CHANGELOG.md

# Changelog

## [Unreleased]

- **Launcher model picker.** The launch dialog gains a "Model" selector fed by
  the SDK crates' model catalogs — `claude_codes::ClaudeModel` (floating
  aliases grouped separately from pinned models) and `codex_codes::CodexModel`
  (hidden catalog entries excluded). The selection is passed as `--model <arg>`
  (Claude) or `-c model=<slug>` (Codex), placed before the free-form extra
  args so an explicit model there still wins; "Agent default" sends nothing.
  Bumps claude-codes to 2.1.161 and codex-codes to 0.143.2.

- **Versioning: patch is now the git commit count (issue #1096).** The reported version is `major.minor.{git rev-list --count HEAD}`, derived at build time by `shared/build.rs` and read everywhere as `shared::VERSION`. PRs no longer bump a version line — so parallel PRs can't collide on a hand-picked number, and the patch advances by exactly one per squash-merge. `major.minor` in `Cargo.toml` is the only human knob (its patch is a placeholder). This changelog is maintained by a periodic sweep rather than in lockstep per-PR; add notable changes under this `[Unreleased]` heading.

## 2.13.21

- **Health endpoint reports server version (#1048).** `/api/health` now returns a typed JSON response with the existing `status` plus the backend package `version` (now `shared::VERSION`), so clients and operators can confirm which server build answered a health check.

## 2.13.19

- **Forward preview overlay: accent edge + genie open/close.** The floating preview panel gets a contrasting accent-blue border (plus a faint outer ring in the shadow stack) so it reads as a distinct surface instead of blending into the dark page. Opening now **expands the panel out of the chip that launched it** and closing **collapses it back into the chip** — the chip's screen position is captured at click time and becomes the animation's `transform-origin` (0.18s out / 0.16s in, scale+fade). Unmount waits for `animationend` on the out-animation, with an effect-armed 250ms timer fallback for `prefers-reduced-motion` (where the animations are disabled entirely) — armed via `use_effect_with` so the closure holds fresh state handles, and cancelled if the panel reopens mid-close. The `▾` collapse-to-titlebar behavior is unchanged.

## 2.13.18

- **Forward chip: bound-app name + color-only health (docs/PORT_FORWARDING.md, #689).** When the proxy's health probe finds a listener it now also resolves the owning process (the [`listeners`](https://crates.io/crates/listeners) crate — same-user `/proc`/libproc lookup, run in `spawn_blocking`) and ships it in `ForwardStatus.process` (additive). The name is part of the probe verdict, so an app swap on the same port re-reports; it surfaces as `ForwardInfo.process`, in the chip tooltip (`python3 — {url}`) and the preview overlay's title bar (`python3 :8899 — {url}`). Health is now conveyed by **color alone** — the "port is live"/"nothing listening" tooltip text is gone: the chip **breathes a subtle green** while live (2.8s ease, disabled under `prefers-reduced-motion`) and sits **flat red** when the last probe was refused; neutral when no verdict. New deterministic test binds a listener in-process and asserts the resolver names our own binary; health-cache tests extended for the (listening, process) verdict tuple.

## 2.13.17

- **Forward chip: live green/red port health (docs/PORT_FORWARDING.md, #689).** The session-header forward chip now shows whether anything is actually listening on the forwarded port: green = the proxy's last probe connected, red = connection refused, neutral = no verdict yet (proxy offline / pre-probe / mixed fleet). The proxy's `TunnelManager` background-probes every allowlisted port on a 10s cadence (a loopback TCP dial — microseconds of work) and sends the existing `ForwardStatus` frame **only when a port's verdict changes**, so steady state costs zero WS frames; the registration-time probe seeds the state. The backend caches the latest verdict in memory on the `SessionManager`, exposes it as `ForwardInfo.listening` (`Option<bool>`, additive), and broadcasts `ForwardsChanged` on transitions so chips re-tint within one probe interval of a server starting or dying. No protocol change — old proxies simply never report (chips stay neutral), old backends ignore unsolicited statuses as before. Prober is `Weak`-held and aborted on connection shutdown.

## 2.13.16

- **Forward preview overlay: draggable + resizable.** The inline preview panel can now be moved by dragging its title bar and resized from a corner grip (min 320×160, clamped to the viewport so the bar can't be lost off-screen; geometry survives collapse/expand). Both interactions use pointer capture — `setPointerCapture` on the handle keeps the `pointermove` stream flowing even when the cursor crosses the embedded iframe — with `pointer-events: none` applied to the iframe during an interaction as belt-and-suspenders. `touch-action: none` + `user-select: none` on the handles keep touch scrolling and text selection from hijacking the gesture, so it works on mobile too. Position/size moved from CSS to state-driven inline styles; collapse still keeps the iframe mounted (height 0).

## 2.13.15

- **Port forwarding: inline preview overlay (docs/PORT_FORWARDING.md, #689).** Clicking the session-header forward chip now opens a collapsible overlay that renders the forwarded app in an `<iframe>` (via the `/open` handoff, so auth rides the normal `portal_fwd` cookie flow), with a **Visit site ↗** link to the full page in a new tab, a collapse toggle that hides the frame *without unmounting it* (the embedded app keeps running), and a close `×`. The overlay closes on session switch and disappears with the forward. To make embedding work, the reverse proxy now **re-scopes upstream framing policy**: `X-Frame-Options` and any upstream `frame-ancestors` CSP directive are stripped (all other CSP directives pass through untouched; directive names parsed per CSP whitespace incl. HTAB) and `Content-Security-Policy: frame-ancestors 'self' {portal origin}` is appended — apps like Jupyter ship `frame-ancestors 'self'` which would otherwise block the overlay, while apps that shipped no policy get *narrowed* from any-site-may-frame to portal-or-self. Unit tests cover the CSP directive stripping (only-frame-ancestors → header dropped; mixed policies preserved; HTAB whitespace; lookalike directive names untouched). Dev caveat: on `*.localhost` domains browsers treat the forward origin as cross-site so the iframe's `SameSite=Lax` cookie isn't sent — private-forward previews need production (same eTLD+1) domains; public forwards preview anywhere.

## 2.13.14

- **Limit continuations: wait two minutes after the reset time.** The continuation scheduler now uses a two-minute post-reset grace period before injecting or relaunching a session, and the continuation card copy reflects that timing. This gives the upstream limit window a wider margin before automatic resume.


## 2.13.13

- **Limit continuations: relaunch exited sessions when the continuation is due.** Clicking the continuation card after the reset window can now resume the original session if the local agent process already exited, then queue the continuation prompt against that resumed session. Still-running sessions keep the existing direct-inject path; older continuation syncs without launch metadata fall back to a clear dropped status.


## 2.13.12

- **Continuation cards: make the one-minute post-limit restart explicit.** The launcher already waits one minute after Claude's reported reset time before injecting a scheduled limit continuation; the card now says the continuation runs one minute after reset and the button reads "Continue 1 min after limit lifts." Added launcher scheduler regression tests that prove continuations are not ready before `reset_at + 60s` and are ready after that skew.

## 2.13.10

- **Launcher: park on fatal auth rejection instead of crash-looping (#1237 part 1).** A fatal registration rejection (expired/revoked/missing token, launcher limit, duplicate host) used to make the launcher exit 1, which under systemd `Restart=on-failure`/5s became an indefinite crash loop — one expired token racked up 76k restarts, each a full TLS+WS+registration cycle. The launcher now **parks**: it logs one prominent, actionable instruction (`run \`agent-portal login\` to re-authenticate` for auth; disconnect/stop guidance for limit/duplicate) and retries slowly (60s doubling to a 10-minute cap — distinct from the 30s network backoff). It is **self-healing**: the auth token is re-resolved from `launcher.json` on *every* connection attempt (a CLI `--auth-token` still pins), so running `agent-portal login` while parked recovers the launcher on its next retry with no service restart. `LauncherRegisterAck` gains an additive machine-readable `reject_reason` (`AuthFailed`/`TooManyLaunchers`/`DuplicateLauncher`); old backends omit it and the launcher falls back to sniffing the error text, old launchers ignore it. `save_config` is now write-temp+rename so a login concurrent with the per-attempt re-read can never observe a torn `launcher.json`. Verified live against prod with a bogus token: one instruction line, process parked (no exit). Part 2 (token rotation over the live websocket) is a follow-up.

## 2.13.9

- **Launcher: guarantee `agent-portal` is on spawned agents' PATH.** Agents shell out to `agent-portal` for messaging and port forwarding, but under systemd/launchd the service PATH often doesn't cover wherever the binary actually lives (e.g. `~/.config/claude-portal/`), so sessions got `command not found` despite the portal reminder saying the CLI is on PATH. Two-layer fix, both keyed off the running binary's own directory: (1) the generated systemd unit / launchd plist `Environment=PATH` now includes the launcher executable's directory (existing installs self-heal via `service::sync()` on the next auto-update); (2) at daemon startup, if `agent-portal` doesn't resolve on the current PATH, the launcher prepends its own directory to the process environment so already-running-style units are fixed immediately — children inherit it. A deliberate install that already resolves (e.g. a `~/.local/bin` symlink) is left untouched. Verified live both ways (stripped PATH → "prepended own directory" + resolves; resolvable PATH → no-op). Unit tests cover the PATH builder and the generated unit contents.

## 2.13.8

- **Port forwarding: admin custom subdomains (Admin ▸ Subdomains, docs/PORT_FORWARDING.md, #689).** An admin can give a session's forward a human-readable alias (e.g. `myapp` instead of the auto `a3f9c2e1`) that routes to the same session *alongside* the auto label — both URLs work. New `custom_subdomains(label PK, session_id UNIQUE, created_by, created_at)` table (migration `2026-07-07-230000`, cascade with the session, one custom label per session). Admin-only endpoints (`require_admin`): `GET/POST /api/admin/subdomains`, `DELETE /api/admin/subdomains/{label}`, and `GET /api/admin/forwards` (the assignment picker). The Host-gate parse now accepts any single lowercase DNS label **except the reserved words, which fall through to the normal router rather than 404ing as forward hosts** (the reservation lives at the routing boundary and `admin_subdomains` shares the same predicate, so create-time and route-time can't drift), and resolves it via `custom_subdomains` then the auto LUT (unknown → 404); the two namespaces can't collide because 8-hex strings are rejected as custom labels. **Explicit deconfliction**: an invalid label → `400` with the reason (lowercase DNS label, not 8-hex, not a reserved word like `admin`/`www`/`api`), a taken label or a session that already has one → `409`; the new admin Subdomains tab surfaces the message inline next to the text entry. Verified live: create → 201, dup → 409, 8-hex → 400, reserved → 400, and both the custom and auto labels route to the forward. New `AppError::Conflict` (→ 409). Backend + WASM build, workspace clippy, tests (incl. label-validation + relaxed host-parse), and migration up/down all clean.

## 2.13.7

- **Port forwarding: public forwards (Settings ▸ Forwarding, docs/PORT_FORWARDING.md, #689).** A new `session_forwards.public` flag (migration `2026-07-07-220000`, default false) makes a forward's subdomain reachable without the token-handoff auth — an owner opt-in ngrok-style public share. New **Settings ▸ Forwarding** tab lists the caller's active forwards across sessions (`GET /api/forwards`, owner-scoped) with a per-forward public/private toggle (`PATCH /api/sessions/{id}/forwards/public`, owner-only, serialized under the same per-session row lock as create/delete). The forward-origin dispatch checks `public` before the cookie gate and serves a public forward with no auth; for a private-or-absent forward it still runs the cookie gate *before* distinguishing present-from-absent, so an unauthenticated caller can't probe whether a private forward is active (same auth bounce either way). **Re-pointing the forward to a different port resets `public` to false** — the opt-in covers the service it was granted for, not whatever the port moves to next; a fresh owner toggle is required (idempotent same-port re-registration keeps the flag). `ForwardInfo` gains `public`. Verified live: public + no cookie → reaches the tunnel (503 only because no agent connected, i.e. auth bypassed); private + no cookie → 401 (XHR) / 307 bounce (navigation). Backend + WASM build, clippy, tests, and migration up/down all clean.

## 2.13.6

- **Port forwarding: one forward per session on a per-session subdomain (docs/PORT_FORWARDING.md, #689).** The public subdomain now identifies the *session*, not the port: `{label}.{PORTAL_FORWARD_DOMAIN}` where `label` is a short 8-hex value from a new `forward_subdomains` lookup table (derived from `sha256(session_id)`, counter-bumped on the rare collision, `UNIQUE(label)` backstop), stable across close/reopen and independent of which port is forwarded. `session_forwards` is now one row per session (`UNIQUE(session_id)`); `agent-portal forward <port>` upserts it, and the response carries `replaced_port` so the CLI tells the agent when it moved an existing forward — an agent that needs several services fronts them behind its own reverse proxy on the single forwarded port. Handoff/cookie JWTs bind `session_id` only (the port is looked up per request, so revocation and re-pointing take effect immediately). Routes lose the port segment: `DELETE /api/…/forwards` and `GET /api/…/forwards/open`; `agent-portal forward close` takes no port. Migration `2026-07-07-210000_one_forward_per_session` (clears the not-yet-deployed ephemeral rows, adds the LUT + single-forward constraint). Frontend chip, reverse-proxy Host router, host-label parse (`^[0-9a-f]{8}$`), and spec/reminder all updated. Backend + WASM build, clippy, and unit tests (host parse, `next` clamp, `aud` requirement, `Location` rewrite) pass.

## 2.13.5

- **Port forwarding milestone 3: session-header forward chips (docs/PORT_FORWARDING.md, #689).** The session view header now renders a chip per active forward (`:8080 ↗`), fetched from `GET /api/sessions/{id}/forwards` and refetched whenever a `ServerToClient::ForwardsChanged` frame arrives (new `WsEvent::ForwardsChanged` → a `forwards_refresh` tick prop the `ForwardChips` component watches), so chips appear/disappear live as the agent registers or revokes. Each chip links through the portal `/open` handoff endpoint in a new tab; the session owner also gets a revoke `×` (owner-gated in the UI to match the backend). Completes the user-facing surface and the whole #689 forwarding feature (spec → protocol → proxy tunnel → backend reverse proxy + WS upgrade → CLI → UI).

## 2.13.4

- **Port forwarding milestone 2: WebSocket upgrade passthrough (docs/PORT_FORWARDING.md, #689).** The forward-origin reverse proxy now relays `Connection: Upgrade` requests end-to-end: the hyper client connection is driven with `.with_upgrades()`, upgrade requests keep their `Connection`/`Upgrade` headers (other hop-by-hop still stripped), and on a `101 Switching Protocols` the browser's and upstream's upgraded byte streams are spliced with `copy_bidirectional` — so WebSocket-dependent apps (Jupyter kernels, Vite HMR) work through a forward, riding the same raw tunnel as ordinary requests. Upgrade detection scans all `Connection` header values (split fields are RFC-legal); a stray upstream `101` to a non-upgrade request is refused rather than forwarded; the 101 response keeps `Connection`/`Upgrade` and passes `Sec-WebSocket-Accept` through normally. SSE already worked via the streaming-body path (no upgrade). Unit tests cover the handshake detection (incl. split `Connection` fields). (Idle-stream timeouts remain deferred; streams are still bounded by the per-connection cleanup from milestone 1c.)

## 2.13.3

- **Port forwarding milestone 1d: `agent-portal forward` CLI + agent reminder (docs/PORT_FORWARDING.md, #689).** New launcher subcommand on the same rails as `agent-portal message` (stored launcher token, `/api/agent/*` endpoints, session identity via `sender_session_id`): `agent-portal forward <port>` registers a forward and prints exactly one URL line (so agents can relay it verbatim), with a stderr warning when the proxy reports nothing listening / can't confirm; `agent-portal forward list` shows active forwards; `agent-portal forward close <port>` revokes one. Extra args are rejected (`forward list 8080`, `forward 8080 9090`) rather than silently ignored. `claude-session-lib/portal_reminder.md` gains a port-forwarding bullet so agents discover the affordance (owner-only, WebSockets/SSE noted). Completes the user-facing surface of milestone 1.

