can still be declined locally (content collision, etc.), so the persisted fallback now reads "Todo snapshot not mirrored" instead of implying the remote call changed nothing.
• Hardened Cursor todo mirroring against snapshots carrying unresolved TodoItem.dependencies. The wire model blocks a row behind other rows by id; the local list has no ids and no edges, so an imported dependent row files as plain pending and nextActionableTask then offers work the server considers blocked. Snapshots with an edge pointing at a row that is not yet completed/abandoned are now refused like any other that cannot be represented locally. Edges whose blockers already finished constrain nothing and still mirror.
• Extended the Cursor todo total_count mismatch guard to update_todos. A partial or size-limited merge response is as incomplete as a filtered read, but the check only applied to reads, so an update returning fewer rows than its own count was mirrored as the full list and deleted every task it omitted. An empty update still syncs — it remains the authoritative clear path, unlike an ambiguous empty read.
• Hardened Cursor todo mirroring against rows with empty content. content is a proto3 string, so a missing or default value arrives as ""; the local list is keyed by content and rejects a falsy one before lookup, leaving the imported row unreachable to every task-targeted done/drop/rm. Such snapshots are now refused like any other that cannot be represented locally.
• Fixed a deterministic circular-import TDZ that crashed packages/catalog's test process with ReferenceError: Cannot access 'claudeCodeVersion' before initialization: registry/oauth/anthropic.ts imported claudeCodeVersion from providers/anthropic.ts, which transitively pulls the registry back in (providers/anthropic → stream → registry → registry/oauth/anthropic), so the module-level claude-code/${claudeCodeVersion} bootstrap user-agent const read the binding while providers/anthropic.ts was still mid-initialization. claudeCodeVersion now lives in a zero-import leaf module (providers/claude-code-fingerprint.ts) that providers/anthropic.ts, registry/oauth/anthropic.ts, and usage/claude.ts all import from, removing the cycle at the source rather than deferring the read.
• Fixed a circular initialization between the Anthropic provider and OAuth registry that could throw before claudeCodeVersion was initialized when package tests or consumers loaded modules in parallel (#6628 by @anatoli-tsinovoy).
• Stopped the account-level Codex rate_limit.limit_reached flag from being applied to individual chat windows. Codex reports one shared flag for the whole account, so a window with real headroom was marked exhausted because a different window (or a separate metered feature) was at its limit, which over-blocked sibling accounts during credential selection. Each window's status now reflects only its own usage
• Scoped Codex reactive backoff per meter: a usage_limit_reached from a Spark request no longer persists a block that ordinary chat requests honour, and the reverse. Blocks written before scoping used a shared scope meaning "block everything", so requests still honour it and reconciliation still heals it
• Implemented scopeLimits for the Codex ranking strategy so a request gates only on the windows it actually consumes: -spark models spend the Spark meter and every other model spends the 5h/weekly chat windows, instead of OR-ing every window and meter into one provider-wide block
• Fixed native Anthropic adaptive-only models (Opus 4.6+, Sonnet 4.6+, Fable/Mythos 5) keeping thinking ON when reasoning was meant to be off. mapOptionsForApi never consulted disableReasoning on the Anthropic branch, so a caller-side disable left adaptive thinking at full effort; and disableThinkingIfToolChoiceForced deleted output_config.effort alongside thinking, which for adaptive-only models silently re-enabled adaptive thinking (a bare omission defaults to adaptive-ON). Both paths now omit thinking and pin the lowest adaptive effort, so disableReasoning and forced tool_choice turns (e.g. the delivery reviewer's report_delivery) actually suppress reasoning instead of returning a thinking block with end_turn (#6589).
• Fixed Bedrock Converse dropping captured Claude thinking signatures when replaying application-inference-profile ARN models, restoring adaptive-thinking multi-turn conversations (#6610).
• Fixed the alibaba-token-plan login only supporting the international Singapore endpoint, which rejected China (Beijing) Token Plan sk-sp- keys with 401 invalid_api_key. Login now selects a region (International / China (Beijing) / Custom), validates the key against that region's /models endpoint, and stores the chosen base URL in the credential so inference and discovery both target it (#6682).
• Fixed statusless provider capacity errors such as no_capacity and high-demand responses being treated as terminal instead of retryable. (#6503)
• Fixed QwenCloud Token Plan quota reporting to call the current console usage RPC and document how to capture its optional Cookie during login.
• Fixed Cursor exec-channel MCP calls such as web_search omitting toolCall blocks when no interaction block arrives, which rendered their tool cards below the final assistant answer or dropped them on transcript replay. (#6501)
• Fixed Claude scoped weekly limits (e.g. Claude 7 Day (Fable)) with is_active: false being dropped by the /usage parser, rendering as not reported in omp usage despite carrying real utilization. Live payloads mark only the currently binding limit active — an account pinned at a 100% Fable cap reports its 77% shared weekly row as inactive too — so is_active signals severity ranking, not bucket existence, and is now ignored. Exhaustion gating is unchanged: tier rows still hard-block only at confirmed 100% with a future reset.
• Fixed a TDZ crash (Cannot access 'claudeCodeVersion' before initialization) when providers/anthropic was the first module loaded: providers/anthropic → stream → registry → registry/oauth/anthropic circled back into the still-initializing provider module. The Claude Code fingerprint constants now live in the leaf module providers/claude-code-fingerprint (star re-exported from providers/anthropic, so import paths are unchanged).

