Changelog — July 10, 2026

OpenAI released the GPT-5.6 model family — a three-tier lineup aimed at different capability/cost points, plus a batch of new API controls:

• GPT-5.6 Sol — the frontier tier, the most capable model in the family. The bare gpt-5.6 alias routes to gpt-5.6-sol, so requests to the base identifier get frontier-class capability by default.
• GPT-5.6 Terra — positioned for a balance of intelligence and cost, the practical default for most production workloads.
• GPT-5.6 Luna — optimized for efficient, high-volume workloads where speed and per-token cost matter most.
• New API capabilities: Programmatic Tool Calling; explicit prompt-caching controls; persisted reasoning with a new max reasoning-effort setting and Pro mode; and support for accepting images at their original dimensions via the original or auto image-detail settings.

All three models are available on v1/responses, v1/chat/completions, and v1/batch. This lands three days after GPT-Realtime-2.1 and GPT-Realtime-2.1 mini (July 6).

Who should care: anyone building on the OpenAI API — the Sol/Terra/Luna split lets you match tier to task instead of paying frontier rates for high-volume work, and the explicit prompt-caching controls are worth wiring in for repeated-context workloads. If you call the bare gpt-5.6 alias, note you're getting Sol (the most expensive tier) unless you pin Terra or Luna explicitly.

OpenAI changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/tips/

A handful of quality-of-life additions and a run of MCP and background-agent fixes. The new bits:

• Directory path suggestions in /cd: the /cd command now offers path autocompletion, matching /add-dir behavior.
• New /doctor CLAUDE.md check: /doctor can now propose trimming checked-in CLAUDE.md files by cutting content Claude could derive from the codebase itself — a nudge toward leaner, cheaper context.
• /commit-push-pr push remote: now auto-allows git push to the repo's configured push remote (remote.pushDefault, or the sole remote when only one is set) in addition to origin.
• EnterWorktree confirmation: now asks before entering a git worktree outside the project's .claude/worktrees/ directory.
• Background-agent upgrades: background agents now upgrade to a new version in the background right after a Claude Code update, instead of paying a slow stale-session upgrade when you attach.
• Gateway login: /login now supports Anthropic-operated public gateway endpoints.

The fixes:

• MCP request_timeout_ms: servers configured via --mcp-config or .mcp.json no longer ignore a per-server request_timeout_ms — long-running MCP tool calls were timing out at the 60s default in fresh sessions.
• Background workers: CLAUDE_CODE_EXTRA_BODY is no longer silently ignored by claude agents / --bg workers; the shell-exported override now follows the dispatching session.
• OAuth MCP: servers no longer require manual re-authentication after a single failed token refresh.
• --permission-prompt-tool: pointing it at an MCP server no longer crashes with "MCP tool not found" on cold start before the server finishes connecting.
• Login & resume: an expired login now prompts you to run /login instead of failing every model with a misleading "There's an issue with the selected model" error; and claude --resume / --continue now respond to keyboard input on startup.

Who should care: anyone driving Claude Code through MCP servers (the per-server request_timeout_ms and OAuth-refresh fixes are the standouts) or running background/agent workers with a custom CLAUDE_CODE_EXTRA_BODY. Nothing here is breaking — an incremental release on the 2.1 line.

Release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/

The Claude API added expiring API keys. You can now set an expiration when you create an API key or an Admin API key in the Claude Console — choose a preset, a custom duration, or Never. For keys with a lifetime of at least 7 days, Anthropic emails the creator before expiration. Existing keys are unaffected, and the Admin API now reports each key's expiration in an expires_at field. Separately (July 10), the Access Transparency docs expanded coverage of cmek_preserve events with a filter example, a sample event payload, and two new preservation reason codes (policy_violation_investigation, csae_report).

Who should care: teams managing API credentials at scale — expiring keys are a straightforward hygiene win for CI tokens and short-lived integrations, and the expires_at Admin API field makes rotation auditable. The Access Transparency change is documentation-only.

Claude API release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/

A maintenance release — "No notable changes" per the published notes, following the feature-heavy v7.4.4 (AI image generation, VS Code project memory, first-class sandboxing) a day earlier. Recorded here for version tracking; nothing to act on.

Release notes → Affects: /kilocode/

A feature-and-hardening day on main. The headline additions:

• Hermes upgraded to v0.18 + Slack Block Kit (#6507): the pinned Hermes release moves to v2026.7.1 (package 0.18.0), the config schema advances to 32 (keeping verify_on_stop: false), and Hermes's upstream Slack Block Kit renderer — including native table blocks — is enabled for Hermes. No new Slack scopes or app reinstall required; the multi-arch base image is pinned by immutable digest.
• OpenRouter runtime attribution adapter (#6584): OpenRouter runtime traffic now routes through a host-local NemoClaw adapter that injects the OpenRouter attribution headers (HTTP-Referer, X-OpenRouter-Title) OpenShell can't add per-provider today. The adapter keeps OPENROUTER_API_KEY owned by OpenShell and binds requests to the exact bearer token by SHA-256 hash. New NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT with conflict validation.
• Native OpenRouter provider for DCode routes (#6616): OpenRouter-backed Deep Agents Code sandboxes now use Deep Agents' native openrouter provider instead of falling back to OpenAI request shaping, carried through a validated NEMOCLAW_UPSTREAM_ENDPOINT_URL.
• Corporate proxy CA import (#6210): on networks where a corporate MITM proxy re-signs TLS, an operator-supplied CA (via NEMOCLAW_CORPORATE_CA_BUNDLE or the conventional REQUESTS_CA_BUNDLE/SSL_CERT_FILE fallbacks) is now imported into the sandbox trust bundle — never replacing the OpenShell CA — so channel endpoints like api.telegram.org stop failing certificate verification.

Plus reliability and docs:

• Release-matched sandbox base images (#6624): base-image resolution now prefers a release-matched tag before the mutable :latest, so a newer checkout no longer consumes an older deepagents-code base image (Hermes keeps its Dockerfile-pinned immutable base first).
• Credential-rotation guide (#6266): a new docs page covering rotation for inference keys, messaging tokens, and web-search credentials, with each copy-paste flow validated against the current CLI.
• Also: onboard now surfaces redacted Docker diagnostics on cluster-image build failures (#6623); a Hermes light-terminal skin for light-background sessions (#6578); onboard --resume now recovers a pending route reservation through a not-ready recreate (#6626); and a clearer installer message when a pre-upgrade sandbox backup is skipped (#6610).

Who should care: NemoClaw users on OpenRouter (attribution now flows on runtime traffic, and DCode routes use the native provider), anyone running Hermes with Slack (Block Kit renders natively now, no reinstall), operators behind a corporate MITM proxy (the CA-import fix unblocks channel endpoints), and anyone with a credential-rotation process to formalize. These are commit-level changes on main, not a tagged release — NemoClaw versions from the changelog, not version tags.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/policy/, /nemoclaw/skills/