chore(release): v3.20.0

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to CC Switch will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [3.20.0] - 2026-08-18
 
 Development since v3.19.2 spans every subsystem, led by three structural additions. Pi becomes the ninth managed app (#6064): provider management over `~/.pi/agent/models.json` with 58 presets, a prompt library with system-prompt and slash-command editors, Skills, a session browser, and — behind a schema migration (`SCHEMA_VERSION` 16 → 17, the first new table since v12 introduced profiles) — session usage imported into the dashboard (#6463). Codex gains real multi-account ChatGPT management (#3879): sign in to several accounts in the Auth Center, bind each provider card to one of them or let it follow the CLI's own login, and switch between them like any other provider — with official cards deliberately leaving auto-failover so a retry can never bill a different account. And Claude Code's built-in WebSearch now works when routed to a Responses provider or the Codex OAuth backend, alongside proxy support for Codex's standalone Alpha Search endpoint (#5681). The urgent fix is for Windows-with-WSL users: v3.19.2's switch to `ReplaceFileW` failed on `\\wsl.localhost` paths with an error the fallback did not catch, so existing configurations could not be updated or switched (#6232) — this release repairs it and adds real WSL2 filesystems to CI (#6233). The same Windows wave overhauls CLI detection to read the registry PATH and standalone installer directories, fixing a five-issue family of "not installed" and stale-version reports (#6284), eliminates the white/black startup flash (#6252), and stops the MSI from writing a garbage registry key it had been writing since v3.4.0 (#6283). Codex reasoning control gets a full pass: per-model reasoning levels in the model catalog (#6228), vendor-documented tiers pre-filled across the presets, and corrected thinking-switch dialects for the aggregator platforms that had been receiving fields their gateways never accepted. A contributor's backup/sync audit lands as two hardening waves — SQL dumps that round-trip every value and refuse truncated imports (#6146), and restores that rebuild every derived file and run strictly one at a time (#6147). Rounding it out: a sweeping provider-form consistency pass, an IME fix that stops macOS Chinese/Japanese input from corrupting form fields (#6308), and DeepSeek V4 repriced to the vendor's new peak-tier rates.
 
@@ -15,7 +15,7 @@ Development since v3.19.2 spans every subsystem, led by three structural additio
 
