0.37.0 (2026-08-27)

Features

• compress: session-aware /v1/compress (sidecar mode) + /v1/usage relay (#3270) (4fa8802)
• proxy: self-limiting session state for the compression-cache registry (#3261) (826b600)
• proxy: unify proxy and sidecar compression on one session engine (#3271) (d12ea50)

Bug Fixes

• cache/semantic: don't semantic-match an empty query across contexts (#3226) (455f4f2)
• copilot: preserve native enterprise model routing (#2998) (997a479)
• kimi: route managed Kimi Code through the proxy (#3223) (701e461)
• learn: surface Codex analysis failures (#3016) (632cb81)
• mcp: add explicit Serena reconciliation (#3222) (7550efb)
• proxy/anthropic: authenticate and attribute buffered Copilot turns (#3277) (4f2e70a)
• proxy: enforce HEADROOM_PROXY_TOKEN on WebSocket handshakes (#3305) (27b4e2d)
• proxy: make output-savings flush atomic and keep it off the event loop (#3231) (b9d7dcc)
• proxy: protect file reads from lossy compression on the Responses API path (Copilot view + HEADROOM_PROTECT_READS) (#3238) (4408e88)
• transforms: stop compression garbling mixed subagent output (#3286) (8884d87)
• transforms: stop folding datetime-prefixed user messages as search results (#3221) (7784bb1)
• vertex: validate location region to close a path-parameter SSRF (#3304) (7c0b886)
• windows: terminate native proxy process tree (#3313) (91d4fc8)
• wrap: stop concurrent wrap sessions clobbering settings.local.json (#3232) (f27f235)

0.36.5 (2026-08-22)

Bug Fixes

• codex: detect ChatGPT auth from id_token claims so wrap/init emit requires_openai_auth (#3212) (2f81fa5)
• doctor: report project-scoped Claude routing instead of a false negative (#3213) (8f3e33a)

0.36.4 (2026-08-22)

Bug Fixes

• dashboard: pin MIME types for the vendored static assets (#3193) (b485768)
• proxy/responses: keep the Codex additional_tools carrier on the wire (#3194) (1617f83)
• security: validate caller-supplied upstreams on every resolution path (#3195) (3e3c409)
• skip cross-turn dedup pointers on OpenAI chat streaming (#3191) (9c30b62)
• wrap: make the Serena pre-index stall budget configurable (#3183) (202c189)

0.36.3 (2026-08-21)

Bug Fixes

• proxy/responses: lift Codex >= 0.149.0 additional_tools into top-level tools (#3186) (25ca580)

0.36.2 (2026-08-21)

Bug Fixes

• copilot: bind the minted token to the integration ID we forward (#3164) (397803a)
• kompress: accept ccr_original on the remote compressor (#3162) (45cb1b9)
• proxy: count output tokens from the stream's text, not its wire size (#3163) (4006964)

Dependencies

• bump ai from 6.0.138 to 7.0.59 in /sdk/typescript (#2281) (0891062)
• bump ai from 6.0.149 to 7.0.59 in /docs (#2277) (f7e5d37)
• bump md-5 from 0.10.6 to 0.11.0 (#3146) (c6dd823)
• bump ruff from 0.16.2 to 0.16.3 in the pip-minor-patch group (#3143) (c8db13d)
• bump the cargo-minor-patch group with 8 updates (#3145) (9c14e3a)
• bump tiktoken-rs from 0.11.0 to 0.12.0 (#3147) (a307c11)
• bump tokenizers from 0.22.2 to 0.23.1 (#3149) (6e2e10f)
• bump typescript from 5.9.3 to 7.0.2 in /plugins/openclaw (#2279) (85774fc)
• bump typescript from 5.9.3 to 7.0.2 in /plugins/opencode (#2280) (a382137)
• update mcp requirement from <2.0.0,>=1.28.1 to >=1.28.1,<3.0.0 (#3144) (6928d19)

Bug Fixes

• security: address u9up assessment findings (WEB-01–07) (#2207) (1f96dab)
• proxy: return 502, not 200, when upstream connect retries are exhausted (#3083) (a3d9424)
• docker: give :latest exactly one writer (#3154) (bf651c3)
• metrics: attribute tool-schema savings per model, not just compression (#3155) (81fe9d5)

Full Changelog: v0.36.0...v0.36.1

0.36.0 (2026-08-20)

Features

• add deterministic runtime rollout controls (#1490) (3077ac8)
• proxy: let extensions report cost savings and their own latency (#3051) (f9807fd)
• proxy: unify savings attribution across stats, perf, metrics, and dashboard (1b0b0b8), closes #2976
• wrap/claude: make the --1m fallback model configurable via HEADROOM_1M_MODEL (#2983) (2a84725)

