DEV Community: LucioLiu

I checked three of this week’s claims against the primary sources

LucioLiu — Sat, 15 Aug 2026 12:24:12 +0000

Three things landed this week that are easy to misread. Here is what the primary sources actually say, and where I could not get to one.

1. DeepSeek's price change: nobody ran the flash column

New pricing takes effect August 16, 16:00 UTC.

Most coverage ran the numbers for v4-pro. The v4-flash column is going up too, and I have seen almost nobody quote it.

Per million tokens, v4-flash:

	today	peak	off-peak
cache hit input	$0.0028	$0.014	$0.007
cache miss input	$0.14	$0.44	$0.22
output	$0.28	$1.32	$0.66

And v4-pro:

	today	peak	off-peak
cache hit input	$0.003625	$0.044	$0.022
cache miss input	$0.435	$1.32	$0.66
output	$0.87	$3.96	$1.98

The part that trips people up: off-peak is exactly half of peak, but both tiers sit above today's price. v4-pro cache hit goes from $0.003625 to $0.022 off-peak, roughly 6x. Scheduling into off-peak saves you half the increase, not a return to current pricing.

The docs give peak hours in UTC only: 01:00-04:00 and 06:00-10:00. If your team runs on China time that is 09:00-12:00 and 14:00-18:00, which is exactly the working day. Worth knowing before you move batch jobs around.

Source: DeepSeek official API pricing page, checked 2026-08-15.

2. "Firefox is the last browser with uBlock Origin" is not quite right

A post with that headline hit 1099 points on HN. The top-voted reply says simply not true, and it is correct: Brave still ships uBlock Origin.

The two are not the same mechanism, and that distinction matters more than the headline does:

Firefox never removed the extension APIs. Any content blocker can do this work, and nobody has to approve it.
Brave self-hosts a specific set of MV2 extensions on its own servers after upstream Chromium removed them: uBlock Origin, AdGuard, NoScript, uMatrix. Four items, curated by Brave.
Chrome and Edge have dropped it.

So if you depend on a blocker that is not on Brave's list, "Brave still supports MV2" does not cover you.

One detail from the same thread deserves more attention than the headline: Firefox reviews uBlock's code on every update to check the developer has not shipped something malicious. That is a property of the Recommended Extensions program, not something every browser does.

3. OpenAI rated its own model High for cyber capability

GPT-5.6-Cyber is, under OpenAI's own Preparedness Framework, the first model to reach the High threshold for cybersecurity capability. High, not Critical.

The number going around: it completes 95% of advanced security requests, against 2% for Sol under Daybreak Blue. That is a refusal-rate delta, not a capability benchmark. The two get conflated in headlines.

Access is gated to approved individuals and organizations with identity verification, and hardware security keys become mandatory for individual Daybreak accounts on September 1.

Caveat on this section: OpenAI's own newsroom returned 403 to me, so the figures above come from several secondary reports that agree with each other. Treat them as reported rather than verified first-hand. The first two sections I checked against the primary source directly.

If you only act on one

Make it the pricing one. It has a deadline, and the flash column is the part most people have not looked at.

The 50% price cut everyone reported has an expiry date nobody quoted

LucioLiu — Fri, 14 Aug 2026 16:17:53 +0000

Three pricing stories landed this week. They got reported separately. Read together, they point the same way.

What got reported

Google launched Gemini 3.7 Flash at $0.75 per million input tokens and $3.75 output. Roughly half the previous Flash cost. That was the headline.

What the headlines left out

The price is introductory. It runs through December 31, 2026. On January 1 it becomes $1.50 and $7.50.

Google's own pricing page states this plainly, so this is not hidden information. It just did not survive the trip into headlines, which mostly kept the "half price" half of the sentence. If you are sizing a 2027 budget on the current number, you are off by 2x.

The other half of the week

DeepSeek moves V4 Pro to peak/off-peak pricing on August 16 at 16:00 UTC, which is 00:00 Beijing time on Monday, August 17. The full table, per million tokens:

	now	new peak	new off-peak
cache-hit input	$0.003625	$0.044	$0.022
cache-miss input	$0.435	$1.32	$0.66
output	$0.87	$3.96	$1.98

Most coverage led with the output price going up 4.6x. The line that actually moved is cache-hit input: 12.1x.

That is the line agent loops live on. If your system prompt is long and stable, if you are re-sending conversation history every turn, if you are running any kind of ReAct loop, cache hits are most of your input bill. The cheapest line on the sheet just became the fastest growing one.

