release: Token Widget 0.4.0

[SergioChan]

Summary

• release the native, CDP-free Codex overlay as Token Widget 0.4.0
• tolerate rollout files pruned between discovery and reading so the native overlay stays alive
• promote the existing Unreleased notes to the dated 0.4.0 changelog entry
• update package and lockfile versions to 0.4.0

Scope decision

PR #1 is conflicting and primarily targets the deprecated CDP injector. This PR integrates only its rollout-pruning race fix because the new native Codex runtime shares RolloutStore; legacy CDP retry/socket work is not a 0.4.0 release blocker, and the new-session binding behavior already has equivalent coverage on main.

Verification

• npm run check — passed (78 JavaScript, 22 shell, 20 Markdown files)
• Node.js 22.13 focused release/runtime suite — 29/29 passed
• Node.js 22.22 focused rollout/native snapshot suite — 14/14 passed
• git diff --check — passed

Post-merge release plan

After CI passes and this PR merges: build with the Developer ID identity, notarize and staple the DMG, verify Gatekeeper/signature/version, publish v0.4.0 and both immutable/latest-named assets, then update production release metadata in a separate deploy PR using the final artifact SHA-256 and size.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
token-widget	Ready	Preview	Aug 18, 2026 5:34am