Bug Fixes

• anthropic: honor the [1m] 1M-context tier, and price it correctly (#3073) (6d2254d)
• ccr: make --no-ccr disable server-side response handling too (#3101) (131b119), closes #3082
• ccr: make StreamingCCRHandler work on OpenAI streams (#3069) (7ef736f)
• ccr: only buffer a stream when a marker is actually redeemable (#3092) (c502087)
• ccr: re-inject headroom_retrieve when history references it on the sessionless path (942af56)
• ccr: relay a successful upstream turn when post-processing fails (#3094) (0ec73fa)
• ccr: send Accept: application/json on a buffered stream:false turn (#3102) (139c7cb), closes #3078
• ccr: verify a scanned marker's hash before advertising it (#2908) (41dab2d)
• ci: prevent native detector from hanging test shards (#2996) (a708c05)
• ci: scope the release credential and stop persisting it to disk (#3062) (ac8646a)
• ci: unjam release and Docker publishing (#2958) (e269afb)
• claude: reject conflicting auth before proxy startup (#2993) (2d88e31)
• cli/install: resolve the deployment profile instead of dead-ending on default (#2832) (8252619)
• cli: stop the macOS malloc re-exec replacing an embedder's process (#3064) (96c25f5)
• copilot: route VS Code inline completions to Copilot, not OpenAI (#3077) (204e751)
• copilot: send VS Code inline completions to the host that serves them (#3112) (b77d612)
• deps: bump datasets past PYSEC-2026-3716 (#3136) (df6ff6b)
• deps: clear the two Rust advisories and make cargo audit blocking (#3121) (93c474e)
• deps: raise the GitPython floor to 3.1.58 to clear 9 open advisories (#3120) (8156d4d)
• docker: publish compose ports on loopback only (#3061) (481e0b8)
• docker: ship Bedrock auth and current registry (#2982) (eafdf11)
• doctor: surface that Claude Desktop agent sessions bypass the proxy (#2987) (be5b26d)
• install: consolidate Windows fallback and cleanup safety (#2980) (ddd2a25)
• install: honor HEADROOM_PORT in install apply and deploy (#3085) (58f28dc)
• install: stop the PowerShell installer leaking temp dirs into the real user PATH (#2985) (ddd9f76)
• learn: include stdout in CLI failure messages, not just stderr (#3080) (c5563d3)
• mcp: restore SDK v1 compatibility cap (#2978) (6077e5a)
• memory: sanitize entity_refs to prevent dict-shaped entries crashing search (#2951) (2d1e96b)
• onnx: enforce Rust API-24 runtime compatibility (#2979) (a3fe5cb)
• openclaw-plugin: circuit breaker + per-request timeout for proxy resilience (#639) (6576ef6)
• opencode: send x-headroom-project header on all proxied requests (#2868) (eeb038b)
• policy: price net-cost mutations with the 1h cache-write tier (#2780) (ef7e07e)
• providers: don't crash on a non-object HEADROOM_MODEL_LIMITS / models.json (#3089) (3ed8f76)
• proxy/anthropic: don't buffer a CCR stream when passthrough discards the stream flip (#2953) (f1c34d3)
• proxy/anthropic: don't replay recorded prefix over live history (#3026) (#3052) (c16be9b)
• proxy/anthropic: repair headroom_retrieve history references the tools array cannot support (#2876) (7de3573)
• proxy/anthropic: stop answering a non-streaming turn with an event stream (#3142) (0e26fb8)
• proxy/cache: strip cache_control from messages in the semantic cache key (#3086) (2cae0f8)
• proxy/gemini: guard CCR continuation usage against present-null counts (#3035) (a01897c)
• proxy/openai: propagate provider usage on the Responses WS->HTTP fallback (#2988) (536c949)
• proxy: adapt 200 SSE upstream replies on buffered /v1/responses instead of 502 (#2622) (d76fce0)
• proxy: align signed-thinking wire accounting (#3015) (b3f4436)
• proxy: complete stateless Responses and buffered CCR lifecycle (#2997) (8a1d38b)
• proxy: guard feedback endpoints and add CSRF checks to loopback writes (#3060) (a6ab359)
• proxy: keep prefixed core tools resident (#3046) (2f4d001)
• proxy: preserve Codex WebSocket model attribution (#3029) (a06a51e)
• proxy: relocate stray system-role messages to the top-level system param (#765) (#1357) (9fde127)
• proxy: restore the buffered-CCR heartbeat behind a grace window (#3091) (a29d201)
• proxy: scope the signed-thinking lock to blocks that actually changed (#3124) (17522fb)
• proxy: stop a lone surrogate turning a thinking body into a 500 (#3134) (284ff31)
• proxy: stop cached responses replaying the producing turn's wire framing (#3024) (9d37059)
• proxy: stop operator secrets following a client-chosen upstream (#3122) (05f5ef4)
• proxy: tune macOS libmalloc and trim allocator pages so long-lived RSS stays bounded (#2879) (6d87825)
• reporting: show net vs gross savings, real skip thresholds, and the effective profile (#3123) (250ede2)
• tool_search_tool_regex deferred and falsely resolved on direct-Anthropic path (#2971) (8ea87e7)
• vscode: persist compatible Claude modes and route Copilot CAPI (#2986) (1aa701a)
• wrap: set xAI upstream for grok-build proxy (#2772) (c831081)
• wrap: stop the Serena pre-index stalling the launch path for 300s (#2945) (6147883)
• wrap: verify proxy deps before mutating Codex config (#1628) (b7f342c)