@oh-my-pi/pi-catalog

Added

• Added Claude Opus 5 model entries for Amazon Bedrock: anthropic.claude-opus-5 plus its us., eu., au., and global. regional/geo IDs.

Fixed

• Fixed alibaba-token-plan locking out China (Beijing) 百炼 Token Plan subscribers: the provider hardcoded the international Singapore endpoint, so Beijing-issued sk-sp- keys got 401 invalid_api_key. The wire credential now carries an optional region base URL, and model discovery targets the credential's region (#6682).
• Fixed forced tool_choice 400s (tool_choice 'specified' is incompatible with thinking enabled) on Kimi Code's Anthropic-compatible endpoint for the kimi-for-coding, kimi-for-coding-highspeed, and k3 aliases: the Anthropic-surface compat matcher only recognised Moonshot's native kimi-k2.7-code* ids, so thinking-locked kimi-code models kept supportsForcedToolChoice: true and the forced selector was sent to a host that always thinks. These models now resolve requiresThinkingEnabled, keeping thinking on and downgrading forced choices to auto.
• Retried empty successful provider discovery responses after the short non-authoritative interval instead of caching them for the full catalog TTL (#6620).
• Fixed GitHub Copilot Claude models with no bundled catalog reference (e.g. a freshly served claude-opus-5) discovering with reasoning: false/thinking: null and no effort dial, and disappearing along with their synthesized -1m sibling on offline reads: reference-less Copilot models on the anthropic-messages proxy now derive the adaptive reasoning ladder from the model id, and the cache restores their compile-time COPILOT_API_HEADERS by value instead of dropping them as unrestorable (#6664).

@oh-my-pi/pi-coding-agent

Added

• omp usage now surfaces auto-disabled credentials as red ✗ tombstone rows (identity, how long ago, the shortened upstream cause — e.g. Refresh token expired — and a re-login hint), including a provider section when no active credential remains. User-driven tombstones (replaced by newer credential, deleted by user) and API-key rows stay hidden. Requires a broker with GET /v1/credentials/disabled; older brokers degrade to no tombstone rows.
• omp usage warns about Anthropic's ~30-day OAuth grant lifetime: accounts whose interactive login (authorizedAt) is within a week of the deadline get a yellow ⚠ re-login within <time> line, and past-deadline accounts a red one. Grants die server-side exactly ~30 days after login regardless of refresh rotation, so this is the only warning before the broker auto-disables the row.

Changed

• Enabled Computer Use sessions now state the desktop-routing contract in the compact system prompt, retain their controller across model switches, expose effective native/function routing through /computer status, and emit structured lifecycle diagnostics without logging captured content.