## 2.13.2

- **Port forwarding milestone 1c: backend forward-origin router + reverse proxy (docs/PORT_FORWARDING.md, #689).** Requests whose `Host` matches `{port}--{session}.{PORTAL_FORWARD_DOMAIN}` are caught by an outermost router middleware (`forward_host_gate`) and never reach the normal routes. Auth is a token handoff: `GET /api/sessions/{id}/forwards/{port}/open` (portal origin, session-read access) mints a 60s JWT (`aud`/`session_id`/`port`-bound) and 307s to the forward origin's `/__portal/auth`, which exchanges it for an 8h host-only `portal_fwd` cookie; authenticated requests are then reverse-proxied through a fresh tunnel stream to `127.0.0.1:{port}` on the proxy host via a hyper HTTP/1.1 client over the `session_lib` tunnel. Backend relay (`session_manager::tunnel_client`) mirrors the proxy side symmetrically: 256 KiB per-direction credit, ≤16 KiB frames, receive-credit enforcement + oversized-frame rejection on the downlink, grant-on-drain windows. Request rewriting strips portal cookies/`Authorization`/hop-by-hop headers and pins `Host: localhost:{port}` (defuses dev-server host checks) with `X-Forwarded-*`; response rewriting rewrites loopback `Location`/`Content-Location` back to the forward origin. Hardening: strict authority normalization (lowercase, strip `:port`/trailing dot) before label parse; `next=` clamped to origin-relative paths (rejects `//`, `/\`, absolute URLs, control chars, >2048b); missing-cookie navigations bounce back through the portal `open` endpoint while XHR/WS get plain 401. `WebSocket` upgrades are not yet passed through (hop-by-hop `upgrade` still stripped) — that plus SSE hardening is milestone 2. Unit tests cover host parsing (valid + 8 hostile shapes), `next` validation, and `Location` rewrite; host-gate/auth/redirect/fallthrough paths verified end-to-end against a live dev backend.

## 2.13.1

- **Port forwarding milestone 1b: proxy-side tunnel transport (docs/PORT_FORWARDING.md, #689).** New `session_lib::tunnel::TunnelManager`, one per session-WS connection, wired into BOTH proxy hosts (claude-session-lib's `proxy_session` for launcher-managed claude+codex sessions, and the VS Code shim's reader): maintains the `ForwardOpen`-synced port allowlist, answers each open with a probe-dialed `ForwardStatus`, and serves `TunnelOpen` by dialing `127.0.0.1:{port}` (loopback hard-coded, allowlist-checked, 64-stream cap, dup-id refused) then running a per-stream copy loop. Flow control per spec: 256 KiB credit per direction with grant-on-drain `TunnelWindow`s, ≤16 KiB frames; outgoing frames go straight through the shared FIFO `WsSender` mutex — no queue to grow, so buffering is bounded at streams×16 KiB and ready streams are served round-robin, with session frames sharing the same fair mutex. Stream handles are registered synchronously in reader dispatch before the (spawned) dial so a pipelined `TunnelData` can't race the handle map; managers tear down all streams on WS disconnect and the backend's `ForwardOpen` replay rebuilds the allowlist on reconnect. Unit tests cover the credit gate (block-at-zero, resume-on-grant, no missed pre-armed grants). Spec doc: browser POST row + bearer-or-cookie wording (codex review nits on #1240). Backend reverse proxy + handoff auth are next.

## 2.13.0

- **Port forwarding milestone 1a: tunnel protocol + forward registration (docs/PORT_FORWARDING.md, #689).** Protocol: `ServerToProxy` gains `ForwardOpen`/`ForwardClose` (proxy allowlist sync) and `TunnelOpen`/`TunnelData`/`TunnelWindow`/`TunnelClose`; `ProxyToServer` gains `ForwardStatus` (allowlist ack + probe-dial result) and `TunnelOpened`/`TunnelRefused`/`TunnelData`/`TunnelWindow`/`TunnelClose`; `ServerToClient` gains `ForwardsChanged` (payload-free refetch nudge). New `session_forwards` table (migration `2026-07-07-190000`, cascade-deleted with the session) is the authoritative allowlist. New endpoints — `POST`/`GET /api/sessions/{id}/forwards` (member), `DELETE /api/sessions/{id}/forwards/{port}` (owner), mirrored under `/api/agent/…` for the CLI (cookie or Bearer auth, shared handlers). `POST` pushes `ForwardOpen` to the live proxy and reports its probe verdict (`listening: Some(bool)`; `None` = proxy disconnected/too old — old proxies ignore unknown frames via their catch-all, so mixed fleets degrade cleanly). The backend replays `ForwardOpen` for every active forward after each successful proxy registration. `PORTAL_FORWARD_DOMAIN` configures the forward-subdomain authority (dev-mode default `localhost:{PORT}`; unset in prod = forwarding disabled, endpoints report it cleanly). Proxy tunnel transport, the Host-routed reverse proxy, the CLI, and frontend chips land in the next PRs.

## 2.12.138

- **Fix duplicate migration version 2026-06-04-120000 (silent skip).** Two migrations shipped with the same version prefix (`add_send_mode_to_pending_inputs` and `decouple_turn_metrics_from_sessions`); Diesel keys migrations by version, so each database only ever applied ONE of them — fresh databases silently skipped the turn_metrics decoupling (no `user_id` column, `schema.rs` regen produced spurious drift), while databases that migrated incrementally skipped `pending_inputs.send_mode`. Both are renamed to unique versions (`-120001`, `-120002`) and rewritten idempotently (`IF NOT EXISTS` guards, null-safe backfill), so every database converges regardless of which one it previously applied; the stale `20260604120000` row in `__diesel_schema_migrations` is harmless. `scripts/check-migration-names.sh` (CI) now also fails on duplicate version prefixes so this can't recur. No schema change for a database that already has both columns.

## 2.12.137

- **Spec: port forwarding (docs/PORT_FORWARDING.md).** Design for the remaining half of #689: agents expose local HTTP services through per-forward subdomains (`{port}--{session}.{PORTAL_FORWARD_DOMAIN}`), transported over a multiplexed credit-windowed byte tunnel on the existing session WebSocket, with token-handoff auth onto the forward origin, a `session_forwards` allowlist, an `agent-portal forward <port>` CLI, and WebSocket/SSE passthrough. Docs only, no code.

## 2.8.79

- **Launch/restore hardening, phase 4: atomic launch lease (closes the double-launch race + the pending-wedge).** Reconcile decided whether to relaunch a session by consulting two eventually-consistent in-memory sets (the launcher's last-heartbeat `running_sessions` and the `pending_launch_sessions` map). The gap between a launch being sent and the next heartbeat reporting it as running let a second reconcile relaunch the same session — the duplicate-process race — and a launcher that died between `LaunchSession` and `LaunchSessionResult` left a `pending_launch_sessions` entry that *never* cleared, wedging that session out of reconcile forever (no TTL). Now a new nullable `sessions.launch_lease_until` column is the single source of truth for "a launch is in flight": reconcile claims it with an atomic conditional `UPDATE … WHERE launch_lease_until IS NULL OR < now()` (only one claimant wins, even across backend instances) before sending `LaunchSession`, and the lease self-expires after 60s so a mid-launch death frees the session for retry instead of wedging it. Registration and launch-failure both clear the lease. The `pending_launch_sessions` map is no longer the dedup gate (kept only for request→session result correlation). Migration `2026-06-18-120000_add_launch_lease` (additive nullable column; applies at startup). Backend builds + 111 tests pass; the lease is a DB roundtrip so it isn't exercised by CI unit tests. (Remaining spine follow-ups, not in this PR: backend-driven atomic SessionNotFound rotation to fully close the mid-rotation fork, and unbound launch-token GC.)

## 2.8.78

- **Launch/restore hardening, phase 3: stable launcher identity across restarts.** The launcher minted a fresh random `launcher_id` on every boot (`Uuid::new_v4()`), but reconcile selects a launcher's desired sessions by `sessions.launcher_id` — so after a launcher restart none of its prior sessions matched the new id, and they were stranded (not relaunched) until each proxy happened to reconnect on its own. The id is now persisted to `<config-dir>/launcher_id` (`config::persistent_launcher_id`, created on first run, regenerated if the file is corrupt), so a restarted launcher reclaims and relaunches its own sessions. Tests cover stability across calls and regeneration on a garbage file. (The launch-lease / atomic-rotation DB changes — which need a migration and change core launch arbitration — are deferred to phase 4 so they can land with explicit review; this phase is launcher-only, no migration.)

## 2.8.77

- **Launch/restore hardening, phase 2 of 4: deterministic process ownership.** Closes the duplicate/orphaned agent-process class. The io-task parks in `client.receive()`, so dropping the command channel (the old `Session::stop`) never ended an idle agent — the child leaked. Now `Session<A>` owns the io-task `JoinHandle`; `stop()` aborts and awaits it (dropping the task's client), and a `Drop` impl aborts it as a safety net if the session is dropped without `stop()` (e.g. its owning task was aborted). Paired with `kill_on_drop(true)` on the claude spawn (`spawn.rs`), aborting the task now reliably reaps the `claude` child instead of leaving it holding its transcript and a live WebSocket. Plus a launcher **dedup guard**: `ProcessManager::spawn` no longer overwrites an existing `ManagedTask` for a session id already running — a reconcile/launch race used to orphan the old task (losing its cancel token) and double-spawn the process (the "two claude procs for one session" symptom); it's now a logged no-op. New `stop_aborts_and_reaps_io_task` test with a mock parked agent. (Codex's app-server is spawned via the SDK's `AppServerBuilder`, which doesn't expose `kill_on_drop`; the `Session`-level abort still applies, but guaranteed reaping there needs an upstream `rust-code-agent-sdks` change — follow-up.)

## 2.8.76

- **AskUserQuestion frames now have a free-text "something else" answer.** The interactive question dialog (`permission_dialog.rs` `render_ask_user_question`) previously only let you pick a preset option, railroading you when none fit. Each question now has a `Something else…` text row; typing sets that question's answer to your custom text, and it shows as selected (matching no option / multi-select join). A blank field un-answers the question (`permission_handler.rs` removes rather than stores an empty string), so it doesn't falsely satisfy the submit gate. Because Codex's `ToolRequestUserInput` is normalized to the same `AskUserQuestion` permission shape and rendered by this same frame, both Claude and Codex questions get the escape hatch from one change. CSS for the input in `permissions.css`. 317 frontend tests pass.

## 2.8.75

- **Launch/restore hardening, phase 1 of 4: typed exit reason + deterministic resume.** First slice of the session launch/restore refactor. Two structural gaps fixed:
  - **Deterministic resume.** Before `claude --resume <id>`, the launcher now checks whether the local transcript exists (`claude-session-lib::claude_transcript_status`, resolving `~/.claude/projects/<encoded-cwd>/<id>.jsonl`). If the project dir exists but the transcript is gone, it rotates to a fresh session *in one step* instead of spawning a doomed `claude` that exits in ~1s and gets relaunched every heartbeat (the ~40× crash loop we hit). `Unknown` (path-encoding uncertainty) safely falls through to a normal spawn so a resume is never discarded on a guess. Claude-only; codex has no transcript file.
  - **Typed exit reason → crash-loop backoff.** `LauncherToServer::SessionExited` now carries a typed `SessionExitReason` (`Completed`, `CrashedEarly`, `ResumeTargetMissing`, `RegistrationRejected`, `Stopped`, `Error`; `#[serde(default)]` for mixed-version fleets). The launcher classifies a sub-10s `NormalExit` as `CrashedEarly`; the backend bumps `launch_failure_count` on `CrashedEarly`/`ResumeTargetMissing` (engaging the existing exponential backoff) and resets it on a healthy `Completed` run. The reset moved off *registration* — a crash loop registers every attempt, which previously pinned the counter at zero so backoff never escalated. Tests: transcript-status classification (present/missing/unknown), `SessionExitReason` wire-default + roundtrip.

## 2.8.74

- **Logging on the session relaunch / crash-loop paths.** A session whose agent registers fine but then exits cleanly (code 0) within ~1s — e.g. `claude --resume <id>` where the local conversation is missing — was relaunched by reconcile on every heartbeat (~30s) with no log line marking the relaunch, and `launch_failure_count` stayed 0 (it *did* register), so the #1045 backoff never engaged. The storm was effectively invisible from the backend. Now: (1) `launcher/src/process_manager.rs` times each attempt and logs the elapsed lifetime at every exit arm, emitting a `WARN` ("possible crash loop") when a `NormalExit` happens in under 10s, and noting "resume target missing" on the `SessionNotFound` branch; (2) `backend/.../launcher_socket.rs` `reconcile_desired_sessions` now `INFO`-logs each relaunch it sends (session id, name, `launch_failure_count`, dir) and `DEBUG`-logs sessions skipped due to backoff (with seconds remaining). Logging only — no behavior change.

## 2.8.73

- **Session token totals now include sub-agent (Task tool) tokens for Claude sessions.** `store_result_metadata` wrote `sessions.output_tokens` straight from `result.usage`, which covers only the *parent* conversation — sub-agents (Explore/Plan/etc.) run as separate API conversations whose tokens arrive on `task_notification` frames (`TaskUsage.total_tokens`) and were never aggregated, so per-session totals and the admin spend dashboard under-counted. `SessionManager` gains a `subagent_tokens` map; each completed `task_notification` (the SDK emits it once per task, with cumulative `total_tokens`) adds into the session's running total, and `store_result_metadata` folds that into `output_tokens` at result time. Cost (`total_cost_usd`) was already inclusive via the CLI's session-wide figure, so this closes the cost-right/tokens-low asymmetry. New `task_notification_exposes_total_tokens` test pins the wire contract the fold depends on. (Codex sub-agent tokens are a separate path with an unresolved delivery question and are not covered here. The per-turn `turn_metrics` footer is also a separate path, unchanged.)

## 2.8.72

- **`spawn_ws_reader` no longer takes 11 arguments (closes #1052).** The reader's eight `mpsc`/`oneshot` senders are bundled into a new `WsReaderChannels` struct (`claude-session-lib/src/proxy_session/ws_reader.rs`), dropping the signature to three params (`ws_read`, `channels`, `heartbeat`) and removing the `#[allow(clippy::too_many_arguments)]` plus its stale `// TODO … issue #271` comment (the referenced issue was closed without the refactor being done). The struct is destructured at the top of the function so the body and the call site (`proxy_session/mod.rs`) are otherwise unchanged — pure mechanical refactor, no behavior change. Clippy passes with the allow removed.

## 2.8.71

- **Codex `collabAgentToolCall` / `spawnAgent` items now render as a tool card (closes #1049).** Codex's multi-agent collaboration calls aren't modeled in the `codex-codes` `ThreadItem`, so they previously fell through to the raw-JSON fallback card. Added a local mirror `CollabAgentToolCallItem` (+ `AgentState`) to the `#[serde(untagged)] CodexItem` enum in `frontend/src/components/codex_renderer/events.rs` — same pattern as the existing `ContextCompactionItem` mirror — tagged `TODO(SDK)` pending an upstream `codex-codes` variant. `render_collab_agent_tool_call` (`codex_renderer/tools.rs`) shows a 🤖 "Spawn Agent" card: status + model + reasoning effort as meta, the spawn prompt as expandable `pre`, and a compact child-agent list (thread id → status). Dispatched in `codex_renderer.rs`; sparkline `classify_codex_event` updated for exhaustiveness. New deserialization test from the real wire payload; 317 frontend tests pass.