Performance Improvements

• perf: skip rotated logs outside the requested window (#3081) (6c9f41e)

Dependencies

• bump axum from 0.7.9 to 0.8.9 (#2966) (5731be7)
• bump criterion from 0.5.1 to 0.8.2 (#2965) (b30f339)
• bump ruff from 0.15.22 to 0.16.2 in the pip-minor-patch group across 1 directory (#2962) (ff17961)
• bump sha2 from 0.10.9 to 0.11.0 (#2288) (322425c)
• bump the cargo-minor-patch group across 1 directory with 4 updates (#2964) (888a9f4)
• bump tokio-tungstenite from 0.24.0 to 0.30.0 (#2967) (bbe9013)
• update mcp requirement from <2.0.0,>=1.28.1 to >=1.28.1,<3.0.0 (#2963) (d6fb536)

What's Changed

• fix: emit SSE ping before message_start on Bedrock streaming path (issue #902) by @MrAshRhodes in #1080
• fix(litellm): add async_post_call_success_hook to HeadroomCallback by @khaosdoctor in #1322
• deps: bump brace-expansion from 5.0.7 to 5.0.9 in /docs by @dependabot[bot] in #2751
• deps: bump next from 16.2.10 to 16.3.0 in /docs by @dependabot[bot] in #2750
• deps: bump postcss from 8.5.19 to 8.5.25 in /plugins/openclaw by @dependabot[bot] in #2749
• deps: bump postcss from 8.5.19 to 8.5.25 in /plugins/opencode by @dependabot[bot] in #2748
• deps: bump postcss from 8.5.19 to 8.5.25 in /sdk/typescript by @dependabot[bot] in #2747
• fix(proxy): unwrap Hermes tool_call bridge in tool name map by @pgjh in #2717
• fix(ccr): preserve exact SQLite TTL boundary by @Agistaris in #2669
• fix(tokenizer): coerce non-string tool_call fields before counting by @Parideboy in #2801
• fix(beacon): report all-layers savings, not context-compression only by @chopratejas in #2796
• test(ccr): cross SQLite max lifetime boundary by @JerrettDavis in #2794
• fix(deps): enforce audited transitive dependency floors by @JerrettDavis in #2791
• feat(cli,pricing): add CLI extension seam and prompt-cache TTL pricing by @chopratejas in #2802
• fix(opencode): don't preload a missing transport shim into child processes by @chopratejas in #2806
• fix(proxy): enable tool search by default and repair poisoned transcripts by @chopratejas in #2807
• Per-request backend selection for routing extensions by @chopratejas in #2809
• fix(beacon): split session failures by status code by @chopratejas in #2815
• fix(proxy): graceful shutdown and reliable Ctrl+C exit by @neogenix in #621
• feat(beacon): allowlist the routing summary key by @chopratejas in #2818
• fix(deps): bump h2 to 4.4.1 for CVE-2026-71554 by @chopratejas in #2839
• perf: cut hot-path latency 27% (token-count memo, startup preloads, JSON scan memo) by @chopratejas in #2838
• fix(proxy): stop discarding compressed Codex WS later-frame payloads by @ashishpatel26 in #2823
• test(openclaw): match inherited PATH shell check by @JerrettDavis in #2821
• fix(proxy/gemini): keep streaming-parity baseline so eligible_pct can't exceed 100 by @abhay-codes07 in #2824
• fix(memory): bound the TrafficLearner pending-pattern accumulator (memory leak) by @abhay-codes07 in #2579
• fix(proxy/anthropic): inject headroom_retrieve whenever a CCR marker is present, not only for new markers by @abhay-codes07 in #2848
• fix(install): stop baking the host memory DB path into a container deployment by @abhay-codes07 in #2845
• fix(install): use --userns=keep-id under Podman so bind-mount writes don't fail by @abhay-codes07 in #2846
• fix(wrap): stop the launch cwd from shadowing the installed package in the proxy subprocess by @abhay-codes07 in #2843
• fix(openai): skip Responses tool-search deferral for clients that cannot execute it by @rodboev in #2696
• fix(onnx): stop ONNX thread pools from spinning idle cores (#2495) by @abhay-codes07 in #2540
• fix(anthropic): strip first-party tool search on custom upstreams by @rodboev in #2539
• perf(subscription): skip transcripts older than the window in compute_window_tokens by @romulomorgan in #2861
• fix(proxy/openai): run response hooks on Responses, and bill their re-drives by @chopratejas in #2872
• Beacon: hourly R2 compaction, per-strategy savings, and a stack that reports by @chopratejas in #2853
• perf(proxy): bound upstream calls and hot-path costs by @chopratejas in #2852
