0

Console recovery

• Add confirmed session-level Force stop for Bun on macOS and Linux. Stop the dedicated execution process and registered tool resources while keeping the engine and unrelated chats usable. Retain history, paused messages, scope and captured model connections. (#285, #229)
• Keep an execution quarantined when startup or teardown cannot confirm cleanup. Oversized display records cannot discard safety state, account bindings or pending operator input.
• Acknowledge runtime changes before continuing; preserve Daybreak selection and OpenCode Go conversation affinity through worker replacement.

Windows and findings

• Retry one timed-out, read-only Windows ACL query using the same five-second per-attempt limit. Permission, validation and unsafe-ACL failures remain terminal; diagnostics distinguish fixed launch-failure categories without exposing native error text. Native timeout recovery, unsafe-ACL and process-exit controls passed. (#289, #280)
• Show recorded finding status separately from retained verifier votes. A recorded reported, fixed or confirmed label alone no longer implies verifier consensus. (#287)

Documentation

• Shorten onboarding and model-connection guidance, remove retired terminal instructions, and clarify cited-source learning freshness. Dependencies or build/runtime changes still require revalidating affected conclusions. (#286, #288)

Force stop retains the existing adapter on Node, Windows, enabled Jev features and unsupported transports. Arbitrary external daemon escape is not universal containment; unconfirmed ownership stays blocked. Native-plan or relay changes on a supervised chat require a new chat. The release workflow qualifies the actual compiled worker using a loopback-only synthetic provider on supported platforms.

Added

• Explicit Daybreak selection in the console model menu and CLI assessments, using existing ChatGPT/Codex OAuth or public OpenAI Responses API credentials. Choices remain bound to the selected connection; requested access and provider confirmation are recorded separately. Requires provider-approved access. (#279)
• MCP controls for existing session workers, including correct attachment after a saved conversation is resumed and an 8,000-character message limit matching the engine. (#283)

Fixed

• Stable conversation headers for current and legacy OpenCode Go endpoints, including custom OpenAI-compatible connections. (#284)
• Lower Windows storage-verifier cold-start overhead while retaining fresh ACL checks and the five-second fail-closed deadline. Measured fresh probes improved from 2.85–4.83s to 1.91–2.20s. (#282)

Validated with source CI, native Windows ACL/junction tests, synthetic full-assessment API/OAuth wire tests, and the custom Daybreak menu in a browser. Release binaries and npm packages are built and smoke-tested by the release workflow.

Fixes the Windows 11 dashboard crash when selecting a model (#277).

• Validate private storage using native Windows ACLs instead of synthetic POSIX permission bits, retaining ownership and reparse-point protections.
• Handle delayed executable-plugin initialization failures without an unhandled dashboard-wide rejection.

Validated with the full source suite, six native Windows cases, a compiled Bun 1.3.14 check, and smoke tests for all four release binaries.

Changes: https://github.com/0sec-labs/0/pull/278

• Preserve findings already saved during discovery when a later scan stage fails. Retained candidates keep their actual status; partial execution and provider errors remain visible.
• Preserve automatic workflow/step deadline causes in child reports instead of attributing expiry to operator cancellation.
• Correct scan help and guides for optional scope-plugin activation, timeout/plan precedence and the published npm package.
• Cross-check and shorten 13 documentation pages against current behavior: browser UI, model connections, development reloads, Findings sorting, team collaboration, research limits and tool discovery. Replace historical roadmap sprawl with current workflow pointers. Operator documentation is net 277 lines shorter.

Validation includes deterministic SQLite-backed failed-report tests, workflow/step deadline and explicit-cancel controls, full build, repository-wide TypeScript checks, the generated reference for 189 commands, and a 61-page docs build with link checks. No model assessment or paid evaluation was needed.

Explicit Daybreak selection for the direct ChatGPT subscription route and a confirmed force-stop boundary for cancellation-ignoring local work remain open issues. Model-backed routing/evolution qualification also remains unperformed; this release does not claim those capabilities are qualified.