chore: release 0.42.0 (#4228)

🤖 I have created a release *beep* *boop*
---


##
[0.42.0](v0.41.0...v0.42.0)
(2026-10-26)


### Features

* **pipeline:** put per-request saved tokens on OutcomeSnapshot
([#4231](#4231))
([8cedf7b](8cedf7b))
* **proxy:** let turn hooks rewrite OpenAI Responses requests on HTTP
and WebSocket
([#4232](#4232))
([fbf7bc3](fbf7bc3))
* **proxy:** report the same tool savings on gateway /v1/compress as the
proxy path
([#4467](#4467))
([a904210](a904210))
* **savings:** add the per-request counterfactual savings record
([#4236](#4236))
([2912b7b](2912b7b))


### Bug Fixes

* **batch:** preserve live contexts during capacity cleanup
([#4210](#4210))
([2cbdd22](2cbdd22))
* **batch:** preserve native Gemini continuation tools
([#4211](#4211))
([8757458](8757458))
* **cache:** bound the router's compression cache, keep the rest in
SQLite
([#4357](#4357))
([b196424](b196424))
* **cache:** keep indented lines intact in OpenAI whitespace
normalization
([#4343](#4343))
([2480100](2480100))
* **cache:** keep prefix-tracker state across a graceful proxy restart
([#4299](#4299))
([62b3bed](62b3bed))
* **ccr:** recognize client-owned MCP retrieval aliases
([#4165](#4165))
([89545fb](89545fb))
* **ccr:** stream the buffered CCR upstream request so idle-killing
networks cannot cut it
([#4206](#4206))
([ca6ba34](ca6ba34))
* **ci:** pin checkout in release notification smoke workflow
([#4399](#4399))
([70273db](70273db))
* **copilot:** detect COPILOT_API_URL in cli-main.js for Copilot CLI
>= 1.0.93
([#4450](#4450))
([043fe09](043fe09))
* **copilot:** preserve native inline OAuth identity
([#4144](#4144))
([ad62166](ad62166))
* **deps:** bump rustls to 0.23.46 for RUSTSEC-2026-0346..0349
([#4222](#4222))
([132dbc7](132dbc7))
* **deps:** patch OpenClaw Undici and narrow E2E audit exceptions
([#4453](#4453))
([1be699f](1be699f))
* **deps:** require hf-xet>=1.6.0 so a Hub download can't crash
Python at exit
([#4192](#4192))
([9e5dac7](9e5dac7))
* **deps:** require mcp>=1.30.0 for CVE-2026-59951
([#4239](#4239))
([2f7a83a](2f7a83a))
* **gateway:** keep input_includes_cache when re-drive usage is merged
([#4423](#4423))
([3f94144](3f94144))
* **gemini:** keep snake_case inline_data and function parts when
compressing
([#4290](#4290))
([4bf1bf5](4bf1bf5))
* **image:** clear last_result before each compress() call
([#4341](#4341))
([19c91a8](19c91a8))
* **image:** flatten transparent images onto white before re-encoding as
JPEG ([#4296](#4296))
([9f5cfcf](9f5cfcf))
* **install:** keep the HuggingFace cache on a writable mount in Docker
presets
([#4207](#4207))
([#4209](#4209))
([7b6cb77](7b6cb77))
* **kompress:** skip the local model download when a remote endpoint is
set ([#4234](#4234))
([ff36931](ff36931))
* **kompress:** time each model-load stage and stop false not-ready
warnings during warm-up
([#4195](#4195))
([89b229c](89b229c))
* **learn:** anchor the managed block on its last start marker, append
when no end marker
([#4342](#4342))
([45dacc1](45dacc1))
* **learn:** keep the digest's loop section inside its budget
([#4269](#4269))
([506ba16](506ba16))
* **logs:** count omitted levels from dropped lines
([#4141](#4141))
([023dd1b](023dd1b))
* **mcp:** accept the JSONC opencode config that wrap and install
already accept
([#4297](#4297))
([9202948](9202948))
* **memory:** bound retrieval queries before embedding
([#4244](#4244))
([8c07cf4](8c07cf4))
* **memory:** ignore incidental cwd prose
([#4166](#4166))
([3765439](3765439))
* **memory:** log storage and SQLite failures that currently make
retrieval miss silently
([#4111](#4111))
([4e6e955](4e6e955))
* **memory:** resolve partial IDs beyond the first 1000 records
([#4389](#4389))
([c4ea31b](c4ea31b))
* **memory:** treat a cwd with no UTF-8 form as unresolved instead of
raising
([#4167](#4167))
([760c05e](760c05e))
* **openai:** read Responses cache_write_tokens instead of inferring
writes
([#4237](#4237))
([4630602](4630602))
* **openai:** recompress cached Responses units whose CCR entries
expired
([#4146](#4146))
([8f7b419](8f7b419))
* **opencode:** do not rewrite an OpenCode config that fails to parse
([#4424](#4424))
([0fe0a59](0fe0a59))
* **opencode:** restore process env keys on transport dispose
([#4430](#4430))
([d17bac8](d17bac8))
* **pricing:** suppress litellm's Provider List banner that corrupts
perf JSON
([#4197](#4197))
([e01ad35](e01ad35))
* **proxy:** accept HEADROOM_MEMORY_INJECTION_MODE=tool
([#4395](#4395))
([f89c928](f89c928))
* **proxy:** bound per-model state keyed by the client model string
([#4407](#4407))
([33e5f67](33e5f67))
* **proxy:** copy cached tool compaction results (hardening)
([#4410](#4410))
([a256231](a256231))
* **proxy:** count output tokens from CRLF-framed SSE streams too
([#4298](#4298))
([755293d](755293d))
* **proxy:** do not rebuild a failed turn-hook re-drive as HTTP 200
([#4398](#4398))
([f59c8ff](f59c8ff))
* **proxy:** drop web_search_call history from a Responses request with
no web_search tool
([#4202](#4202))
([2a70d12](2a70d12))
* **proxy:** honor bypass header and license gate in Anthropic batch
create
([#4411](#4411))
([4fd9cdd](4fd9cdd))
* **proxy:** import Response at runtime in the Bedrock handler
([#4397](#4397))
([51e4ae3](51e4ae3))
* **proxy:** judge NAT64 upstream addresses by their embedded IPv4
([#4179](#4179))
([486afaa](486afaa))
* **proxy:** keep in-period costs in the budget ledger when the entry
cap is reached
([#4448](#4448))
([41c15b3](41c15b3))
* **proxy:** keep negative compression savings across restart
([#4406](#4406))
([bebe24c](bebe24c))
* **proxy:** keep tool deferral for GitHub Copilot upstream
([#4356](#4356))
([217b658](217b658))
* **proxy:** let HEADROOM_LOG_LEVEL=debug turn on Headroom's own debug
logs ([#4137](#4137))
([00093ce](00093ce))
* **proxy:** make handler failures debuggable from the logs
([#4127](#4127))
([7dc20b6](7dc20b6))
* **proxy:** net tools a turn hook adds against the saving it books
([#4057](#4057))
([85520c2](85520c2))
* **proxy:** record a stream the client closes after its terminal event
as completed
([#4286](#4286))
([762a337](762a337))
* **proxy:** record outcome when a passthrough stream ends mid-character
([#4429](#4429))
([75cfbba](75cfbba))
* **proxy:** report disabled Kompress at startup
([#4217](#4217))
([430ea4f](430ea4f))
* **proxy:** report read maturation as inert in cache mode
([#4198](#4198))
([ba82453](ba82453))
* **proxy:** show turn-hook savings in /stats extension_savings, incl.
Codex WS
([#4233](#4233))
([1d112cd](1d112cd))
* **proxy:** snapshot the original messages when a turn hook can edit
them ([#4241](#4241))
([df11f27](df11f27))
* **relevance:** load the default embedder from one pinned snapshot
([#4152](#4152))
([f380692](f380692))
* **savings:** key a Responses conversation on its thread, not the
shared session
([#4440](#4440))
([11f743d](11f743d))
* **sdk:** preserve Vercel AI SDK file and image parts through
compression
([#4048](#4048))
([1668a6c](1668a6c))
* **security:** restrict the Windows runtime log via NTFS ACL, not just
warn ([#4135](#4135))
([125a703](125a703))
* **smart-crusher:** match audit-safe protected_patterns against
unescaped text
([#4294](#4294))
([e11afdb](e11afdb))
* **storage:** normalize timezone-aware JSONL time filters
([#4063](#4063))
([bf34ccf](bf34ccf))
* **tabular:** pass tables with repeated header names through verbatim
([#4278](#4278))
([ed3195b](ed3195b))
* **telemetry:** give empty-item compressions a stable tool signature
([#4396](#4396))
([a79def4](a79def4))
* **telemetry:** let HEADROOM_TELEMETRY=off stop the anonymous beacon
([#4235](#4235))
([1a40b3c](1a40b3c))
* **transforms:** keep the fences of a code block passed through for a
protected tag
([#4292](#4292))
([02958c6](02958c6))
* **transforms:** log the compression failures that silently become "no
savings"
([#4092](#4092))
([580cc83](580cc83))
* **zcode:** skip providers that point at the Headroom proxy itself
([#4413](#4413))
([9ac1b52](9ac1b52))