## 2.8.70

- **Thinking blocks expose their encrypted signature on mouseover.** `claude-codes`' `ThinkingBlock` carries a `signature` (the encrypted attestation of the thinking content) alongside `thinking`, but the renderer only ever showed the text. The `thinking` label (`frontend/src/components/message_renderer/renderers/assistant.rs`) now carries a `title` tooltip with the full signature (or "No signature on this thinking block." when absent), and `.thinking-label` gets `cursor: help` + `width: fit-content` so the hover affordance is discoverable and hugs the label text.

## 2.8.69

- **Codex bash command cards no longer overflow horizontally.** A Codex command rendered into `<pre class="tool-input-content">` (`frontend/src/components/codex_renderer/tools.rs`), but `.tool-input-content` was never styled — so the bare `<pre>` defaulted to `white-space: pre` and a long single-line command ran off the side of the card instead of wrapping, the way Claude's bash card and Codex's own `.tool-result-content` already do. Added a `.tool-input-content` rule to `frontend/styles/tools/base.css` mirroring `.tool-result-content` (`white-space: pre-wrap; word-break: break-word;` plus the shared mono font/size), so the command wraps and stays contained. Also fixes the Codex web-search query `<pre>` that shares the class.

## 2.8.68

- **Sessions no longer get permanently wedged in `paused`, and leaked launch tokens are cleaned up (#1045).** A transient launch failure used to set `paused = true`, but `paused` doubles as the user's "don't relaunch" flag and reconcile only ever relaunches `paused = false` sessions — so one failure removed a session from reconciliation forever, and deleting it didn't help because the launcher recreated it straight back into the trap. Launch failures now bump a dedicated `launch_failure_count` (+`last_launch_attempt_at`) instead of pausing; reconcile keeps retrying failed launches with exponential backoff (30s→15min cap), and a successful registration resets the counter. A proxy that receives `RegisterAck { success: false }` (revoked/expired token, unauthorized) now exits instead of reconnecting forever with a dead token — that was keeping the proxy in the launcher's running set and blocking reconcile from relaunching with a fresh token. Separately, `launcher-spawned` tokens were only ever bound/revoked on a *successful* registration, so every failed launch leaked a never-expiring, never-bound token (12.5k accumulated on prod); the hourly token-cleanup task now deletes unbound launch tokens older than an hour, and a migration clears the existing backlog.

## 2.8.67

- **Thinking-token chip no longer "resets" after tool calls.** The CLI's `estimated_tokens` is cumulative across a turn, but each tool call or assistant message splits the marker run into a new `Thinking` group, mounting a fresh `CountUp` whose odometer re-raced from 0 up to the full cumulative total — most visibly right after the final edit before the answer. `CountUp` gains a `start` prop (consulted on mount, clamped to `0..=target`), and a new `thinking_chip_starts` pass seeds each chip with the previous burst's peak within the same turn, resetting at turn terminators. The count now reads continuously across splits; if the marker stream ever restarts low, the clamp degrades to a static display rather than a backwards animation. Pinned by a grouping test (`[0, 150, 0]` across a split + terminator).

## 2.8.66

- **Cargo hygiene: tokio narrowed from `full` to 11 measured features; tower-http to `cors` only; nine deps hoisted to workspace.** The tokio feature set (`fs, io-std, io-util, macros, net, process, rt, rt-multi-thread, signal, sync, time`) was determined by grepping actual per-crate usage, not guesswork — five member crates also dropped their own `features = ["full"]` overrides. tower-http's unused `fs`/`trace`/`compression-full` removed (lockfile −92 lines). `serde`/`serde_json`/`uuid`/`chrono`/`thiserror`/`tracing`/`anyhow`/`hostname`/`directories` now use `workspace = true` across session-lib, claude-session-lib, codex-session-lib, portal-auth, portal-update, proxy, launcher (with per-crate feature additions like chrono `clock` made explicit where crates had been riding feature unification). claude-session-lib's unused `thiserror` and `directories` deps deleted; session-lib's thiserror moved 1→2. WASM targets verified unregressed; all three binaries link.

## 2.8.65

- **Frontend misc dedup sweep: 11 consolidations + dead props removed.** Highlights: the skip-permissions CLI arg tables (duplicated between launch and schedule dialogs, with `strip_skip_permissions_args` needing to recognize exactly what they emit) now live in one `skip_permissions.rs` module with a drift-guard test; `set_field("name")`'s silent string-typo fallthrough replaced by typed setter closures; the throughput/TTFT series builders, token-secret cards, ShareDialog error arms (×5), splash footer, tab-switch callbacks (×9), markdown table cell renderers, user-message extraction, and `Option<TurnMetrics>` footer matches (×3) each collapsed to one implementation; `dir_entry`/`autosize` helpers extracted. Dead code: `VoiceInput.session_id` (kept "for API compatibility" — gone), `MessageData.agent_type` (deserialized, never read; stale comment corrected), `pub` dropped from `sparkline::ACCENT_COLOR`. The `MessageRenderer.session_id` prop flagged by the audit turned out LIVE post-#1005 and stays. Net −79 lines with all rendered DOM byte-identical (314 tests).

## 2.8.64

- **Frontend helper consolidation: localStorage, spend tiers, file sizes, token counts, model labels.** `utils::storage_get/storage_set` replace 9 inlined `window().local_storage()` chains (plus one bool-pref load/save pair helper in dashboard types); the spend-tier 1/10/100/1000/10000 ladder is encoded once (`spend_tier` + `spend_tier_class`) instead of twice in page.rs; `format_file_size` and `format_token_count` move to utils with their tests; the pill's `shorten_model_name` is renamed `compact_model_label`, killing the same-name-different-behavior import hazard; `window_param` (an exact duplicate of `TimeWindow::label`) is deleted. Deliberate skips, documented: two token formatters render genuinely different strings, `pair_label` ≠ `format_model_tier_label` (vendor-stripping/case differ — a doc note pins the divergence), and the expiry-helper duplication had already disappeared upstream. ~95 lines of duplicated logic removed.

## 2.8.63

- **`shared::fmt` hosts the cross-crate `truncate_str`/`format_duration`; upload chunk constants live with the protocol.** The byte-identical UTF-8-boundary truncation and the accidentally-divergent duration formats (`"{}m {}s"` frontend vs `"{}m{}s"` proxy logs) are unified on the user-facing spaced form — visible only in proxy debug logs. Six fresh unit tests (the originals had drifted away entirely). `UPLOAD_CHUNK_SIZE`/`MAX_UPLOAD_CHUNK_BYTES`/`MAX_UPLOAD_TOTAL_CHUNKS` moved from frontend/backend into `shared/src/protocol.rs` with doc comments tying sender to validator (values unchanged; a stale "~3.2 GiB" doc figure corrected to 4 GiB).

## 2.8.62

- **Backend `main.rs` shrunk from 958 to 233 lines (`main()` 633 → 125).** New `background.rs` hosts `spawn_periodic(name, period, state, f)` — replacing five identical spawn/interval skeletons — plus the relocated spend-broadcast/retention/session-age/token-cleanup loops and the device-code purge (extracted from an inline closure). New `config.rs` owns all env parsing (`ServerConfig::from_env`) and the OAuth client build, log lines preserved verbatim and in order. `routes.rs` gains `build_router` with the full route table; the duplicate `/api/sessions/{id}` registration pair is one chained `get().delete()` and the two byte-identical governor configs are one `rate_limit(per_second, burst)` helper. `db.rs` gains `run_migrations_logged` and `seed_dev_user` (now built on #978's `dev_user`/`DEV_USER_EMAIL`). Startup order, intervals, env names/defaults, and graceful shutdown preserved exactly. Bonus: the unused direct `governor = 0.8` dep aligned to 0.10, dropping a duplicate from the lockfile.

## 2.8.61

- **Admin user list: 1+7N queries → 3; `bigdecimal` dropped from the dependency tree.** `list_users` ran a session-count query plus `get_user_usage` (6 sequential SUMs with `BigDecimal` round-trips) per user — ~700 queries for a 100-user page. One `GROUP BY user_id` aggregate (with the CLAUDE.md-mandated `::bigint`/`::float8` casts) plus one `deleted_session_costs` load now join in memory; `get_user_usage` itself is deleted (list_users was its only caller). Semantics pinned against a live Postgres: no status filter (as before — replaced/inactive included), `COALESCE(...,0)` ≡ the old `unwrap_or(0)`, absent users get zeros, and usage-query errors still degrade to zeros instead of a 500. `bigdecimal` removed from backend and the diesel `numeric` feature from the workspace (zero `Numeric` columns in the schema) — Cargo.lock −24 lines.

## 2.8.60

- **Docs drift fixed: log filename, stale workspace tree, completed workplans, loose migration file.** Four docs told users to tail `/tmp/agent-portal-backend.log` — a file nothing writes (scripts write `/tmp/claude-portal-backend.log`); references to the equally-fictional proxy log dropped. CLAUDE.md's workspace tree now matches `[workspace] members` exactly (adds `session-lib`/`claude-session-lib`/`codex-session-lib` with rustdoc-sourced descriptions), its AppState snippet matches the real struct, and the env-var table gains the missing `SPLASH_TEXT`. `PROXY_LIBRARY_EXTRACTION.md` and `SERVER_PAUSED_SESSIONS_WORKPLAN.md` get STATUS: COMPLETED banners citing the shipped artifacts. `fix_migration_names.sql` moved out of `backend/migrations/` to `scripts/` (with the checker's help-text pointer updated) so the migrations dir contains only migrations.

## 2.8.59

- **Session access checks centralized in `session_access.rs`.** One canonical `verify_session_reader` (any-role membership join, 404 on miss) replaces three near-identical implementations in messages, turn-metrics, and the WS auth module (now deleted); `is_session_mutator` is a thin wrapper over `verify_session_mutator` instead of a re-implementation (orphaned `can_mutate_role` + tests removed). The three owner checks in sessions.rs were NOT identical — delete accepts the `sessions.user_id` owner without a member row (404 on miss) while the member-management gates require an actual owner member row (403) — so two helpers preserve both semantics: `verify_session_owner` and `verify_owner_membership`. One nuance: the messages path used to map DB errors to 404; it now surfaces 500 like the other paths (authorization outcomes unchanged). Net −86 lines.

## 2.8.58

- **scripts/ cleanup: broken package names fixed, `test-dev.sh` deleted, shared `lib.sh`.** `test-oauth.sh` ran `cargo run -p proxy` — a package that doesn't exist (it's `claude-portal`), so the script failed at the proxy step; `clean.sh`/`test-oauth.sh` `pkill`ed the same wrong name (could never match). All fixed, plus `docker-compose` v1 → `docker compose` across scripts. `test-dev.sh` (~80% duplicate of `dev.sh`) is deleted with its references updated in TROUBLESHOOTING.md/install-deps/README. The dev DATABASE_URL literal (6 copies) now lives once in a sourced `scripts/lib.sh`; diesel/trunk auto-install lives only in `install-deps.sh` (dev.sh fails fast with a pointer); `up.sh` guards its macOS-only `open -a Docker` by `$OSTYPE` with a Linux `systemctl` path. Scripts still write `/tmp/claude-portal-backend.log` — doc alignment is #999's.

## 2.8.57

- **Launcher registration reuses the scheduled-task sync helpers instead of hand-building `ScheduledTaskConfig`.** The 45-line registration block (including a redundant hostname re-fetch from the launchers map) is now one call to a new `send_initial_schedule_sync(app_state, user_id, launcher_id, hostname, launcher_name)` — a single-launcher variant chosen deliberately over the broadcast `send_schedule_sync`, which (a) targets all of a user's launchers and (b) always sends even when empty (needed so deletes clear state), whereas registration historically sends nothing when no enabled tasks match the hostname. Both variants share a new `load_enabled_tasks` and all config construction flows through `task_to_config`, so the #995 field flatten lands in exactly one place. Same mpsc delivery, same log line.

## 2.8.56

- **Native-crate misc dedup: hostname helper, default session name, dead config fields, heartbeat constant.** `hostname_or_unknown()` in claude-session-lib replaces 7 inline copies (unified on `to_string_lossy`; non-UTF-8 edge cases now render lossily instead of three different fallback strings — normal hostnames byte-identical; portal-auth keeps its copy rather than inverting the dependency graph, and one proxy site keeps its no-fallback `Option<String>` semantics deliberately). `default_session_name` moved next to `ProxySessionConfig`. Write-only `ProxyConfig` fields removed: `SessionAuth.user_id`, `session_prefix` (+ setter + init-URL plumbing), `Preferences.auto_open_browser`. `atomic_save` delegates to `save_with_lock`. `probe.rs` uses `AgentType::as_str()`. Launcher's heartbeat cadence moved to `shared/src/protocol.rs` as `LAUNCHER_HEARTBEAT_INTERVAL_SECS` with a doc note that the backend deliberately has no staleness timeout (liveness = the WS connection). Two issue items were already done on main (#1003 removed the RegisterFields duplication and the `unreachable!`). Net −46 lines.

## 2.8.55

- **Repo-root scratch purged and `.gitignore` extended.** ~20 untracked artifacts (a 3.8MB `screenlog.1`, `parsing-dump/`, stray phone photos and AI-generated images, brand-mark source files duplicating `frontend/assets/`, `test-*.png/svg` plot outputs, `shim-mode.patch` + notes, a design doc for code that doesn't exist) were verified unreferenced and removed from the working tree. `.gitignore` now covers the patterns that demonstrably accumulate: `screenlog.*`, root `test-*.png/svg`, root `*.patch`, `parsing-dump/`.

## 2.8.54

- **Admin page: three PATCH-user handlers deduped; `/api/auth/me` no longer fetched redundantly.** `patch_user(user_id, body) -> bool` + `update_user_in(users, id, f)` collapse the toggle-admin/unban/confirm-ban triple to one-liners. The dashboard's leave-confirm now uses the `current_user_id` it already holds (typed `Option<Uuid>` now) instead of a second network round-trip, and the admin modal receives the id as a prop, skipping its own me-fetch; the standalone `/admin` route keeps its original fetch with 401→Home / 403→denied handling.

## 2.8.53

- **Shim cleanup: wiggum prompt single-sourced, one write_line, dead channel and fake retries gone, shared claude arg builder.** The wiggum DONE-loop prompt suffix existed in three byte-identical copies (drift would silently break loop semantics) — now `wiggum_prompt()` next to `WiggumState`. All six serialize→write→newline→flush sites in the shim use one generic `write_line` (newline/flush errors at four raw sites now surface like write errors instead of being ignored). The stdin-line channel feeding an empty select arm is deleted. Both "retry the same failing constructor" fallbacks (`warn!("continuing without persistence")` then `?`, and `unwrap_or_else(|_| …unwrap())`) reduced to honest single calls. `claude_cli_args()` in spawn.rs builds the CLI flag list once for the lib spawn, its diagnostic log, and the shim's respawn — a flag change can't miss the shim anymore. Net −56 lines.

## 2.8.52

- **ScheduledTask wire trio flattened around one `ScheduledTaskFields` core; MessageRole/PortalMessage serde simplified.** `ScheduledTaskConfig`/`CreateScheduledTaskRequest`/`ScheduledTaskInfo` repeated ~10 fields; they now `#[serde(flatten)]` a shared core (the `RegisterFields` pattern). Serialized key sets are byte-identical (only contiguous key order shifts; all consumers are serde) and Create's deserialization defaults are preserved exactly — five new wire-compat tests pin the JSON shapes including `last_session_id: null` and old-key-order parsing. As a side effect `task_to_config` became `pub(crate)` and launcher registration reuses it instead of hand-building the config. `MessageRole` gains `as_str()` with `Display` delegating (the `AgentType` pattern; `from_type_str` fallback verbatim), and `PortalMessage`'s always-"portal" `message_type` is now encoded once via a const + `with_content` constructor used by all six construction sites.