 - **Pi Joins CC Switch as the Ninth Managed App**: Pi runs in additive mode like OpenCode and Hermes — a provider is enabled exactly when its key exists in `~/.pi/agent/models.json`, and multiple providers coexist. The provider form is a structured editor over Pi's native schema (API format, per-model reasoning and thinking-level maps across Pi's seven levels, compat keys), backed by 58 presets covering four of the five API formats the form offers (everything but Google Generative AI) and a reviewed 57-model capability catalog; a raw JSON editor and a fetch-models button round it out, and unknown fields in an existing node are preserved verbatim. Every read-modify-write is guarded by a content revision check, so an edit made by another process is refused with a conflict error instead of overwritten. The boundaries are deliberate and documented: CC Switch never materializes Pi's built-in providers into models.json, never reads or writes Pi's `auth.json`, and never touches `defaultProvider`/`defaultModel` — Pi's own login and model selection stay Pi's; providers already written into models.json are imported on first launch. Beyond providers: a prompt library that writes one chosen prompt into Pi's global `AGENTS.md` (auto-backing-up unmatched existing content as a library entry first), dedicated editors for `SYSTEM.md` (replaces Pi's base prompt) and `APPEND_SYSTEM.md`, a slash-command template manager over `~/.pi/agent/prompts/*.md`, Skills support with an exists-equals-active rule that refuses to overwrite or delete a same-named skill CC Switch does not own, a session browser for Pi's JSONL sessions, and Pi install/upgrade from Settings → About. Pi has no native MCP registry, so it is deliberately excluded from MCP sync, and it has no proxy takeover, failover or tray presence — proxy and failover commands now reject every app without a local gateway explicitly rather than writing dead configuration. (#6064)
 - **Pi Session Usage in the Dashboard**: A new importer reads Pi's session files and records tokens, costs, errors and aborted turns per model under a "Pi (Session)" source with its own app filter. Pi reports its own cost per entry, and a positive reported cost is preferred; a missing or all-zero cost falls back to CC Switch's pricing table. Incremental resync fingerprints each file's tail so only appended bytes are parsed, and rewritten or branch-forked sessions are deduplicated through a new durable ledger table — `session_usage_dedup`, the reason for this release's v16 → v17 schema migration — that survives detail-row pruning and stays device-local (excluded from cloud sync, preserved on import). Because a Pi session can mix Anthropic-style and OpenAI-style APIs, sums that include Pi carry the partial cache-write caveat rather than an unqualified number. (#6463)
-- **Multiple ChatGPT Accounts, Bound Per Codex Card**: The Auth Center holds any number of ChatGPT (Codex OAuth) sign-ins, and each OpenAI Official card either binds to one specific account or follows whatever the Codex CLI is logged into; any number of official cards can coexist, and binding or unbinding keeps the card's identity, endpoints and health history (#6535 removed the earlier one-card-per-mode rule before it ever shipped). Switching to a bound card writes that account's complete token bundle into `~/.codex/auth.json` — so the bare `codex` CLI runs as that account too, and can self-refresh past the access token's lifetime — while a CLI-rotated refresh token for the same account is adopted back before each write, so re-switching never overwrites a newer login with a stale one. The account picker is a labelled dropdown with a direct jump into the Auth Center; a transient failure to load account status now shows an alert with Retry instead of reading as "not signed in", and no longer silently unbinds the account on the next save. Sign-out and account removal are serialized against provider switching, OAuth requests carry a 30-second timeout instead of ten minutes, and signing out now also cancels a device login whose network round-trip was still in flight, so an abandoned flow can no longer complete in the background and silently restore an account (#6506). Requests through takeover are validated against the bound account: a Codex session still authenticated as a different ChatGPT account fails with a "restart Codex" error instead of silently billing the wrong account. (#3879, #6535, #6506)
+- **Multiple ChatGPT Accounts, Bound Per Codex Card**: The Auth Center holds any number of ChatGPT (Codex OAuth) sign-ins, and adding an OpenAI Official provider now lets you pick one of those authorized accounts right in the form — or keep the classic route: an unbound official card that follows whatever the Codex CLI is logged into, reading the local access token. Any number of official cards can coexist, and binding or unbinding keeps the card's identity, endpoints and health history (#6535 removed the earlier one-card-per-mode rule before it ever shipped). Switching to a bound card writes that account's complete token bundle into `~/.codex/auth.json` — so the bare `codex` CLI runs as that account too, and can self-refresh past the access token's lifetime — while a CLI-rotated refresh token for the same account is adopted back before each write, so re-switching never overwrites a newer login with a stale one. The account picker is a labelled dropdown with a direct jump into the Auth Center; a transient failure to load account status now shows an alert with Retry instead of reading as "not signed in", and no longer silently unbinds the account on the next save. Sign-out and account removal are serialized against provider switching, OAuth requests carry a 30-second timeout instead of ten minutes, and signing out now also cancels a device login whose network round-trip was still in flight, so an abandoned flow can no longer complete in the background and silently restore an account (#6506). Requests through takeover are validated against the bound account: a Codex session still authenticated as a different ChatGPT account fails with a "restart Codex" error instead of silently billing the wrong account. (#3879, #6535, #6506)