### Dependencies

* Bump base64 from 0.22.1 to 0.23.1
([#4029](#4029))
([8d468d4](8d468d4))
* Bump ruff from 0.16.8 to 0.17.0 in the pip-minor-patch group across 1
directory
([#4026](#4026))
([de3f639](de3f639))
* Bump the cargo-minor-patch group across 1 directory with 12 updates
([#4186](#4186))
([683c9a6](683c9a6))
* Bump the npm-minor-patch group across 2 directories with 16 updates
([#4218](#4218))
([07c8bbf](07c8bbf))
* Bump the npm-minor-patch group across 3 directories with 12 updates
([#4219](#4219))
([1f71cb3](1f71cb3))
* Update huggingface-hub requirement from <2.0,>=1.5.0 to
>=1.5.0,<3.0
([#4027](#4027))
([fcf3db8](fcf3db8))


### Code Refactoring

* **integrations:** share the local/cloud compress backend of asgi and
litellm_callback
([#4124](#4124))
([58caafb](58caafb))
* **transforms:** share one CCR persist helper for the Rust-backed
compressors
([#4094](#4094))
([ea947ca](ea947ca))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.41.0 (#4002)

🤖 I have created a release *beep* *boop*
---


##
[0.41.0](v0.40.0...v0.41.0)
(2026-10-13)


### Features

* **antigravity:** add native Google Antigravity IDE integration
([#3817](#3817))
([cd4367b](cd4367b))
* **opencode:** support the OpenCode 2.x plugin API
([#3999](#3999))
([1d4b357](1d4b357))
* **plugins:** add headroom-snip Claude Code mod that animates
compression
([#3980](#3980))
([17abee2](17abee2))
* **proxy:** native spend/savings stats + dashboard for the Rust proxy
([#2321](#2321))
([70b21c1](70b21c1))
* **router:** add max_output_tokens condition to ModelRoute
([#3898](#3898))
([01185e3](01185e3))
* **savings:** per-agent attribution in history checkpoints and rollups
([#2627](#2627))
([489de46](489de46))
* show the Headroom for Teams offer in the dashboard, docs, llms.txt and
release notes
([#3991](#3991))
([1ad92f0](1ad92f0))


