docs(devlog): close the 2.66.0 release round

[lidge-jun]

Summary

Records the 2.66.0 release round in devlog/_fin/260925_release_2660_prs/: the roadmap (000-060) with its architect consultation and audit dispositions, and 070_done.md with the outcome, merge commits, CI and release evidence, the behavior change from #5839, what did not go to plan, and follow-ups. The unit is closed because 2.66.0 is published (npm latest 2.66.0, preview 2.66.0-preview.20260925, GitHub releases with 25 assets each, signed latest.json).

Docs only; no security review material is included (independent security reviews stayed in scratch, and only verdicts already public on the PRs are recorded).

Verification

• bun run privacy:scan: passed.
• bun run structure:check: passed.
• No absolute user paths in the unit; all internal references point at devlog/_fin/260925_release_2660_prs.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Direct chats now send heartbeat keepalives consistently, and these keepalives are not counted as relayed events.

• Security

  • For installations that opt in to native local execution, foreground Cursor shell operations are refused before they start. Background shell operations and other native operations are unchanged.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T15:25:44.016128Z	0bab5cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 84dd14c8-f0f5-4210-83b6-bb08528cc1ee

📥 Commits

Reviewing files that changed from the base of the PR and between ba3b3c5 and 0bab5cd.

📒 Files selected for processing (8)

• devlog/_fin/260925_release_2660_prs/000_plan.md
• devlog/_fin/260925_release_2660_prs/010_wp2_direct_chat_heartbeat.md
• devlog/_fin/260925_release_2660_prs/020_wp3_5006_5754.md
• devlog/_fin/260925_release_2660_prs/030_wp4_5835_5837_5826.md
• devlog/_fin/260925_release_2660_prs/040_wp5_security_5838_5839_5757.md
• devlog/_fin/260925_release_2660_prs/050_wp6_5778_5776_5780.md
• devlog/_fin/260925_release_2660_prs/060_wp7_release.md
• devlog/_fin/260925_release_2660_prs/070_done.md

 ___________________________________________________________________________
< I love a good shortcut. This is a great shortcut to production incidents. >
 ---------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bab5cdc35

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lidge-jun]

리뷰 · 우선순위 38 / 80

이 풀리퀘스트는 프로그램을 고치지 않아요. 이미 나간 2.66.0의 기록을 devlog/_fin/260925_release_2660_prs/에 넣어요. 바탕은 dev예요.

직접 채팅이 심박을 빠뜨리던 문제를 먼저 고치고, 골라 둔 풀리퀘스트를 dev에 합쳤어요. 그 나무의 후보 커밋은 82cb66e82d예요. 정식 버전은 2.66.0이고, 미리보기 태그는 2.66.0-preview.20260925예요. 합친 뒤 dev는 2.67.0을 가리켜요.

표에 적힌 합치기 커밋 13개, 승격 #5854와 #5855, 후보 CI 36142367892(성공 39개, 개인정보 검사 1개는 건너뜀), 릴리스 실행 두 개, GitHub 릴리스 파일 각 25개, npm latest 2.66.0을 다시 열어 봤어요. 적힌 값과 같습니다. types.ts와 config.ts 분리는 이 글에 없어요.

라인 - devlog/_fin/260925_release_2660_prs/040_wp5_security_5838_5839_5757.md 84–88행과 070_done.md 61–64행. 아직 안 고친 구멍을 저장소 기록에 다시 적어요. 설정 파일이 디스크에 올라간 뒤 쓰기가 실패하면 세대 번호를 올리지 않고, 이어서 할 정리도 건너뛴다는 내용이에요. 카탈로그 백업은 소유 등록이 실패하면 장부에 없는 파일이 남는다는 내용이에요. AGENTS.md는 이런 메모를 임시 폴더 .tmp에만 두라고 해요. 커밋하면 바로 공개되고, 나중에 지워도 역사에 남아요. 같은 설명은 이미 #5838과 #5780의 공개 댓글에 있어요.

라인 - 070_done.md 53–54행. #5778이 도우미 함수를 두 번 넣었고 감사가 잡았다고만 적혀 있어요. 그 블록은 합치기 전 커밋 2e7e4e53e5에서 빠졌어요. 합쳐진 결과 파일에는 중복이 없어요. 지웠다는 말이 기록에 한 줄 없어요.

메인테이너의 판단이 필요한 지점

61–64행과 040의 84–88행을 공개 스레드 번호만 남기고 줄일지, 댓글에 이미 있으니 이대로 둘지 정해 주세요.

너의 추천

바탕 dev가 맞아요. 이 글 때문에 닫을 중복은 없어요. 버전과 증거 숫자는 맞으니, 위 두 곳만 고치고 머지하면 돼요. 보안 줄은 "#5838, #5780 공개 스레드에 남은 일"로 줄여 주세요. 53–54행에는 지우기 커밋 2e7e4e53e5를 더해 주세요.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Maintainer integration by the owner. Docs-only; exact-head checks for e9da850: Cross-platform CI aggregate success (code legs skipped by path filters for a devlog-only diff), privacy gate, React Doctor, hygiene, enforce-target and CodeRabbit passed. The one review thread (unfixed follow-up details) was fixed in e9da850 and resolved.