Fixed

• Fixed omp refusing to start on Windows when no bash.exe is discoverable — most visibly with scoop-installed Git, whose manifest shims sh.exe/git.exe but never bash.exe, so PATH lookup missed it. Startup threw No bash shell found while merely building the bash tool description, even though bash tool commands always execute in the embedded brush-core shell and need no host bash. Shell discovery now also checks GIT_INSTALL_ROOT, scoop and per-user Git for Windows install roots, and sh.exe on PATH, then falls back to cmd.exe for the spawn-only paths (interactive PTY, ACP client terminals) instead of failing; the cmd fallback is never used to wrap user-shell commands — brush runs the POSIX line directly.
• Fixed dragging an image whose path contains unescaped spaces (e.g. macOS screenshot names like Screenshot 2026-07-24 at 1.55.12 PM.png) into the terminal — the bracketed-paste image extraction route now has the same whole-text-as-path fallback as the clipboard keybind route, so both routes share identical detection and attach the image instead of inserting the raw path as literal text (#6578). The shared fallback only claims payloads that hold a single path: one carrying a second absolute-path anchor after unescaped whitespace (/tmp/a.png /tmp/b shot.png — dragging two files at once when either name has spaces) now pastes as text on both routes instead of being fused into one unresolvable path, which on the clipboard route previously attached nothing and swallowed the text behind an "Image not found" status.
• Fixed transient reasonless request aborts that arrived after a tool call finished streaming ending the turn instead of entering recovery, which left edit calls and task subagents dead until the user manually resumed. The session now continues from the synthetic unexecuted tool result under the normal retry policy without replaying completed side effects (#6668).
• Fixed prewalk silently dropping a same-model hand-off that only lowers the thinking level: the arm/switch guard compared model identity alone and discarded the resolved thinkingLevel, so a legal effort-downgrade target (e.g. prewalk: "@task" resolving to the same model at a cheaper effort) never applied and the session paid the plan/continue nudges for nothing. Prewalk now compares (provider, id, effective thinking level), applies effort-only hand-offs, and emits a notice on a genuine no-op instead of returning silently (#6659).
• Fixed @czottmann/pi-automode failing legacy extension validation because the pi-ai compatibility shim omitted clampThinkingLevel, then failing every classified tool call because ctx.modelRegistry omitted getApiKeyAndHeaders. (#6648)
• Fixed hide-secrets placeholders conflicting with hashline edit headers by replacing hash-delimited tokens with the unambiguous $$HASH$$ format (#6631).
• Fixed the advisor silently swallowing its own quarantined turns: when an advisor called an ungranted tool (e.g. bash) its whole turn was discarded before dispatch, so its advice never reached the primary agent and the failure surfaced only in advisor diagnostics — every other non-recovering failure branch notifies the host UI, but quarantine re-primed silently with no bound. A persistently-quarantining advisor now surfaces a notifyFailure warning in the main UI (deduped, cleared on the next successful turn) and stops the unbounded silent re-prime loop (#6661).
• Fixed the Docker natives-builder stage failing to build releases ≥ 17.1.1: the native audio stack added bindgen (miniaudio needs libclang) and a bundled-opus CMake build (needs cmake + make), none of which were installed in the slim builder image.
• Fixed a configured modelRoles.default naming an extension-registered model (listed in enabledModels) silently running on a different in-scope provider's model. The startup model scope is resolved before extensions call registerProvider(), so the default role dropped out of scope and buildSessionOptions pinned options.model to the first scoped model — which marked the model "explicit" and suppressed the post-extension default-role re-resolution. A configured default that can't be found in the startup scope is now deferred so it re-resolves against the fully registered, still enabledModels-scoped catalog once extensions load (#6694).
• Fixed Parakeet speech-to-text failing to load sherpa-onnx-node from Windows source workspaces when Bun installed the wrapper under packages/coding-agent/node_modules but hoisted its native platform package to the repository root (#6690).
• Fixed omp usage duplicating org-less legacy accounts as "no usage data" rows whenever any sibling report carried an organization (mixed pools of pre-org-capture rows and fresh org-scoped logins): an org-less account is now covered by its own org-less report, while org-attributed sibling reports still never count as its coverage.
• omp usage revalidates the broker credential snapshot before rendering: live usage reports were previously paired with a disk-cached account list up to an hour old, so a just-completed re-login (org-less row upserted to org-scoped) rendered as a phantom duplicate until the cache expired.
• Fixed Advisor requests reaching Anthropic-compatible endpoints without a provider-facing session identity: the separately constructed advisor Agent never had a metadata resolver installed, so its outbound requests omitted the metadata.user_id session id that the main and subagent agents carry. Each advisor now emits its own advisorProviderSessionId via metadata.user_id, resolved live so a token refresh surfaces the current account_uuid, giving Main, subagent, and Advisor traffic distinct, stable session ids for proxy routing and attribution (#6625).
