shortcutxl 0.3.90 → 0.3.92

package/BINARY-INVENTORY.json

@@ -1,17 +1,17 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-02T05:35:16.912Z",
+  "generatedAt": "2026-09-28T15:24:40.862Z",
   "package": "shortcutxl",
   "build": {
     "builder": "github-actions",
     "repository": "lyfegame/shortcut",
-    "sourceRef": "refs/heads/codex/excel-preexecution-approval",
-    "sourceCommit": "2520273120cc4b4024d877790eacf6f41fefdd7c",
-    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/excel-preexecution-approval",
-    "runId": "33595155271",
+    "sourceRef": "refs/tags/shortcutxl/v0.3.92",
+    "sourceCommit": "e570fa7e9f098635d5a8594035f1ec509d6c84f2",
+    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/tags/shortcutxl/v0.3.92",
+    "runId": "36443042051",
     "runnerOs": "Windows",
     "runnerImage": "win25-vs2026",
-    "runnerImageVersion": "20260824.214.3"
+    "runnerImageVersion": "20260922.246.2"
   },
   "binaryExtensions": [
     ".dll",
@@ -22,7 +22,7 @@
   "files": [
     {
       "path": "xll/ShortcutPowerPoint.dll",
-      "sha256": "5c5c7630cd30e36daaf85b944baee2bf84c1cb59c2dde40b05505b8dbf04239b",
+      "sha256": "e74ec73ef238eff5f936ffb236610220c2c545da164a7cf58b868ae1b4fa1d45",
       "source": "ShortcutXL native PowerPoint COM add-in build",
       "version": "package",
       "builtBy": "shortcut",
@@ -30,7 +30,7 @@
     },
     {
       "path": "xll/ShortcutWord.dll",
-      "sha256": "2823c3604f6b7a6fdbabd3bedcdf31a66ec1d3dcd51e54284affb64969d8bcc5",
+      "sha256": "17a78ed362a9edd2dc413d6d090c37347eb68a27cb23b53e91f647c9f940fe37",
       "source": "ShortcutXL native Word COM add-in build",
       "version": "package",
       "builtBy": "shortcut",
@@ -38,7 +38,7 @@
     },
     {
       "path": "xll/ShortcutXL.xll",
-      "sha256": "b1d14ede58224be66163f924bd2259bfc1c586849743c2b97bb28de77b4072e4",
+      "sha256": "b3ea0f0ac97160f45fa4571488e3e038ef0a09bd7d5d67833eb1248f24d9ff50",
       "source": "ShortcutXL native XLL build",
       "version": "package",
       "builtBy": "shortcut",
@@ -550,7 +550,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "a7f8d80085b1d17fdf993cd7246d55f05726e3eb624859a8ba3b69b76368bd4c",
+      "sha256": "38991b06575eecf3ed2dce55d63b5f70617a132462b6e011a05567836017458b",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -558,7 +558,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "75e2f1c65f561084f603823794d6ad5877ef0a5b1ef0b1fffff096603479642a",
+      "sha256": "93cfec5f08ff75bd6358ddf0427d0ed53bbdcc8c139b8feac5b96671d4e22d4f",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -566,7 +566,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "417cbb3269a7e6fdfe8bdf606f56ea86f80f0fc5d939d65c7857d0f3aa263c2c",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -574,7 +574,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "417cbb3269a7e6fdfe8bdf606f56ea86f80f0fc5d939d65c7857d0f3aa263c2c",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -582,7 +582,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "417cbb3269a7e6fdfe8bdf606f56ea86f80f0fc5d939d65c7857d0f3aa263c2c",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -590,7 +590,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "3d5142d3d301b5b22ec9f9ba2d29c9f8a4a73bad069389a73dafbd61e2b37696",
+      "sha256": "e0b6ba36d80a9cd5d712e05a5b7cbe353afa05a65e51d26b60680ef75d49cc98",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -598,7 +598,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "494be3de764340437d1fb12aaaefaf8f47c5a482f14834da3a17b080c71d6e16",
+      "sha256": "fdac2f9fbcf98b44f89e9846f727b93c8f6f4be6fa9db2210cc62450e1e74d52",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.3.92]
+
+- **Latest OpenAI and Anthropic models** - Select GPT-6 Sol, GPT-6 Luna, or Claude Opus 5.5 in the CLI and Windows app. New CLI sessions default to GPT-6 Sol.
+- **Simpler model selector** - Replaced GPT-5.6 Sol/Luna and Opus 5 in the selector with their successors. Existing saved sessions and explicit model selections remain supported.
+
+## [0.3.91]
+
+- **GPT-6 Astra** - GPT-6 Astra is now available in the model selector.
+- **Faster, more reliable MCP startup** - Shortcut now starts MCP integrations faster, retries temporary connection failures, and clearly reports servers that take too long to start.
+
 ## [0.3.90]
 
 - **Skill Forge** - A recursive self-improvement loop for skills. Create or improve personal skills by giving Skill Forge tasks and a grading bar to train, evaluate, and refine against.