• fix(litellm): don't forward a caller key the target cannot accept by @chopratejas in #2883
• deps: bump postcss from 8.5.19 to 8.5.26 in /docs by @dependabot[bot] in #2881
• build(deps): bump gitpython from 3.1.50 to 3.1.54 in the uv group across 1 directory by @dependabot[bot] in #2575
• deps: bump ruff from 0.15.17 to 0.15.22 in the pip-minor-patch group by @dependabot[bot] in #2501
• deps: bump rusqlite from 0.32.1 to 0.40.1 by @dependabot[bot] in #2287
• deps: bump bytesize from 1.3.3 to 2.4.2 by @dependabot[bot] in #2286
• deps: bump hf-hub from 0.4.3 to 0.5.0 by @dependabot[bot] in #2285
• fix(cache): stabilize Anthropic block-growing lineages by @chopratejas in #2917
• fix(proxy/anthropic): run tool-search history repair after turn hooks by @gglucass in #2889
• fix(wrap/serena): install Serena from the serena-agent PyPI wheel, not the git source by @abhay-codes07 in #2877
• fix(opencode): ship the transport hook-shim so wheel installs route Node child traffic by @abhay-codes07 in #2878
• fix(opencode): keep Claude models off OpenAI provider by @SulimanAbdulrazzaq in #2913
• fix(proxy): cancel periodic TOIN task on shutdown by @abhinavkr26104 in #2906
• fix(cache): bound compression cache bookkeeping by @Robert2547 in #2875
• fix(proxy): emit request log timestamps in UTC by @SulimanAbdulrazzaq in #2912
• fix(memory): close MCP backend on shutdown by @abhinavkr26104 in #2905
• fix(proxy): cache litellm model resolution to stop repeated Provider List spam by @connectsudhindra-gif in #2860
• fix(litellm): close shared cloud client by @abhinavkr26104 in #2903
• fix(oauth2): make repository lint checks pass by @abhinavkr26104 in #2902
• fix(install): trust Docker bridge for dashboard metadata by @SulimanAbdulrazzaq in #2914
• fix(memory): close DirectMem0 resources by @abhinavkr26104 in #2904
• fix(memory): sync FTS5 and vector indexes on CLI delete/edit/prune/purge by @gingeekrishna in #2869
• fix(settings): accept documented HEADROOM_* env names as settings keys by @axelray-dev in #2833
• fix(cli/update): let install ownership win over bare /.dockerenv so venv installs self-update by @abhay-codes07 in #2830
• fix(toin): bound private query and pattern retention by @chopratejas in #2929
• fix(proxy): guard telemetry and TOIN endpoints by @chopratejas in #2930
• fix(ccr): avoid injecting tool on chat streaming by @chopratejas in #2931
• fix(wrap/opencode): verify the opencode binary before mutating config by @abhay-codes07 in #2923
• fix(wrap/claude): keep --1m effective when an explicit --model is passed through by @abhay-codes07 in #2922
• fix(cache): mirror client cache_control positions instead of single-marker consolidation by @gglucass in #2919
• fix(backends/anyllm): convert Anthropic tools and tool_choice to OpenAI shape by @abhay-codes07 in #2892
• fix(backends/anyllm): stream tool_use blocks and map finish_reason on the streaming path by @abhay-codes07 in #2890
• fix(content-router): protect custom-tag blocks before mixed-content section split by @gglucass in #2887
• fix(proxy): close the upstream stream when a streaming body is never consumed by @abhay-codes07 in #2882
• fix(proxy): include tool_search_deferral savings in the savings ledger by @abhay-codes07 in #2880
• fix: Vertex model pricing shows $0.00 for versioned model names and vertex:anthropic provider by @yossiovadia in #2517
• fix(proxy): allow settings routes for trusted gateway/dashboard clients by @Parideboy in #2491
• fix(ccr): report embedded hashes from compress endpoint by @Alexsun1one in #717
• fix(health): label kompress as degraded/optional when not yet loaded by @gingeekrishna in #2865
• fix(proxy): gate mid-turn message coalescing to Claude Code clients by @tenderdeve in #1643
• fix(proxy): give each Codex /v1/responses WS turn a unique request_id by @rodboev in #2164
• fix(learn/gemini): detect the project path for JSONL sessions by @abhay-codes07 in #2229
• fix(learn/gemini): stop double-counting session tokens by @abhay-codes07 in #2230
• fix(memory): make explicit-project and user store keys collision-resistant by @abhay-codes07 in #2231