• Todo progress now stays in sync when using Cursor models: the Cursor exec bridge mirrors the provider's server-owned todo list into session state, refreshes the interactive todo panel, and persists each snapshot to the session branch so the list survives reloads, rewinds, compaction, and session switches. Existing phase grouping is preserved for tasks the session already knows. Previously the list was in-memory only and the panel stayed stale, because Cursor resolves the todo tool remotely and never emits the local todo tool result that both paths key off.
• Cursor todo calls the server refuses or rejects no longer leave the todo card spinning: the bridge settles every completed native todo call, not just the ones carrying a list. Local phases and the session branch are left untouched in that case, and the settling result deliberately carries no details.phases — echoing the current list back would let a call that changed nothing overwrite live panel state.
• Fixed the todo renderer emitting mirrored label text verbatim. A Cursor snapshot carries provider-authored task content, phase names, and summary text, and the renderer interpolated all of it straight into terminal output, so a label holding ANSI/C0 sequences rewrote the terminal every time the list rendered or replayed. Every display path now goes through one sanitize-and-flatten-tabs helper — task labels, blocker notes, phase headers, the zero-task fallback, and the streaming call preview — while the raw values stay untouched as the lookup keys they are.
• Fixed a server-resolved Cursor todo card animating for the rest of the session when the server packed the call's start and completion into one HTTP/2 chunk. The bridge's tool_execution_end is a synchronous callback fired mid-parse, while the streamed toolcall_start that creates the visible card is queued on the event stream and delivered a microtask later — the interactive controller handled the completion first, found no pending card, and dropped it, leaving the card that appeared moments later with nothing to settle it. An early completion is now held and attached the moment the streamed block creates its card, settling it without repeating the panel refresh or failure warning that already fired on first arrival. Card creation from cumulative message_update frames is also guarded by the turn's timeline map, so a call settled mid-stream can no longer be recreated as a second, permanently pending card by the next update re-listing the same block.
• Cursor todo failures no longer render unsanitized provider text into the status line. The bridge forwards the server's error string verbatim, so an ANSI escape or other C0/C1 control reached the terminal intact and could repaint outside the row, tabs punched holes in the single-line warning, and a long message overflowed it. The detail is now stripped of control sequences, collapsed, and truncated at the render boundary; the persisted result keeps the full-fidelity error for the transcript.
• Fixed disabling the Advisor from /settings updating the persisted setting without stopping the live Advisor runtime until the session restarted: SelectorController.handleSettingChange had no case for advisor.enabled, unlike other session-managed toggles (autoCompact, steeringMode, ...), so the change never reached session.setAdvisorEnabled.
• Fixed bash.patterns deny/prompt rules matching only against the whole command string, so a dangerous command in any non-leading position of a compound line (e.g. cd /tmp && rm -rf /tmp/x, sleep 1 & rm -rf /tmp/x) silently bypassed a deny rule and, under approvalMode: yolo, executed with no prompt. deny/prompt rules now also match each command segment, split with a shell-aware tokenizer that honors every command boundary (&&, ||, ;, |, single &, subshells, newlines) and quoting; allow rules still require the whole command to match and never apply to compound lines (#6695).
• Fixed omp config list printing credential settings in plain text. auth.broker.token, searxng.token, searxng.basicPassword and dev.autoqaPush.token were disclosed in both the human and --json output of a command that dumps every value without anyone asking for a specific credential. Credentials are now marked in the schema with a top-level credential flag, which also covers settings that have no settings-panel entry and so cannot use ui.secret. Human output shows dots; JSON omits value and marks the entry redacted rather than substituting a placeholder a consumer could write back. omp config get <path> is unchanged, since that is an explicit request for one value. The settings panel now derives masking from the same flag, so a credential cannot render as plain text on one surface and dots on the other. Only a credential that is actually set is redacted, so a fresh configuration still reports unset credentials as unset rather than implying every one of them is configured.
• Fixed /new, /drop, /fork, and /move crashing or doing unnecessary work when invoked during vibe mode; interactive session transitions now show the existing exit-vibe warning and leave the session unchanged, and reset loops disable themselves instead of resubmitting into that unchanged session (#6607).
• Fixed legacy pi extensions failing extension validation when importing estimateTokens from @earendil-works/pi-coding-agent (aliased to the legacy shim). Legacy pi re-exported estimateTokens from its coding-agent package root; in omp it lives in @oh-my-pi/pi-agent-core/compaction and the coding-agent barrel does not forward it, so the shim's export * from "../index" left it off the surface and a named import threw Bun's static "Export named 'estimateTokens' not found" error (e.g. omp plugin install pi-blackhole). The shim now re-exports it (#6583).
• Fixed plan approval presenting a completed plan instead of the newest draft when the submitted title did not match the draft filename (#6569).
