release: v1.4.0 - #89
Merged
Merged
Conversation
Model resolution moves to Claude Code, Codex spawn_agent routing stops pinning host-owned identifiers, forwarding children request targeted network escalation, and sandbox-denied process probes no longer reap live background jobs. Also carries the actions/checkout 7.0.1 bump from #84 (its branch could not be rebased onto the merged workflow changes) and an npm audit fix for the transitive brace-expansion advisory in the dev tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
b61194f |
2026-07-29 07:21 UTC | 0 | 0 | 0 |
844731f < |
2026-07-29 07:26 UTC | 0 | 0 | 0 |
Last scanned: 844731f · 2026-07-29 07:26 UTC
|
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
b61194f |
2026-07-29 07:21 UTC | 0 | 0 | 0 |
b61194f |
2026-07-29 07:21 UTC | — | — | — |
844731f < |
2026-07-29 07:27 UTC | — | — | — |
Last scanned: 844731f · 2026-07-29 07:27 UTC
Verified against the real Claude CLI 2.1.220 that `--model haiku --effort high` and `--model fable --effort high` are both accepted, so the new alias defaults are safe; the changelog just did not mention haiku moving from unset to high. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 1.4.0. Originally scoped as a 1.3.1 patch; it became a minor release because #76/#77 change user-visible model defaults.
Closes #79, closes #81, closes #83. Supersedes #84.
What's in it
Model resolution moves to the host CLI (#76, #77 — @mychaelconnolly)
--modelforwards every value through unchanged;fable,opus,sonnet, andhaikuare matched case-insensitively. The plugin no longer pinsclaude-opus-4-7[1m]/claude-sonnet-4-6[1m]— those pins had already gone stale relative to what the aliases resolve to today. Every friendly alias now defaults tohigheffort, soopusmoves fromxhightohighunless--effortis passed. This is the breaking-ish change in the release and the reason it is not a patch.Codex 0.145 compatibility (#87)
spawn_agentonly advertisesagent_typewhen custom agents are configured, andgpt-5.4-mini/gpt-5.4are gone from the child-model catalog. Both were pinned in the forwarding contracts, so every built-in background spawn hit an unadvertised parameter plus an unavailable model. The children now omit both and inherit the built-in default agent and the parent model. This also unblocked CI, which had been red on every PR since 0.145 shipped.Network escalation for the companion (#82 — @behruznassre, closes #81)
The single companion
exec_commandnow requestssandbox_permissions: "require_escalated"with a scoped justification, instead of silently failing DNS inside the defaultworkspace-writesandbox. Globalnetwork_accessis still not required.Sandbox-denied process probes no longer kill live jobs (#80 — @behruznassre, closes #79; #88, closes #83)
isProcessAlive()treatsEPERMas "exists but cannot be signaled", andvalidateProcessIdentity()falls back to that probe when the identity check is denied.ESRCH, absent PIDs, and genuine identity mismatches stay dead, so PID-reuse detection is unchanged.Maintenance
actions/setup-node 7.0.0 (#78), eslint 10.8.0 (#85), globals 17.8.0 (#86), actions/checkout 7.0.1 (carried from #84, whose branch could not be rebased onto the merged workflow changes), and an
npm audit fixclearing the transitivebrace-expansionadvisory in the dev tree.Validation
npm run checkon this branch with codex-cli 0.145.0:npm audit: 0 vulnerabilities🤖 Generated with Claude Code