• fix(transforms/smart_crusher): don't crash on a tool call with a null function by @abhay-codes07 in #2232
• fix(ci): publish latest from the root Docker manifest by @rodboev in #2252
• fix(gemini): resolve native CCR retrieval calls by @rodboev in #2253
• fix(tokenizer): price CJK in the Rust fixed-ratio estimator (Python parity) by @lifeodyssey in #2260
• fix(proxy/openai): don't crash the Responses memory tool loops on null arguments by @abhay-codes07 in #2273
• fix(learn/grok): detect a Windows absolute project path by @abhay-codes07 in #2283
• fix(learn): stop classifying a successful exit code 0 as an error by @abhay-codes07 in #2289
• fix(memory): keep vector metadata in sync by @superdiaodiao in #2295
• fix(proxy/batch): don't crash an OpenAI batch on a valid-JSON non-object line by @abhay-codes07 in #2316
• fix(proxy/bedrock): report uncached input tokens from backend usage, not the live-zone count by @abhay-codes07 in #2318
• fix(transforms/adaptive-sizer): honor max_k on small-input fast path by @abhay-codes07 in #2319
• fix(backends/litellm): None-guard core token counts in OpenAI usage block by @abhay-codes07 in #2324
• fix(proxy): preserve signed Anthropic thinking blocks on outbound re-serialize by @axelray-dev in #2254
• fix(proxy): pass through cross-region prefixed Bedrock model IDs directly by @mhaitana in #2330
• fix(proxy/openai): feed Codex WS traffic into the traffic learner by @abhay-codes07 in #2334
• fix(proxy): compress cache-mode cold starts and tag prefix-mismatch passthrough by @Parideboy in #2365
• fix: publish headroom-opencode in release workflow by @rodboev in #2372
• fix(proxy): port session-sticky beta headers to the Rust proxy by @abcgco in #2381
• fix(wrap): honor Copilot OAuth wire-api override and model default by @mvanhorn in #2387
• fix(subscription): dedup transcript usage by message id (#2340 token inflation) by @abhay-codes07 in #2408
• fix(proxy): time-cap the compression timeout-debt quarantine (#2360) by @abhay-codes07 in #2412
• fix(proxy/anthropic): None-guard usage token counts on the direct buffered path by @abhay-codes07 in #2434
• fix(install/windows): register persistent-task from S4U hidden XML (#2453) by @Parideboy in #2459
• fix(proxy/metrics): escape label values in the Prometheus export by @inix-x in #2463
• fix(ccr): tolerate null/malformed OpenAI data in response handling by @abhay-codes07 in #2467
• fix(install): don't crash the PowerShell installer when $PROFILE is unset by @abhay-codes07 in #2469
• fix(memory): don't crash inline memory extraction on a non-object block by @abhay-codes07 in #2470
• fix(providers/anthropic): don't crash token estimation on null tool_calls by @abhay-codes07 in #2472
• fix(claude): stop forcing tool search on Foundry by @rodboev in #2477
• fix(proxy/metrics): cap client-supplied model label cardinality by @inix-x in #2480
• docs: add guide for using Headroom with OpenCode + DeepSeek by @suvenkatesh97 in #2497
• docs(transforms): correct stale unit-result-cache placeholder comments by @gglucass in #2506
• fix(ccr): resolve <ccr:...> markers inline when no retrieve-tool path exists by @Parideboy in #2512
• fix(doctor): flag ollama launch claude proxy bypass instead of misdirecting by @tenderdeve in #2566
• fix(providers/openai): bound tiktoken vocab loads with the guarded loader by @gglucass in #2554
• fix(memory): skip blocks when building the retrieval query (#2195) by @abhay-codes07 in #2541
• fix(codex): route alpha search through the Codex backend by @rodboev in #2538
• fix(image): decouple routing types from trained_router so importing the compressor doesn't import torch (#2513) by @abhay-codes07 in #2537
• fix(observability): aggregate tool savings in OTEL by @chopratejas in #2936
• fix(proxy): preserve merged session and quarantine contracts by @JerrettDavis in #2943
• fix(wrap): serialize shared proxy startup by @chopratejas in #2946
• fix(cache): enforce Anthropic's 1h-before-5m cache_control ordering before forwarding by @Parideboy in #2941
• deps: bump the cargo-minor-patch group across 1 directory with 22 updates by @dependabot[bot] in #2916
• chore: release headroom-ai 0.35.0 by @chopratejas in #2792