package/dist/ai/types.d.ts

@@ -296,6 +296,8 @@ export interface Model<TApi extends Api> {
         cacheWrite: number;
     };
     contextWindow: number;
+    /** Optional auto-compaction threshold. Defaults to the runtime-wide threshold policy. */
+    compactionThresholdTokens?: number;
     maxTokens: number;
     capabilities?: ModelCapabilities;
     headers?: Record<string, string>;

package/dist/app/connectors/secret-store.d.ts

@@ -12,12 +12,20 @@
 export declare function setSecret(name: string, payload: Record<string, string>): void;
 /** Retrieve a secret payload for a connection. Returns undefined if not found. */
 export declare function getSecret(name: string): Record<string, string> | undefined;
+/**
+ * Retrieve several connection secrets without serially blocking the Node event loop.
+ * Windows uses one PowerShell process for the whole batch so the P/Invoke helper is
+ * compiled once. Other platforms perform their native lookups concurrently.
+ */
+export declare function getSecrets(names: readonly string[], timeoutMs?: number): Promise<Map<string, Record<string, string> | undefined>>;
 /** Remove a secret for a connection. Returns true if it existed. */
 export declare function removeSecret(name: string): boolean;
 /** Store a JSON payload in the OS keychain under a custom service namespace. */
 export declare function setNamespacedSecret(service: string, name: string, payload: object): void;
 /** Retrieve a JSON payload from the OS keychain for a custom service namespace. */
 export declare function getNamespacedSecret<T extends object>(service: string, name: string): T | undefined;
+/** Retrieve several secrets through a single asynchronous batch operation where possible. */
+export declare function getNamespacedSecrets<T extends object>(service: string, names: readonly string[], timeoutMs?: number): Promise<Map<string, T | undefined>>;
 /** Remove a JSON payload from the OS keychain for a custom service namespace. */
 export declare function removeNamespacedSecret(service: string, name: string): boolean;
 /**

package/dist/app/connectors/secret-store.js

@@ -8,7 +8,7 @@
  *
  * Imports: none from internal layers. Pure shell-out utility.
  */
-import { execFileSync } from 'child_process';
+import { execFile, execFileSync } from 'child_process';
 const CONNECTION_SERVICE = 'shortcut.connection';
 // =============================================================================
 // Public API
@@ -21,6 +21,14 @@ export function setSecret(name, payload) {
 export function getSecret(name) {
     return getNamespacedSecret(CONNECTION_SERVICE, name);
 }
+/**
+ * Retrieve several connection secrets without serially blocking the Node event loop.
+ * Windows uses one PowerShell process for the whole batch so the P/Invoke helper is
+ * compiled once. Other platforms perform their native lookups concurrently.
+ */
+export function getSecrets(names, timeoutMs = 10_000) {
+    return getNamespacedSecrets(CONNECTION_SERVICE, names, timeoutMs);
+}
 /** Remove a secret for a connection. Returns true if it existed. */
 export function removeSecret(name) {
     return removeNamespacedSecret(CONNECTION_SERVICE, name);
@@ -61,6 +69,45 @@ export function getNamespacedSecret(service, name) {
     }
     return undefined;
 }
+/** Retrieve several secrets through a single asynchronous batch operation where possible. */
+export async function getNamespacedSecrets(service, names, timeoutMs = 10_000) {
+    const uniqueNames = [...new Set(names)];
+    const result = new Map();
+    if (uniqueNames.length === 0)
+        return result;
+    if (process.platform === 'win32') {
+        const targets = uniqueNames.map((name) => `${service}/${name}`);
+        const psTargets = targets.map((target) => `'${psEsc(target)}'`).join(', ');
+        const ps = `${WIN_CRED_PREAMBLE}
+$result = @{}
+foreach ($target in @(${psTargets})) {
+  $value = [CredManager]::Read($target)
+  if ($null -ne $value) { $result[$target] = $value }
+}
+$result | ConvertTo-Json -Compress`;
+        const raw = await execFileUtf8('powershell', ['-NoProfile', '-EncodedCommand', psEncode(ps)], timeoutMs);
+        const values = raw.trim() ? JSON.parse(raw) : {};
+        for (const [index, name] of uniqueNames.entries()) {
+            result.set(name, parseSecretJson(values[targets[index]]));
+        }
+        return result;
+    }
+    if (process.platform === 'darwin') {
+        await Promise.all(uniqueNames.map(async (name) => {
+            try {
+                const raw = await execFileUtf8('security', ['find-generic-password', '-a', name, '-s', service, '-w'], timeoutMs);
+                result.set(name, parseSecretJson(raw));
+            }
+            catch {
+                result.set(name, undefined);
+            }
+        }));
+        return result;
+    }
+    for (const name of uniqueNames)
+        result.set(name, undefined);
+    return result;
+}
 /** Remove a JSON payload from the OS keychain for a custom service namespace. */
 export function removeNamespacedSecret(service, name) {
     try {
@@ -115,7 +162,11 @@ export function buildConnectionEnv(connectionNames) {
  * PowerShell script that uses P/Invoke to call CredRead/CredWrite/CredDelete
  * from advapi32.dll. Works on every Windows version. No external modules needed.
  */
+// Secrets are read back as .NET strings but serialized to stdout with the
+// console's OEM codepage, which varies per machine and locale. Force BOM-less
+// UTF-8 so Node decodes non-ASCII values correctly on every host.
 const WIN_CRED_PREAMBLE = `
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -161,6 +212,27 @@ public class CredManager {
 function psEncode(script) {
     return Buffer.from(script, 'utf16le').toString('base64');
 }
+function execFileUtf8(command, args, timeout) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, { encoding: 'utf-8', timeout, windowsHide: true }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+function parseSecretJson(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw.trim());
+    }
+    catch {
+        return undefined;
+    }
+}
 function winCredWrite(target, secret) {
     const ps = `${WIN_CRED_PREAMBLE}\n[CredManager]::Write('${psEsc(target)}', '${psEsc(secret)}')`;
     execFileSync('powershell', ['-NoProfile', '-EncodedCommand', psEncode(ps)], {