The timezone nobody converted

DeepSeek publishes its peak windows in UTC: 01:00 to 04:00 and 06:00 to 10:00.

Convert to Beijing time: 09:00 to 12:00 and 14:00 to 18:00. That is the Chinese working day, morning block and afternoon block, with the lunch break carved out of the middle.

Off-peak is exactly half of peak. One thing worth stating clearly, because "half" is easy to misread here: that is half of the new price, not a discount against today. Off-peak cache-hit input is $0.022, still about 6x today's $0.003625. Both tiers cost more than what you pay right now. Scheduling saves you half of the increase, it does not undo it.

The docs give you the UTC numbers. They do not do this conversion, and I have not seen anyone else do it either.

What I would actually change

On DeepSeek: from 00:00 Beijing time on Monday, August 17, move non-urgent batch work outside 09:00 to 12:00 and 14:00 to 18:00 Beijing time. Same work, half the peak rate.
On Gemini 3.7 Flash: put $1.50 and $7.50 in the 2027 column, not $0.75 and $3.75.
On any agent system: re-run the cost model with cache hits at 12x. If cache hits were rounding-error cheap in your spreadsheet, that assumption expires at 00:00 Beijing time on August 17.

The part that does not get repriced

Same week, Qwen shipped Qwen3.8-27B. Dense 27B, Apache 2.0, 262k native context extensible to 1M, and 84.3 on OSWorld-Verified computer use.

I am not going to claim local replaces API. It does not, for most people, most of the time.

But there is one property worth naming while everyone is reading pricing tables: weights you already downloaded do not get repriced on January 1.

Sources: DeepSeek official pricing docs, Qwen3.8-27B model card on Hugging Face, and Google's Gemini API pricing page. The Beijing time conversion is mine, from the UTC windows DeepSeek publishes.

Corrected after publishing: an earlier version said the DeepSeek change starts "Sunday" and that the assumption "expires on Saturday". Both were off. 16:00 UTC on August 16 is 00:00 Beijing time on Monday, August 17. The earlier version also described off-peak as a straight 50% cut without noting it is half of the new price rather than a saving against today's.

My AI agent thought it was a different agent, and confidently finished the job as that agent

LucioLiu — Fri, 14 Aug 2026 06:31:36 +0000

On July 17 I opened a session, picked one agent's folder in the UI, and halfway through reviewing the output realized a different agent had been doing the work.

Background: I keep a local team of AI roles. Each has its own memory folder, its own rules, its own work log. One of them builds and edits the roles themselves. Another handles scripts, environment and debugging.

That session ran as the wrong one. It wrote its results into that agent's memory. It posted to the shared team log under that name. I only caught it halfway through approving the output.

My first thought was not "this round is wasted". It was: how many previous sessions did this too.

One regex, wrong identity

The cause was mundane. The startup hook decides which agent a session belongs to by regex-matching the current working directory:

01_数字员工\\([^\\]+)

That session was a git worktree. The worktree happened to live under the other agent's .claude/worktrees/ folder. So the hook picked up which agent's house this copy physically sits in, not which agent this session is logically serving.

What I took from it: identity was being inferred, not declared. Anything inferred will eventually be inferred wrong. And when an agent is wrong about who it is, it does not stop to ask. It finishes the job with full confidence, as someone else.

The fix is boring and it is the whole point of this post: an explicit identity file the session asserts against at startup, instead of a path the runtime guesses from. If your multi-agent setup derives identity from cwd, process.env.PWD, or the repo name, you have this bug. It just has not fired yet.

This was not an isolated bug

I keep a mistake ledger for this team, scored by stars. More stars means the same class of error keeps coming back despite having been logged and mechanised before. Current top two:

★28: Treating the output of your own checker or scanner as ground truth about the thing being checked, when the ruler itself is silently blind in that particular shape.

★17: The rule was written down but only lives in the document layer. Nothing pulls it out when a matching task starts, so the same deviation reappears within 3 days to 5 weeks. The line I keep coming back to: what recurs is not judgment, it is the retrieval mechanism.

I hit the second one again last night. A scroll command in the browser stopped working, I immediately concluded the whole control surface was unusable, and was about to ask for a completely different setup. Before sending that request I ran one control experiment: tried a sibling API instead. Clicks worked fine. Only the wheel event was dead. The ledger entry for "blame the environment before running one experiment that rules out your own usage" sits at ★8, and one of its relapse records is also me, 18 days earlier, same browser, same non-active tab.

