If you ever tried running Verboo Code headless with a vbk_ key and the agent simply refused to authenticate, this release is for you. Version 0.15.18 ships three commits across 25 files, almost all of them in two places that never show up in the interface and ruin the day of anyone automating: authentication and the layer that speaks the OpenAI protocol.
What changed in authentication?
The startup gate accepted OAuth only. That created an odd situation: the desktop injected the API key, but the gate never looked at it, so a perfectly valid vbk_ key would not authenticate a headless agent.
The key is now accepted as a session fallback, validated with Bearer against /router/v1/models. That endpoint was chosen for a reason: /api/me rejects API keys, and this was verified before the fix landed. OAuth remains the primary path, and an invalid or expired key returns an explicit message instead of failing silently.
One detail worth knowing before you migrate your automation: the terms and entitlement flows use endpoints that only accept OAuth. On the API key path, they are skipped.
Why did a credential break only on Windows?
This is the kind of bug that eats an afternoon until someone finally looks at the raw bytes. Windows credential storage wrote the file using Encoding.UTF8, and PowerShell 5.1 emits a BOM in that mode: three bytes, EF BB BF, at the start of the file. The content looked correct in any editor, but the next read never matched the expected base64.
The fix switches to UTF8Encoding($false) and, more importantly, validates the write by reading the bytes back and comparing them against the exact base64. It is not just removing the BOM, it is no longer assuming the write succeeded.
What does hardening the OpenAI shim mean?
Most of the change volume lives here. The heaviest files were openaiShim.ts, openaiArtifactSelfTest.ts and openaiProtocolReliability.ts, plus codexShim.ts and boundedResponseBody.ts.
In practice, this is the layer that makes the OpenAI-compatible endpoint behave the way clients expect even when a response arrives in less than ideal shape. Every one of those files has a test alongside it in the same commit, which tells you the nature of the work: no new features, just closing the paths a malformed response could slip through.
How to update
npm i -g @verboo/code@latestThe full diff between versions is at github.com/verbeux-ai/code/compare/v0.15.17...v0.15.18.
What this release says
None of these three changes belongs on a feature list. Headless API keys, a Windows BOM and protocol robustness are the kind of thing you only notice when they break, and they break at the worst possible moment: inside a pipeline, with nobody watching the terminal.
It is the same reasoning behind the rest of the product. Fourteen open models running on dedicated GPUs with unlimited tokens exist so a developer never has to stop mid-refactor to think about usage. We served 22.7 billion tokens this month across 222 active subscribers. None of that matters if authentication fails silently on Windows.
Want to run your agent without counting tokens? Take a look at Verboo Code.