 - **Per-Model Reasoning Levels in the Codex Model Catalog**: Each model row in the Codex provider form can now declare exactly which reasoning efforts its upstream accepts — a multi-select over the eight canonical levels (none through ultra) plus an optional default — and the generated catalog carries them to Codex's picker, instead of inheriting whatever the base template declares (none/high on the native-Responses template, gpt-5.5's low/medium/high/xhigh on the chat-conversion path). Unknown values are dropped so a typo never reaches Codex, an explicit default is validated against the declared set, and the override applies on both the neutral template path and the mirrored vendor-catalog path. The proxy transforms learned `ultra` at the same time: previously picking the deepest level on a routed provider silently disabled extended thinking (Anthropic path) or dropped the effort parameter; it now maps to the upstream's deepest legal tier. (#6228, #6181)
 - **Vendor-Documented Reasoning Tiers and Real Thinking Switches Across the Codex Presets**: The presets now ship the effort tiers each vendor actually documents — Volcengine Ark low/medium/high, DouBaoSeed minimal through high, Hunyuan low/high, DeepSeek low/high/max, xAI Grok low/medium/high (no `none`: reasoning cannot be disabled), Zhipu GLM none/high, and more — so a newly added provider's Codex picker starts from the truth instead of a generic template; for Zhipu GLM this makes "disable thinking" selectable from Codex at all. Both Kimi presets enable reasoning effort per Moonshot's own integration guide, sent as top-level `reasoning_effort` with the tiers the gateway accepts, and Kimi For Coding grows from one model to the four official ones. The Baidu Qianfan Coding Plan preset gains a real thinking on/off switch using the platform's documented `thinking` object. Levels come from vendor documentation or the vendor's own Codex catalog, narrowed to the tiers that actually behave differently — MiniMax M3, MiMo and Zhipu GLM expose none/high even though their endpoints also accept lower tiers the vendors describe as equivalent; models with no evidence at all stay unfilled.
 - **Claude Code Hosted WebSearch and Codex Alpha Search Through the Local Proxy**: Two web-search paths that previously dead-ended at the proxy now work. Claude Code's built-in WebSearch tool is bridged onto OpenAI Responses and the Codex OAuth backend: searches execute upstream, results come back as paired Anthropic search blocks with citations preserved and merged, and search counts land in usage. `max_uses` is enforced natively via `max_tool_calls` where the Responses API supports it, and locally with a mid-stream cutoff on Codex OAuth when the request forces the hosted tool — an unforced Codex OAuth request carrying `max_uses` fails with an explicit error, because that backend rejects `max_tool_calls` and the proxy cannot otherwise bound the budget. Constraints the Responses API cannot represent (`blocked_domains`, non-direct callers, `response_inclusion`, unknown tool versions) likewise fail with an explicit error rather than silently searching more broadly. The bridge covers the Responses conversion path only — Chat Completions upstreams still cannot serve hosted WebSearch. Separately, Codex's standalone Alpha Search endpoint is registered as a semantic passthrough with the full provider-selection, auth, model-mapping, retry and logging pipeline, ending the 404 newer Codex clients hit; full-URL providers derive the search endpoint only from unambiguous `/responses` URLs and fail closed otherwise. The Claude-in-Codex routing guide was updated in all three languages: "web search is unavailable under GPT routing" is no longer true on these paths. (#5681, #5363, #5378)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-switch",
-  "version": "3.19.2",
+  "version": "3.20.0",
   "description": "All-in-One Assistant for Claude Code, Codex & Gemini CLI",
   "type": "module",
   "scripts": {

src-tauri/Cargo.lock

@@ -758,7 +758,7 @@ dependencies = [
 
 [[package]]
 name = "cc-switch"
-version = "3.19.2"
+version = "3.20.0"
 dependencies = [
  "anyhow",
  "arboard",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cc-switch"
-version = "3.19.2"
+version = "3.20.0"
 description = "All-in-One Assistant for Claude Code, Codex & Gemini CLI"
 authors = ["Jason Young"]
 license = "MIT"

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CC Switch",
-  "version": "3.19.2",
+  "version": "3.20.0",
   "identifier": "com.ccswitch.desktop",
   "build": {
     "frontendDist": "../dist",