🚀🧑‍💻 - 3.10.3 - release #684

Release Type

Patch

Release Version

3.10.3

Changelog

• Recover the Codex standalone installer from primary download failures using one pinned official recovery script with SHA-256 verification, preserving bounded execution and credential isolation (🐛 - fixagents official Codex installer endpoint returns HTTP 404 and blocks fresh reviews #680, fix(runtime): recover failed official Codex installer downloads #681).
• Prevent generated and repository credential-health checks from exposing secret headers in process arguments; use stdin transport and Google header authentication, with 82 regression cases (🐛🧑‍💻 - Protect credential health requests from process argument disclosure #682, fix(security): keep credential health secrets out of curl arguments #683).
• Update the trusted packaged health-workflow identity and patch the vulnerable undici production dependency to 6.29.1.

Additional Context

Publication of 3.10.3 was explicitly authorized by the maintainer. Both implementation PRs are merged in develop with every applicable check successful and complete current-head native reviews with zero unresolved findings. Follow the installed release lifecycle: Action-owned frozen branch, version/build/package validation, promotion PR to master, publication from the accepted production commit, and reconciliation to develop. Merge only after all applicable checks pass and no findings remain pending. Consumers using vypdev/copilot@v3 receive the patch through the moving major tag; immutable v3.10.2 must remain unchanged.