Why a ledger with star counts instead of a list of lessons

Two properties matter, and both are easy to get wrong:

Never open a new entry for a recurrence. If you log the same class of mistake as a fresh item, the count resets and you lose the single most valuable signal: this is an old disease, and the mechanism you wrote last time did not hold. Star count is the honest measure of how stubborn something is.

Distinguish "caught it" from "shipped it". Last night's browser incident got caught by a control experiment before it reached anyone, so I logged the relapse without incrementing the star. Two hours later I told my collaborator that opening a second GitHub account might jeopardise an ongoing appeal, purely from impression, with zero sources. That one left my mouth before I checked, so it got the increment. Same class of error, different cost, different accounting.

So what does the setup actually look like

The hard part of running a team of agents long term is not making them capable. Models solved that. The hard part is making the same mistake not come back in three weeks, when every new session starts with none of the prior context.

That cannot be solved by memory. It can only be solved by putting identity, memory, rules and handoffs into ordinary local files, and forcing them to be pulled up at the moment work starts.

I packaged the setup I use into a starter pack called Agent Modpack. Bilingual (English and Chinese), containing an orchestrator, two sample specialist roles, a role builder, a blank role template, and seven collaboration skills.

git clone https://gitlab.com/LucioLiu/agent-modpack.git

# or, equivalently:
hf download LucioLiu/agent-modpack --repo-type dataset --local-dir ./agent-modpack

Nothing to build and no script to run. The repo ships two already-assembled team folders, sample-team-en/ and the Chinese equivalent, 218 files each. Copy the one whose language you read out to wherever you want the team to live, then point your AI tool at the orchestrator folder inside it. Claude Code enters through CLAUDE.md, Codex through AGENTS.md, both reading the same files.

One Windows note: if hf download throws FileNotFoundError, that is not the command failing, it is the 260-character path limit. Keep the target near the drive root.

Boring parts stated plainly: on Hugging Face it is a Dataset, not a hosted service, and there is no demo to click. License is PolyForm Noncommercial 1.0.0, which is source-available, not OSI open source. Hooks ship with it but are not enabled automatically.

Disclosure: I made it and I maintain it.

The part I have not solved

The top entry in that ledger is at 28 stars. That number means the same class of error happened 28 times across different roles, and every single time it was logged, and every single time a mechanism was written to stop it.

Files and mechanisms made recurrence slower. They have not made it zero.

Three things about today's four model releases that the benchmark tables don't tell you

LucioLiu — Thu, 13 Aug 2026 14:29:05 +0000

Four flagship models landed within 24 hours today. The benchmark tables are getting all the attention. Here are three things I checked on the official pages that I have not seen discussed.

1. DeepSeek's price has an expiry date

The official pricing page lists $0.435 input / $0.87 output / $0.003625 cache hit per million tokens for deepseek-v4-pro.

The footnote on that same page says peak/off-peak pricing starts 2026-08-16 16:00 UTC:

	now	peak	off-peak
input	$0.435	$1.32	$0.66
output	$0.87	$3.96	$1.98
cache hit	$0.003625	$0.044	$0.022

That is 4.55x on output and 12.14x on cache hits at peak. Peak windows are 01:00-04:00 and 06:00-10:00 UTC.

If your workflow leans on prompt caching, the cache hit line is the one to budget against, not the output price.

2. "20x cheaper" is a comment, not a claim

The line everyone quotes came from a Hacker News comment posted 82 seconds after the submission. DeepSeek never said it.

In the same thread, one person computed 60x from opencode's published agentic request distribution. Another argued 10x. Straight list-price division against Anthropic's published rates gives 11.5x on input and 28.7x on output.

Three numbers, one thread, and almost nobody states whether they are comparing unit price or cost per task.

3. The open Qwen is not the Qwen in the benchmark table

Qwen/Qwen3.8-2.4T-A95B is real and downloadable: 2.4T total parameters, 95B activated, 213 safetensors shards, about 4.89TB.

But the model card says it is text-only, multimodal input is not supported, and thinking mode cannot be disabled. The vision input, non-thinking mode, default 1M context and built-in tools belong to Qwen3.8-Max, the hosted version on Qwen Cloud. That is the column in the benchmark table.

The license is also not Apache 2.0. It is a custom Qwen3.8-Max License with two commercial gates: MaaS or AI work assistant businesses with over $50M revenue in any rolling 12 months need separate authorization, and products over 100M MAU or $20M monthly revenue must display the model name prominently in the UI.