• Fixed omp auth-gateway serve advertising only the compiled-in bundled catalog, so every model omp reaches through provider discovery (e.g. ids released after the build date) was invisible on /v1/models and returned Unknown model through /v1/chat/completions even though the same broker credential answered it in the TUI. The gateway now sources its catalog from ModelRegistry — the same component the TUI/CLI use (bundled + cached + discovered) — keeping the credential scoping and qualified/bare-id registration, and rebuilds it periodically so a long-lived serve tracks newly discovered models without a restart (#6615).
• Fixed screenshot-relative pointer actions missing their visible targets when image transports that cannot preserve original detail silently downscaled a large computer screenshot; affected transports now establish the native coordinate frame below the verified image-resize threshold without changing the public capture defaults for other models (#6596 by @wolfiesch).
• Corrected Windows shell resolution errors to identify the active global, project, overlay, or runtime source for shellPath, including profile and custom configuration directories, instead of directing every user to the retired settings.json file (#6579).
• Fixed debug (js-debug/pwa-node) stateful commands misrouting after launch: a lazily-attached [worker N] child session (or the threadless root launcher) would steal the active-session focus from the stopped script child, so threads listed only the worker thread, post-launch breakpoints read back as pending/unbound, and there was no way to step/continue/evaluate the script's thread. Focus now follows stops rather than registrations, and threads aggregates every live thread across the session tree (#6663).
• Fixed a turn-ending provider error being truncated to 8 lines in the transcript with no way to reveal the rest: AssistantMessageComponent now implements setExpanded, so Ctrl+O (tool-output expansion) reveals the full error body and the collapsed view shows a … +N more lines (Ctrl+O to expand) hint (#6555).
• Fixed direct binary updates trusting an executable that only reported the expected version. The updater now selects one exact asset from the tagged GitHub release, requires its published SHA-256 digest and size, and verifies both while streaming the download before installation. GitHub release metadata requests use GITHUB_TOKEN or GH_TOKEN when available, allowing users behind an exhausted anonymous rate limit to authenticate.
• Documented that the non-PTY shell's bundled jq command is backed by jaq, including its null-indexing divergence and portable filter syntax (#6614).
• Fixed omp://tools/task.md and omp://tools/eval.md drifting from the 17.1.3 runtime: task.md claimed subagents force-disable async.enabled/bash.autoBackground.enabled (both are inherited from the parent since 17.1.0) and omitted the task tool's effort parameter, and eval.md omitted the still-working eval agent(model=…) per-call model selector (#6594).
• Fixed advisor retry amplification after transient Codex SSE socket closures by limiting each advisor-level try to one provider transport attempt.
• Fixed omp update aborting with npm error EEXIST on standalone binary installs whose directory coincides with the global npm/bun bin dir (for example npm prefix -g set to ~/.local, which the installer also targets). The install-target resolver classified the binary as npm/bun-managed from directory containment alone, so npm install -g tried to replace a regular file its symlink step would clobber; it now treats a plain executable (not a symlink) in a package-manager bin dir as the standalone binary and self-updates it in place (#6527 by @am423).
• Fixed Codex subscription and proxy models being sent the unsupported native { type: "computer" } declaration based only on model ID. They now receive the callable function-tool fallback, including after switching from native OpenAI Responses history, while explicit endpoint metadata can still opt into the GA contract. Explicit native Codex replays preserve computer_call/computer_call_output pairing, normal CLI startup keeps the native desktop worker graph lazy, and packaged workers re-enter the single CLI host without the computer module claiming non-computer selectors.
• Fixed isolated JavaScript eval subprocesses letting the global fatal-rejection handler race the cell rejection interceptor. A floated promise rejection is now folded into the owning cell result without killing its reusable worker process.
• Fixed /context counting hidden, explicit-only skills (hide: true / disable-model-invocation) in the Skills category and subtracting that inflated estimate from the first system-prompt block, which reported System prompt: 0 tokens and inflated Skills usage. Accounting now counts only the skills actually rendered into the system prompt — mirroring buildSystemPrompt's filter, so hidden skills and all skills when the read tool is unavailable contribute zero (#6498).
• Fixed pi-sprite failing plugin validation because the legacy Pi compatibility shims omitted createExtensionRuntime and terminal capability/image-deletion helpers used by the extension (#6506).
• Fixed Escape waiting for an in-flight session_stop extension handler to exhaust its timeout; abort now cancels the active stop pass without reporting a false timeout or applying stale continuation context (#6489).
• Fixed the agent not resuming after re-answering a past ask from the session tree. Committing a new answer via /tree branched a fresh sibling toolResult and rebuilt context, but nothing ever continued the agent — unlike a live ask, whose continuation is intrinsic to the streaming run loop — so the model never consumed the new answer and the session sat idle until a manual prompt. navigateTree now reports the commit (askReanswerCommitted) and the interactive /tree handler resumes the agent via resumeAfterAskReanswer() after its transcript rebuild, so the resumed turn never renders against the stale pre-rebuild UI. Plain leaf moves and the read-only reopenAsk probe stay idle (#6483).
• Fixed Ctrl+C and fatal shutdown entering an ExtensionExitError rejection loop while an extension or hook was still loading (#6488).

