release: veryfront 0.1.1264

[kwakayama]

Stable release 0.1.1264, cut from the 0.1.1264-rc line at b4bab6610 (main tip, 0.1.1264-rc.20260). On main, CI publishes the stable version (npm latest, JSR, binaries) and dispatches veryfront-code-released to veryfront-server.

The main reason for this release is #4599: Veryfront Cloud models now call the vendor-neutral gateway endpoints (/ai/v1, /ai/anthropic/v1) instead of /ai/gateway/{provider}. Projects pinned to the stable line keep calling the vendor route until they get this version, and the vendor route can only be deleted once production traffic on it is zero (veryfront/veryfront-issue-inbox#1859).

Ships since 0.1.1263, including:

• Provider and models: feat(provider): send Veryfront Cloud models to the vendor-neutral endpoints #4599 (neutral routes), fix: remove retired gateway models from model resolution #4611 (retired gateway models removed from resolution), Retire DeepSeek from managed model selections #4569 (DeepSeek retired from managed selections), fix(provider): preserve verified Mistral system message boundaries #4568, fix(provider): accept a tool call that an OpenAI-compatible model closes twice #4566, fix(agent): retain Gemini signatures across streamed tool turns #4570
• Agent runtime: fix(agent): park a control-plane invoke_agent instead of running it locally #4587, fix(agent): preserve recent file reads for follow-up edits #4596, feat(agent): execute connected source with consuming project identity #4572, fix(agents): honor signed execution environment bindings #4564
• Integrations: feat: add project-bound integration client and CLI lifecycle #4580, feat(integrations): negotiate connection generation preconditions #4582, feat(integrations): expose shared selected readiness in client and CLI #4584, fix(integrations): retain typed remote failure conditions #4567
• Observability: fix(agent): mark failed agent.run spans as ERROR with their run error code #4600, fix(proxy): stamp snake_case project and request fields on proxy logs #4601, feat(observability): tag project request spans with the serving release #4602, fix(server): identify the run on project run execution spans #4603, fix(metrics): make sparse project counters countable and bound tenant series #4604, refactor(observability): simplify run outcome tracking, route span attributes and proxy log deprecations #4605, refactor(observability): make project run dispatch and run id parsing easier to follow #4607, Trace durable API calls from agent execution #4590, Fix outbound trace context fallback #4583
• API client: Accept conversations without a type field #4592, Accept decimal-string credit and USD amounts from the Veryfront API #4593, refactor(api): make the parsed analysis the validator's single source of truth #4578, fix(api): stop the capability analyzer overflowing and rejecting ordinary code #4579

Verification

• 0.1.1264-rc.20250 (52c148dcc, includes feat(provider): send Veryfront Cloud models to the vendor-neutral endpoints #4599) runs on the staging veryfront-server. Strict staging E2E on it: run 36297282255 (Remote E2E Health, staging, strict, green).
• rc.20260 (b4bab6610, this cut) adds fix: remove retired gateway models from model resolution #4611 and feat(integrations): expose shared selected readiness in client and CLI #4584 and now runs on the staging veryfront-server after a re-run of the rollout the Actions budget had blocked. The strict E2E above predates it.
• 0.1.1264 is not yet on npm and has no tag; stable-release-requested.sh returns true for this change.

Changes (same as #4557):

• deno.json version
• src/utils/version-constant.ts
• regenerated hydration-runtime.generated.ts (deno task generate, version-only change; generate:manifests:check passes)

Part of veryfront/veryfront-issue-inbox#1859

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T08:11:44.868541Z	0179b66	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: fb39e217-a99a-412b-97a2-7ca535f8fa8e

📥 Commits

Reviewing files that changed from the base of the PR and between b4bab66 and 0179b66.

⛔ Files ignored due to path filters (1)

• src/html/hydration-script-builder/hydration-runtime.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (2)

• deno.json
• src/utils/version-constant.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The configured version and exported VERSION constant change from 0.1.1264-rc to 0.1.1264.

Changes

Release version update

Layer / File(s)	Summary
Update release version values deno.json, src/utils/version-constant.ts	The configured version and exported VERSION constant change to 0.1.1264.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0179b

The version update is consistent with the stated stable-release intent. No merge-blocking risk is identified in the supplied context.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0179b

The release broadens distribution of an existing build, but the reviewed changes do not show a new security boundary or permission. Publication has release checks; the latest candidate’s production behavior and downstream deployment recovery remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The release can reach stable package users and initiate deployment across three receiving repositories. The changed VERSION constant itself has no identified attacker-controlled input or newly privileged sink.

Trust Boundaries and Controls

• observed — The sending workflow requires successful release and registry checks before dispatch and obtains a repository-scoped application token. No receiving-side trust decision was available to assess.

Resilience and Maintainability Implications

• observed — The stable npm publisher fails closed on an already-published version rather than treating a conflicting write as its own. This limits mistaken publication attribution, while leaving interrupted-release recovery to a separate process not established by the reviewed evidence.

Hardening Proposals

• proposed — Before retiring vendor routes, confirm production traffic has reached zero for pinned clients and establish a recovery path for partial publication or downstream dispatch. These are release checks, not verified defects in this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the stable release of veryfront version 0.1.1264, which matches the primary changes and objectives.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	289	2321 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[kwakayama]

Code review: 96/100 — trivial, mechanical release PR, verified correct

This is a version-bump release PR (0.1.1264-rc → 0.1.1264), scored accordingly rather than as a feature change.

Strengths

• Diff is exactly the three files the description promises: deno.json, src/utils/version-constant.ts, and the regenerated hydration-runtime.generated.ts. No unrelated changes.
• Verified the generated file's actual content delta (it's a single very long line): the only change inside the bundled string is var VERSION = "0.1.1264-rc"; → var VERSION = "0.1.1264";. No incidental line-number/formatting drift from a mismatched Deno version, which AGENTS.md specifically warns can turn CI red.
• deno.json and version-constant.ts changes are in sync with each other and with the generated bundle — no split-version risk.
• PR description is thorough: cites the RC line it was cut from, the reason for the release (feat(provider): send Veryfront Cloud models to the vendor-neutral endpoints #4599 neutral gateway routes), a linked staging E2E run, and states the generate:manifests:check step passed.
• Commit message and PR title follow the existing release: veryfront <version> convention.

Minor notes (non-blocking)

• mergeable_state is currently blocked and several required CI checks (lint, typecheck, coverage shards, e2e) were still queued/in-progress at review time — nothing to flag in the code itself, just confirm the full required check set goes green before merging.
• No test changes are expected or needed for a pure version constant bump.

Given the trivial, generated-only nature of this change and that the actual diff was verified by hand rather than taken on faith, this is approvable pending green CI.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kwakayama]

Release gate: strict veryfront-e2e run https://github.com/veryfront/veryfront-e2e/actions/runs/36305340670 against staging on 0.1.1264-rc.20260 (same content as this release) is green on attempt 2. Attempt 1 failed once in chat-recovery.health.spec.ts:33 and passed on retry, so it looks like a flake. Ready for the second approval.

[kwakayama]

main now includes the veryfront/veryfront-issue-inbox#1913 fix (qwen hosted provider routing, #4616, 798146d), so it ships in 0.1.1264 once this release PR is rebuilt from main.