New Contributors

• @pgjh made their first contribution in #2717
• @Agistaris made their first contribution in #2669
• @romulomorgan made their first contribution in #2861
• @SulimanAbdulrazzaq made their first contribution in #2913
• @abhinavkr26104 made their first contribution in #2906
• @Robert2547 made their first contribution in #2875
• @connectsudhindra-gif made their first contribution in #2860
• @gingeekrishna made their first contribution in #2869
• @yossiovadia made their first contribution in #2517
• @Alexsun1one made their first contribution in #717
• @suvenkatesh97 made their first contribution in #2497

Full Changelog: v0.34.0...v0.35.0

0.34.0 (2026-08-05)

Features

• claude: support Claude Code in VS Code (#2752) (13a310a)
• code: add PHP support to CodeAwareCompressor (#2423) (6d5516d)
• compress: accept config.frozen_message_count on /v1/compress (#2718) (2797099)
• compress: reach the lossless provider seam on the general path and default /v1/compress to marker-free output (#2691) (f2c48e2)
• copilot: proxy VS Code models transparently (#2687) (007446c)

Bug Fixes

• ccr: stop persisting retrieval markers as original content (#2694) (#2703) (3e348f3)
• ci: restrict Codecov shard uploads (#2745) (3f2ca99)
• compression: honor qualified CCR names across integrations (#2698) (dcb674b)
• compress: resolve the /v1/compress tokenizer per model, and document the real contract (#2743) (6422a80)
• cost: send litellm the total prompt so --budget stops seeing $0 (#2757) (a033ac4)
• deps: bump aiohttp and cryptography to clear the CVEs blocking 0.34.0 (#2753) (0221e7f)
• kompress: let orgs run Kompress on their own inference stack (#2736) (3d23d76)
• kompress: load merged.pt for the v2 checkpoint instead of the unmerged PEFT safetensors (#2716) (46da91b)
• kompress: reject artifacts that fail at run, and prefetch model files at startup (#2740) (224578e)
• learn: filter ambient user-role scaffolding (#2275) (3eb0122)
• learn: run project discovery off the event loop (#2731) (a70e5ff)
• normalize /p/<project> prefix on WebSocket upgrades so the Responses WS route is not rejected with 403 (#2379) (789a4f3)
• providers: give every model exactly one tokenizer (#2761) (cd92ed5)
• providers: stop a shorter model family shadowing a longer one (#2762) (0cb72f4)
• providers: stop pricing modern content blocks at zero (#2760) (06add9e)
• proxy/cost: mark estimated-basis budget records and add an enforcement policy (#2713) (#2725) (01df245)
• proxy/debug: reconcile Kompress warmup state in /debug/warmup (#2711) (3a27c4d)
• proxy/openai: run tool-description compaction on chat-completions (#2741) (f9db5b5)
• proxy: route Codex Live voice through a dedicated /v1/live transport (#2709) (232fb49)
• proxy: skip OpenAI tool_search deferral for Codex client (#2729) (56b3e4c)
• proxy: stop toggling headroom_retrieve in the Anthropic tools array (#2672) (08fce29)
• remove rtk and lean-ctx CLI context tools (#2677) (e0ce4b1)
• router: stop counting an image's base64 payload as suffix tokens (#2778) (f03cc6d)
• savings: surface request growth the tok_saved clamp swallows (#2708) (184146b)
• stats: report one "Tokens Saved" headline across every harness (#2737) (8262a4a)
• telemetry: anonymous compression stats — no prompts, no data (#2728) (9cfb008)
• telemetry: stop mixing tokenizer scales in RequestOutcome, and fix the overhead framing (#2756) (04e1517)
• tokenizers: count HuggingFace chat templates, and resolve gpt-5 / gateway-wrapped names (#2758) (0ed306b)
• tokenizers: resolve gpt-5 and mixed-case model names to the right encoding (#2776) (fc4680b)
• transforms: stop ContentRouter recompressing headroom_retrieve results (#2654) (677e097)
• wrap/serena: stop creating serena_config.yml, unbricking Serena on fresh installs (#2676) (759209c)