Sources

All read 2026-08-13:

api-docs.deepseek.com pricing page and change log
huggingface.co/deepseek-ai/DeepSeek-V4-Pro-0813
huggingface.co/Qwen/Qwen3.8-2.4T-A95B README and LICENSE
platform.claude.com pricing
x.ai/news/grok-4-6

I am not arguing against switching to any of these. Just check which price you are budgeting against, and which artifact you actually downloaded.

67.2% Is Not 67.2% of the Riemann Hypothesis

LucioLiu — Wed, 12 Aug 2026 13:33:18 +0000

67.2% does not mean that Claude solved 67.2% of the Riemann hypothesis.

Anthropic reports a narrower mathematical result. The proven lower bound on the fraction of Riemann zeta zeros on the critical line increased from 41.6% to 67.2%. The Riemann hypothesis says all non-trivial zeros lie there. This work does not prove that.

The research workflow is also notable. Anthropic reports about 31 million output tokens across two Claude Code sessions. The second run used roughly 60 subagents, executed about 2,400 shell commands, and wrote hundreds of Python scripts. The team then had mathematicians check the paper and released a Lean 4 formalization companion.

The boundaries matter. The model was an unreleased research version. Internal verification and short expert review are not formal peer review. Anthropic also says it does not expect these techniques to lead directly to a proof of the Riemann hypothesis.

This is a large research-agent workflow with a checkable mathematical result, not a solved millennium problem.

Research: https://www.anthropic.com/research/riemann-zeta

Lean companion: https://github.com/anthropics/zeta-23-lean

Memory, Local Models, and Execution Receipts Are Different Controls

LucioLiu — Wed, 12 Aug 2026 13:30:09 +0000

GitHub Copilot is bringing three previously separate layers into JetBrains: cross-session memory, a local model provider, and agent execution records.

The August 11 update lets Copilot Memory retain and recall information across agent chats. Ollama is now available as a BYOK provider with provider configuration and model selection inside JetBrains. Codex sessions also appear in agent debug logs and support updated permission modes, instructions, and skills.

Those are different controls. Memory decides what survives into later sessions. Ollama decides where a model runs. Debug logs and permissions show what this run could do and what it actually did.

Enterprise settings now cover plugin availability, MCP server access, permission bypass behavior, and OpenTelemetry. The useful review is therefore four separate checks: memory scope, model source, permission policy, and execution receipt.

This is a read of GitHub's official changelog, not a local JetBrains reproduction.

Source: https://github.blog/changelog/2026-08-11-copilot-memory-and-ollama-in-github-copilot-for-jetbrains/

A Watermark Is a Processing Receipt, Not an Authorship Verdict

LucioLiu — Tue, 11 Aug 2026 16:12:32 +0000

A Claude watermark is a processing receipt, not an authorship verdict.

Anthropic describes two machine-readable signals: model-level watermarks embedded in text and signed C2PA provenance metadata on supported files such as SVG, PNG, and JPG.

The limitation is the useful part. A detected mark indicates that content may have been processed by Claude. It does not prove Claude was the original author. Proofreading, translation, summarization, or file conversion can produce a marked output whose underlying work came from someone else. The reverse is also unsafe: short passages, heavy edits, translation, screenshots, or stripped metadata can leave no detectable mark.

I would separate a provenance record into original_author, processed_by, edit_history, and provenance_signature. The mark records a processing event. Authorship still needs an evidence chain.

Anthropic says technical detection documentation is forthcoming, so claims about exact false-positive rates or reliable removal are premature.

Official source: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

An SDK Upgrade Can Change an Agent Without Changing the App

LucioLiu — Tue, 11 Aug 2026 16:10:19 +0000

An SDK upgrade can change an agent even when the application code does not.

OpenAI Agents SDK 0.20.0 changes the implicit default model to gpt-5.6-luna. Explicit models, run-level overrides, and OPENAI_DEFAULT_MODEL still take precedence, but an application that relied on the implicit default will change runtime behavior by upgrading the dependency alone.

The release also crosses the MCP v2 migration boundary. Local connections support MCP Python SDK v1 and v2 across stdio, SSE, and Streamable HTTP. Custom HTTP authentication and client factories still need to use the HTTP types owned by the installed MCP major version, or pin mcp<2 while migrating.

Two more changes belong in the recovery test: RunState.add_input() can persist new input before a resumed model call, and tool approvals are bound more tightly to concrete invocation identity.

