v2026.6.33
发布于 2026-08-08 · 翻译于
🎯 一句话总结：本版本全面强化系统安全与运行稳定性，优化消息投递与权限管控，显著提升长时任务可靠性。
📋 更新要点（中文翻译）
1强化网络与密钥安全，限制响应体积并防止凭证泄露至日志。
2提升长时运行代理稳定性，精准区分真实卡顿与正常模型调用。
3优化消息通道投递，修复重连丢消息及线程错乱问题。
4增强凭证恢复机制，服务重启保留密钥且修复流程更安全。
5支持扩展稳定版更新通道，软件包安装与更新不再意外降级。
6严格工具调用权限，执行命令需人工或插件确认以防越权。
7限制外部工具权限范围，采用临时会话授权并拦截不可信请求。
8强化网关授权校验，拦截非法来源请求并自动隐藏敏感信息。
9提升网关与进程稳定性，修复缓存溢出、句柄泄漏及心跳异常。
▶查看英文原文（Release Notes）
## 2026.6.33
### Highlights
- **Safer network and secret boundaries:** provider streams, Discord REST responses, browser fetches, OAuth paths, and logs now cap hostile response sizes and keep Telegram credentials out of diagnostics. (#96989, #95412, #99428) Thanks @wangmiao0668000666, @Alix-007, @xialonglee, @liuhaiyang14, @Pick-cat, @mushuiyu886, @vincentkoc, @ZOOWH, @Pandah97, @solodmd, @zhangguiping-xydt, and @obviyus.
- **More reliable long-running agents:** run release, liveness checks, and watchdog semantics now distinguish genuine stalls from active long model calls and wedged backends. (#102160) Thanks @obviyus, @kiagentkronos-cell, @alvelda, @alkor2000, and @vincentkoc.
- **Stronger channel delivery:** Discord reconnects no longer silently drop queued messages or repeat ambiguous non-idempotent sends, while Telegram bot-to-bot and reply-fence handling preserve the intended thread and authorization result. (#100896, #103867, #106755) Thanks @tiffanychum, @Godecule, @yetval, @xialonglee, and @RomneyDa.
- **Safer credential recovery:** service restarts preserve SecretRef-backed Telegram credentials, and OAuth repair no longer overwrites an already-valid destination profile. (#99124, #97541) Thanks @mushuiyu886, @1Wanker, @liuhao1024, @yetval, @Darren2030, @obviyus, and @RomneyDa.
- **Extended-stable updates:** package installations can select, update from, and receive availability notices for the `extended-stable` channel without silently falling back to another release line. (#99811, #100438) Thanks @kevinslin.
### Changes
- **Approval and tool authority:** Codex app-server commands now require an actual human/plugin approval, exec auto-review stays bound to the exact resolved command, and narrow tool allowlists remain owned by the factory that constructs them. (#103430, #103457, #104213) Thanks @obviyus, @brokemac79, @Pandah97, @wangmiao0668000666, and @pgondhi987.
- **Scoped external tooling:** external MCP loopback clients use short-lived session-bound