release: prepare v1.7.5

README.md

@@ -23,7 +23,7 @@ Listen to the SwiftASB Codex apps promo clip:
 
 ### Status
 
-SwiftASB is actively maintained and supported by Gale. Our current API is v1, and `v1.7.4` is the current and latest release.
+SwiftASB is actively maintained and supported by Gale. Our current API is v1, and `v1.7.5` is the current and latest release.
 
 ### What This Project Is
 
@@ -38,7 +38,7 @@ I built SwiftASB because I saw so many others building and forking existing Apps
 Add SwiftASB to your `Package.swift` dependencies:
 
 ```swift
-.package(url: "https://github.com/gaelic-ghost/SwiftASB", from: "1.7.4"),
+.package(url: "https://github.com/gaelic-ghost/SwiftASB", from: "1.7.5"),
 ```
 
 Then add the library product to your target dependencies:
@@ -60,7 +60,7 @@ Check your Codex version:
 ```bash
 codex --version
 ```
-*Note: SwiftASB currently supports the latest reviewed Codex CLI minor release, `0.139.x`. This narrow reviewed window will be revised once the app-server schema stabilizes or Codex CLI reaches a v1.x.x release.*
+*Note: SwiftASB currently supports the reviewed current Codex CLI minor release, `0.140.x`, and the latest prior minor, `0.139.x`, when that prior runtime remains compatible. This narrow reviewed window will be revised once the app-server schema stabilizes or Codex CLI reaches a v1.x.x release.*
 
 Add the Socket Marketplace to Codex and enable the SwiftASB Skills Plugin:
 