### Bug Fixes

* **anthropic:** route /api/hello connectivity probes to Anthropic
([#3336](#3336))
([#4059](#4059))
([931e5b9](931e5b9))
* **beacon:** stop Cloudflare logging senders' IP addresses
([#4018](#4018))
([db983ba](db983ba))
* **cache:** keep cache mode when Claude Code re-serializes its last
reply ([#4003](#4003))
([aeb09f8](aeb09f8))
* **cache:** retain prefix trackers for the provider cache lifetime
([#4023](#4023))
([9553d42](9553d42))
* **cache:** stop Claude Code forks from cold-starting the
conversation's lineage
([#4043](#4043))
([1cf4d05](1cf4d05))
* **ccr:** serve headroom_retrieve when the model calls it alongside
client tools
([#4034](#4034))
([01d9194](01d9194))
* **cli:** name the broken Codex config, write init configs atomically,
keep the identity check
([#4129](#4129))
([976aa71](976aa71))
* **cli:** pass configured SSL context to stdlib urlopen calls
([#4011](#4011))
([22d0905](22d0905))
* **cli:** say why the proxy failed to start
([#4120](#4120))
([f3d240b](f3d240b))
* **codex:** make unwrap codex remove headroom init routing
([#3920](#3920))
([3260795](3260795))
* **codex:** preserve auth.json API keys through Headroom
([#3355](#3355))
([a6523b1](a6523b1))
* **copilot:** honour GitHub's advertised Business/Enterprise host by
default
([#4155](#4155))
([1dc7a18](1dc7a18))
* **copilot:** send VS Code next-edit requests to the completions host
([#4188](#4188))
([22a1296](22a1296))
* **dashboard:** keep savings profile visible in light mode
([#2544](#2544))
([4e4f49d](4e4f49d))
* **dashboard:** show the effective value in settings enum selects
([#4032](#4032))
([20ce054](20ce054))
* **deps:** bump quinn-proto to 0.11.19 for RUSTSEC-2026-0338..0342
([#4178](#4178))
([49751ec](49751ec))
* **deps:** clear the two high npm advisories failing the Security
workflow
([#4004](#4004))
([5a516b5](5a516b5))
* **deps:** recommend headroom-ai for optional extras
([#4046](#4046))
([f1bc260](f1bc260))
* **deps:** support Intel macOS ONNX Runtime resolution
([#3823](#3823))
([51ec6e8](51ec6e8))
* **docker:** adds mount for the litellm config dir
([#2454](#2454))
([64a661d](64a661d))
* **gateway:** report why /v1/compress/response rejected a body
([#4081](#4081))
([5cac7ab](5cac7ab))
* **grok:** attribute api.x.ai chat outcomes as provider xai, recognize
grok-shell UA
([#2626](#2626))
([b1fb162](b1fb162))
* **install/windows:** back persistent-service with an always-on task
([#1866](#1866))
([#2460](#2460))
([5682883](5682883))
* **install:** distinguish protocol targets in status
([#4040](#4040))
([79f2c27](79f2c27))
* **install:** keep an explicitly empty dashboard allowlist on Windows
PowerShell 5.1
([#4012](#4012))
([c195a12](c195a12))
* **install:** preserve OpenCode edits during reactivation
([#4022](#4022))
([40955b0](40955b0))
* **learn:** decode sanitized pattern-id markers and keep visible-text
dedup keys
([#3956](#3956))
([ec1ba70](ec1ba70))
* **learn:** make live traffic learning use the shared error classifier
([#4110](#4110))
([e6eaa41](e6eaa41))
* **learn:** pin the learned verbosity level on a cache-mode proxy
([#4033](#4033))
([71663b4](71663b4))
* **logging:** add payload-safe helpers for exceptions, URLs, ids and
repeat warnings
([#4138](#4138))
([bebe559](bebe559))
* **onnx:** stop magika's ORT intra-op pool from spinning idle cores
([#4189](#4189))
([2016dc6](2016dc6))
* **openclaw:** preserve tool-call thought signatures
([#4038](#4038))
([37f3f9e](37f3f9e))
* **plugins/openclaw:** keep compression system-prompt notice
cache-stable
([#3811](#3811))
([f885187](f885187))
* **pricing:** reconcile cache billing with model-specific LiteLLM rates
([#3033](#3033))
([463c1a4](463c1a4))
* **providers:** drop the shadowed POST /v1/messages route spec
([#4075](#4075))
([69a16cb](69a16cb))
* **proxy/bedrock:** record the real upstream status on InvokeModel
outcomes
([#4025](#4025))
([159daa2](159daa2))
* **proxy/streaming:** tolerate malformed upstream SSE events
([#2558](#2558))
([d091fbd](d091fbd))
* **proxy:** astgrep disk verify truncation
([#3192](#3192))
([1fb4cba](1fb4cba))
* **proxy:** break the compact-every-turn loop near the real context
window
([#2942](#2942))
([76cceeb](76cceeb))
* **proxy:** classify failed streams as failed requests
([#3747](#3747))
([42d4f58](42d4f58))
* **proxy:** don't retry a 429/529 that cannot succeed within the
backoff cap
([#3992](#3992))
([a961a6f](a961a6f))
* **proxy:** don't send a memory continuation with unanswered client
tool calls
([#4009](#4009))
([#4013](#4013))
([87e05b6](87e05b6))
* **proxy:** forward x-litellm-key-* headers on streaming path
([#2532](#2532))
([33ade5b](33ade5b))
* **proxy:** ignore defer_loading when measuring a turn hook's tool
delta ([#4056](#4056))
([f8212a3](f8212a3))
* **proxy:** keep Claude Haiku 5.5 mid-conversation system messages in
place ([#4153](#4153))
([a9eb2a7](a9eb2a7))
* **proxy:** keep leading Anthropic system payloads valid
([#3671](#3671))
([d9e29bb](d9e29bb))
* **proxy:** log the savings and metrics failures that currently vanish
([#4084](#4084))
([2800932](2800932))
* **proxy:** read stream cache usage from message_delta; keep Fireworks
sessions on one replica
([#4174](#4174))
([30b22df](30b22df))
* **proxy:** record the provider's billed input count on streamed turns
([#4052](#4052))
([a9815bb](a9815bb))
* **proxy:** say why proxy.log is missing and why a knob or extension
was ignored
([#4088](#4088))
([72302a3](72302a3))
* **release:** synchronize editable uv lock version
([#4054](#4054))
([3f99066](3f99066))
* **router:** bound ML compression per request, not just per block
([#3721](#3721))
([f37980f](f37980f))
* **router:** preserve nested JSON records through compression
([#3680](#3680))
([fd06703](fd06703))
* **savings,ccr:** log the ledger and MCP failures that are swallowed
silently
([#4105](#4105))
([97680e7](97680e7))
* **savings:** don't let a thin holdout arm decide the headline number
([#3127](#3127))
([2a12e03](2a12e03))
* **security:** resolve 23 open CodeQL alerts
([#4045](#4045))
([a88e2d5](a88e2d5))
* **security:** resolve high-severity CodeQL alerts
([#4005](#4005))
([dea9092](dea9092))
* **smart-crusher:** preserve wrapped retrieval results in apply
([#4149](#4149))
([9762a14](9762a14))
* **subscription:** log a failed OTEL window update instead of passing
silently
([#4131](#4131))
([7d9dd55](7d9dd55))
* **toin:** make diagnostic pattern identifiers addressable
([#4021](#4021))
([def6d41](def6d41))
* **transforms:** log failed transforms with tracebacks
([#3981](#3981))
([a654558](a654558))
* **wrap:** carry the shared proxy's extensions over to a dedicated
Copilot proxy
([#4154](#4154))
([feea130](feea130))
* **wrap:** let `wrap opencode` target a third-party OpenAI-compatible
upstream
([#3125](#3125))
([0d7d61d](0d7d61d))
* **wrap:** reject saved bob gateway URLs the proxy would not route
([#3975](#3975))
([944eafc](944eafc))
* **wrap:** trim the wrap claude startup banner
([#3900](#3900))
([aba75cb](aba75cb))
* **wrap:** warn when reused proxy ignores compression settings
([#4019](#4019))
([278bbc8](278bbc8))


### Performance Improvements

* **proxy:** avoid eager dependency imports
([#3546](#3546))
([59bd482](59bd482))


### Code Refactoring

* **backends:** reuse the LiteLLM tool converters in the any-llm backend
([#4076](#4076))
([03538f2](03538f2))
* **cli:** one missing-binary error for every wrap command
([#4122](#4122))
([2c2357a](2c2357a))
* **cli:** remove test-only and dead helpers from wrap, proxy and mcp
([#4118](#4118))
([73f59a3](73f59a3))
* **compression:** deprecate the test-only UniversalCompressor package
([#4095](#4095))
([fc8ff5a](fc8ff5a))
* **core:** remove unreferenced helpers, attributes and a shadowed
module
([#4091](#4091))
([08fce18](08fce18))
* **graph:** drop the bespoke codebase-memory-mcp downloader nothing
calls ([#4102](#4102))
([30d23fb](30d23fb))
* **mcp_registry:** share spec helpers and fold GrokRegistrar onto the
Codex TOML registrar
([#4121](#4121))
([6e14ee0](6e14ee0))
* **memory,learn,cache:** remove unreferenced classes, methods and
constants
([#4112](#4112))
([abbf36f](abbf36f))
* **memory:** deprecate the never-wired agent memory writers
([#4101](#4101))
([2e497cb](2e497cb))
* **memory:** deprecate the orphaned Mem0SystemAdapter
([#4114](#4114))
([7387b8c](7387b8c))
* **memory:** drop the unused extraction prompts and tool schemas
([#4100](#4100))
([6d23895](6d23895))
* **memory:** remove the unused memory budget manager
([#4099](#4099))
([e7ac6ca](e7ac6ca))
* **proxy:** delete the unused memory_tool_adapter module
([#4071](#4071))
([7e5d97f](7e5d97f))
* **proxy:** drop the test-only memory ranker and file-backed native
memory ops
([#4072](#4072))
([fc5ac70](fc5ac70))
* **proxy:** parse HEADROOM_OUTPUT_HOLDOUT in one place
([#4082](#4082))
([1a4e419](1a4e419))
* **proxy:** remove dead aliases and wrappers from helpers,
body_forwarding, forwarded_headers
([#4080](#4080))
([63cc9af](63cc9af))
* **proxy:** remove dead wiring and unused re-exports from server.py
([#4073](#4073))
([58387c1](58387c1))
* **proxy:** remove test-only and dead helpers from the handlers
([#4117](#4117))
([31d378b](31d378b))
* **proxy:** remove the unreachable debug branches from the Responses
payload compressor
([#4116](#4116))
([132cd58](132cd58))
* **proxy:** remove the unreachable debug branches from the Responses
unit router
([#4115](#4115))
([25cc2d5](25cc2d5))
* **proxy:** remove unreferenced and test-only helpers
([#4074](#4074))
([e5cbec5](e5cbec5))
* remove test-only compatibility helpers in rollout and agent_savings
([#4089](#4089))
([310c108](310c108))
* remove write-only and test-only code in subscription and install
([#4123](#4123))
([c191bee](c191bee))
* **transforms:** deprecate the unused Python AnchorSelector port
([#4104](#4104))
([9b1971d](9b1971d))
* **transforms:** deprecate unused compress_with_stats, extract_batch
and align_for_cache
([#4098](#4098))
([e4a1ec1](e4a1ec1))
* **transforms:** drop the Python mirror of the Rust log selector
([#4096](#4096))
([a20c76c](a20c76c))
* **transforms:** drop the Python mirror of the Rust search selector
([#4103](#4103))
([47f8710](47f8710))
* **transforms:** remove the unused summarize_dropped_items
([#4093](#4093))
([eaa7308](eaa7308))
* **transforms:** remove unused convenience wrappers and helpers
([#4097](#4097))
([5c72d82](5c72d82))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.40.0 (#3833)