## 2.8.51

- **Session rail: dropdown options share one button shell and close-then-emit helper; dead tick counter removed.** `close_then(menu_session, action)` and `menu_option(extra_classes, label, hint, onclick)` absorb ~9 repeated button shells and 7 close-menu closures (hide/pause/leave/delete/share/schedule/copy-id/stop/blocked-stop); the blocked-stop and schedule options share one `open_schedule` callback. The sparkline tick effect's `Rc<Cell<u32>>` counter (incremented every 100ms, never read) is deleted. The compaction/task range loops folded into one `(ranges, class)` flat_map preserving render order. Deliberately distinct shells (two-click stop confirm, disabled spans, PR/repo links) untouched. Net −27 lines with far less repetition in the dropdown block.

## 2.8.50

- **Permission dialog: keyboard handler and option-row loop deduped between standard and ExitPlanMode variants.** `nav_keydown` (ArrowUp/k, ArrowDown/j, Enter/Space with preventDefault — verbatim in both dialogs before) and `render_options` (cursor, selected classes, click-to-confirm) are now shared; each dialog still builds its own options list (standard keeps the 3-option Allow-&-Remember variant). The question-header badge's two near-identical branches collapsed to one with a conditional `<span class="badge">` (empty `html!{}` renders nothing — DOM identical). AskUserQuestion's distinct Enter-to-submit handler untouched. Net −44 lines.

## 2.8.49

- **`update_task_handler` uses an `AsChangeset` struct instead of a ten-field load-merge-save; `list_runs` is typed.** `ScheduledTaskChangeset` (ten `Option`s built straight from the request; Diesel's default `treat_none_as_null = false` matches the old keep-existing semantics — verified safe since every updatable column is NOT NULL, so no `Option<Option<T>>` tri-state exists). The ownership pre-load stays (slimmed to an id select) deliberately: it must run before cron validation so nonexistent-task + invalid-cron stays 404, and the blanket diesel→AppError From would turn a filtered-update miss into a 500. `updated_at` still bumps on every request including empty bodies. `list_runs_handler` returns `Json<Vec<Session>>` instead of untyped `serde_json::Value` — byte-identical JSON.

## 2.8.48

- **REST and WS replay share their three duplicated helpers.** `TurnMetric::into_wire()` (the 24-field row→wire mapping, previously written out twice) lives on the model; `sender_names()` (the character-identical user-id→name-or-email lookup) and `parse_iso_cursor()` (with its four tests) live in `handlers/helpers.rs`. One deliberate fix: WS replay now strips trailing `Z` from `replay_after` like the REST path always did — Z-suffixed watermarks previously parsed to `None` and silently triggered a full-history replay. Net −29 lines.

## 2.8.47

- **Startup auto-update ceremony extracted to `portal_update::startup_auto_update`; proxy update handlers merged.** The apply-pending + check + 4-arm `UpdateResult` match was copy-pasted across proxy startup, launcher startup, and `cmd_update`; it's now one helper with a `check` flag (both startups apply pending updates unconditionally but gate the GitHub check on `--no-update` — preserved exactly). Proxy's `handle_check_update`/`handle_force_update` + a third inline copy merged into `handle_update(check_only)` — the differing arms were provably unreachable per mode. Also: `binary_name_for` replaces the second platform match (a new test pins all six names byte-for-byte against release assets, including the darwin rename), and the Windows binary-swap dance is one `swap_binary` helper with a `SwapError` enum keying the two callers' divergent fallbacks. Launcher's `UpdateAndRestart` path deliberately untouched (distinct restart-anyway semantics).

## 2.8.46

- **One clipboard helper and one escape-key implementation replace seven hand-rolled copies.** `copy_to_clipboard(text, copied, reset_ms)` (typed `web_sys` Clipboard API instead of the `js_sys::Reflect` dance) serves CopyButton/CopyCommand/CodeBlock with their original per-site reset timings preserved (1500/2000/2000ms). New `hooks/use_escape.rs`: `use_escape` (bubble, component lifetime) for the launch/schedule dialogs, `use_escape_capture(active, …)` for the ImageViewer (capture-phase, attached only while expanded, preventDefault+stopPropagation as before), and an `escape_listener` RAII helper for the struct-component ShareDialog — all three delegate to one implementation. Redundant `#[allow(dead_code)]` on ShareDialog's listener field removed. Net −45 lines.

## 2.8.45

- **Validation errors return 400 instead of 500.** Caller mistakes ("Invalid role" ×2 — now a shared `validate_member_role` helper — "User is already a member", "Owner cannot remove themselves", "Cannot change own role", "Invalid cron expression" ×2) were mapped to `AppError::Internal`, logging server faults for user typos and masking the message behind "Internal server error". All other `Internal` uses audited and left alone (genuine infra faults). Frontend: the share dialog's add-member 409 branch never fired (backend sent 500) — repointed at 400, so "User is already a member" / "Invalid role" now surface verbatim; the schedule dialog's generic `Error ({status})` display now shows the real cron message.

## 2.8.44

- **Chart frame extracted: LinePlot and StackedArea share one frame implementation.** `charts/mod.rs` now hosts the `VIEW_*`/`PAD_*`/`PLOT_*` constants, `chart_empty`, `render_gridlines`, `render_x_labels`, `render_legend`, and a `chart_frame` wrapper (header + scale badge + legend + responsive SVG with rotated y-axis title); the component files keep only their geometry. StackedArea's local `value_to_y` wrapper (PAD_T baked in) deleted in favor of `scale::value_to_y` + explicit offset. Markup copied verbatim — zero rendered-output change; legend swatch styles deliberately stay per-component (they differ byte-wise). Two duplicate axis-format tests consolidated into one in scale.rs. Net −45 lines with each component file ~60% lighter on frame code.

## 2.8.43

- **`handle_claude_output` reads the session row once per proxy output frame instead of twice.** The owner-only `select(sessions::user_id)` is hoisted above both consumers (image extraction and the message-insert gate); the full `Session` load — used only for `user_id` — is gone. Failure semantics per consumer are identical to before (lookup failure skips extraction and insert but never blocks `last_activity` or `OutputAck`); the second pool *checkout* is kept deliberately so no connection is held across CPU-bound base64 work and a transient pool error can't poison the ack path.

## 2.8.42

- **One `ConfirmModal` component replaces five copy-pasted confirm dialogs.** Admin user actions, settings sessions/tokens panels, and the dashboard's Delete/Leave session modals all hand-rolled the same overlay + message + cancel/confirm markup. The new component parameterizes the three pre-existing CSS class families (`Standard` admin, `Panel` settings, `Danger` dashboard with title/warning) so the rendered DOM is byte-identical at every site; overlay-click-cancels and inner stop-propagation semantics preserved. The admin ban dialog (text-input modal) and token-renewed dialog (single "Done" button) were deliberately not migrated — they aren't confirm modals.

## 2.8.41

- **`require_admin` now reuses `auth::extract_user` instead of re-implementing the cookie→user→disabled-check sequence.** −23 lines and one auth path instead of two. Two deliberate consistency changes: admin endpoints honor the dev-mode bypass like every other handler (grants nothing — the seeded dev user has `is_admin = FALSE` by column default, so dev-mode admin requests still get 403 unless manually promoted), and a stale cookie for a deleted user now yields 401 instead of a 404, matching all other authed handlers.

## 2.8.40

- **Hand-rolled base64url codecs replaced by the `base64` crate (×2, ~110 lines).** `shared/src/proxy_tokens.rs` and `proxy/src/util.rs` each reimplemented base64url; both now use a const lenient engine (URL_SAFE, no encode padding, `DecodePaddingMode::Indifferent`, allow-trailing-bits) that preserves every leniency the old decoders had: padding accepted anywhere it was before, whitespace pre-filtered, non-canonical trailing bits masked. One intentionally stricter case: length ≡ 1 (mod 4) inputs (which no encoder produces, and which the old code decoded into a garbage byte) now fail softly. Byte-identity pinned by RFC 4648 fixtures, an all-256-values round-trip, and a hardcoded `ProxyInitConfig` fixture. `base64` added to shared (WASM-safe).

## 2.8.39

- **Live messages no longer have their server timestamp clobbered by the browser clock.** `handle_proxy_message` folds the server `created_at` into `_created_at`, but the component's live path re-ran `inject_message_metadata` with `Date::now()`, overwriting it. The live path now uses `inject_created_at_if_absent` — browser-clock fallback only when the key is missing (error envelopes, pre-#784 backends keep their tooltips). REST history replay keeps overwrite semantics as before. Four new tests pin the behavior, including the no-clobber case.

## 2.8.38

- **One `dev_user` helper + `DEV_USER_EMAIL` const replace nine `testing@testing.local` literals.** The dev test-user lookup was re-implemented across `auth.rs`, `main.rs` (seeding keeps its create logic but uses the const), `handlers/auth.rs` (dev_login + device dev path), `sessions.rs`, `launcher_socket.rs`, and `registration.rs`. `QueryResult<User>` return fits every site's error style (`?`, `.optional()`, `.expect()`, `.ok()`). Three id-only sites now select the full row — same filter, same error paths, identical semantics.

## 2.8.37

- **Backend dead code: `NewSession`, `ImageStore::count()`, dangling device-error route.** `NewSession` was never inserted (all five insert sites use `NewSessionWithId`); `ImageStore::count()` had no callers and `with_defaults()` is now `#[cfg(test)]` (its only callers are tests); `routes::AUTH_DEVICE_ERROR` pointed at a route registered nowhere — invalid/expired device codes redirected to the SPA fallback with a `?message=` param nothing rendered. They now redirect to the device-code entry form so users can retry.

## 2.8.36

- **Remove the dashboard's dead cost-flash machinery.** `total_cost`/`cost_flash` were written on every Result message (with a 600ms flash-clear timeout) but never read by any `view()`, and the `on_cost_change` prop terminated in an explicit no-op callback "kept for API compatibility". Deleted end-to-end: the props, the `ClearCostFlash` msg arm, the struct fields, the whole Result-block cost computation in `handle_received_output`, and the no-op callback at the `<SessionView>` call site. −34 lines, one less fake data path.

## 2.8.35

- **Delete dead `shared` types: `UserInfo`, `ApiError` (+ manual `Display`/`Error` impls), `DevicePollRequest`.** All three were grep-verified unreferenced across every consumer crate (`UserInfo` was a strict subset of `MeResponse`; `DevicePollRequest` an exact field duplicate of the live `DeviceFlowPollRequest`). `DevicePollResponse` stays — #1006 made it the canonical wire type. Pure deletions, −46 lines.

## 2.8.34

- **Codex: drop cumulative `turn/diff/updated` cards and dedupe per-file patch updates.** Codex re-sends the entire turn diff on every edit tick, so transcripts accumulated O(ticks) redundant cards — each the size of the whole turn — on top of the per-file `item.completed{file_change}` diffs that already render the same edits. The events are now dropped in `group_messages` (before grouping, so Codex runs don't fragment around each dropped diff) with a no-op dispatcher arm kept for exhaustiveness. `item/fileChange/patchUpdated` events (also cumulative per file) now surface their `item_id` in `codex_event_item_id`, letting the existing group dedup keep only the final patch and collapse it against the matching lifecycle events. The `DiffCard` `cumulative` chip and `render_turn_diff` are deleted with their only producer.

## 2.8.33

- **CI dedup: one composite `setup-rust` action, one frontend build, matrix release.** `ci.yml` previously built the frontend in four jobs and pasted Install Rust/cache/trunk/protoc steps across eight; now `build-frontend` builds once and uploads `frontend/dist` as an artifact consumed by clippy/build-backend/test, the eight per-platform proxy/launcher jobs are one `build-binaries` matrix, and setup lives in `.github/actions/setup-rust` (which also carries the macOS clean-rustup workaround once instead of twice). `release.yml`'s five copy-pasted platform jobs are one matrix — uploaded artifact and release-asset filenames verified byte-identical against what `portal-update` expects. `container.yml` keeps its independent build (cross-workflow artifact handoff would couple it to CI's run lifecycle) but uses the composite action. Job display names, cache keys, runners, and codesign steps unchanged. actionlint-clean.

## 2.8.32

- **`CurrentUserId` extractor + `AppState::conn()` replace the auth/DB preamble pasted into 33 REST handlers.** The extractor implements `FromRequestParts<Arc<AppState>>` over the existing `extract_user_id` (dev-mode bypass and disabled-user rejection reused, not reimplemented; rejection built from the same `AppError::into_response()`, so status/body are identical), which means a new handler can no longer forget the auth check. `AppState::conn()` centralizes pool checkout + `AppError::DbPool` mapping. Deliberately untouched: device-flow approve/deny (custom `DeviceFlowApiError` shape), `/api/me` (custom error mapping), Diesel `NotFound → 404` sites, and WebSocket paths with no request context. One inherent edge: requests that are both unauthenticated and malformed now get 401 before 400 (extractors run first) — auth-first is the point.

## 2.8.31

- **Session statuses now come from `shared::SessionStatus` everywhere, and the enum gained the missing `Replaced` variant.** The DB has contained `"replaced"` rows that the shared enum could not represent — any `SessionInfo` serialized with that status failed frontend deserialization, and every query had to remember `.ne("replaced")` by hand against a bare string. Sixteen raw `"active"`/`"inactive"`/`"disconnected"`/`"replaced"` literals across ten backend files (sessions, registration, launcher/proxy sockets, launchers, admin's raw-SQL `FILTER` — now a `$1` bind — plus `main.rs` cleanup loops and test fixtures) are replaced with `SessionStatus::X.as_str()`. Columns stay text (no Diesel custom type); query semantics identical. Frontend: the sessions panel styles `Replaced` like Inactive; everything else already matched non-exhaustively.

## 2.8.30

- **One `issue_proxy_token` helper replaces four duplicated token-mint sites.** `mint_launch_token` (launchers), `create_token_handler` + `renew_token_handler` (proxy tokens — whose `ProxyInitConfig`/init-URL construction was also duplicated verbatim and is now a shared `token_response` helper), and `complete_device_flow` (device auth) all did the same load-user → `create_proxy_token` JWT → `hash_token` → `proxy_auth_tokens` row dance. The helper parameterizes persistence (`TokenPersist::Create { name }` vs `Renew { token_id }`, preserving renew's update-in-place semantics) and TTL. The issue's fifth site (`renew_launcher_token_for`) had already been deleted by #933. JWT claims, hashing, row contents, and log messages are unchanged — token semantics now change in one place.

## 2.8.29

- **Wire types defined once in `shared/src/api.rs` instead of hand-copied on both sides of the API.** Migrated the stragglers that never followed `AdminUsersResponse`'s move: `AdminStats`/`AdminSessionInfo`/`AdminSessionsResponse` (admin page), `DirectoryListingResponse`/`ProbeAgentsResponse` (launch dialog envelopes around already-shared payloads), `SessionMemberInfo`/`SessionMembersResponse` (share dialog — frontend copy had silently dropped `created_at`), a generic `MessagesListResponse<T>` (frontend now sees `total` instead of silently ignoring it), and the device-flow pair: `shared::DevicePollResponse` is now canonical (deleting identical private copies in the backend and portal-auth) and the backend uses the existing `shared::api::DeviceCodeResponse`. Serialize-side field names/attrs byte-identical; `#[serde(default)]` added only on deserialize-lenient non-key fields per the established pattern. Compile-time wire-shape checking restored on the admin, launch, membership, and device-auth paths.