@oh-my-pi/pi-natives

Added

• Added the @oh-my-pi/pi-natives/desktop factory entry, which defers native addon loading until a desktop worker initializes its session.

Fixed

• Fixed Linux native audio over forwarded PulseAudio servers: capture now handles 125 ms Android fragments without stalling, and playback buffers enough audio to avoid TCP underruns and stuttering (#6628 by @anatoli-tsinovoy).
• Fixed older running OMP versions deleting newer native addon cache directories during cleanup, which could race a new version's first-run extraction and crash with ENOENT.
• Fixed macOS computer screenshots occasionally returning the pre-action frame instead of reflecting completed keyboard and pointer input (#6595 by @wolfiesch).

@oh-my-pi/pi-tui

Fixed

• Prevented inline Kitty graphics from covering full-width overlays such as /switch.
• Fixed Ctrl+O (expand tools) truncating the session on ConPTY hosts (native Windows and WSL): the full-view replay routed through the ConPTY frame-truncation intended only for bulk transcript-replacement paints (issue #2115), dropping every row above the retained tail behind an "older lines hidden" marker. The bound now keys on paint intent — bulk replacements (initial resume, /resume, handoff, resize geometry rebuilds) stay bounded, while a user-driven resetDisplay() (Ctrl+O expand, thinking/setting toggles, display reset) replays the whole transcript (#4863).

@oh-my-pi/pi-utils

Fixed

• getShellConfig no longer throws No bash shell found on Windows hosts without a discoverable bash. resolveWindowsShell searches Git for Windows install roots (machine, per-user, GIT_INSTALL_ROOT, scoop app dirs — scoop shims sh.exe/git.exe but never bash.exe), then bash.exe/sh.exe on PATH, and finally falls back to cmd.exe from ComSpec with /c args, so shell resolution always succeeds.
• Fixed postmortem signal and fatal shutdown exits being intercepted by temporary process.exit guards during extension startup (#6488).
• Corrected Windows shell resolution errors to identify the active global, project, overlay, or runtime source for shellPath instead of directing every user to the retired settings.json file (#6579).
• Contained timed-out child lifecycle rejections so ptree callers cannot leak an unhandled TimeoutError after settling (#6635).
• Fixed an invalid configured shellPath being silently masked whenever an earlier caller had already resolved a shell in the same process; the guidance error now surfaces regardless of cache state.