ROADMAP.md

@@ -42,15 +42,15 @@
 | --- | --- | --- |
 | Bundled schema-driven wire generation | `Shipped internally` | `scripts/generate-wire-types.sh` derives from the bundled v2 schema, patches dynamic JSON to `CodexWireJSONValue`, and validates the staged Swift output. |
 | Promoted generated v2 wire snapshot | `Shipped internally` | `Sources/SwiftASB/Generated/CodexWire/Latest/` now contains a wider lifecycle batch covering bootstrap, stored and loaded thread reads, filesystem reads and watches, config reads, extension inventory, remote-control status plus pairing/client-management wire families, thread goals, and many thread, turn, item, reasoning, and tool-progress notifications, alongside the hand-owned `CodexWireInitializeResponse` shim. |
-| Codex CLI schema review | `Shipped / ongoing` | The current reviewed compatibility window is `codex-cli 0.139.x`; the staged `v0.139.0` refresh added an optional thread target to `mcpServer/startupStatus/updated` and wording-only turn-environment comment drift, and SwiftASB kept the new MCP status target internal-only for now while preserving the repeatable dump and generation path through `scripts/dump-codex-schemas.sh` and `scripts/generate-wire-types.sh`. |
+| Codex CLI schema review | `Shipped / ongoing` | The current reviewed compatibility window is `codex-cli 0.140.x plus 0.139.x when feasible`; the staged `v0.140.0` refresh promoted additive config, plugin/app metadata, selected capability roots, and sub-agent activity wire changes internally, widened the public turn-item kind for `subAgentActivity`, and removed old public compatibility shims for fields no longer present in the reviewed app-server shape while preserving the repeatable dump and generation path through `scripts/dump-codex-schemas.sh` and `scripts/generate-wire-types.sh`. |
 | Stdio subprocess transport | `Shipped internally` | The transport launches `codex app-server --listen stdio://`, frames newline-delimited JSON, correlates request IDs, and captures stderr for diagnostics. |
 | Raw server-event fanout | `Shipped internally` | Transport can stream raw JSON-RPC notifications and server requests to higher layers. |
 | Typed protocol request encoding | `Shipped internally` | `initialize`, `initialized`, core thread and turn methods, archive-state actions, filesystem reads and watches, config reads, app/skill/plugin/collaboration-mode inventory, model/MCP/hook reads, MCP resource reads, and thread-goal methods are encoded through the protocol layer. |
 | Typed protocol response decoding | `Shipped internally` | `initialize`, core thread and turn methods, archive-state actions, filesystem reads and watches, config reads, app/skill/plugin/collaboration-mode inventory, model/MCP/hook reads, MCP resource reads, and thread-goal responses are decoded and validated against request IDs. |
 | Typed protocol notification decoding | `Partially shipped` | The protocol layer now maps a broader batch of app, thread, turn, item, reasoning, hook, MCP-status, config-warning, deprecation, remote-control, and reroute notifications, plus the item lifecycle needed to drive the current observable tool, MCP, file-edit, hook, and compaction summaries. |
 | Public owning client actor | `Shipped` | `CodexAppServer` owns transport plus protocol and exposes startup, shutdown, initialize, thread start, and turn start. |
 | Public value-typed request and result models | `Shipped` | Public API uses hand-owned Swift value types rather than exposing `CodexWire...` directly. |
-| App-wide capability surfaces | `Partially shipped` | `CodexExtensions.Inventory` now provides observable model capabilities, global MCP summaries, hook diagnostics, apps, skills, plugins, and collaboration modes with SwiftASB-owned refresh from app-server inventory notifications. Direct methods such as `listModels(...)`, `readModelCapabilities()`, `listHooks(...)`, `extensions.mcp.statusSnapshot()`, and `extensions.mcp.readResource(...)` remain available for one-off reads and inspector-style detail. Deprecated app-server inventory and MCP conveniences remain compatibility-only while consumers move to the top-level extension owner. Broader app-wide settings and actions still need deliberate public models before promotion. |
+| App-wide capability surfaces | `Partially shipped` | `CodexExtensions.Inventory` now provides observable model capabilities, global MCP summaries, hook diagnostics, apps, skills, plugins, and collaboration modes with SwiftASB-owned refresh from app-server inventory notifications. Direct methods such as `listModels(...)`, `readModelCapabilities()`, `listHooks(...)`, `extensions.mcp.statusSnapshot()`, and `extensions.mcp.readResource(...)` remain available for one-off reads and inspector-style detail. Broader app-wide settings and actions still need deliberate public models before promotion. |
 | Initialize handshake | `Shipped` | `initialize(...)` automatically sends the follow-up `initialized` notification. |
 | Thread start flow | `Shipped` | `startThread(...)` returns `CodexThread`, which carries thread metadata plus a back-reference to the shared app-server owner. |
 | Stored thread list flow | `Shipped` | `listThreads(...)` wraps `thread/list`, returns typed stored-thread pages, and now reconciles local thread metadata plus explicit archived or unarchived list results back into the internal history store. |
@@ -88,7 +88,7 @@
 | Internal thread history persistence | `Partially shipped` | The package now has a Core Data-backed `ThreadHistoryStore` that persists live-built thread and turn history, hydrates stored turns from `thread/read`, `thread/resume`, `thread/fork`, and `thread/turns/list`, seeds previously unknown local threads from paged history, widens persisted turn identity to stay thread-scoped across forks, and records explicit fork lineage while preserving conservative reconciliation that keeps richer local detail when upstream stored history is thinner. Public history paging/search helpers and archive-retention policy are still open. |
 | Direct local Codex thread storage | `Planned / prototyped` | SwiftASB now has a maintainer plan for an opt-in, read-only local Codex storage reader that can inventory threads through Codex's SQLite metadata and lazily hydrate JSONL evidence without forcing every caller through the app-server JSONL pipe. AgentSB prototypes the inspection shape for reports only; the package API, version gates, privacy defaults, and fallback behavior remain separate SwiftASB design work. See [`docs/maintainers/codex-direct-thread-storage-plan.md`](docs/maintainers/codex-direct-thread-storage-plan.md). |
 | Convenience run API | `Not started` | No `run(...)` or one-shot text convenience layer yet. |
-| Binary discovery and compatibility policy | `Partially shipped` | Explicit binary override exists, the docs now define a current-reviewed Codex CLI support window of `0.139.x`, transport startup checks PATH, common Homebrew paths, and the npm global prefix on macOS, and `cliExecutableDiagnostics()` now exposes the resolved binary, version string, and documented support-window assessment. Any further diagnostics work is now expansion rather than a missing baseline surface. |
+| Binary discovery and compatibility policy | `Partially shipped` | Explicit binary override exists, the docs now define a current-reviewed Codex CLI support window of `0.140.x plus 0.139.x when feasible`, transport startup checks PATH, common Homebrew paths, and the npm global prefix on macOS, and `cliExecutableDiagnostics()` now exposes the resolved binary, version string, and documented support-window assessment. Any further diagnostics work is now expansion rather than a missing baseline surface. |
 | README-level consumer docs | `Shipped / ongoing` | The README covers installation, runtime assumptions, first-use examples, the supported lifecycle, SwiftUI companion surfaces, and the current Codex CLI compatibility window. Future README work should track new public API additions rather than prerelease readiness. |
 | AgentSB maintainer automation | `Report-first maintainer app` | `Tools/AgentSB/` is a repo-local Python maintainer app that inspects SwiftASB deterministically, writes tracked reports under `docs/agents/reports/`, evaluates safety-boundary cases, diffs schema dumps, writes reviewable maintenance drafts, and prototypes local Codex thread-index inspection for future SwiftASB planning. The v1 boundary stays report-first: safe auto-apply is classifier-gated and limited to AgentSB-owned report artifacts, and it must not mutate Swift source, generated wire snapshots, public API, releases, or behavior-changing docs. |
 | Agent workflow guidance | `Shipped / ongoing` | SwiftASB-specific Codex guidance now ships through `socket`'s [`swiftasb-skills`](https://github.com/gaelic-ghost/socket/tree/main/plugins/swiftasb-skills) plugin, with skills for explaining SwiftASB, choosing an integration shape, building SwiftUI-facing app state, and diagnosing integration failures. This repo now points package users and maintainers at that plugin while keeping SwiftASB source, DocC, tests, generated-wire review, and release notes here as the package source of truth. |
@@ -112,17 +112,17 @@ lifecycle, SPI visibility, basic history hydration, first-pass reconciliation,
 or command-approval completion. Those slices now exist and shipped in the
 `v1.7.1` baseline.
 