🤖 I have created a release *beep* *boop*
---


##
[0.40.0](v0.39.1...v0.40.0)
(2026-10-06)


### ⚠ BREAKING CHANGES

* **proxy:** read HEADROOM_LICENSE and make usage reporting opt-in
([#3857](#3857))
* drop the crewai extra to remove chromadb from the lockfile
([#3870](#3870))

### Features

* **compress:** add per-message compression diagnostics
([#3058](#3058))
([fef99cc](fef99cc))
* **compress:** live-agent densify mode, lossless and cache-safe
([#1402](#1402))
([84f0e84](84f0e84))
* **dashboard:** add CO₂ Saved card to dashboard and /stats API
([#1369](#1369))
([2bc9419](2bc9419))
* **dashboard:** give savings metrics one canonical home
([#3320](#3320))
([6af7efe](6af7efe))
* **learn:** add agy (Antigravity CLI) as an analysis backend
([#3939](#3939))
([4ba231a](4ba231a))
* **live-zone:** wire the SourceCode and PlainText dispatch arms
([#3227](#3227))
([49f69be](49f69be))
* **memory:** persist TrafficLearner pending evidence across restarts +
expose learner stats
([#3104](#3104))
([4257ed4](4257ed4))
* **proxy:** add x-headroom-keep-last-turns header for per-request
context trimming (issue
[#2858](#2858))
([#3059](#3059))
([246162d](246162d))
* **proxy:** route Gemini plugin traffic through native transforms
([#2697](#2697))
([0ad996a](0ad996a))
* **proxy:** serve on a Unix domain socket (--uds)
([#3151](#3151))
([e7b3baf](e7b3baf))
* **wrap:** add headroom wrap bob for IBM Bob CLI
([#3801](#3801))
([0b7dab4](0b7dab4))
* **wrap:** extend reduce-at-source quiet defaults to telemetry/nag
banners
([#2550](#2550))
([3a3a465](3a3a465))