What's Changed

• fix(coding-agent): source auth-gateway catalog from ModelRegistry by @roboomp in #6618
• fix(catalog): retry empty model discovery by @roboomp in #6622
• fix(advisor): propagate advisor provider session id via metadata by @roboomp in #6626
• fix(natives): stabilize forwarded PulseAudio capture and playback by @anatoli-tsinovoy in #6628
• fix(utils): contain ptree timeout rejections by @roboomp in #6644
• fix(secrets): avoid hashline placeholder collisions by @roboomp in #6646
• fix(coding-agent): restore legacy pi automode compatibility by @roboomp in #6649
• feat(ai): report MiniMax Token Plan quota in usage by @everton-dgn in #6650
• fix(prewalk): apply same-model effort downgrades instead of skipping by @roboomp in #6660
• fix(advisor): notify the user when a quarantined turn drops advice by @roboomp in #6662
• fix(coding-agent): route js-debug commands to the stopped script child by @roboomp in #6665
• fix(catalog): keep reference-less Copilot Claude models reasoning-capable and cache-stable by @roboomp in #6666
• fix(ai): break anthropic oauth↔providers circular import (claudeCodeVersion TDZ) by @oldschoola in #6667
• fix(session): retry reasonless tool-call aborts by @roboomp in #6669
• fix(providers): add China (Beijing) region for alibaba-token-plan by @roboomp in #6683
• fix(stt): resolve Windows workspace sherpa addon by @roboomp in #6691
• fix(coding-agent): match bash deny/prompt patterns per command segment by @roboomp in #6697
• fix(cli): defer out-of-scope default role so extension models resolve by @roboomp in #6698
• fix(coding-agent): stop the live advisor runtime when /settings disables it by @paolomazzitti in #6701
• fix(tui): keep full-width overlays above inline images by @oleksoleksoleks in #6471
• fix(coding-agent): resume agent after /tree ask re-answer by @roboomp in #6484
• fix(coding-agent): bypass extension guards during shutdown by @roboomp in #6493
• fix(session): cancel in-flight session_stop handlers by @roboomp in #6494
• fix(coding-agent): count only rendered skills in /context accounting by @roboomp in #6500
• fix(cursor): synthesize missing exec MCP tool calls by @roboomp in #6502
• fix(ai): retry statusless provider capacity errors by @roboomp in #6505
• fix(plugins): restore pi-sprite legacy compatibility by @roboomp in #6507
• fix(ai):strip output-only statuses from Responses replay by @Ant39140 in #6513
• fix(ai): repair Alibaba Token Plan usage reporting by @eggpeat in #6521
• fix(coding-agent): self-update binary install when its dir overlaps npm/bun bin dir by @am423 in #6527
• fix(computer-use): correct Codex subscription routing by @usr-bin-roygbiv in #6533
• fix(advisor): bound Codex SSE retries by @jeffscottward in #6537
• fix(ai): stop one Codex window's limit from blocking the others by @paralin in #6541
• feat(agent): wake steering on an event instead of polling for it by @paralin in #6544
• fix(tui): stop Ctrl+O expand truncating the session on ConPTY by @roboomp in #6553
• fix(omp): fit native compaction after large tool output by @oleksoleksoleks in #6556
• fix(update): verify GitHub release asset and digest by @rvagg in #6557
• fix(tui): make provider error blocks expandable via ctrl+o by @roboomp in #6558
• fix(cursor): embed data URI for images in root-prompt history by @sethmorton in #6564
• fix(plan-mode): prefer newest draft during review by @roboomp in #6570
• fix(utils): correct shell path config guidance by @roboomp in #6581
• fix(tui): attach drag-dropped image paths with unescaped spaces by @rcbran in #6582
• fix(coding-agent): re-export estimateTokens from legacy pi shim by @roboomp in #6584
• fix(cli): redact credential settings in config list by @wolfiesch in #6588
• fix(ai): disable adaptive-only thinking on disableReasoning and forced tool choice by @roboomp in #6590
• fix(natives): settle macOS input before capture by @wolfiesch in #6595
• fix(coding-agent): preserve Claude computer coordinates by @wolfiesch in #6596
• docs: reconcile omp:// task/eval docs with 17.1.3 runtime by @roboomp in #6597
• feat(catalog): add Claude Opus 5 entries for Amazon Bedrock by @k1riiiii in #6599
• fix(catalog): downgrade forced tool choice for thinking-locked Kimi Code aliases by @voidfreud in #6601
• fix(natives): preserve newer cache versions by @wolfiesch in #6606
• fix(coding-agent): handle vibe session commands safely by @roboomp in #6608
• fix(ai): preserved Bedrock ARN thinking signatures by @roboomp in #6613
• fix(cursor): sync native todo list from server-resolved tool calls by @quantmind-br in #6616
• docs(bash): document bundled jaq divergence by @roboomp in #6617