Code Refactoring

• pricing: make LiteLLM the source of truth, not the hardcoded table (#2779) (0e1d6bf)
• remove the dead headroom/prediction module (#2692) (b7a79ac)

Features

• lossless: factor shared directory prefix in the grep search fold (#2547) (7dc9a97)
• metrics: record per-extension token savings (#2371) (02eb90f)
• opencode: ship the transport plugin in pip installs (#2601) (f54f04f)
• opencode: support Copilot subscription backend for headroom models (#2441) (#2445) (9089e7f)
• proxy/hooks: run fold-only (stream-safe) turn hooks on streaming OpenAI chat (#2549) (a6d4921)
• proxy/savings: aggregate tool-schema savings into Metrics + all reporting sinks (#2546) (9f1ffef)
• proxy: label GitHub Copilot traffic as "copilot" in the outcome… (#2377) (d7a8cdb)
• proxy: make /v1/compress usable as a gateway/Kong sidecar (#2458) (1329ed7)
• proxy: model-aware cold-prefix hook — reasoning compaction (Kimi/GLM) + cold recompaction (CC) (#2555) (cb8f4b6)
• proxy: route selected external compressors through the content router (#2388) (e3c7964)
• proxy: select built-in compressors via --compressor + registry inventory (#2373) (56c7d4a)
• rust: add structured prose offload plumbing (#334) (#2378) (9e07785)
• rust: port CodeCompressor AST compressor to Rust (parity-only) (#1154) (e530de5)
• rust: port Kompress ML prose compressor to Rust (parity-only) (#1153) (83e27e5)
• telemetry: record provider cache read/write/uncached tokens per request (#2450) (bec4cce)
• transforms: add compressed signal + dispatch code_aware/html/diff via registry (#2400) (7ebda67)
• transforms: add pluggable compressor registry + headroom.compressor entry point (#2370) (a02073e)
• transforms: dispatch kompress/text via the compressor registry + forward question (#2411) (446ec26)
• transforms: dispatch smart_crusher via the compressor registry (defer kompress/text ML boundary) (#2404) (7c7bf43)
• transforms: make built-in compressors real Compressor implementations (adapters) (#2391) (981616c)
• wrap: boost Serena — symbol-first guidance, wrap-time pre-index, repo-language scoping (#2425) (fd0e1a8)
• wrap: default code-memory to Serena (dashboard browser off) behind unified --code-memory (#2413) (6e4425a)
• wrap: reduce-at-source — SAFE quiet-CLI env defaults for the launched agent (#2548) (c990cfb)