## 2.8.28

- **Message renderer: one JSON parse per message instead of 3-4 on the hot transcript path.** The dedicated `extract_local_timestamp` full-`Value` parse is gone — the timestamp tooltip is now derived from the already-extracted `_created_at` ISO string via `js_sys::Date::parse` (`local_timestamp` helper). Group dedup in `grouping.rs` now parses each message's codex `item_id` once into a cached `Vec<Option<String>>` instead of twice (last-index map + visibility filter both read the cache). Separately, the two near-identical 12-arm `CodexEvent` dispatchers in `codex_renderer.rs` (`CodexMessageRenderer` and `render_codex_message_content`, the latter carrying self-documented dead arms) collapsed into a single `render_codex_event(..., bare_agent_message, turn_metrics)` — the flag carries the only real difference (AgentMessage content-only rendering, no raw-JSON card on the grouped path). Rendering output verified arm-by-arm identical; 310 frontend tests pass.

## 2.8.27

- **Frontend: one `fetch_json` helper replaces 25 hand-rolled GET call sites across 16 files.** New `utils::fetch_json<T>(path, On401)` (gloo_net GET via `api_url` → status check → JSON decode) with a typed `FetchError { Network, Status, Decode }` so pages that branch on status keep their exact behavior: admin's 401→Home / 403→"Access denied", launch dialog's distinct 400/504 messages. 401→logout applies only where it existed before (`/api/sessions`, `/api/proxy-tokens`); the splash page explicitly ignores 401 (pre-login). The logout redirect itself, previously copy-pasted in five files, is now `utils::logout()`. One genuine bug fixed in passing: share-dialog member-list decode failures used to hang the loading spinner silently, now they show an error. Net −22 lines and uniform error logging.

## 2.8.26

- **Proxy shim now uses claude-session-lib's ws_bridge stack instead of a hand-rolled tokio-tungstenite wrapper.** `proxy/src/session.rs` (376 → 156 lines) loses `WebSocketConnection`, `connect_ws`, `register_with_backend`, raw text-frame parsing, and a byte-for-byte copy of the ClaudeInput/SequencedInput/PermissionResponse/OutputAck/Heartbeat/ServerShutdown/SessionTerminated dispatch — the shim now shares the exact connect/register/ack code path as the main proxy loop. The lib's duplicated wiggum-vs-input dispatch was extracted into `classify_portal_input`, which the shim reuses (deleting `ShimPortalInput`/`ShimPortalInputAck`). Behavior parity preserved deliberately: decode-tolerant reads (skip undecodable frames, warn), shim-style heartbeat replies, and the proxy keeps its direct tokio-tungstenite dep solely for the `rustls-tls-native-roots` feature union so cert validation is unchanged. Net −228 lines.

## 2.8.25

- **Dedupe `get_git_branch` (4 copies) and `get_repo_url` (2 copies) into `claude-session-lib`.** The canonical implementations in `proxy_session/git_metadata.rs` are now `pub` and re-exported from `claude_session_lib::proxy_session`; the verbatim copies in `proxy/src/main.rs`, `proxy/src/session.rs`, and `launcher/src/process_manager.rs` are deleted and their call sites pointed at the shared versions. All copies were byte-identical modulo comments — no behavior change. Net −109 lines.

## 2.8.24

- **Remove the launcher's dead expected-session restart machinery.** `expected_sessions` is wiped unconditionally at startup (the backend DB has been authoritative since #908) and nothing repopulates it, so the crash-restart path could never fire. Deleted: `RESTART_DELAY`/`MAX_RESTART_ATTEMPTS`, the `restart_counts` map, the restart channel and its select arm, the post-exit clean/non-clean expected-session block, the resume-id fallback in `LaunchSession`, `config::remove_session`, and the now-orphaned `session_working_directory()` helper + `ManagedTask.working_directory` field. The one-time legacy-config wipe (`clear_sessions`) moved to `main.rs` where the config is loaded; behavior is identical. Net −132 lines and a simpler launcher select loop.

## 2.8.17

- **Add log-scale support to Performance plots.** The Performance page now has a `Y scale` control with `Linear` as the default and `Log` as an alternate view across all plots. Log scaling maps positive values by base-10 decades while keeping zero/non-positive buckets on a baseline, and the chart headers show the active scale.

## 2.8.16

- **Increase Performance chart x-axis resolution.** Performance tabs now request minute buckets for 6-hour windows, 5-minute buckets for 1-day windows, and hourly buckets for week-plus windows instead of collapsing long windows to daily data. Multi-day minute/hour tick labels include the date so the denser charts stay readable.

## 2.8.15

- **Keep the launch-session modal inside the viewport.** The launcher dialog now has bounded height, backdrop padding, and internal scrolling so tall directory listings or install instructions do not extend off the bottom of the screen.

## 2.8.14

- **Update code-agent protocol crates.** `claude-codes` is now `2.1.155` and `codex-codes` is now `0.137.3`, with frontend and Codex bridge call sites updated for the newer typed citation, model-usage, turn-start, and notification shapes.
- **Render Claude rate-limit events as a compact single-line message.** The previous card used the same large visual treatment as API overload messages despite carrying only status, rate-limit window, reset timing, overage, and optional utilization. The renderer now keeps those fields inline in the header row and removes the progress bar/icon block.

## 2.8.13

- **Add a direct regression test for portal file link rewriting.** Markdown link destinations are now classified through a small testable helper, and `[description](portal://file/path)` is pinned to render as an authenticated portal download target. `portal://file/...` now requires a session id and panics in tests/dev if called without one, because session file downloads cannot work outside a session context. Codex assistant markdown now receives the active session id too.

## 2.8.12

- **Keep portal file downloads active in grouped assistant messages.** Consecutive assistant messages render through the identity-group path, which previously passed `None` for `session_id` into assistant markdown. That made `[label](portal://file/path)` hit the generic invalid-link fallback and display as literal angle-bracket text. Grouped assistant markdown now receives the active session id, matching standalone assistant and portal-message rendering.

## 2.8.11

- **Keep portal file downloads active in portal reminders and grouped portal messages.** The markdown renderer already rewrites `[label](portal://file/path)` into an authenticated session download URL, but two portal-message paths discarded `session_id` before rendering markdown. Reminder bodies and collapsed portal groups now pass the active session id through, so documented download links are formatted consistently.

## 2.8.10

- **Render literal angle-bracket text in markdown instead of dropping it as raw HTML.** `pulldown-cmark` classifies text like `<Download sensor-report.csv>` as inline HTML; the frontend markdown renderer now emits those events as escaped text, preserving portal messages without allowing raw HTML injection.

## 2.8.9

- **Codex session resume re-attaches to the prior app-server thread.** Codex launches now persist the app-server `thread_id` and pass it back through `thread/resume` when a session is resumed. Standalone proxy sessions store the id in their directory-session config, launcher sessions store it in a sidecar `codex_threads.json`, and resume falls back to a fresh `thread_start` if the prior thread cannot be reopened.

## 2.8.7

- **Strip a trailing `` (deleted)`` from `current_exe()` before baking it into the service unit.** On Linux `current_exe()` reads `/proc/self/exe`; per `proc(5)`, once the running binary's inode is unlinked (which `agent-portal update` does by replacing it in place) the kernel appends a literal `` (deleted)``. `service::sync()` then wrote `ExecStart=.../agent-portal (deleted) --no-update`, so the next restart handed `(deleted)` to clap as a subcommand (`unrecognized subcommand`) — a fast restart loop and an offline launcher. `launcher/src/service.rs` now routes its four `current_exe()` consumers through one helper that strips the suffix.

## 2.8.6

- **Portal version surfaced in the agent's `<system-reminder>`.** The reminder injected at session start (and after each compaction) in `claude-session-lib/src/proxy_session/portal_reminder.rs::agent_facing` now leads with `Agent Portal version X.Y.Z`, captured at compile time via `env!("CARGO_PKG_VERSION")`. The agent now knows which portal release it's running on without having to ask, and operator overrides via `PORTAL_REMINDER_FILE` still get the version line auto-prepended.

## 2.8.5

- **Slow the thinking/reasoning token odometer 2× (`CountUp`).** `frontend/src/components/count_up.rs` now climbs over ~60 frames instead of ~30 (40ms/frame unchanged), so each leg takes ~2.4s instead of ~1.2s — a more deliberate count-up. Smoothness (~25fps) is unchanged; only the duration doubles. Affects both the condensed `thinking` chip and the per-turn reasoning-token footer chip.

## 2.8.4

- **Performance metrics: make `turn_metrics` a durable per-user archive (fix "only ~2 days show").** The Performance page only ever displayed as many days as the user's *sessions* happened to survive. Root cause: `turn_metrics.session_id` was `NOT NULL REFERENCES sessions(id) ON DELETE CASCADE`, and the aggregation/recent queries attributed ownership via `INNER JOIN sessions ... WHERE sessions.user_id = $me`. So when the hourly session-age cleanup (`SESSION_MAX_AGE_DAYS`) — or any explicit/launcher session deletion — removed a session, its metrics were cascade-deleted *and* would've been dropped by the join anyway. This directly contradicted the table's documented intent ("stick around indefinitely for long-horizon trend analysis"). New migration `2026-06-04-120000_decouple_turn_metrics_from_sessions`: adds `user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE` (backfilled from each row's session owner), makes `session_id` nullable and switches its FK to `ON DELETE SET NULL`, and adds a `(user_id, started_at DESC)` covering index. The insert path (`handle_turn_metrics_report`) now resolves and stores the session's owner on each row; the aggregation, stop-reason, and recent-turns queries filter by `tm.user_id` directly (no `sessions` join), so a row survives — and still attributes correctly — after its session is deleted. `TurnMetric.session_id` is now `Option<Uuid>`; the wire `TurnMetrics.session_id` stays non-null (`unwrap_or_default()` for orphaned rows). Migration verified reversible via `diesel migration redo`; backend builds, clippy clean, all `turn_metrics` tests pass.

## 2.8.3

- **Fix WebSearch tool cards rendering their query as `"?"`.** `extract_tool_input` (`frontend/src/components/tool_renderers/mod.rs`) round-tripped every tool's raw `input` through the upstream `#[serde(untagged)]` `claude_codes::ToolInput` enum, which matches variants by field shape in declaration order. `ToolSearch` (`{query, max_results?}`) is declared before `WebSearch` (`{query, allowed_domains?, blocked_domains?}`), so a normal WebSearch call — just `{"query": "…"}` — matched `ToolSearch` first and never reached the `WebSearch` variant; `extract_tool_input::<WebSearchInput>` then returned `None` and the card fell back to `"?"`. (A WebSearch *with* domain filters rendered fine, because the extra fields tripped `ToolSearch`'s `deny_unknown_fields` and fell through.) Since `render_tool_use` already dispatches by tool *name*, `extract_tool_input` now deserializes the input **directly** into the named `T: DeserializeOwned` struct instead of guessing via the untagged enum — sidestepping the ordering hazard for every tool, not just WebSearch. Removed the now-dead `FromToolInput` trait + `impl_from_tool_input!` macro + 12 impls. Three regression tests (`websearch_bare_query_extracts`, `websearch_with_domains_extracts`, `glob_and_grep_still_extract_by_name`). The upstream enum-ordering hazard is flagged with a `TODO(SDK)` to fix in `meawoppl/rust-code-agent-sdks`.

## 2.8.2

- **Remove legacy launcher-config migration.** Dropped `migrate_legacy_config()` / `legacy_config_path()` from `launcher/src/config.rs` and the `migrate_legacy_config()` call at the top of `load_config()`. This was a one-time migration from the old `~/.config/claude-portal/launcher.toml` (TOML) to the current `~/.config/agent-portal/launcher.json` (JSON) — long since run everywhere, so the launcher no longer probes for or rewrites the old path on startup. The `toml` dependency was only used by that migration, so it's removed from `launcher/Cargo.toml` (drops `toml` + its transitive deps from the workspace lockfile); `dirs` stays (still used by `connection.rs`). Updated the stale path reference in `docs/LAUNCHER_ROADMAP.md`. All 8 `config` unit tests pass; launcher clippy clean.

## 2.8.1

- **Condensed `thinking` chip counts tokens, not pulses, and climbs smoothly instead of re-racing from 0.** Follow-up to 2.8.0. (1) The `thinking_tokens` system marker actually carries the running estimate in its (flattened, untyped) `data`: `estimated_tokens` (cumulative: `50` → `150` → `250` …) plus `estimated_tokens_delta`. The condensed chip now shows the run's peak `estimated_tokens` (`"1.8k tokens"`) via new `grouping::thinking_tokens_estimate()` — the max across the run's markers — instead of `messages.len()`. `claude-codes` 2.1.141 models the subtype as `SystemSubtype::Unknown`, so the field is read from `SystemMessage.data` with a `TODO(SDK)` to push a typed variant upstream. (2) `CountUp` no longer resets to `0` on every target change — it resumes the climb from its *current* displayed value toward the new target, so a live-growing estimate ticks upward continuously rather than snapping back and re-racing on each marker. Cadence slowed to ~30 frames × 40ms (~1.2s/leg). A target that moves backwards (fresh card reusing the slot) snaps down rather than animating in reverse. New `thinking_tokens_estimate_returns_peak` test; the grouping/classifier tests carry `estimated_tokens` payloads now. 51 `message_renderer` tests pass.

## 2.8.0

- **Condense the wall of `THINKING_TOKENS` badges + animate the reasoning-token footer chip.** The Claude CLI emits a bodyless `system`/`thinking_tokens` marker per reasoning step; the portal didn't model the subtype, so each one fell through the `system.rs` catch-all to a bare `<span class="message-type-badge system">{ subtype }</span>` (uppercased by CSS to "THINKING_TOKENS"), and since `classify()` didn't recognize `ClaudeMessage::System` each rendered as its own `Single` card — a long reasoning turn produced a vertical wall of ~15 empty badges. Two changes: (1) **grouping** — new `GroupCategory::Thinking` (key prefix `t`); `classify()` now folds a run of consecutive `subtype == "thinking_tokens"` system messages into one `Thinking` identity group, and `MessageGroupRenderer` renders that group as a single compact chip — a purple `thinking` badge plus a `× N` odometer that rolls up to the pulse count (suppressed when N = 1). `system.rs` also suppresses any stray standalone `thinking_tokens` marker (returns `html! {}`) rather than emitting the fallback badge. (2) **footer odometer** — the per-turn metrics footer now renders the real reasoning-token total (`TurnMetrics.thinking_tokens`) as an animated count-up chip (`"1.2k thinking"`), appended after the existing chips and shown only when `> 0`. This lights up for Codex turns (the proxy maps `reasoning_output_tokens` into the field) and stays hidden for Claude turns (the Claude wire folds reasoning into `output_tokens`, so the field is `0`). New reusable `CountUp` component (`frontend/src/components/count_up.rs`) drives both odometers: a one-shot 0→target roll over ~20 frames that drops its `Interval` on completion and unmount (no timers left running on historical transcript cards), with optional `compact` abbreviation and `suffix` label; digits use `font-variant-numeric: tabular-nums` so width doesn't jitter while rolling. Two regression tests pin the grouping (`serial_thinking_tokens_collapse_into_one_group`, plus a `Thinking` row added to the exhaustive classifier table); 50 `message_renderer` tests pass.

## 2.6.25

- **Service unit always puts `$HOME/.local/bin` on PATH, and self-heals on update.** The launcher resolves the agent binary (`claude`) purely via PATH (`Command::new("claude")`), so the installed systemd unit / launchd plist must carry a PATH that includes it. The native Claude installer drops `claude` in `~/.local/bin`, which is *not* on the minimal PATH a systemd `--user` service inherits — so after a Claude update the daemon would spawn sessions that fail with "claude not installed." Two fixes in `launcher/src/service.rs`: (1) `generate_unit` / `generate_plist` now run their PATH through a new `path_with_local_bin` helper that prepends `$HOME/.local/bin` if absent, instead of blindly snapshotting the install-time `$PATH`; (2) a new `service::sync()` regenerates the installed unit/plist from the current executable + PATH (rewriting + `daemon-reload` only when the content actually changed) so units written by older launchers — which had no `Environment=PATH` at all — repair themselves. `sync()` is invoked before the service restart in both update paths: the dashboard-triggered `UpdateAndRestart` handler (`connection.rs`) and the `agent-portal update` CLI command (`main.rs`). Previously the auto-updater only swapped the binary and never touched the unit file, so a stale unit persisted indefinitely across updates. Four unit tests pin `path_with_local_bin` (prepend-when-absent, leave-untouched-when-present, empty-PATH, no-HOME).

## 2.6.24

- **Pill watermark: shrink to 80% (80×80 → 64×64), keep horizontal center at x=16.** Continues the gradual size taper started by #719 (which had taken the original 88×88 launch dimensions down to 80×80). New size is exactly 80% of the current main-tree value, with `left: -24px` → `left: -16px` recomputed so the watermark's horizontal center stays at x=16 in pill coordinates — the visual centering doesn't drift across the resize. Vertical center is held by the existing `top: 50%; translateY(-50%)` which is size-agnostic. CSS-only change; no Rust touched.



- **Session-pill agent-logo watermark: shrink to 80%.** `.pill-watermark` in `frontend/styles/session-rail.css` drops from 80×80 to 64×64 and `left` shifts from `-24px` to `-16px` so the icon's horizontal center stays anchored at `x = 16` in pill coords. Vertical centering uses `top: 50%` + `translateY(-50%)`, which is size-agnostic — no change there. Net visual: same position, same crop, same opacity, just a smaller mark.

## 2.6.15

- **Performance page: add `1h` / `6h` / `1d` window buttons.** The radio group previously offered only `7d` / `30d` / `90d`; the three new short-window buttons sit before them in chronological order so the most-recent view is on the left. Adds three `TimeWindow` variants (`Hours1` / `Hours6` / `Days1`) and a new `bucket_param(window) -> &'static str` dispatch helper: short windows (≤ 1 day) request `bucket=hour` so a 1-hour view doesn't collapse into a single daily data point; week-plus windows stay `bucket=day` so 30 / 90 day runs don't overwhelm the x-axis. `render_charts` now takes the active `window` and threads it into `BucketKind::from_wire(bucket_param(window))` so the time-axis label format (HH:MM for hourly, "May 5" for daily) stays in lockstep with the requested data. The hardcoded `BUCKET_PARAM: &str = "day"` constant deletes. Backend already accepts `Nh` window suffixes and `bucket=hour` (verified by `parse_window_accepts_d_and_h_suffix` + the existing `BucketKind::from_wire` arms) — no backend changes. Three new tests: `bucket_param_dispatches_on_window_length` pins the short-window → hourly / long-window → daily mapping, `window_param_strings` extends to cover all six variants, `time_window_all_lists_every_variant_in_chronological_order` pins the radio button ordering (Hours1 first, Days90 last). 16 performance-panel tests pass; workspace clippy clean.

## 2.6.14

- **Push-driven session refresh on launch: new session pops into the rail at the exact moment the proxy registers, not on a poll tick.** Before: `/api/sessions` polled every 5 s steady-state and `page.rs::on_launch_success` didn't trigger a refresh — so after clicking Launch, the user waited up to a full 5-second window before the new pill appeared. The wire signal needed to do better already existed end-to-end: `LauncherToServer::LaunchSessionResult { request_id, success, session_id, pid, error }` flows from the proxy register-path to the backend, and the backend already broadcasts it to the user's web clients as `ServerToClient::LaunchSessionResult` (`backend/src/handlers/websocket/launcher_socket.rs:367`). The frontend's `use_client_websocket` was just dropping that frame in its `_ => {}` catch-all. Wire it in: `UseClientWebSocket` gains a `launch_event_counter: u32` field that ticks on every received `LaunchSessionResult` (`wrapping_add` for overflow safety; `success: false` cases also log the carried `error` string at `warn`). `frontend/src/pages/dashboard/page.rs` hangs a `use_effect_with` on the counter that fires `sessions_hook.refresh.emit(())` whenever the value changes — but skips the initial mount (`if c > 0`) so it doesn't pile on top of the hook's own initial fetch. Net effect: a freshly-launched session shows up in the rail in one round-trip (typically a few hundred ms — the proxy register handshake), not up to 5 s later. The pre-existing 5 s steady-poll stays as a belt-and-suspenders safety net (covers WS-frame loss / reconnect mid-launch) but is no longer the load-bearing path. Zero extra polling — the alternative I considered (a 500 ms burst-poll window over 15 s, ~30 wasted GETs per launch) is unnecessary now that the push signal is consumed. Approach also strictly better than blocking `/api/launch` on registration: that would tie up the HTTP request for the launcher boot window and risk timeout-behind-nginx; the push path keeps the endpoint sub-100 ms while still surfacing the precise registration moment.

## 2.6.13

- **`AGENTS.md` symlink → `CLAUDE.md` so any agent honoring the cross-tool convention picks up the same instructions.** This repo's agent guidance lives in `CLAUDE.md` (~27 KB of conventions, troubleshooting, common tasks). Agents like Codex / Cursor / aider look for `AGENTS.md` by convention rather than the Claude-specific filename, so they were silently running uninstructed in this tree. Add `AGENTS.md` as a git-tracked symbolic link to `CLAUDE.md` — zero content duplication, zero drift risk, single source of truth. The contract is documented in CLAUDE.md's preamble already (project conventions, architecture, code style, troubleshooting), so the same content serves both audiences without any per-tool shaping. Windows checkouts need `core.symlinks=true` (default on modern git for Windows); Linux / macOS pick it up automatically.

## 2.6.12

- **Codex item types: migrate the frontend off the locally-mirrored `CodexItem` / `FileChange` / `TodoEntry` enums and onto upstream `codex-codes::io::items::ThreadItem` (closes part 2 of #827).** The frontend's `codex_renderer.rs` historically re-declared a parallel `CodexItem` enum with `Option<String>` fields under the "lenient parsing" rationale, but two of those fields had drifted from the actual wire shape: `FileChange.kind` was `Option<String>` while the wire ships `{"type": "update"}` (an object), and `FileChange` was missing `diff` entirely. The `CodexEvent::ItemStarted{item: FileChange{...}}` parse silently failed, the event dropped to `Unknown`, and the user's permission dialog headline fell back to *"File change for item `call_<hex>` (diff streamed above under this item id)"* — with nothing actually streamed above. Fix: add `codex-codes = { workspace = true }` to `frontend/Cargo.toml` and import `ThreadItem` / `FileChangeItem` / `FileUpdateChange` / `PatchChangeKind` / `PatchApplyStatus` / `CommandExecutionItem` / `CommandExecutionStatus` / `McpToolCallItem` / `McpToolCallStatus` / `TodoItem` from `codex_codes::io::items::*` (the newtype-wrapper flavor in `io::items`, *not* the struct-variant flavor exported at the crate root from `protocol_generated::types::*` — two distinct types with the same name covering different protocols). Local `CodexItem` enum + `id()` method + `FileChange` + `TodoEntry` structs all delete; `CodexEvent::Item{Started,Updated,Completed}{item: Option<CodexItem>}` becomes `Option<ThreadItem>`; `FileChangePatchUpdatedParams.changes` becomes `Option<Vec<FileUpdateChange>>` (same bug pattern, also silently fixed). New free fn `thread_item_id(&ThreadItem) -> &str` mirrors the deleted `CodexItem::id()` method API so existing call sites in `mod.rs` / `helpers.rs` work unchanged. All eight renderers rewrite to dispatch on the newtype-wrapper variants, and `render_file_change` now routes each per-file change through `<DiffCard>` from #823 — so file-change events that previously dropped silently render as a framed card with kind chip + path + per-file diff body, matching `render_file_change_patch`. New `command_status_label` / `mcp_status_label` / `patch_status_label` helpers convert the typed enum status fields to their CSS-friendly forms; `patch_kind_css(&PatchChangeKind)` maps to the existing `.diff-card-kind.{add,update,delete}` palette. `helpers.rs::classify_codex_event` updates the same way — newtype pattern match, no `Unknown` arm to handle (upstream `ThreadItem` doesn't have one; an unrecognized wire `type` cleanly errors the parse, the existing `.ok()?` short-circuit returns `None`, and the outer renderer falls through to its raw-JSON catch-all). `UserMessage` items get a `_ => html!{}` arm in `render_item` so they don't double-render. Tests rewrite: previous `item_file_change_*` round-trips used the now-invalid `"kind":"update"` bare-string shape (which was always wrong on the wire) and are replaced with `item_file_change_snake_case_with_typed_kind_and_diff` / `..._camel_case_with_typed_kind_and_diff` that round-trip the actual wire shape; new `event_item_started_with_file_change_no_longer_silently_drops` uses the **verbatim** wire dump from #827's bug report and asserts the parse succeeds. Test helpers updated to pass valid `CommandExecutionStatus` strings (`"in_progress"` instead of the pre-#827 loose `"running"`). 292 frontend tests pass; full workspace clippy clean. **Part 1 follow-up** (harvest file paths from in-scope `FileChange` items into the dialog headline) is a small subsequent PR — the type migration here is the foundation.

## 2.6.11

- **AskUserQuestion answer key: revert to question text (closes #873).** The previous #831 fix preserved the `questions` array in the `allow_with` permission response (correctly avoiding the `q.map` crash) but mis-introduced a second bug: it switched the answer-map key from `q.question.clone()` (question text) to `q.header.clone()` (with `q.question` as fallback only when header was empty). The Claude CLI's `mapToolResultToToolResultBlockParam` destructures `({question: z})` from each question object and looks up `answers[z]`, so the canonical key is whatever sits in the `question` field. With header-keyed answers, every CLI lookup returned `undefined` and the sub-agent never saw the user's choices — the form rendered, the user clicked an option, and the answer silently dropped. Revert the keying in `build_permission_response`'s `AnswerQuestions` arm to always use `q.question.clone()` (no header fallback, no header consideration). The renamed regression test `build_response_answer_questions_preserves_questions_and_keys_by_question_text` now asserts BOTH the `questions`-survival guard (the #831 crash) AND that lookups by `"first?"` / `"second?"` succeed while lookups by header `"One"` / `"Two"` explicitly fail — so the next person can't quietly re-introduce the header keying. Companion test `build_response_answer_questions_keys_by_question_text_even_with_no_header` pins that the presence/absence of a `header` field never changes the key choice. 15 `permission_handler` tests pass.

## 2.6.10

- **Drop OpenSSL runtime dependency from the shipped `claude-portal` and `agent-portal` binaries — switch TLS to rustls across all four consumers.** Reported by a user on Ubuntu 20.04: the GitHub release binaries crashed immediately with `libssl.so.3: cannot open shared object file` because the prebuilt artifacts were linked against OpenSSL 3 (the build host's default) and Ubuntu 20.04 ships OpenSSL 1.1 only. The auto-updater compounded the problem by replacing any locally-built binary with the broken release on first run, so even building from source didn't help without `--no-update`. `cargo tree -i openssl-sys` against the proxy / launcher binaries showed exactly four root nodes: `proxy/Cargo.toml`'s `tokio-tungstenite = { features = ["native-tls"] }`, and `portal-auth/Cargo.toml` + `portal-update/Cargo.toml` + `launcher/Cargo.toml`'s `reqwest = { version = "0.12", features = ["json"] }` (default features ON pulls in reqwest's `default-tls = native-tls`). Even though `ws-bridge 0.2.1` already feature-gates its own `tokio-tungstenite` dep to `rustls-tls-webpki-roots`, Cargo features are additive across the workspace — the proxy's `native-tls` opt-in unioned native-tls back into the build for every consumer. Fix is one-line per file: `proxy/Cargo.toml` switches `tokio-tungstenite` to `{ version = "0.28", default-features = false, features = ["connect", "handshake", "rustls-tls-native-roots"] }`, and `portal-auth` / `portal-update` / `launcher` each switch `reqwest` to `{ version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }`. `rustls-tls-native-roots` (rather than `rustls-tls-webpki-roots`) was chosen so the binaries pick up corporate-CA additions from the OS trust store automatically; mixing native-roots with ws-bridge's `webpki-roots` enables both feature flags on `tokio-tungstenite`, which is the standard additive-superset behavior cargo expects and which uses both trust sources at runtime. The reqwest `default-features = false` removes `charset` (non-UTF-8 response decoding via `encoding_rs`) and `http2` from the build — both call sites only consume JSON HTTP/1.1 responses, so the loss is invisible at runtime. Post-fix verification: `cargo tree -p claude-portal -p agent-portal --target x86_64-unknown-linux-gnu -i openssl-sys` returns no matches; `ldd target/release/{claude-portal,agent-portal} | grep -i ssl` returns nothing. Closes the Ubuntu 20.04 crash without requiring users to rebuild against OpenSSL 1.1 or pin an older runtime — the released binaries now have **zero** OpenSSL link dependency and run on any system regardless of installed OpenSSL version.

## 2.6.9

- **Typed `ActivityTag` enum + Codex sparkline classification.** Closes the "Codex pill ticks are uncolored / gray" triage. Before: `classify_output_msg_type` returned a stringly-typed `String` (`"assistant"` / `"user"` / `"result"` / `"portal"` / `"error"` / `"system"` / `"rate_limit_event"` / `"compaction_start"` / `"compaction_end"` / `"task_start"` / `"task_end"` / `"unknown"`), `ActivityRef::push` stored `(f64, String)` tuples in `EventStore`, `SparklineView::view_for` did `match kind.as_str() { "assistant" => "assistant", … }` to produce the CSS suffix, `extract_ranges` took `&str` start/end tags, `reconcile_pending_sends` matched on `"user"` / `"assistant"` / `"result"` string literals, and Codex events fell through the entire classifier chain — `ClaudeOutput` parse failed, local `ClaudeMessage::Unknown` fired via `#[serde(other)]`, `message_type_tag` returned `"unknown"`, and the sparkline's match arm fell through to `"other"` so every Codex tick painted neutral gray (`.sparkline-tick.tick-other`). After: new `ActivityTag` enum (`Assistant` / `User` / `Result` / `Portal` / `Error` / `System` / `RateLimit` / `Unknown` / `CompactionStart` / `CompactionEnd` / `TaskStart` / `TaskEnd`, derives `Copy + PartialEq + Eq + Hash`) with three typed-dispatch methods: `tick_css() -> Option<&'static str>` (returns the existing CSS suffix `"assistant"` / `"user"` / `"result"` / `"portal"` / `"error"` / `"other"`, returns `None` for range markers — pinned by a new `activity_tag_tick_css_matches_existing_css_classes` test that names each variant's suffix so a future CSS rename is one assertion sweep, not a multi-file grep), `is_range_marker() -> bool` (true for the four compaction/task markers, lets the tick-iteration short-circuit without naming each variant), and `is_compaction_start()` / `is_compaction_end()` / `is_task_start()` / `is_task_end()` (range-pair predicates passed by-fn-pointer to the new generic `extract_ranges` so it dispatches typed rather than string-compared). `classify_output_msg_type` now returns `ActivityTag` directly; `message_type_tag` returns `ActivityTag` directly. `EventStore` becomes `HashMap<Uuid, Vec<(f64, ActivityTag)>>` (12 bytes/entry vs the heap-allocated `String`). Sparkline tick rendering now reads `tag.tick_css()` instead of the string match — same six suffixes, one source. New `classify_codex_event` arm in `helpers.rs` runs after both Claude parse attempts: typed dispatch over the `CodexEvent` enum maps `ItemStarted` / `ItemUpdated` / `ItemCompleted` with `AgentMessage` / `Reasoning` / `CommandExecution` / `FileChange` / `McpToolCall` / `WebSearch` / `TodoList` items to `ActivityTag::Assistant` (agent working — same blue tick as a Claude assistant reply), `Error` items to `ActivityTag::Error`, `TurnCompleted` / `TurnFailed` to `ActivityTag::Result` (same orange tick as a Claude turn-end), top-level `Error` to `ActivityTag::Error`, and `ThreadStarted` / `TurnStarted` plus the four streaming-delta variants (`PlanDelta` / `ReasoningTextDelta` / `ReasoningSummaryPartAdded` / `TurnDiffUpdated` / `FileChangePatchUpdated` / `TurnPlanUpdated`) to `None` (those don't render visible cards on the message stream, so they shouldn't tick the sparkline either — keeps the rail readable instead of strobing on every reasoning delta). The semantic mapping reuses Claude's color buckets deliberately: the sparkline is a cross-agent visual primitive (`.tick-assistant` = "agent talking", `.tick-result` = "turn ended", `.tick-error` = "something broke") and agent type doesn't matter once the user knows the palette, so Codex events route into the same buckets instead of inventing a parallel color scheme. The `Callback<(Uuid, String, f64)>` boundary at `SessionViewProps.on_activity` flips to `Callback<(Uuid, ActivityTag, f64)>` — the enum derives `Copy` so the wire is identical. `reconcile_pending_sends` takes `tag: ActivityTag` by value (no more `&str`) and matches on `ActivityTag::User` / `Assistant | Result` — same three-arm logic, no allocations. `ActivityTag` is `pub(crate)` and re-exported through `session_view::ActivityTag` for the two off-module consumers (`session_rail.rs`, `page.rs`). Test suite gains seven Codex-classifier cases (`classify_codex_item_completed_agent_message_is_assistant`, `…_command_execution_is_assistant`, `…_file_change_is_assistant`, `…_error_is_error`, `classify_codex_turn_completed_is_result`, `…_turn_failed_is_result`, `…_streaming_deltas_are_unknown`) plus two `ActivityTag`-shape tests; six existing `reconcile_pending_sends` tests + four `is_claude_awaiting` cases + the `message_type_tag` per-variant case rewrite their string assertions to enum-variant assertions so the typed boundary stays pinned. 298 frontend tests pass (up from 296), full workspace clippy clean.

## 2.6.8

- **Add a copy button to the Codex raw-event card.** `render_raw_codex` (`frontend/src/components/codex_renderer.rs`) renders the pretty-printed JSON of unrecognized Codex events — the fallback path for SDK-schema variants the frontend doesn't yet dispatch on (see #827). Until now the only way to surface a raw frame in a bug report was to screenshot the truncated `ExpandableText` block; the new `<CopyButton text={display} title="Copy raw event" />` in the card's `message-header` (next to the `Codex Raw` badge) puts the full JSON on the clipboard in one click, matching the copy-button placement on Claude assistant text and portal-message cards. CSS is unchanged (the existing `.copy-button` styling already covers it); the only new wiring is the `use super::copy_button::CopyButton` import and the one-line `<CopyButton>` mount. Pure UI; no wire-shape or behavior change.

## 2.6.7

- **Settings → Performance page with five hand-rolled SVG drill-in plots over an aggregated `/api/metrics/turns` endpoint (PR 4 of 4 — closes the per-turn metrics rollup).** Final slice of the per-turn metrics feature opened by 2.6.4 / 2.6.5 / 2.6.6: a new Settings tab that aggregates the user's `turn_metrics` rows server-side and renders throughput / TTFT / stop-reason / cache hit / cost-per-token trends without pulling in a chart-library dependency. New typed `GET /api/metrics/turns?bucket={hour|day}&window={Nd|Nh}` endpoint (`backend/src/handlers/turn_metrics.rs::list_aggregated_turn_metrics`) returns a typed `shared::api::MetricBucketsResponse { buckets: Vec<MetricBucket> }` where each `MetricBucket` carries `bucket_start: DateTime<Utc>`, `agent_type`, `model`, `service_tier`, `turn_count` / `error_count`, p50/p95 latency (`ttft_p50_ms` / `ttft_p95_ms`), p50/p95 throughput (`throughput_p50_tps` / `throughput_p95_tps`), token sums (`input_tokens_sum` / `output_tokens_sum` / `cache_read_tokens_sum` / `cache_creation_tokens_sum`), `total_cost_usd_sum`, and a `stop_reason_counts: BTreeMap<String, i64>` histogram. Bucket / window parameters are validated against a small allowlist (`bucket ∈ {hour, day}`; window is parsed as `Nd` / `Nh` with `N: u32`; unknown unit / zero / non-integer rejected with 400 BadRequest) before any SQL runs — only the validated constant strings reach the query. Aggregation uses `diesel::sql_query` with two passes: the main rollup `GROUP BY (date_trunc($1, started_at), agent_type, model, service_tier)` with `percentile_cont(0.5)` / `percentile_cont(0.95) WITHIN GROUP (ORDER BY ttft_ms)` for latency and the same construct over `(output_tokens / (generation_duration_ms / 1000.0))` (gated on `generation_duration_ms > 0 AND output_tokens > 0`) for throughput; a second `GROUP BY (..., reason_key)` pass produces the stop-reason histogram with `is_error = true` rows folded under the `"error"` key and `stop_reason IS NULL` non-error rows under `"unknown"`. Per CLAUDE.md's raw-SQL guidance every `SUM(bigint)`/`COUNT(*)` cast explicitly to `::bigint` and every `SUM(float8)` to `::float8` so Diesel doesn't choke on `numeric` decode. Owner-only ACL gate (`JOIN sessions s ON s.id = tm.session_id WHERE s.user_id = $2`) mirrors the existing `/api/metrics/recent` endpoint. Frontend ships a new `PerformancePanel` (`frontend/src/pages/settings/performance_panel.rs`) registered as the new "Performance" tab in `frontend/src/pages/settings/mod.rs` between Sounds and Appearance; on mount it fetches the default `bucket=day&window=30d` aggregation, then refetches when the user clicks the 7d / 30d / 90d radio. A group-by `<select>` dropdown filters to one `(model, service_tier)` pair or to `"All"` (renders one line per pair). Five hand-rolled SVG plots ship in a new `frontend/src/components/charts/` submodule: a reusable `LinePlot` (`charts/line_plot.rs` — multiple `LineSeries` with `dashed: bool` for p95 traces, contiguous-run `None`-aware polyline splitting so a gap in the data breaks the line cleanly) drives throughput (tok/s p50 solid + p95 dashed per pair), TTFT in seconds (same shape), cache-hit-percent (filters out rows where the denominator `cache_read + cache_creation + input = 0` so codex pairs naturally drop out), and cost-per-1k-output-tokens (`total_cost_usd_sum / output_tokens_sum * 1000`; filters out rows where `total_cost_usd_sum` is `None` or `0` so codex naturally drops out). A `StackedArea` component (`charts/stacked_area.rs`) renders the stop-reason mix with a fixed-order stack of `end_turn` (green `#9ece6a`) / `tool_use` (blue `#7aa2f7`) / `max_tokens` (red `#f7768e` so spikes pop) / `error` (purple `#bb9af7`) plus an `other` bucket for unknown reason strings (slate `#565f89`). Both components share width-100 % responsive sizing via an 800x260 `viewBox` and `preserveAspectRatio="xMidYMid meet"`, so the SVG scales with the container without media queries. Pure axis / projection helpers live in `frontend/src/components/charts/scale.rs` and are unit-tested independently: `nice_y_axis(min, max) -> (lo, hi, step)` rounds bounds to a 1/2/5 x 10^n "nice step" heuristic (matplotlib / D3 style), clamping the lower bound to >= 0 for our non-negative metrics and handling NaN / flat-run inputs defensively; `nice_step(raw)` rounds up to the nearest 1/2/5 multiple of the next power of ten; `time_axis_ticks(buckets, BucketKind, max_ticks)` builds evenly-spaced x-axis ticks (`"May 5"` for daily, `"14:00"` for hourly), capped at the bucket count; `y_axis_ticks(min, max, step)` produces `(value, normalized_frac)` pairs for gridlines; `series_points(values, w, h, y_min, y_max)` builds the polyline string with clamping and SVG-y-inversion. New `frontend/styles/performance.css` (registered in `index.html` alongside `settings.css`) carries the `.performance-panel`, `.performance-controls`, `.performance-window-button`, `.performance-chart`, `.chart-title`, `.chart-legend`, `.chart-legend-swatch`, `.chart-empty`, `.chart-gridline`, `.chart-x-label` / `.chart-y-label` / `.chart-y-axis-title` chrome in Tokyo-Night palette; `.performance-window-button.active` flips to the accent-blue background, dashed-series swatches use a `repeating-linear-gradient` so the legend matches the polyline style. Mobile clamp in `session-mobile.css` at `max-width: 600px` stacks the controls vertically and shrinks the legend gap + font so it doesn't blow up the column. Backend handler tests (`backend/src/handlers/turn_metrics.rs::tests`) cover bucket-parameter validation (`Day` default for missing / empty; `hour` / `day` accepted case-insensitively; unknown values incl. SQL-injection attempts rejected with `AppError::BadRequest`), window-parameter validation (`30d` default; `Nd` / `Nh` accepted incl. case-insensitive suffix; zero / non-integer / unknown-unit / SQL-injection-attempts rejected), and a `MetricBucketsResponse` serde round-trip via `serde_json::to_value`. New shared roundtrip tests (`shared/src/api.rs::tests`) pin the typed `MetricBucket` shape (full Claude row with cost + stop-reason mix) and the `MetricBucketsResponse` envelope. Pure-helper tests in `charts/scale.rs::tests` (16 new) cover `nice_step` decade-rounding, `nice_y_axis` typical / small / flat / negative-clamp / NaN cases, daily / hourly tick label formatting + bucket-count cap, `y_axis_ticks` invalid-step rejection, `series_points` empty / single / endpoint-anchoring / clamping; `charts/line_plot.rs::tests` (5 new) cover `contiguous_runs` splits on `None` / all-some / all-none / NaN-as-gap and `format_axis_value` compact-form selection; `charts/stacked_area.rs::tests` covers count axis formatting; `pages/settings/performance_panel.rs::tests` (13 new) cover `distinct_pairs` dedup + sort, `pair_label` standard-tier-drop + unknown-model-fallback, `pair_color` palette cycling, `GroupBy::key` <-> `from_key` round-trip + unknown-key fallback, `distinct_bucket_starts` ordering, `build_stop_reason_series` band-ordering + drop-empty + unknown-reason-folds-to-other, `build_cache_hit_series` zero-denominator skip, `build_cost_per_token_series` zero-cost skip + `0.10/100*1000 = 1.0` math, and the `window_param` string mapping. Workspace bumped 2.6.6 -> **2.6.7**. All wire shapes typed end-to-end — no `serde_json::json!` on the new path. **Closes the per-turn metrics rollup**: the dashboard pill (2.6.6) shows the at-a-glance trend; this page is the drill-in.

## 2.6.6

- **Dashboard-header sparkline pill for per-(model, service_tier) trends (PR 3 of N).** A glanceable widget next to the spend chip in the dashboard header that plots the user's recent turns for the **most-recently-active** (model, service_tier) pair, with a dropdown to switch the plotted metric (tok/s default, TTFT, max gap, cache hit %). Hand-rolled `<svg>` + `<polyline>` sparkline (`frontend/src/components/sparkline.rs`) — no chart-library dependency — sized 80×20 px by default with a 15 % top/bottom y-axis margin so peaks don't sit flush against the SVG edge; renders a thin dashed accent-blue midline for the empty-data placeholder and a single accent dot when only one data point is available. New typed `GET /api/metrics/recent` endpoint (`backend/src/handlers/turn_metrics.rs::list_recent_user_turn_metrics`, capped at `RECENT_TURN_LIMIT = 50`) returns the calling user's most-recent turn-metrics rows across all of their sessions, ordered `started_at` ASC so the sparkline reads left-to-right oldest → newest; the response goes through the existing typed `TurnMetricsResponse { metrics: Vec<TurnMetrics> }` envelope so no new wire shape is introduced. Hook-side: `use_client_websocket` is extended (rather than introducing a parallel hook) to expose `recent_turn_metrics: Vec<TurnMetrics>` — seeded once on mount from the new REST endpoint, then kept fresh by the existing `ServerToClient::TurnMetrics` WS broadcasts (the backend already fans the per-session frame out to every member's user channel); a new pure `insert_recent_metric(buf, incoming, cap) -> Vec<TurnMetrics>` helper holds the sorted-by-`started_at`-ASC insertion + dedup-by-`id` + trim-to-cap logic so the long-running buffer can't grow unboundedly and a backfill-plus-live-broadcast for the same row collapses into one entry. New `frontend/src/components/turn_metrics_pill.rs` `TurnMetricsHeaderPill` component owns the dropdown state, picks the (model, tier) pair via `pick_most_recent_model_tier(&buf)` (the *newest* turn's pair — multi-pair rendering is intentionally deferred to a later PR), shortens the model name with `shorten_model_name` (strips a leading `claude-` / `gpt-` / `o` vendor prefix and a trailing 8-digit dated checkpoint suffix so `claude-opus-4-7-20260301` renders as `opus-4-7`), and appends a non-`standard` tier suffix via `format_model_tier_label`. `project_metric(&buf, &model, &tier, metric)` filters the buffer to the chosen pair and projects the scalar per turn, skipping turns where the chosen metric is `None` or zero — so Codex turns (which have all-zero `input_tokens` / `cache_read_tokens` / `cache_creation_tokens`) naturally drop out of the `CacheHit` projection rather than rendering misleading zeros, and pre-completion rows with no `generation_duration_ms` drop out of the `TokPerSec` projection. **Empty state**: when no recent turns exist (no `(model, tier)` pair can be picked), the pill renders nothing at all — no skeleton, no "loading" affordance, no chip in the header — keeping the header chrome clean for fresh installs. New CSS rules in `frontend/styles/dashboard.css` (`.turn-metrics-pill`, `.turn-metrics-pill-{label,value,chevron}`, `.turn-metrics-pill-menu`, `.turn-metrics-pill-menu-item{,.active}`) match the spend-chip's Tokyo-Night accent-blue palette, with a `transform: rotate(180deg)` open-state on the chevron and a small absolutely-positioned dropdown menu with `z-index: 100` so it floats above the rail. Workspace bumped 2.6.5 → **2.6.6**. Unit tests cover `points_attr` (empty / single / two-point / many — including the y-margin invariant), `pick_most_recent_model_tier` (empty buffer / non-empty / newest-with-no-model-or-tier), `shorten_model_name` (vendor-prefix stripping + dated-suffix dropping), `format_model_tier_label` (skipping `standard`, appending other tiers, unknown model fallback), `project_metric` (filtering by pair + skipping codex-zero rows from cache-hit + correct tok/s math), and `format_current_value` per metric. Settings → Performance page lands in PR 4 (drill-in plots over `GET /api/metrics/turns?bucket=day&window=30d&group_by=model,service_tier`).

