This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+13 more
Affected surfaces
Summary
AI summaryDefault model changed from codex to gpt-5.4, CLI version reporting fixed, and missing commands restored.
Full changelog
What's Fixed
Codex Governed Launches
Spawned Codex subprocesses now pass --ignore-user-config to prevent auth-sensitive MCP servers and plugin surfaces from poisoning governed runs. Default model changed from codex to gpt-5.4 to avoid unsupported model errors under ChatGPT-account auth.
CLI Version Reporting
The vendored CLI manifest version is now aligned with the root package version. martin-loop --version reports the installed version correctly, not a stale build artifact.
All CLI Commands Restored
start, tour, env, review, receipts explain, and enable commands restored after the public repo merge. The previous 0.3.9 npm build was missing these.
Stale Flag Reference Removed
Codex error guidance now references --ignore-user-config --sandbox workspace-write instead of the non-existent --ask-for-approval never flag.
Subpath Exports
martin-loop/core, martin-loop/contracts, and martin-loop/adapters are now importable subpaths for downstream packages.
Install
npm install -g [email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Keesan12/Martin-Loop
All releases →Related context
Related tools
Earlier breaking changes
- vmcp-v0.1.3 martin_status uses oneOf for selector exclusivity, latest as const.
- vmcp-v0.1.3 maxIterations and maxTokens modeled as integers in tool schemas.
- vmcp-v0.1.3 Tool schemas enforce additionalProperties: false on public contracts.
- vmcp-v0.1.3 Packaged artifacts now require and ship server.json alongside package.json.
Beta — feedback welcome: [email protected]