Trust before autonomy
Vector now treats agent autonomy as a security boundary. Packaged builds seal the credential-vault key with the operating system's secure storage and stop visibly if no protected store is available instead of falling back to a plaintext vault. Agent shell confinement remains an opt-in preview on supported macOS and Linux hosts instead of being enabled during this release; set OPENCODE_SHELL_SANDBOX=1 to try it. When enabled, unavailable confinement needs explicit approval and linked-worktree Git objects, refs, and reflogs stay read-only, while web access and reads of common SSH, cloud, Kubernetes, Docker, environment, and private-key files ask first. The hosted help and bug-report endpoints now validate origins, content types, sizes, and structured fields, and use atomic Redis rate limits that fail closed in production before model or email capacity can be spent. First launch no longer forces the exhaustive tour. It presents a short activation path with a read-only starter task, keeps the full guide optional, and only marks provider setup and the first task complete after a real model response finishes successfully. V2 sessions now calculate model spend from catalog input, output, reasoning, cache read, cache write, and context-tier prices, honor authoritative Copilot billing metadata, persist normalized token breakdowns, and keep session totals exact through event replay, replacement, and revert paths; usage without a finite catalog price keeps the existing $0 compatibility fallback. Releases are now blocked on package typechecks, unit tests, and desktop and website build smoke tests; macOS artifacts must be signed and notarized, Windows installers must carry a valid signature and an updater publisher identity, every expected architecture is checked, checksums are published, and update feeds must succeed before the GitHub release becomes public. The objective agent eval expands from five tasks to eight with billing-idempotency, path-containment, and concurrent-allowance cases, plus repeated trials for exposing run-to-run variance. Embedded SDK hosts now resolve their database location when their runtime is built rather than capturing a stale import-time path. The subagents Vector delegates to are now named and described for the work they do — Explore, General, Judge, Debug, Migration, Performance, Review, Security and Test — each with its own mark, a summary of what it handles, and a read-only badge where that matches its permissions. They appear by name in the session timeline, in the Agent Dashboard, and on a new Subagents page in Settings. Settings also gains Voice and Personalization, where custom instructions you write are saved to the instruction file every new session already loads. The settings panels scroll again: they were scrollable all along, but the scrollbar was hidden, so a page taller than the dialog simply looked cut off.