This is a release-note read, not a local reproduction. Before upgrading, pin the model ID, Agents SDK version, MCP major, transport, approval call ID, and one interrupt-resume canary.

Official release: https://github.com/openai/openai-agents-python/releases/tag/v0.20.0

Append-Only Memory Fails When an Agent Needs to Change Its Mind

LucioLiu — Mon, 10 Aug 2026 11:52:15 +0000

Agent memory is often described as a storage problem. The harder failure appears when a stored fact used to be correct and is now wrong.

TEPA, a new preprint, models memory validity explicitly. When new evidence conflicts with an old precedent, it revokes the old record from active use while preserving the history for audit. The authors report a score of 0.950 in a complete-reversal setting, compared with 0.210 for append-only and last-write-wins baselines. Those are author-reported research results, not an independently reproduced production benchmark. The paper also reports remaining retrieval-chain and long-context limits.

The production translation can be deliberately boring. Give each durable memory a status, valid_from, superseded_by, and evidence_id. When evidence conflicts, write a revocation event, link the replacement, and record the reason. Do not erase the old record. Do not let the last write automatically become the current truth.

This changes debugging too. A failed decision can be replayed against the evidence and policy that were valid at the time. You can then tell the difference between a reasonable old decision and a system that ignored an already available correction.

Source: TEPA: Revoking Stale Memories for Conflict-Robust Language Agents.

Only Two AI Updates Cleared My 36-Hour Cutoff

LucioLiu — Mon, 10 Aug 2026 11:49:59 +0000

I checked eleven AI and agent candidates today. Only two cleared a strict 36-hour cutoff.

The first is Meta Muse Glimmer, a roughly 30B multimodal model released under Apache 2.0 and aimed at agentic workloads. Its model card says the 4-bit weights come in under 20 GB and targets a 24/32 GB device envelope that also leaves room for the vision encoder, cache, and drafter. That is a publisher claim, not a local reproduction. Context length, runtime, and cache policy can still change peak memory materially.

The second is Transformers 5.15.0. It adds Muse Glimmer, FSDP plans across 94 causal-LM classes, batched Omni audio generation, and Tekken tokenizer support. The part I would read before the feature list is the breaking-change section. Kernels become opt-in for several linear-attention families. Cache cropping now accepts negative offsets instead of absolute sizes. T5-family attention defaults may change unless callers explicitly request the eager path.

Six other items belong to a 72-hour watchlist: SGLang 0.5.17, Anthropic Python SDK 0.121.0, TEPA, Pydantic AI 2.27.0, SkillProx, and a diffusion-LLM safety paper. I am keeping the time window visible rather than presenting all eight as releases from today.

A useful local-model claim should be reproducible. Record the quant, context length, runtime, peak RAM or VRAM, and tool-call success. An upgrade record should also name the kernel, cache, and attention behavior it expects. “Runs locally” is a starting point; that run sheet is the evidence.

Sources: Transformers 5.15.0 and Muse Glimmer model card.

A CLI Installer Is Now an Agent Skill Distributor

LucioLiu — Sun, 09 Aug 2026 13:30:07 +0000

Disclosure: This article was drafted and organized with AI assistance. The commands, update behavior, and account-access boundary were checked against the official Hugging Face Hub 1.27.0 release notes.

Hugging Face Hub 1.27 changed the default behavior of its standalone CLI installers.

This is not a model release and it does not make an agent more capable by itself. It is a packaging change. That makes it easy to overlook and worth reviewing.

The Bash and PowerShell installers still install the hf command. They now also install an hf-cli skill into a global skills directory. The skill teaches compatible agents how to use the CLI.

This is opt-out. Bash accepts --exclude-skill. PowerShell accepts -ExcludeSkill. Running hf update later refreshes the skill, but the release notes say the update path will not restore it if a user previously opted out or removed it. When the skill is missing or came from another hf version, a command may show a local hint at most once a day. That hint never installs anything.

The skill does not grant Hugging Face account access. It is not a token, and different agent hosts may consume skill instructions differently.

It also does not prove that every agent host will discover the same directory or interpret the instructions in the same way. The installer can place the skill on disk. The host still decides whether that location is trusted, indexed, and available to an agent.

The packaging change is still important. Installing a developer tool can now modify two operational surfaces: the executable path for humans and a global instruction directory for agents.

That second surface deserves the same attention as a shell profile or plugin directory. It can change what an agent is told about a tool even when the executable itself has not changed. A team that only inventories binaries may miss the instruction layer completely.

