release: veryfront 0.1.1265

[kwakayama]

Stable release 0.1.1265, cut from the 0.1.1265-rc line at c46cc40d7 (main tip). On main, CI publishes the stable version (npm latest, JSR, binaries) and dispatches veryfront-code-released to veryfront-server.

The main reason for this release is the Integration 1-3 work, which production projects on the stable line only get with this version:

• docs: publish integration journey, recovery and credentials guides #4589 integration journey, recovery and credentials guides (d024c117e)
• fix(integrations): make connector setup and side-effect metadata truthful #4623 truthful connector setup and side-effect metadata (204ce1284)
• feat(integrations): bounded consent wait and typed stale connection refusal in the client #4625 bounded consent wait and typed stale connection refusal in the client (deb92e0c8)
• fix(integrations): reject consent baselines from another scope #4635 reject consent baselines from another scope (ce4f2b23c)
• fix(cli): embed every bundled skill, references included, in the npm package and binary #4636 embed every bundled skill, references included, in the npm package and binary (5e15a0ac6)

Also ships since 0.1.1264:

• Integrations follow-ups: fix(integrations): load the Twilio scaffold and stop requiring env vars no tool reads #4637, docs(integrations): publish a setup guide for every default connector #4638, test(cli): pin integration get to the REST catalog detail #4639, fix(integrations): match Salesforce setup metadata to the published guide #4641, docs(integrations): handle the presenter promise when the connect URL deadline has passed #4642, docs(integrations): give the Node setup for the TypeScript first call #4643, fix(integrations): read API-key scaffold credentials from env in each client #4644
• Provider and models: feat(provider): add GPT-6 Sol and Luna to the shipped model table #4640 (GPT-6 Sol and Luna), feat(provider): send Anthropic Messages to /ai/v1 #4615 (Anthropic Messages to /ai/v1), feat(provider): read model facts from the served catalog instead of the shipped table #4610 (model facts from the served catalog)
• Agent runtime: fix(agent): follow the served surface for tool schema rules and replay #4618, feat(agent): prepare managed executor runs from served catalog facts #4620, Trace provider replay checkpoint appends #4595
• Observability and logging: fix(metrics): send the project token with hosted project metrics #4619, fix(observability): join proxied requests to their caller's trace and name run lineage #4621, test(observability): prove local OTLP HTTP export #4622, feat(logging): emit service_version (artifact tag) in runtime and proxy JSON logs #4627, fix(observability): stamp run release on control-plane cancel and resume spans #4629, docs(observability): complete local trace setup guidance #4634
• API: refactor(api): retire the textual fallback from the handler validator #4581
• Version line: chore: open the 0.1.1265-rc prerelease line #4617

Verification

• 0.1.1265-rc.20528 (495ae0c90, contains all five integration merges above) runs on the staging veryfront-server (image 20260928065351-6570abe1079e, RELEASE_VERSION=v0.1.1265-rc.20528).
• Strict staging E2E on it: run 36388889651 (Remote E2E Health, staging, strict, dispatched 06:55 UTC after the 06:53 rollout, green: platform-ui, ai-live, overall_green).
• This cut adds docs(integrations): give the Node setup for the TypeScript first call #4643 (docs) and fix(integrations): read API-key scaffold credentials from env in each client #4644 on top of rc.20528.
• 0.1.1265 is not yet on npm and has no tag.

Changes (same as #4613):

• deno.json version
• src/utils/version-constant.ts
• regenerated hydration-runtime.generated.ts (version-only change; prebundle-hydration-runtime.ts --check passes)

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T07:11:23.768646Z	3a78bc1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	289	2325 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: d057c279-2a57-4fd4-832b-3d90a400f702

📥 Commits

Reviewing files that changed from the base of the PR and between c46cc40 and 3a78bc1.

⛔ Files ignored due to path filters (1)

• src/html/hydration-script-builder/hydration-runtime.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (2)

• deno.json
• src/utils/version-constant.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The package version in deno.json and the exported VERSION constant changed from 0.1.1265-rc to 0.1.1265.

Changes

Version Release Update

Layer / File(s)	Summary
Update package version values deno.json, src/utils/version-constant.ts	The configured package version and exported VERSION value changed from 0.1.1265-rc to 0.1.1265.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 3a78b

The release version is consistent across package metadata and the inspected runtime consumers. No actionable versioning issue remains in the supplied changes.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3a78b

The changed code does not show a new access path or weakened control. The stable release reaches an existing distribution and deployment path, but downstream rollout and rollback behavior have not been fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Stable publication can broaden exposure beyond prerelease consumers, and the existing workflow names three downstream deployment recipients. The effective production exposure of each recipient was not established.

Trust Boundaries and Controls

• inferred — The changed constant is a static string, and its inspected eval use supplies metadata rather than crossing an identity or authorization boundary. No new attacker-controlled path was identified in that scope.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release of veryfront version 0.1.1265, which matches the primary changes.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[kwakayama]

Code review: 96/100 — Excellent

Trivial, mechanical release-version-bump PR. Correct as scoped, nothing to block on.

Strengths

• Change is exactly the three files this class of release PR should touch: deno.json version, src/utils/version-constant.ts, and the regenerated hydration-runtime.generated.ts.
• I traced the ~79KB diff hunk in the generated bundle by hand: the pre- and post-image are byte-identical except for the single embedded var VERSION = "0.1.1265-rc" → "0.1.1265" string. It's genuinely a version-only regeneration, as the PR description claims, not a hand-edit masquerading as one.
• version-constant.ts and deno.json stay in sync, consistent with the "Keep in sync with deno.json version" contract documented in the source comment.
• PR description is thorough: names the exact commit the release is cut from, links the constituent PRs, and documents staging verification (0.1.1265-rc.20528 running on staging, RC image tag noted).
• Matches the stated precedent (#4613) for what a release PR of this shape should contain, so this is a repeatable, low-risk pattern rather than a one-off.

Minor notes (non-blocking)

• CI was still mid-run at review time (several coverage shards, lint, and the E2E suites in progress). Worth confirming everything lands green, and that the "Strict staging E2E" result promised in the description gets added before merge as noted.
• mergeable_state currently shows blocked — likely just pending required checks/reviews rather than a real conflict, but worth a glance before queueing.

No functional risk here; this is exactly the kind of change that should be fast to approve once CI is green.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud