# caveman v2.5.0

- Product: caveman (https://whatsnew.fyi/product/caveman)
- Vendor: Julius Brussee
- Date: 2026-09-02
- Version: v2.5.0
- Original notes: https://github.com/JuliusBrussee/caveman/releases/tag/v2.5.0
- Permalink: https://whatsnew.fyi/product/caveman/releases/v2.5.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Wrap that finds a listener on the proxy port it did not start and cannot verify now launches the agent directly, so provider keys never go to a foreign process
- **added** — Qwen Code and Kilo Code wraps refuse extension, ACP, session-restore, control-command, daemon, and console surfaces that could carry model traffic outside the locked route
- **added** — Standalone proxies prove MCP recovery from the request's own tool list, so subscription sessions compress without a wrap
- **changed** — Provider-native cache optimizers and the breakpoint planner default on in optimization modes
- **fixed** — caveman-compress validates each candidate in a staging file before touching the live file and tolerates a leading tool_use block
- **fixed** — caveman-stats counts each multi-block response once
- **added** — Claude Code Remote Control is documented as incompatible with a proxied base URL and launches direct under wrap
- **changed** — README rewritten around measured savings with static charts rendered from the committed benchmark table
- **removed** — cacheengine/ removed from this repository

Caveman 2.5.0 closes this week's issue and PR queue, drops the standalone cache engine from the repository, and ships a fail-closed fix for proxy-port takeover.

Highlights:
- Security: a wrap that finds a listener on the proxy port it did not start and cannot verify now launches the agent directly, so provider keys never go to a foreign process (#945).
- Qwen Code and Kilo Code wraps refuse extension, ACP, session-restore, control-command, daemon, and console surfaces that could carry model traffic outside the locked route.
- Standalone proxies prove MCP recovery from the request's own tool list, so subscription sessions compress without a wrap (#908).
- Provider-native cache optimizers and the breakpoint planner default on in optimization modes; explicit off still wins.
- caveman-compress validates each candidate in a staging file before touching the live file (#544, #938) and tolerates a leading tool_use block.
- caveman-stats counts each multi-block response once (#793, #794).
- Claude Code Remote Control is documented as incompatible with a proxied base URL and launches direct under wrap (#947).
- README rewritten around measured savings with static charts rendered from the committed benchmark table.
- cacheengine/ removed from this repository.

Artifacts:
- CLI: `npm install -g @caveman-ai/cli@1.3.2` (npm publish pending)
- Signed binaries: bin-v1.1.5 (built by CI from this tag)

Validation:
- Full CLI suite locally: 943 tests, 942 passed, 18 skipped; the one failure is the raw-wrap base-URL test on a machine whose own caveman proxy already holds port 8787, which the new fail-closed path treats as unverifiable.
- Go proxy suite green except the pre-existing learn_retro store failures, unchanged from v2.4.0.
- verify_repo, Python, hook, and installer pin tests green.