I would add three checks to an installation review:

Diff the global skills directory before and after installation.
Verify that an opt-out remains respected by future updates.
Trace the skill version and source back to the same release package.

I would run those checks in a disposable user profile. Capture the skills directory before installation, run the default installer, and save the diff. Then remove the skill and run hf update. Finally, repeat the install with the explicit opt-out. The expected result is observable: default install adds the skill, update refreshes an installed copy, and a deliberate opt-out or removal remains respected.

I would also inspect permissions separately. A skill can explain how to call hf, but any action that needs an account should still fail until the normal authentication path is complete. If installing instructions appears to grant access, that is a different and more serious problem.

The default may be reasonable. The practical change is that an installer is now shipping both software for a person and operational instructions for an agent. Both belong in the installation review, the rollback plan, and the dependency inventory.

Official release: https://github.com/huggingface/huggingface_hub/releases/tag/v1.27.0

Seven Agent Tool Releases and Four Boring Failure Paths

LucioLiu — Sun, 09 Aug 2026 13:27:09 +0000

Disclosure: This article was drafted and organized with AI assistance. Every factual claim was checked against the seven official release pages linked below.

Across seven official release pages today, the shared story was not a smarter model. It was better behavior around interruption, identity, concurrency, and execution context.

That distinction matters because release roundups can turn into feature shopping. A new provider or model name is easy to notice. The failure path is what decides whether the tool remains usable after a timeout, an aborted turn, an expired login, or two clients touching the same workspace.

Interruption

Cline Desktop 0.0.11 preserves prompts queued during a turn when that turn is interrupted. Session context also remains durable across aborts and hub restarts. A hung MCP server no longer takes down session creation.

Identity

Cline now surfaces an OAuth authorization prompt when a remote SSE MCP server returns 401. Crush 0.88.1 fixed MCP OAuth in server-client mode.

Concurrency

Crush fixed a path where clients in the same workspace could kill each other. It also reduced the timeout for slow-loading MCP servers that could block messages.

Execution context

llama.cpp b10331 fixed get_info for a configured tools runtime. Without an explicit working directory, it used to report the server process directory even though tools ran inside an isolate elsewhere. It now asks the isolate for the path.

This sounds like a diagnostic detail, but it changes incident response. If a tool says it is operating in one directory while its process is actually isolated somewhere else, a human can inspect the wrong files, approve the wrong path, or misread a permission failure. Reporting the environment where execution really happens is part of the safety boundary.

The other releases filled adjacent gaps. PydanticAI 2.27 improved compaction round-tripping and added Snowflake Cortex support. CrewAI 1.15.14 split runtime context from the coding agent and added project ID. SGLang 0.5.17 added model support and an initial Rust frontend. Hugging Face Hub 1.27 made its installer distribute an agent skill by default.

My upgrade checklist today has four questions. What survives an abort? Where does authorization appear? Can concurrent clients interfere with one another? Do diagnostics describe the environment where tools actually run?

How I would test this batch

First, start a long tool call, queue another prompt, and abort the active turn. Reopen the session and check whether the queued prompt and the earlier context both remain. A green process exit is not enough. The user-visible work must still be there.

Second, point a remote MCP connection at an endpoint that returns 401. The client should show a recognizable authorization path. It should not turn an identity problem into a generic server failure or leave the user guessing where to sign in.

Third, open two clients against the same workspace and make them overlap. One client should not terminate the other or silently steal its state. Then repeat the test with a slow MCP server to see whether unrelated messages continue moving.

Fourth, run a tool inside an isolate without setting an explicit working directory. Compare the path reported by diagnostics with the directory the tool can actually read and write. If those differ, stop the upgrade review there.

None of these checks proves a release is safe in every environment. They turn broad release-note language into small failures that a team can reproduce before production does it for them.

Official sources

Cline Desktop 0.0.11: https://github.com/cline/cline/releases/tag/desktop-v0.0.11
Hugging Face Hub 1.27.0: https://github.com/huggingface/huggingface_hub/releases/tag/v1.27.0
SGLang 0.5.17: https://github.com/sgl-project/sglang/releases/tag/v0.5.17
PydanticAI 2.27.0: https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.0
Crush 0.88.1: https://github.com/charmbracelet/crush/releases/tag/v0.88.1
llama.cpp b10331: https://github.com/ggml-org/llama.cpp/releases/tag/b10331
CrewAI 1.15.14: https://github.com/crewAIInc/crewAI/releases/tag/1.15.14