### Bug Fixes

* **anthropic:** preserve failed CCR continuations
([#3843](#3843))
([94bb055](94bb055))
* **backends/anyllm:** map Anthropic tool_choice none to OpenAI none
([#3963](#3963))
([d722a64](d722a64))
* **backends/litellm:** align streaming usage tokens with the
non-streaming path
([#2688](#2688))
([90a68e0](90a68e0))
* **backends/litellm:** keep the upstream 4xx status on send_message
errors
([#3944](#3944))
([e0e41cd](e0e41cd))
* **backends/litellm:** map Anthropic tool_choice none to OpenAI none
([#2689](#2689))
([57a5708](57a5708))
* **backends/litellm:** match the caller-key Bearer scheme
case-insensitively (RFC 7235)
([#3965](#3965))
([848d7a0](848d7a0))
* **backends/litellm:** report requested model in OpenAI streaming
chunks
([#2690](#2690))
([8538a83](8538a83))
* **cache:** keep prefix lineage across a replaced system tail
([#3934](#3934))
([16eaec1](16eaec1))
* **ccr:** answer headroom_retrieve on the direct chat path instead of
forwarding it
([#3816](#3816))
([126e144](126e144))
* **ccr:** inject headroom_retrieve before the prefix is warm, not after
([#3810](#3810))
([bb8c285](bb8c285))
* **ccr:** only proactively expand compressions present in the
requesting conversation
([#3924](#3924))
([9b9a883](9b9a883))
* **ccr:** unwrap Hermes batched tool_call so headroom_retrieve stays
exempt
([#3839](#3839))
([2f07668](2f07668))
* **ci:** clear dependency audit and gate Docker publishing
([#3984](#3984))
([67ce7d0](67ce7d0))
* **ci:** keep hard watchdog out of pytest shards
([#3845](#3845))
([2527431](2527431))
* **ci:** tolerate missing Docker cache blobs
([#3945](#3945))
([540f4da](540f4da))
* clarify CCR marker content preservation
([#3175](#3175))
([005a4e1](005a4e1))
* **cli:** honor CODEX_HOME and align wrap/init/doctor with the live
proxy port
([#3855](#3855))
([5bf6612](5bf6612))
* **cli:** strip unmarked headroom_memory TOML table before injecting
([#3490](#3490))
([08dda4c](08dda4c))
* **codex:** explain why wrapped Codex runs without the shared server
([#3899](#3899))
([1982b3a](1982b3a))
* **codex:** preserve remote compaction in init config
([#3410](#3410))
([6df4a96](6df4a96))
* **codex:** resolve per-turn project context
([#2636](#2636))
([0396ea2](0396ea2))
* **codex:** strip stale compression framing on the Responses subpath
passthrough
([#3792](#3792))
([0eba65c](0eba65c))
* **copilot:** defer keychain auth lookup
([#2739](#2739))
([81a8a28](81a8a28))
* **copilot:** read timezone-naive token expiry as UTC, not host local
time ([#3216](#3216))
([2b2dc1b](2b2dc1b))
* **copilot:** warn when a VS Code profile cannot see the proxy settings
([#3919](#3919))
([7b68fc2](7b68fc2))
* **deps:** patch brace-expansion in wrap E2E lockfile
([#3873](#3873))
([5e0435d](5e0435d))
* **deps:** patch urllib3 and Next.js advisories
([#3896](#3896))
([573e385](573e385))
* **doctor:** recognize Azure Foundry routing for Claude Code
([#1339](#1339))
([d5318ac](d5318ac))
* **grok:** route CLI traffic to api.x.ai on shared proxies
([#2693](#2693))
([ef1c528](ef1c528))
* honor configured port in container startup and healthcheck
([#2436](#2436))
([1b7977c](1b7977c))
* **install/apply:** add --no-rate-limit flag, persist in proxy_args
([#1350](#1350))
([#1365](#1365))
([31d0344](31d0344))
* **install:** parse Windows Task Scheduler XML output
([#3830](#3830))
([c32a4f4](c32a4f4))
* **install:** replace the launchd wrapper with the proxy listener
([#3224](#3224))
([44db755](44db755))
* **install:** use safe model backends for persistent services
([#3646](#3646))
([7287589](7287589))
* **integrations:** record metric timestamps in UTC, not naive local
time ([#3117](#3117))
([76ef2c3](76ef2c3))
* **kompress:** degrade when a native dep is installed but unloadable
([#3133](#3133))
([8f3d677](8f3d677))
* **kompress:** pin ModernBERT tokenizer and encoder revisions
([#3808](#3808))
([2de5828](2de5828))
* **learn:** drop the echoed prompt from a failed cli's error
([#3928](#3928))
([f00d425](f00d425))
* **learn:** keep CLAUDE.local.md out of git via .git/info/exclude
([#3108](#3108))
([c072251](c072251))
* **learn:** keep transcript-derived content inside the managed block
([#3850](#3850))
([c46e74d](c46e74d))
* **learn:** merge git worktree sessions into the repo's project
([#3854](#3854))
([3fdf18e](3fdf18e))
* **learn:** preserve stable traffic pattern items
([#2293](#2293))
([1631cde](1631cde))
* **learn:** recognize escaped persisted pattern IDs
([#3951](#3951))
([2e74f06](2e74f06))
* **learn:** run the claude-cli analysis with hooks disabled
([#3926](#3926))
([2a4d34c](2a4d34c))
* **learn:** run the claude-cli analysis with no tools
([#3892](#3892))
([db90b93](db90b93))
* **log_compressor:** keep and name pytest short-summary failures
([#3828](#3828))
([d90b320](d90b320))
* make Headroom work behind Zscaler and other TLS-inspecting networks
([#3831](#3831))
([66258c4](66258c4))
* **mcp:** bound version-detection git subprocess
([#3038](#3038))
([0712e04](0712e04))
* **mcp:** escape control characters when rendering TOML server blocks
([#3964](#3964))
([a96154f](a96154f))
* **mcp:** keep other apps' tables when replacing the Codex/Grok MCP
span ([#3877](#3877))
([d0fd56e](d0fd56e))
* **mcp:** resolve opencode.jsonc for MCP registration
([#2496](#2496))
([f824a27](f824a27))
* **memory:** align project routing with wrap headers
([#3603](#3603))
([b1b005a](b1b005a))
* **memory:** avoid injecting tools into tool-free requests
([#3677](#3677))
([46755b5](46755b5))
* **memory:** close SQLite connections in memory/fts5/graph adapters
([#3153](#3153))
([231a627](231a627))
* **memory:** handle list-shaped system content in inline memory
injection
([#3794](#3794))
([717527b](717527b))
* **memory:** ignore leading cd prefix when pairing Bash error
recoveries
([#3776](#3776))
([143a38d](143a38d))
* **memory:** pin LF on memory writers and guard the learn-writer
newline contract
([#3706](#3706))
([b10dd8d](b10dd8d))
* **oauth2:** mint and inject only on requests that go upstream
([#3849](#3849))
([f977d52](f977d52))
* **offline:** make HEADROOM_OFFLINE a real air-gap via one chokepoint
([#3729](#3729))
([119d1a1](119d1a1))
* **opencode:** hide spawned Windows console windows
([#3743](#3743))
([2157400](2157400))
* **opencode:** route only LLM traffic through Headroom
([#3884](#3884))
([d75eecd](d75eecd))
* **output-savings:** seed the holdout key on the whole first user
message
([#3209](#3209))
([117ff72](117ff72))
* **parser:** stop counting HTML comments twice in waste signals
([#3942](#3942))
([d0e9c4c](d0e9c4c))
* **parser:** whitespace waste signal always reported zero
([#1102](#1102))
([f19bc9a](f19bc9a))
* **plugin:** resolve hook CLI through plugin-root launcher
([#3053](#3053))
([ef7605f](ef7605f))
* **plugins/openclaw:** return messages the proxy did not change exactly
as they came in
([#3826](#3826))
([d1ad189](d1ad189))
* prevent HF tokenizer downloads in offline mode
([#3783](#3783))
([d503c57](d503c57))
* **pricing:** add Claude Sonnet 5.5 / Opus 5.5 / Fable 5.1, correct
Sonnet 5 rates
([#3841](#3841))
([0d99c56](0d99c56))
* protect file reads in chained shell commands
([#2668](#2668))
([ffc3599](ffc3599))
* **providers/vertex:** Vertex route multi-region locations
([#3802](#3802))
([a9c1ac5](a9c1ac5))
* **proxy/anthropic:** keep tool_result blocks first when neutralizing
headroom_retrieve history
([#3874](#3874))
([ccd9fff](ccd9fff))
* **proxy/batch:** honor x-headroom-bypass on the batch paths
([#2570](#2570))
([9b26a49](9b26a49))
* **proxy:** add same-origin check to /v1/retrieve/tool_call
([#3955](#3955))
([2297b50](2297b50))
* **proxy:** bill the whole prompt on the gateway path so savings read
true ([#3632](#3632))
([befdb52](befdb52))
* **proxy:** carry safeguard_results through SSE resynthesis
([#3958](#3958))
([f37ef59](f37ef59))
* **proxy:** classify Pi Codex Responses alias
([#2583](#2583))
([a493f55](a493f55))
* **proxy:** do not cache error replies delivered as http 200
([#3930](#3930))
([1132a54](1132a54))
* **proxy:** drop a tool_reference naming the search tool itself
([#3172](#3172))
([b73adaa](b73adaa))
* **proxy:** F3 — per-tenant TOIN learning key
([#404](#404))
([f90a56b](f90a56b))
* **proxy:** forward operator-listed guarded upstreams through a proxy
([#3804](#3804))
([4b7e5d2](4b7e5d2))
* **proxy:** freeze and replay the forwarded prefix on Gemini paths
([#3394](#3394))
([#3865](#3865))
([dd84321](dd84321))
* **proxy:** gate the raw request body, not just its Content-Length
header
([#3338](#3338))
([c946b6b](c946b6b))
* **proxy:** hard watchdog that dumps and exits when a native call
seizes the GIL
([#3180](#3180))
([79daeb5](79daeb5))
* **proxy:** inject memory context past a trailing system message
([#3948](#3948))
([3948dbe](3948dbe))
* **proxy:** keep cache_control outside content blocks where the Chat
Completions client put it
([#3895](#3895))
([a6d6c14](a6d6c14))
* **proxy:** keep exception text and the proxy token out of client
output
([#3851](#3851))
([861e94d](861e94d))
* **proxy:** keep the newest user message verbatim in cache-mode delta
compression
([#3923](#3923))
([613ae92](613ae92))
* **proxy:** key rate limits by peer unless the caller authenticated
([#3860](#3860))
([6fb7cad](6fb7cad))
* **proxy:** kill the image worker a timed-out call abandons
([#3940](#3940))
([793bb85](793bb85))
* **proxy:** label plain OpenAI chat traffic openai, not custom
([#3912](#3912))
([7df8bd8](7df8bd8))
* **proxy:** log response_content_length in proxy_inbound_response
([#2701](#2701))
([cfa479a](cfa479a))
* **proxy:** preserve Bedrock body-limit error dialect
([#3871](#3871))
([ffc6edb](ffc6edb))
* **proxy:** preserve Windows service when Rust core is blocked
([#2989](#2989))
([eaa16d9](eaa16d9))
* **proxy:** quarantine compression only once half the pool is stuck
([#3932](#3932))
([be2b205](be2b205))
* **proxy:** read HEADROOM_LICENSE and make usage reporting opt-in
([#3857](#3857))
([7460389](7460389))
* **proxy:** reap wrap-spawned proxies once no wrap clients remain
([#3202](#3202))
([4227bd2](4227bd2))
* **proxy:** redact upstream error detail and add opt-in /metrics
loopback gate
([#2589](#2589))
([a05717f](a05717f))
* **proxy:** refuse token-less non-loopback binds, gate operator routes
([#3852](#3852))
([ee731d7](ee731d7))
* **proxy:** reset the cc-switch upstream when Claude Official is
selected
([#3166](#3166))
([fed7281](fed7281))
* **proxy:** run extension middleware inside the security gate and body
ceiling
([#3847](#3847))
([1854fd7](1854fd7))
* **proxy:** run injected memory tools server-side on streaming turns
([#3947](#3947))
([1cf4966](1cf4966))
* **proxy:** share one compression deadline across a Responses request
([#3938](#3938))
([4d27d02](4d27d02))
* **proxy:** skip pricing lookup for passthrough:* models
([#2585](#2585))
([f87848c](f87848c))
* **proxy:** stop headroom logger from suppressing propagation to
stdout/stderr
([#3096](#3096))
([f78e66f](f78e66f))
* **relevance:** bound segment size by max_chars
([#2518](#2518))
([0ef7b2a](0ef7b2a))
* **reporting:** price the savings tile instead of fabricating $0.00
([#3821](#3821))
([f519fa8](f519fa8))
* **router:** fall back to built-ins when an external compressor passes
through
([#3893](#3893))
([2c4b20f](2c4b20f))
* **router:** keep ccr_retrieve exemption through orchestrator wrappers
([#3915](#3915))
([6151ed1](6151ed1))
* **rust-proxy:** forward request paths verbatim and pin the rustls
provider
([#3853](#3853))
([9d98ea5](9d98ea5))
* **savings:** record tool-schema dollars disjointly beside the folded
headline
([#3170](#3170))
([c719d4a](c719d4a))
* **savings:** stop scoring unobserved strata against the global mean
([#3128](#3128))
([f864525](f864525))
* **sdk:** keep tool names on Vercel tool-result parts through the
OpenAI round trip
([#3883](#3883))
([b715671](b715671))
* **sdk:** preserve Gemini media parts in message conversion instead of
dropping the turn
([#3882](#3882))
([038c923](038c923))
* **sdk:** stop JSON-wrapping structured tool_result content in the
Anthropic adapter
([#3797](#3797))
([2e4a60a](2e4a60a))
* **search:** stop a context line's body from becoming its line marker
([#3788](#3788))
([f3f2e00](f3f2e00))
* **security:** create memory stores and other state files owner-only
([#3848](#3848))
([5119b6e](5119b6e))
* **security:** exempt only GET health probes from the proxy token
([#3921](#3921))
([d99779d](d99779d))
* **security:** partition the response cache by credential and principal
([#3862](#3862))
([ee6cfcc](ee6cfcc))
* **security:** poll usage only with the operator's own credential
([#3863](#3863))
([65e63c0](65e63c0))
* **security:** stop forwarding the proxy token to upstream providers
([#3891](#3891))
([0147cf0](0147cf0))
* **settings:** report live proxy configuration
([#3177](#3177))
([58b1454](58b1454))
* **smart-crusher:** recurse at adaptive array limit
([#3770](#3770))
([7790bde](7790bde))
* **storage:** page JSONL queries after sorting
([#3872](#3872))
([91237ca](91237ca))
* **subscription:** match the Bearer scheme case-insensitively for the
Codex usage poll (RFC 7235)
([#3966](#3966))
([fe88461](fe88461))
* **subscription:** poll with the refreshed credentials-file OAuth token
([#3916](#3916))
([2dc9fc2](2dc9fc2))
* surface Codex responses traffic in dashboard
([#399](#399))
([ecc4967](ecc4967))
* **telemetry:** label custom-base chat upstreams from a fixed provider
set ([#3759](#3759))
([f0ec2bb](f0ec2bb))
* **thinking:** don't read the model's date suffix as its minor version
([#3791](#3791))
([afaaaa8](afaaaa8))
* **transforms/kompress:** preserve line boundaries and tabular output
in Kompress
([#3119](#3119))
([fe2ed2b](fe2ed2b))
* **transforms:** judge a Codex exec envelope read by its output
([#3878](#3878))
([922924e](922924e))
* **transforms:** judge the code_aware Kompress fallback in tokens
([#3881](#3881))
([6326965](6326965))
* **transforms:** keep record-bearing JSON out of Kompress
([#3673](#3673))
([#3880](#3880))
([8dbbd1d](8dbbd1d))
* **wrap:** never reuse a non-Headroom listener on the proxy port
([#3799](#3799))
([3ffa57e](3ffa57e))
* **wrap:** never reuse a proxy with incompatible routing config
([#3201](#3201))
([f69e246](f69e246))
* **wrap:** preserve pre-set ANTHROPIC_BASE_URL as proxy upstream
([#1358](#1358))
([bb1ab6a](bb1ab6a))
* **wrap:** scope Serena's MCP registration to the wrapped project
([#2787](#2787))
([#2992](#2992))
([8cfeb69](8cfeb69))
* **wrap:** set ANTHROPIC_HOST so `wrap goose` actually proxies
Anthropic
([#2619](#2619))
([c07fad0](c07fad0))
* **wrap:** strip -dev from running proxy version in restart check
([#3200](#3200))
([bd0296b](bd0296b))