package/dist/app/mcp/auth-status.d.ts

@@ -6,6 +6,8 @@ export interface ResolveMcpAuthStatusOptions {
     authStorage?: AuthStorage;
     mcpOAuthStore?: McpOAuthStore;
     discovery?: McpAuthDiscoveryMode;
+    /** Pre-fetched connection secrets by name; when absent the keychain is read directly. */
+    connectionSecrets?: ReadonlyMap<string, Record<string, string> | undefined>;
 }
 export declare function resolveMcpAuthStatus(serverName: string, config: McpServerConfig, options?: ResolveMcpAuthStatusOptions): Promise<McpAuthStatus>;
 export declare function getMcpAuthStatus(serverName: string, config: McpServerConfig, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore): Promise<McpAuthStatus>;

package/dist/app/mcp/auth-status.js

@@ -10,7 +10,11 @@ export async function resolveMcpAuthStatus(serverName, config, options = {}) {
         return 'unsupported';
     }
     const staticHeaders = { ...(config.headers ?? {}) };
-    const secretHeaders = config.connection ? getSecret(config.connection) : undefined;
+    const secretHeaders = !config.connection
+        ? undefined
+        : options.connectionSecrets
+            ? options.connectionSecrets.get(config.connection)
+            : getSecret(config.connection);
     if (hasConfiguredHeaders(staticHeaders) || hasConfiguredHeaders(secretHeaders)) {
         return 'configured';
     }

package/dist/app/mcp/connection.d.ts

@@ -4,17 +4,47 @@
 import type { AuthStorage } from '../auth/auth-storage.js';
 import type { McpOAuthStore } from './oauth-state-store.js';
 import { type McpConnection, type McpFailureKind, type McpRequestPolicy, type McpServerConfig } from './types.js';
+/** Abort signal plus absolute deadline that bounds one server's whole startup. */
+export interface McpStartupBudget {
+    signal: AbortSignal;
+    deadlineAt: number;
+}
+export interface McpConnectOptions {
+    /**
+     * Connection secrets already read from the keychain, keyed by connection
+     * name. When absent, the server reads its own secret synchronously.
+     */
+    connectionSecrets?: ReadonlyMap<string, Record<string, string> | undefined>;
+    /** Budget shared across the whole startup. Direct callers get one from the config's startup timeout. */
+    budget?: McpStartupBudget;
+}
 export declare class McpConnectionError extends Error {
     readonly failureKind: McpFailureKind;
     constructor(failureKind: McpFailureKind, message: string);
 }
 export declare function resolveStartupTimeoutMs(config: McpServerConfig): number;
 export declare function buildRequestPolicy(config: McpServerConfig): McpRequestPolicy;
+/**
+ * Run one server's startup under a single deadline. The budget's signal is
+ * threaded into every SDK request so a stalled initialize or tools/list is
+ * cancelled, and the race guarantees the deadline even for steps that cannot
+ * observe the signal (process spawn, keychain reads).
+ */
+export declare function withStartupBudget<T>(name: string, timeoutMs: number, operation: (budget: McpStartupBudget) => Promise<T>): Promise<T>;
+/** SDK request options for initialize and tools/list under a startup budget. */
+export declare function requestOptions(budget: McpStartupBudget): {
+    signal: AbortSignal;
+    timeout: number;
+};
+/** Whether a failed hosted startup is safe to repeat with a fresh MCP session. */
+export declare function isTransientHostedStartupError(error: unknown): boolean;
 export declare function createHostedMcpLoggingFetch(serverName: string, fetchImpl?: typeof fetch): typeof fetch;
 /**
- * Connect a server, list tools, and return a live MCP connection.
+ * Connect a server, list tools, and return a live MCP connection. The whole
+ * sequence runs under `options.budget`, or under a fresh budget from the
+ * config's startup timeout when the caller did not supply one.
  */
-export declare function connectServer(name: string, config: McpServerConfig, defaultCwd: string, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore): Promise<McpConnection>;
+export declare function connectServer(name: string, config: McpServerConfig, defaultCwd: string, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore, options?: McpConnectOptions): Promise<McpConnection>;
 /**
  * Call a tool on a connected server. Returns the result text or throws.
  */