-The next meaningful work after the `v1.7.4` patch release is to probe and deliberately shape the newly promoted
-Codex CLI `0.139.x` wire families before widening public API. The `v0.139.0`
-promotion itself stayed intentionally small: SwiftASB refreshed the promoted
-wire snapshot, kept the new optional `threadId` on
-`mcpServer/startupStatus/updated` internal-only for now, and left the public
-MCP diagnostics surface app-wide and summary-oriented. Remote-control
+The next meaningful work after the `v1.7.5` patch release is to probe and deliberately shape the newly promoted
+Codex CLI `0.140.x` wire families before widening public API further. The
+`v0.140.0` promotion refreshes the internal wire snapshot, exposes
+`subAgentActivity` as a public turn-item kind, and removes older public
+compatibility shims for prior app-server shapes rather than carrying fallback
+fields forward. Capability roots, plugin sharing metadata, remote-control
 pairing/client management and pairing status, account token usage, turn
-moderation metadata, plugin app templates, skills extra roots, richer
-turn-start context, runtime workspace roots, environments, structured output
-schemas, and rollout-path forking still need live behavior evidence before
-SwiftASB turns them into stable Swift surfaces. Descriptors should compile
+moderation metadata, plugin app templates, richer turn-start context, runtime
+workspace roots, environments, structured output schemas, and rollout-path
+forking still need live behavior evidence before SwiftASB turns them into
+stable Swift surfaces. Descriptors should compile
 against Codex-owned workspace, Git, file, and thread facts wherever possible,
 rather than making SwiftASB or a sandboxed client infer repository identity by
 walking the local filesystem.
@@ -782,10 +782,10 @@ workflow earns them in a later feature release.
   public API until live behavior and consumer use cases are clearer.
 - [x] Decide whether v1 should support only the latest documented rolling window
   or whether a shorter first-v1 compatibility promise is more honest.
-  Decision: use a narrow latest-reviewed-minor support window, currently
-  `0.139.x`, and widen deliberately after generated-wire and public API review
-  catches up
-  with later Codex CLI releases.
+  Decision: use a narrow current-plus-latest-prior support window where
+  feasible, currently `0.140.x plus 0.139.x when feasible`, and widen
+  deliberately after generated-wire and public API review catches up with later
+  Codex CLI releases.
 