### Performance Improvements

* add savings audit output
([#1211](#1211))
([9a72bc0](9a72bc0))
* **compression/code:** avoid a UTF-8 copy per code block in
byte-to-char mapping
([#3169](#3169))
([d5e5534](d5e5534))
* **image:** OCR and SigLIP each image once, not once per turn
([#3941](#3941))
([a8561fb](a8561fb))
* **memory:** bound traffic-learner _persisted_ids with the dedup window
([#3341](#3341))
([7e73438](7e73438))
* **metrics:** cap inbound request-path cardinality to bound memory
([#3340](#3340))
([88a1f4e](88a1f4e))
* **proxy:** lighter request path: alias the message snapshot, keep the
token cache on re-counts, decompress off the event loop
([#3909](#3909))
([c873d13](c873d13))
* **tokenizer:** memoize OpenAI token counts like the Anthropic counter
([#3168](#3168))
([0a2c80d](0a2c80d))


### Dependencies

* bump pyjwt 2.13.0 -> 2.15.1 for CVE-2026-102274
([#3861](#3861))
([37b9c46](37b9c46))
* Bump source-map-js from 1.2.1 to 1.2.2 in /docs
([#3986](#3986))
([e06631a](e06631a))
* Bump source-map-js from 1.2.1 to 1.2.2 in /plugins/openclaw
([#3988](#3988))
([4be83b3](4be83b3))
* Bump source-map-js from 1.2.1 to 1.2.2 in /plugins/opencode
([#3987](#3987))
([478dd9e](478dd9e))
* Bump source-map-js from 1.2.1 to 1.2.2 in /sdk/typescript
([#3985](#3985))
([62cde35](62cde35))
* bump the npm-minor-patch group across 2 directories with 11 updates
([#3903](#3903))
([afe4f4e](afe4f4e))
* bump the npm-minor-patch group across 3 directories with 11 updates
([#3910](#3910))
([ff1a0d6](ff1a0d6))
* bump webpki-roots from 0.26.11 to 1.0.8
([#3905](#3905))
([fee53b4](fee53b4))
* drop the crewai extra to remove chromadb from the lockfile
([#3870](#3870))
([59b8cef](59b8cef))


### Code Refactoring

* **ccr:** read the expansion query through extract_user_query
([#2707](#2707))
([dcec845](dcec845))
* **wrap:** generate goose/openhands/openclaude from a WrapTarget
registry
([#3800](#3800))
([de4cf7e](de4cf7e))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.39.1 (#3807)

🤖 I have created a release *beep* *boop*
---


##
[0.39.1](v0.39.0...v0.39.1)
(2026-09-26)


### Bug Fixes

* **proxy:** stop the 0.39.0 TPM limiter from refusing large-context
requests forever
([#3806](#3806))
([7968122](7968122))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.39.0 (#3713)

🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2026-09-25)