New Contributors

• @everton-dgn made their first contribution in #6650
• @paolomazzitti made their first contribution in #6701
• @Ant39140 made their first contribution in #6513
• @am423 made their first contribution in #6527
• @rvagg made their first contribution in #6557
• @sethmorton made their first contribution in #6564
• @rcbran made their first contribution in #6582
• @k1riiiii made their first contribution in #6599
• @voidfreud made their first contribution in #6601
• @quantmind-br made their first contribution in #6616

Full Changelog: v17.1.3...v17.1.4

Hope you are well. This is my first writeup and I will tell you how I found IDOR on Google Classroom on Day 3 of my hunting on Google. I hope it will inspire you.

I selected my first target as Google Classroom because I use it daily for my University Assignments and Tasks.

So first, I started testing every feature, and I noticed in Burp History that Google is using Batchexecute system with rpcids for every UI functionality.

The batchexecute system at classroom.google.com is Google's internal frontend RPC protocol and it’s completely undocumented.

The batchexecute system works like, every UI action in Classroom triggers a POST request to the batchexecute endpoint with a parameter called rpcids that identifies which internal method to call.

For example when you post a comment in Classroom your browser sends something like:

Then, I started mapping different UI functionalities with rpcids, for example:

ndas7c > CREATE announcement
F7asdb > UPDATE/EDIT announcement
tQbcjc > READ/FETCH announcement
xxxxxx > POST private comment on submission thread

These rpcids helped me map every Ui functionality.

After spending time mapping every RPC method in Classroom batchexecute system, most of my tests were coming back clean. Google’s auth on the obvious attack surfaces was solid. The well-known endpoints had proper authorization checks.

I was about to move on to a different target but I decided to look more carefully one last time at the private comment functionality on assignment submissions.

Private comments in Google Classroom are a specific feature designed for confidential communication between a student and their teacher about a particular assignment submission. When a student submits work they can leave private notes for the teacher and the teacher can respond. These comments are explicitly designed to be visible only to the submission owner and the teacher. No other student should be able to see or interact with that thread.

I gave it a try and said to myself that this is the last endpoint I will test on Classroom.

I had two test accounts set up, one acting as an attacker and one as a victim, both enrolled in the same course with submitted assignments. While intercepting traffic I started looking at the requests that fired when I posted a private comment on my own submission.

What caught my attention was the structure of the request. Like all batchexecute calls, it contained several ID parameters such as the course ID, the coursework ID, and crucially a submission ID that identified whose submission thread the comment was being posted to.

The question I asked myself was simple, what happens if I change that submission ID?

Then, I captured my second account same request and copied the submission ID.

I replaced my submission ID with the victim’s submission ID in the request, kept my own session cookies, and sent it.

The server returned 200 OK.

I opened the victim’s account and looked at their private submission thread. Yippee, my attacker comment was sitting there, visible to the victim and their teacher.

The authorization check wasn’t there for this particular RPC method. The server accepted the request, trusted the submission ID in the payload, and posted the comment without verifying that the commenter had any legitimate relationship to that submission.

Now, there was one thing I had to figure out that how to get the victim submission ID in a realistic scenario.

I started analyzing Burp History and found a response that was showing submission IDs of all students enrolled in the class. BOOM. I tested it again and found that on a specific endpoint, if you refresh the page and capture the request, you will see submission IDs of all students in the response.

I verified the finding from the teacher’s account as well. The unauthorized comment appeared there too.

I documented everything and submitted the report to Google VRP. Unfortunately, The report came back as a duplicate, but I was happy that I found a legitimate issue.

Finding a real vulnerability in a Google product as someone still building their skills felt significant, even if it ended up being a duplicate. The whole process taught me more than I expected, not just about bug hunting but about how to think like a security researcher.

Thank you for reading. Hope you enjoy it and hope it inspire you.

Follow me on Linkedin: linkedin.com/in/marrij

How I found an IDOR in Google Classroom on Day 3 of my Hunting? was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Summary

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected:

• SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333)
• SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333)
• SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333)
• SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333)
• SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333)

Background

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities