## Core
### Improvements
- Added Grok OAuth sign-in, including device-code login. (@Jaaneek)
### Bugfixes
- V2 session APIs now return safe `UnknownError` responses with log reference IDs when stored messages are corrupt.
- Generic API 500s no longer expose config details from server errors.
- Unknown API errors now include reference IDs so you can match responses to server logs.
- V2 session APIs now return `503 ServiceUnavailableError` for mutations that are not available yet.
- V2 session APIs now return `SessionNotFoundError` for missing sessions.
- Deduped concurrent Codex OAuth refreshes to avoid repeated refresh failures. (@cooper-oai)
- Restored native OpenAI OAuth requests.
- Tool schema failures now surface as friendly tool errors.
- Added PDF attachment support for Grok.
- Restored OpenAI reasoning streams.
## TUI
### Bugfixes
- Collapsed thinking labels now use clearer punctuation.
- New sessions now default to the local project.
- Single-select question checkmarks no longer run into option labels.
## Desktop
### Improvements
- Added a pinch zoom setting for the desktop app.
- Added a new desktop home view, session entry flow, and titlebar.
- Refined the new desktop UI and moved app update actions into the titlebar.
- Added desktop log export.
## SDK
### Bugfixes
- V2 global event streams now include account add, remove, and switch events.
**Thank you to 3 community contributors:**
- @cooper-oai:
- fix(opencode): dedupe concurrent Codex OAuth refreshes (#28236)
- @Jaaneek:
- feat(opencode): add xAI Grok OAuth (SuperGrok) + device-code login (#28557)
- @kagura-agent:
- fix(ui): preserve target attribute in DOMPurify config for markdown links (#28598)