### Features

* **compression:** describe what CCR compression dropped, not just how
much ([#3635](#3635))
([62d1cc0](62d1cc0))
* **hooks:** add protect_messages, a hard per-message compression veto
([#3772](#3772))
([d17ac6a](d17ac6a))
* **opencode:** exclude hosts from transport plugin routing
([#3668](#3668))
([0024b57](0024b57))
* **proxy:** let /transformations/feed omit message bodies for
number-only pollers
([#3672](#3672))
([46ac52d](46ac52d))
* **savings:** carry exact cache-read cost in history rollups
([#3734](#3734))
([1cb779e](1cb779e))
* **savings:** show the new-input savings basis beside the whole-wire
figure
([#3485](#3485))
([e92cccc](e92cccc))
* **savings:** track lifetime output spend so a bill-share rate has a
denominator
([#3520](#3520))
([c766bdb](c766bdb))
* **sdk:** support per-call config override in compress()
([#3370](#3370))
([c3e8a1e](c3e8a1e))
* **wrap:** support 1m context in vscode claude
([#3361](#3361))
([fc5a09e](fc5a09e))


### Bug Fixes

* **anthropic:** reject ping-only SSE from buffered CCR
([#3682](#3682))
([000fefc](000fefc))
* **anthropic:** stop the spurious compaction warning and drop dead
handler code
([#3678](#3678))
([6e71267](6e71267))
* **backends/litellm:** stop dropping image blocks from /v1/messages
requests
([#3753](#3753))
([577336d](577336d))
* **binaries:** fail closed when a download carries no sha256 pin
([#3724](#3724))
([26a2c49](26a2c49))
* **cache/google:** tolerate timezone-aware cache expiry timestamps
([#3210](#3210))
([7ce2580](7ce2580))
* **cache:** default CCR payload previews off; harden the log when they
are on
([#3728](#3728))
([5cb87bc](5cb87bc))
* **cache:** never batch-compress already-forwarded small Responses
outputs in cache mode
([#3756](#3756))
([ab62b9e](ab62b9e))
* **cache:** preserve cache_control schema properties
([#3348](#3348))
([b84c4c9](b84c4c9))
* **cache:** preserve the forwarded OpenAI chat prefix across turns
([#3757](#3757))
([deca575](deca575))
* **cache:** stop prefix transforms from busting the provider cache
([#3735](#3735))
([a2bf5ed](a2bf5ed))
* **cache:** stop skipping tool compaction on a pinned tools array
([#3750](#3750))
([a6a9cef](a6a9cef))
* **cli:** keep non-ASCII working directory names out of the init
profile slug
([#3718](#3718))
([f3d95ee](f3d95ee))
* **cli:** report anonymous beacon status accurately in the banner, log,
and /stats
([#3533](#3533))
([fa9edb3](fa9edb3))
* **content_detector:** detect CMTrace (SCCM/Intune) logs as
BUILD_OUTPUT
([#3712](#3712))
([6feb1fb](6feb1fb))
* **dashboard:** separate rolling cache economics by owner
([#3319](#3319))
([a29162b](a29162b)),
closes [#960](#960)
* **docker:** support OpenCode in native wrapper
([#3547](#3547))
([d90dadf](d90dadf))
* fall back for non-admin Windows task installs
([#3437](#3437))
([b958509](b958509))
* **graph:** fetch and extract the zip codebase-memory-mcp asset on
Windows
([#3730](#3730))
([b776983](b776983))
* **grok:** preserve xAI model context metadata
([#3312](#3312))
([#3315](#3315))
([c81378c](c81378c))
* **init:** raise the ensure hook's timeout above cold-start latency
([#3438](#3438))
([9a11109](9a11109))
* **install:** apply managed env vars added after a deployment was
installed
([#3740](#3740))
([a4cb2bc](a4cb2bc))
* **install:** wait for the old process to stop before restarting
([#3670](#3670))
([11c7320](11c7320))
* **kompress:** bound the inference deadline to the request, not each
block ([#3693](#3693))
([7f2766c](7f2766c))
* **kompress:** keep the boolean connectives that hold a condition
together
([#3687](#3687))
([bf290ba](bf290ba))
* **learn:** treat an unreadable project memory dir as absent instead of
crashing
([#3710](#3710))
([ff60d57](ff60d57))
* **mcp:** accept an empty install ledger instead of failing mutations
as malformed
([#3235](#3235))
([19ddfe1](19ddfe1))
* **memory/graph:** apply relation_type filter to both sides of a BOTH
subgraph query
([#3236](#3236))
([1a6f941](1a6f941))
* **memory:** fail closed for unresolved tools
([#3655](#3655))
([7c3cbc8](7c3cbc8))
* **memory:** make extract_system_prompt concatenative, not first-match
([#3644](#3644))
([3f3cf19](3f3cf19))
* **memory:** tolerate None message content in inline memory parser
([#3211](#3211))
([5ccec67](5ccec67))
* **metrics:** split rate-limited by source and label failures by
provider
([#3707](#3707))
([5ff4ea1](5ff4ea1))
* **openclaw:** declare transcriptSemantics and implement commitTurn
([#3442](#3442))
([a28dd4e](a28dd4e))
* **perf:** make budget checks constant-time
([#3368](#3368))
([ed08069](ed08069))
* **perf:** make rate limiter bucket checks constant-time
([#3373](#3373))
([a8bd9be](a8bd9be))
* preserve null and empty strings in lossless CSV compaction
([#3665](#3665))
([7ad9f80](7ad9f80))
* **proxy:** admit container host gateway on compress routes
([#3715](#3715))
([a8ae0a6](a8ae0a6))
* **proxy:** bound request-log message payloads to the feed window; trim
glibc too
([#3717](#3717))
([994a89f](994a89f))
* **proxy:** count a ceiling-stopped stream exactly instead of
estimating its text
([#3771](#3771))
([b36e59a](b36e59a))
* **proxy:** discard partial SSE tails during finalization
([#3411](#3411))
([6c0e817](6c0e817))
* **proxy:** enforce configured TPM limits
([#3350](#3350))
([138736c](138736c))
* **proxy:** fall back when forced Kompress is cold
([#3381](#3381))
([ca54c2a](ca54c2a))
* **proxy:** make the output shaper actually reduce output in the
default mode
([#3773](#3773))
([c029298](c029298))
* **proxy:** partition response cache by upstream
([#3349](#3349))
([dfdc725](dfdc725))
* **proxy:** pin the validated address so DNS rebinding cannot move an
upstream
([#3731](#3731))
([a102e05](a102e05))
* **proxy:** preserve Claude Code auto-mode protocol
([#3784](#3784))
([12c1579](12c1579))
* **proxy:** preserve empty transport error context
([#3675](#3675))
([ca02f28](ca02f28))
* **proxy:** preserve OpenCode Headroom retrieve results
([#3782](#3782))
([c7ebaed](c7ebaed))
* **proxy:** protect Codex exec reads whose argument is a JavaScript
object literal
([#3737](#3737))
([ecb5e5a](ecb5e5a))
* **proxy:** reject Anthropic batch operations on Copilot
([#3318](#3318))
([871bbde](871bbde))
* **proxy:** repair client-side tool_search tool_reference blocks
([#3443](#3443))
([f12e3fb](f12e3fb))
* **proxy:** resolve Codex custom_tool_call names for Responses tool
exclusion
([#3755](#3755))
([55c78de](55c78de))
* **proxy:** restrict urlopen SSL context ALPN to http/1.1
([#3567](#3567))
([5baa439](5baa439))
* **proxy:** scope OpenAI rate limits by api-key
([#3365](#3365))
([b9e8462](b9e8462))
* **proxy:** stamp x-headroom-* compression metrics on streaming
responses
([#3769](#3769))
([2c4dc44](2c4dc44))
* remove deprecated Apache license classifier
([#3566](#3566))
([b2d9275](b2d9275))
* **savings:** report negative savings instead of flooring them at zero
([#3744](#3744))
([1455f00](1455f00))
* **sdk:** enforce dormant public type tests
([#3424](#3424))
([95cbbb8](95cbbb8))
* **sdk:** preserve Anthropic image blocks in message conversion instead
of dropping the turn
([#3439](#3439))
([63676e6](63676e6))
* **sdk:** preserve proxy authentication alongside provider credentials
([#3450](#3450))
([ca4b47a](ca4b47a))
* **security:** create credential files private instead of narrowing
after write
([#3215](#3215))
([9b8cae8](9b8cae8))
* **security:** reject unauthenticated public proxy binds
([#3316](#3316))
([b0c19a2](b0c19a2))
* **smart-crusher:** disclose dropped scalar-array items with a
retrievable ccr sentinel
([#3692](#3692))
([c1fc84a](c1fc84a))
* **spreadsheet:** stop .xls integer rendering fabricating digits above
2^53 ([#3704](#3704))
([e8a5109](e8a5109))
* **spreadsheet:** stop inventing digits for .xls cells above 2**53
([#3700](#3700))
([1a7c5bb](1a7c5bb))
* **tests:** ask litellm for a model it prices instead of naming a
retired one
([#3722](#3722))
([0ad5e68](0ad5e68))
* **tool-search:** detect every wire shape of client-side deferral
([#3746](#3746))
([665b73d](665b73d))
* **tool-search:** don't orphan deferred tools, and stop overstating the
saving
([#3739](#3739))
([85f9e01](85f9e01))
* **tool-search:** make the core-tools override authoritative and the
warning recurrent
([#3745](#3745))
([a9757c9](a9757c9))
* **transforms:** detect fixed-width command output as tabular and keep
it out of Kompress
([#3786](#3786))
([6c9aef1](6c9aef1))
* **transforms:** stop embedded JSON pre-pass short-circuiting HTML
extraction
([#3620](#3620))
([195910b](195910b))
* **transforms:** stop routing timestamped log rows as grep matches
([#3748](#3748))
([d971f7c](d971f7c))
* **wrap:** handle SIGHUP on the shared proxy paths, not just `claude`
([#3331](#3331))
([c4df2dd](c4df2dd))
* **wrap:** stop blocking the launch on the Serena pre-index
([#3557](#3557))
([df8ebdf](df8ebdf))