 ### History And Observable Companions
 
@@ -893,7 +893,8 @@ workflow earns them in a later feature release.
 #### Compatibility Window
 
 - The compatibility promise is intentionally narrow while app-server schema is
-  moving quickly: reviewed support for Codex CLI `0.139.x`.
+  moving quickly: reviewed support for current Codex CLI `0.140.x` plus the
+  latest prior minor `0.139.x` when feasible.
 - SwiftASB discovers `codex` from an explicit executable URL, `PATH`, common
   Homebrew locations, or the npm global prefix, and exposes startup diagnostics
   through `cliExecutableDiagnostics()`.
@@ -903,7 +904,7 @@ workflow earns them in a later feature release.
 #### Migration Notes
 
 - Existing `v0.9.x` consumers should update the SwiftPM dependency to
-  `from: "1.7.4"` once the tag is published.
+  `from: "1.7.5"` once the tag is published.
 - The v1 API surface has removed stale pre-v1 compatibility shims and phantom
   fields that no longer exist in the reviewed `v0.128.0` schema.
 - Same-thread overlapping turns are rejected client-side with
@@ -928,7 +929,7 @@ workflow earns them in a later feature release.
 
 - Keep an eye on future Swift Package Index builds after compatibility-window
   or DocC changes; the `v1.1.1` listing and documentation link are live, and
-  `v1.7.4` should be rechecked after the patch tag is indexed.
+  `v1.7.5` should be rechecked after the patch tag is indexed.
 - Add broader live server-request coverage for permissions and MCP elicitation
   if those become stronger public runtime guarantees.
 - Continue tuning recent companion cache calibration, richer file previews,
@@ -1181,13 +1182,13 @@ runtime can be driven with a mock Responses provider.
   completion.
 - [x] MCP server elicitation.
   Decision: deterministic fake-transport coverage proves public routing and
-  response behavior, and the opt-in live server-request runner now drives an
-  app-connector MCP fixture through the real app-server. The probe asserts MCP
-  tool-call delivery, `mcpServer/elicitation/request` delivery, SwiftASB's
-  JSON-RPC response, `serverRequest/resolved`, and terminal turn completion.
-  The regular stdio MCP fixture remains available as an explicitly opted-in
-  observational probe, while app-connector MCP is the deterministic live
-  elicitation coverage source.
+  response behavior. The opt-in live server-request runner keeps an
+  app-connector MCP fixture in the release gate, but current Codex CLI behavior
+  may complete the turn without routing that fixture to the MCP event stream.
+  When the app-server emits the MCP tool call, the probe still asserts
+  `mcpServer/elicitation/request` delivery, SwiftASB's JSON-RPC response,
+  `serverRequest/resolved`, and terminal turn completion. The regular stdio MCP
+  fixture remains available as an explicitly opted-in observational probe.
 - [ ] Guardian denied-action approval after SwiftASB owns a stable public model.
 - [x] Model capability snapshot through `CodexAppServer.readModelCapabilities()`.