Bug Fixes

• backends/litellm: guard None completion_tokens in usage mapping (#2322) (44a174f)
• backends: don't crash the OpenAI->Anthropic converter on empty choices (#2484) (43a7b57)
• cache: preserve cache_control ttl when re-anchoring a breakpoint (#2651) (e0d2cd0)
• cache: preserve client cache_control ttl when consolidating breakpoints (#2382) (8906d3a)
• ccr: guard empty/malformed OpenAI choices in _extract_assistant_message (#2389) (89319fb)
• ccr: sliding idle-window TTL with max-lifetime ceiling in the Rust core backends (#2604) (#2631) (e825588)
• ci: align Ruff tooling versions (#2406) (2bb14d1)
• cli: warn when Headroom proxy URL leaks into the shell after unwrap claude (#2238) (#2571) (904bc67)
• codex: detect keyring-backed ChatGPT auth (#2478) (46293f4)
• compression: report source-line span in CCR compression marker (#2597) (18e1c3c)
• copilot: derive GHE credential host from API URL (#800) (#2511) (4a8157f)
• copilot: normalize subscription API routing (#2441) (#2455) (2eca5ee)
• copilot: preserve /v1 for the Anthropic /v1/messages endpoint (#2409) (#2414) (c400f90)
• deps: bump mcp to 1.28.1 to clear 3 high-severity CVEs (#2348) (a90be94)
• grok: preserve business-seat auth while routing only inference (#2514) (e4076bb)
• image: reuse image models instead of rebuilding them per request (#2513) (#2536) (2a63ec7)
• install: carry upstream-routing env overrides into supervised deployments (#2429) (170b04a)
• install: default to cache mode, matching headroom proxy (#1893 follow-up) (#2563) (b121223)
• install: migrate deployments off the retired chopratejas image repo (#2427) (17ff13c)
• install: use CREATE_NO_WINDOW instead of DETACHED_PROCESS on Windows (#2527) (045f3df)
• kompress: raise the default execution-slot wait (#2456) (5bd2266)
• learn: detect the active OpenCode database (#2587) (f74d874)
• learn: keep traceback tail in tool-error digest preview (#2596) (85e8699)
• learn: treat unreadable candidate paths as absent in project decode (#2446) (a09ba6c)
• mcp: pin mcp dependency to <2.0.0 to prevent server startup crash (#2642) (b3f016b)
• proxy/cost: count Gemini thinking tokens in output usage (#2639) (22b707f)
• proxy/cost: record each request's savings exactly once (drop 3 double-counts) (#2545) (0845b26)
• proxy/cost: warn once per model when pricing lookup fails (#2504) (#2535) (fa47637)
• proxy/gemini: None-guard token counts from usageMetadata (#2347) (f64aac9)
• proxy/gemini: tolerate malformed parts on the compression path (#2486) (07cf547)
• proxy/metrics: move the savings-ledger append off the event loop (#2439) (4aac068)
• proxy/openai: cache under looked-up messages (#2420) (7052d52)
• proxy/openai: don't record Codex WS savings without input accounting (#2493) (2195ba7)
• proxy/openai: feed chat/completions traffic into the traffic learner (#2333) (6cdfd3f)
• proxy/openai: None-guard usage token counts on the chat path (#2431) (313c290)
• proxy/openai: replay incremental events in buffered Responses SSE (#2410) (#2415) (0cbc0e8)
• proxy/output-shaping: tolerate a non-string system block text in steering (#2435) (3e97671)
• proxy/perf: count turn-hook message folds in token accounting (#2520) (c371d5a)
• proxy/perf: tokenizer-consistent token accounting + surface tool-schema savings (#2542) (1cc53c9)
• proxy/streaming: tolerate malformed content in _response_to_sse (#2481) (77b26c0)
• proxy: keep buffered CCR streams alive (#2479) (a2e42fb)
• proxy: keep core tools and the client's ToolSearch resident for PascalCase clients (#2647) (1d29738)
• proxy: offload OpenAI and Gemini tokenizer counting off the event loop (#2498) (806d2e4)
• proxy: promote Kompress health after runtime load (#2402) (54526bc)
• proxy: reassemble server_tool_use.input from streamed partial_json (#2449) (8c8fae0)
• proxy: report deferred Kompress status and promote health from cache (#2564) (d50cfab)
• proxy: skip max_tokens rename for backend-routed openai chat (#2401) (d6a1af4)
• release: publish Windows wheel + sdist (disable PyPI attestations, #112) (#2405) (f9cbdd6)
• release: sync generated version metadata on the release branch (#2659) (5383c6b)
• rust: port CJK-aware relevance-query matching to CodeCompressor (#2634) (e86c639)
• security: exclude compromised ast-grep-cli 0.44.1 (supply-chain trojan) (#2342) (494fb5a)
• tokenizers: price Claude against a real BPE (tiktoken o200k) not a char estimate (#2543) (285176b)
• transforms/cross-turn-dedup: don't renumber-fold zero-padded line prefixes (#2369) (f4070c4)
• transforms/kompress-remote: keep compress fail-open on malformed 200 (#2320) (b759990)
• wrap: emit bare dotted keys for Codex --config overrides (#2383) (f57e959)
• wrap: make RTK opt-in (off by default) across wrap subcommands (#2344) (44136ed)
• wrap: skip Serena project setup outside real project roots (#2574) (0994ea0)
• wrap: stop same-port persistent routing during claude unwrap (#2340) (#2350) (cf5fa64)

Performance Improvements

• content_router: dedupe content detection (#2419) (9b016f2)

Dependencies

• bump the cargo-minor-patch group with 10 updates (#2284) (3266ed7)
• bump the npm-minor-patch group across 3 directories with 7 updates (#2276) (961866b)

Code Refactoring

• transforms: dispatch simple built-in strategies via the compressor registry (#2399) (fc9c63f)
• wrap: retire tokensave; Serena is the code-memory MCP (#2499) (5d23a0a)