### Performance Improvements

* **cache:** drop eager full-backend TTL sweep on every new-key store()
([#3256](#3256))
([2fed685](2fed685))
* **cache:** LRU-bound the compression-feedback tool-pattern map
([#3342](#3342))
([2d10b10](2d10b10))
* **memory:** reindex FTS5 a page at a time instead of a record at a
time ([#3466](#3466))
([3e36aef](3e36aef))
* **providers:** cache Google/Cohere token counters across requests
([#3273](#3273))
([cc6a07c](cc6a07c))
* **relevance:** order BM25 query terms once, not once per document
([#3468](#3468))
([6880984](6880984))


### Dependencies

* bump dotenv from 17.4.2 to 18.0.1 in /sdk/typescript
([#3765](#3765))
([56edfbc](56edfbc))
* bump ruff from 0.16.7 to 0.16.8 in the pip-minor-patch group
([#3761](#3761))
([b9ded1a](b9ded1a))
* bump the cargo-minor-patch group with 3 updates
([#3762](#3762))
([fbbe8b8](fbbe8b8))
* bump the npm-minor-patch group across 2 directories with 19 updates
([#3763](#3763))
([54357ff](54357ff))
* bump the npm-minor-patch group across 3 directories with 9 updates
([#3764](#3764))
([6311332](6311332))


### Code Refactoring

* **sdk:** route _fetch through rawFetch instead of duplicating it
([#3473](#3473))
([b2b5847](b2b5847))
* **smart-crusher:** drop the dead crush_object clone from the object
path ([#3705](#3705))
([7221724](7221724))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.38.0

Release Headroom 0.38.0.

chore: release 0.37.0 (#3228)

🤖 I have created a release *beep* *boop*
---


##
[0.37.0](v0.36.5...v0.37.0)
(2026-08-27)


### Features

* **compress:** session-aware /v1/compress (sidecar mode) + /v1/usage
relay ([#3270](#3270))
([4fa8802](4fa8802))
* **proxy:** self-limiting session state for the compression-cache
registry
([#3261](#3261))
([826b600](826b600))
* **proxy:** unify proxy and sidecar compression on one session engine
([#3271](#3271))
([d12ea50](d12ea50))


### Bug Fixes

* **cache/semantic:** don't semantic-match an empty query across
contexts
([#3226](#3226))
([455f4f2](455f4f2))
* **copilot:** preserve native enterprise model routing
([#2998](#2998))
([997a479](997a479))
* **kimi:** route managed Kimi Code through the proxy
([#3223](#3223))
([701e461](701e461))
* **learn:** surface Codex analysis failures
([#3016](#3016))
([632cb81](632cb81))
* **mcp:** add explicit Serena reconciliation
([#3222](#3222))
([7550efb](7550efb))
* **proxy/anthropic:** authenticate and attribute buffered Copilot turns
([#3277](#3277))
([4f2e70a](4f2e70a))
* **proxy:** enforce HEADROOM_PROXY_TOKEN on WebSocket handshakes
([#3305](#3305))
([27b4e2d](27b4e2d))
* **proxy:** make output-savings flush atomic and keep it off the event
loop ([#3231](#3231))
([b9d7dcc](b9d7dcc))
* **proxy:** protect file reads from lossy compression on the Responses
API path (Copilot view + HEADROOM_PROTECT_READS)
([#3238](#3238))
([4408e88](4408e88))
* **transforms:** stop compression garbling mixed subagent output
([#3286](#3286))
([8884d87](8884d87))
* **transforms:** stop folding datetime-prefixed user messages as search
results
([#3221](#3221))
([7784bb1](7784bb1))
* **vertex:** validate location region to close a path-parameter SSRF
([#3304](#3304))
([7c0b886](7c0b886))
* **windows:** terminate native proxy process tree
([#3313](#3313))
([91d4fc8](91d4fc8))
* **wrap:** stop concurrent wrap sessions clobbering settings.local.json
([#3232](#3232))
([f27f235](f27f235))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.36.5 (#3214)

🤖 I have created a release *beep* *boop*
---


##
[0.36.5](v0.36.4...v0.36.5)
(2026-08-22)


### Bug Fixes

* **codex:** detect ChatGPT auth from id_token claims so wrap/init emit
requires_openai_auth
([#3212](#3212))
([2f81fa5](2f81fa5))
* **doctor:** report project-scoped Claude routing instead of a false
negative
([#3213](#3213))
([8f3e33a](8f3e33a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.36.4 (#3189)

🤖 I have created a release *beep* *boop*
---


##
[0.36.4](v0.36.3...v0.36.4)
(2026-08-22)


### Bug Fixes

* **dashboard:** pin MIME types for the vendored static assets
([#3193](#3193))
([b485768](b485768))
* **proxy/responses:** keep the Codex additional_tools carrier on the
wire ([#3194](#3194))
([1617f83](1617f83))
* **security:** validate caller-supplied upstreams on every resolution
path ([#3195](#3195))
([3e3c409](3e3c409))
* skip cross-turn dedup pointers on OpenAI chat streaming
([#3191](#3191))
([9c30b62](9c30b62))
* **wrap:** make the Serena pre-index stall budget configurable
([#3183](#3183))
([202c189](202c189))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 0.36.3 (#3188)

🤖 I have created a release *beep* *boop*
---


##
[0.36.3](v0.36.2...v0.36.3)
(2026-08-21)


### Bug Fixes

* **proxy/responses:** lift Codex >= 0.149.0 additional_tools into
top-level tools
([#3186](#3186))
([25ca580](25ca580))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>