Starstruk Logo MarkStarstruk

v1.16.22 v1.16.21

high risk

niri-wm/niriSep 28, 2026 → Sep 27, 20260 days between releases

What's New

v1.16.21 predates v1.16.22, so this 'upgrade' is really a rollback of host validation and hook approvals

Breaking Changes

  • Moving to v1.16.21 drops the web server's host-name allowlist and 421 rejection, so reverse-proxy or Tailscale Serve fronting loses that guard and `[web] allowed_hosts` / `--allowed-host` become inert.
  • Worktree hook approvals revert to the pre-SHA256 scheme, so `.agent-deck/worktree-setup.sh` and `worktree-destruction.sh` are no longer bound to script hash, resolved path and interpreter.
  • The HttpOnly, SameSite=Strict cookie issued on `?token=` visits is absent, so token-authenticated web sessions may not survive a reload when using `--token-file`.

New Features

  • Model and reasoning-effort lists are probed from the installed CLI (Codex via `codex debug models`, cached per binary) with built-in lists as fallback, though v1.16.22 almost certainly already carries this.
  • A `[models] probe = false` setting lets you disable the CLI model probe entirely.

Improvements

  • SSH authentication retry logic was reworked to recover from transient failures.
  • A `[claude] default_model` missing from the list is now prefilled with a warning instead of being silently dropped.
  • The credential symlink fix is retained so worker sessions still share a single login through Claude Code's own lock.

Bug Fixes

  • Push notifications for the web UI were restored.
  • Status filter shortcuts were corrected.

Upgrade Notes

Verify the version ordering before acting: v1.16.21 was published a day before v1.16.22 and carries a lower version number, so targeting it is a downgrade that removes host validation, the token cookie and SHA256-bound hook approvals. If you truly need to roll back, strip any `[web] allowed_hosts` entries you added and re-approve worktree hooks under the older scheme. Staying on v1.16.22 is the safer path.

The Two Releases

v1.16.22

v1.16.22

Sep 28, 2026· 25 days ago

Updated web server host validation to prevent 421 errors and introduced a new approval system for repository worktree hooks based on SHA256 and execution context.

Full release notes
v1.16.21

v1.16.21

Sep 27, 2026· 26 days ago

Removed the deprecated `creds-refresh` command and added model listing capability from the installed CLI. Fixed push notifications and SSH authentication retry logic.

Full release notes