## 2.6.5

- **Per-turn performance metrics frontend rendering (PR 2 of N).** Lights up the dashboard side of the pipeline shipped in 2.6.4: the `ServerToClient::TurnMetrics` frame previously dropped on the `_ => {}` arm in `frontend/src/pages/dashboard/session_view/websocket.rs::handle_proxy_message` is now routed through a new `WsEvent::TurnMetrics(Box<TurnMetrics>)` variant into `SessionViewMsg::TurnMetricsReceived`, and live metrics land in a `turn_metrics: Vec<TurnMetrics>` buffer on the `SessionView` struct (kept sorted by `started_at ASC` via `binary_search_by` insertion so the join walk stays O(n)). New backend endpoint `GET /api/sessions/{id}/turn-metrics` (`backend/src/handlers/turn_metrics.rs`) hydrates the buffer on initial session load — same `session_members` access gate as `GET /api/sessions/{id}/messages`, response shape is a typed `shared::api::TurnMetricsResponse { metrics: Vec<TurnMetrics> }` (so the frontend doesn't pull `serde_json::Value` directly off the wire). The REST hydration and the WS live-stream feed the same buffer, deduping on `metrics.id` so a backfilled row plus a broadcast for the same `id` collapse into one entry. **Join strategy**: by ordering, not by `user_message_id`. PR 1 left `user_message_id` permanently `None` on the proxy-emit side (the proxy doesn't know the backend's `messages.id`), so a key-based join would fail on every row today; the renderer instead walks `self.messages` and `turn_metrics` together in order and pairs the Nth `ClaudeMessage::Result` / `CodexEvent::TurnCompleted` / `CodexEvent::TurnFailed` terminator with the Nth metrics entry. Trade-off: if a turn crashes before producing a terminator, the next visible terminator will mis-pair against that crashed turn's metrics until the page is reloaded — acceptable because a crash without any terminator is rare and the next REST hydration heals it. Per-turn footer renders in a new `<div class="turn-metrics-footer">…</div>` directly beneath both the Claude `result-message` card and the Codex `result-message` card; each chip is a `<span class="turn-metric-chip">` so per-tier coloring can land in a follow-up without touching the renderer. **Field formatting** (new pure helpers in `frontend/src/components/message_renderer/turn_metrics_footer.rs`, all independently unit-tested): tok/s = `output_tokens / (generation_duration_ms / 1000)` with 1 decimal, omitted when `generation_duration_ms` is `None` or 0; TTFT in seconds with 2 decimals, omitted when `ttft_ms` is `None`; `compact_count` for the `2.1k in / 547 out` chip (`<1000` → integer, `≥1000` → one-decimal-k); cache hit % = `cache_read / (input + cache_read + cache_creation)` × 100, omitted when all three are 0 (so the chip naturally vanishes for Codex turns where all three are 0); max-gap chip only renders for gaps `> 1000ms` (sub-1s is noise); cost rendered as `$0.014` with 3 decimals below $1 and 2 decimals at $1+, omitted when `None` (so Codex turns naturally drop the cost chip). New `frontend/styles/messages.css` rules for `.turn-metrics-footer` (`flex` with `flex-wrap: wrap`, `gap: 0.5rem`, muted-text default, top margin so the footer sits below the result-stats-bar rather than glued to it) and `.turn-metric-chip` (Tokyo-Night palette, no icons, separator is the `·` character). Test plan: workspace bumped 2.6.4 → 2.6.5; new pure-helper unit tests cover `compact_count` (1 / 999 / 1000 / 1500 / 1_000_000), tok/s with and without `generation_duration_ms`, cache-hit-% across all-zero / partial-cache / all-cache-hit / all-fresh, max-gap sub-1s drop vs ≥1s render, cost `None` / sub-$1 / $1+, plus one end-to-end builder test that constructs a sample `TurnMetrics` and asserts the rendered chip list matches expected order and content. All wire shapes typed end-to-end — no `serde_json::json!` envelopes on the new path.

## 2.6.4

- **Per-turn performance metrics capture + persist pipeline (PR 1 of N — frontend rendering ships in PR 2).** Adds the foundation for tracking time-to-first-token, throughput, max inter-token gap, tool-call counts, and stop-reason / cost / token totals for every user-input → terminator turn across both Claude and Codex sessions. New `turn_metrics` table (`backend/migrations/2026-05-27-184255_add_turn_metrics/up.sql`) with FK to `sessions(id) ON DELETE CASCADE` (drops with the parent session) and `user_message_id UUID REFERENCES messages(id) ON DELETE SET NULL` (nullable so retention-purging chat messages doesn't cascade into the latency archive); three covering indexes (`session_id`, `started_at DESC`, `(agent_type, model, service_tier, started_at DESC)`) — table is intentionally left out of the `MESSAGE_RETENTION_DAYS` cleanup sweep so per-turn timings stick around indefinitely for long-horizon trend analysis. Schema regenerated by `diesel migration run` and committed. New typed `shared::TurnMetrics` struct (`shared/src/api.rs`) carries `id` / `user_message_id` (both `Option<Uuid>` so the proxy-emit shape and the backend-broadcast shape share one type), `started_at` / `first_token_at` / `completed_at` as `chrono::DateTime<Utc>` (the post-start two `Option<_>` because an error before any content gives `None`), derived `ttft_ms` / `total_duration_ms` / `generation_duration_ms` / `max_inter_token_gap_ms`, the five `BIGINT` token counters, outcome flags (`stop_reason`, `is_error`, `tool_call_count`, `stream_restarts`), `agent_type` / `model` / `service_tier`, and `total_cost_usd: Option<f64>` (Codex doesn't surface per-turn cost on its wire today — stays `None` for codex turns); two new WS frames `ProxyToServer::TurnMetricsReport(Box<TurnMetrics>)` and `ServerToClient::TurnMetrics(Box<TurnMetrics>)` (boxed to keep the rest of the enum compact). New `session_lib::turn_tracker::TurnTracker` (`session-lib/src/turn_tracker.rs`) is a pure-logic state machine wrapping the running state of one turn: `start(now_instant, now_utc)` resets all counters and latches the wall-clock + monotonic anchors, `record_content_frame(now_instant)` latches TTFT on first call and updates the inter-token-gap maximum on subsequent calls, `record_tool_call` / `record_stream_restart` bump counters, `finalize(now_instant, now_utc, outcome) -> Option<TurnMetrics>` consumes a `TurnOutcome { agent_type, model, service_tier, input/output/cache/thinking tokens, stop_reason, is_error, total_cost_usd }` and produces the typed payload (returns `None` when no turn was in flight). Five unit tests cover the no-first-token error path, TTFT measurement, max-gap selection across multiple frames, tool/restart accumulation with cost (Claude shape), and the codex shape with no cost. New `IoEvent::TurnMetricsReady(Box<TurnMetrics>)` and `SessionEvent::TurnMetricsReady(Box<TurnMetrics>)` variants carry the finalized payload across the I/O-task → `Session` → proxy boundary. `claude-session-lib/src/io_task.rs` is instrumented end-to-end: `tracker.start` runs on every `IoCommand::Input` (and on the rate-limit auto-retry path with a `record_stream_restart`), `record_content_frame` on every `ClaudeOutput::Assistant` frame, `record_tool_call` on every `ContentBlock::{ToolUse, ServerToolUse, McpToolUse}` block, and `tracker.finalize` on `ClaudeOutput::Result` plugging in `Result.usage` (tokens, service_tier), `Result.stop_reason`, `Result.total_cost_usd`, and the latched model name from the most recent `Init` / `Assistant` frame. `codex-session-lib/src/io_task.rs` follows the same shape: `tracker.start` on each `start_codex_turn`, `record_content_frame` on `ItemStarted` of `agentMessage` / `Reasoning` / `Plan`, `record_tool_call` on `ItemStarted` of `CommandExecution` / `FileChange` / `McpToolCall` / `DynamicToolCall`, `tracker.finalize` on the `TurnCompleted` notification pulling tokens from the most recent `ThreadTokenUsageUpdated.last` breakdown and mapping `TurnStatus` to a `stop_reason` + `is_error`. Proxy WS bridge ships the typed `ProxyToServer::TurnMetricsReport` (no output-buffer detour — low-latency, missed row acceptable). Backend `handle_turn_metrics_report` inserts the row and broadcasts the saved row (with server-assigned `id`) as `ServerToClient::TurnMetrics(Box::new(...))` to all web clients on the matching session — overrides `metrics.session_id` with the connection-bound `db_session_id` so a misbehaving proxy can't write rows for other sessions. Wire frame is typed end-to-end — no `serde_json::json!` envelopes anywhere on the new path. **Frontend rendering does not ship in this PR**; the frontend silently drops the new `ServerToClient::TurnMetrics` frame today and the dashboard UI for the new data lands in PR 2, with aggregation views in PRs 3 and 4.

## 2.6.3

- **iOS voice follow-up to #840: prevent stuck-recording state.** After 2.6.2 shipped, iOS testing surfaced that the recognizer never naturally terminated — the recording icon stayed lit, and a subsequent tap-to-stop sometimes didn't deliver `onend` either, leaving `pending_stop` set forever (so the next tap showed the busy hint indefinitely). Three changes in `frontend/src/components/voice_input.rs`:
  - **`continuous = false`** universally. iOS Safari does not reliably honor `continuous = true` (the recognizer doesn't auto-end on silence), and our `SessionView::VoiceTranscription` handler already auto-sends on every Final transcript anyway — so a one-tap-one-utterance UX matches the existing send model. Desktop users get a Siri-style "tap, speak one thing, transcript appears" flow.
  - **Stop watchdog**: when the user taps to stop, a 1500 ms `Timeout` is scheduled alongside the session drop. If `onend` arrives within the window (the normal path), `Ended` cancels the watchdog. If `onend` is late or never fires (the iOS hang case), the watchdog force-clears `pending_stop` so the user can tap again. A `warn!` logs the fallback for forensics.
  - **Max-duration safety stop**: a 60 s `Timeout` is armed when a session is established. If it fires while a session is still alive, we drop the session, flip back to idle, and arm the same stop watchdog. Prevents a leaked recognizer from holding the mic indicator indefinitely.
- Two new message variants (`StopWatchdog`, `MaxDurationReached`) handle the fallback paths; both are idempotent with `Ended`.

## 2.6.2

- **Fix #840: voice transcription on iOS Safari / iOS Chrome.** iOS WebKit allows only one `SpeechRecognition` per page and races the permission prompt against `recognition.start()` — a captured probe on iOS 18.7 showed the recognizer reaching `start` and `audiostart` and then being killed by `{error: "aborted", message: "Another request is started"}`. The previous implementation matched `aborted` as benign and silently flipped the mic icon back to idle, so the user saw "nothing happened." Three fixes in `frontend/src/components/voice_input.rs`:
  - **Mic permission primer**: `start_session_async` now calls `navigator.mediaDevices.getUserMedia({audio:true})` first (via `js_sys::Reflect` so no `web-sys` features need re-adding) and holds the returned `MediaStream` open for the recognizer's lifetime. iOS shows its prompt *before* the recognizer is constructed, eliminating the prompt-vs-start race. The stream is stopped in `ActiveSession::Drop`.
  - **Singleton/pending discipline**: a new `pending_stop` flag is set when a session is dropped and cleared by the `Ended` message (delivered when the prior recognizer's `onend` fires). A new `is_starting` flag covers the `getUserMedia` await window. New `ToggleRecording` taps during either window are refused with a visible "Voice recognizer busy" hint instead of constructing a second recognizer.
  - **iOS-specific error surfaced**: `onerror` now captures both `event.error` and `event.message`. When the pair is `aborted / "Another request is started"`, the user sees the busy hint instead of a silent state flip. `not-allowed` / `service-not-allowed` show a "Microphone permission denied" hint. The existing click-pop tooltip slot is reused (`hint_message: Option<&'static str>` replaces the boolean unsupported-only flag).
  - Optimistic UI: tapping the mic flips the icon to recording *immediately*, before the async primer resolves, so the user has feedback during the iOS permission prompt. If the start later fails, the icon reverts and the appropriate hint shows.

## 2.6.1

- **Fix #782: launcher session-mutation authorization bypass.** `LauncherToServer::InjectInput` and `LauncherToServer::ScheduledRunCompleted` in `backend/src/handlers/websocket/launcher_socket.rs` previously accepted any `session_id` and acted on it (inject input / delete the session) without checking that the session belonged to the launcher's authenticated user or that this launcher had even spawned the session. A compromised, malicious, or buggy launcher could mutate or delete sessions owned by other users by passing arbitrary UUIDs. Added `authorize_launcher_session(...)` which loads the target `Session`, verifies `session.user_id == launcher_user_id` AND `session.launcher_id == this_launcher_id`, and logs a forensic `warn!` (with all four IDs) on failure. Both handlers now precheck through that helper and return early on denial. `ScheduledRunCompleted` additionally verifies `session.scheduled_task_id == reported_task_id` so a launcher can't report completion of *its* task for someone else's session. The only other launcher message that mutates server state, `ScheduledRunStarted`, already filtered `scheduled_tasks` by `user_id` and is unchanged.

## 2.6.0

- **Replace Google Cloud Speech-to-Text with the browser's Web Speech API.** Voice transcription now runs entirely in the user's browser via `webkitSpeechRecognition` — no server-side STT, no GCP service-account credentials, no `GOOGLE_APPLICATION_CREDENTIALS` env var. The backend no longer ships the `google-cognitive-apis` gRPC client, the `/ws/voice/{session_id}` route, the `pcm-processor.js` AudioWorklet, or the streaming PCM upload path; ~600 LOC of voice plumbing is gone.
- **Drop the admin-controlled `voice_enabled` user flag.** Voice access is no longer gated by a per-user boolean — every browser that supports the Web Speech API gets the mic. The Users admin tab loses its "Voice: On/Off" toggle, the `voice_enabled` column is dropped from `users` (migration `2026-05-26-120000_drop_voice_enabled_from_users`), and `voice_enabled` is removed from `MeResponse`, `AdminUserInfo`, `UpdateUserRequest`, and the dashboard's `/api/auth/me` fetch.
- **Greyed-out mic on unsupported browsers (Firefox).** When `SpeechRecognition` / `webkitSpeechRecognition` is missing, the button renders in a dashed-border, dimmed state. Hovering shows a native `title` tooltip; clicking it pops a styled hint ("Voice input needs the Web Speech API. Try Chrome, Edge, or Safari.") that auto-hides after 4s.
- **Frontend dependencies trimmed.** Removed `AudioContextOptions`, `AudioWorklet*`, `MediaDevices`, `MediaStream*`, and `MessageEvent`/`MessagePort` from the `web-sys` feature list — they were only needed for the deleted PCM pipeline.

## 2.5.101

- **Codex bash output and raw-codex fallback now truncate with `ExpandableText`, matching Claude.** Three `<pre>` blocks in `frontend/src/components/codex_renderer.rs` rendered untruncated content where Claude already truncates: the bash *command* and bash *output* in `render_command_execution` (`tool-input-content` + `tool-result-content` `<pre>`s) and the raw-JSON fallback in `render_raw_codex`. A long `ls -la` / build log / unmatched-event JSON would push the entire content into the scrollback, in contrast to Claude tool-result blocks which cap at 300/500 chars with a "... N more chars" toggle. Switched all three sites to `<ExpandableText tag="pre" max_len=500 class=… full_text=… />` — same component Claude's renderers already use, same 500-char convention as Claude's bash output, same "show more / show less" toggle (now on its own line at the bottom of each card per the previous PR). Web-search query is left as bare `<pre>` because queries are nearly always short and the toggle would be noise. No wire-shape or behavior change — purely the visual truncation primitive — first concrete parity slice from the codex-vs-claude rendering audit (closes part of #822's "align rendering primitives" spec).

## 2.5.100

- **ExpandableText "show more / show less" toggle drops to its own line at the bottom of the output for block-context renderers.** `ExpandableText`'s `pre` and `div` wrappers (`frontend/src/components/expandable.rs:51-71`) emitted the toggle as `<span class="expandable-toggle">{label}</span>` immediately after the truncated content, so the toggle sat inline against the last line of the displayed text — visually noisy for tool-result blocks (the bash `tool-result-content`, the webfetch prompt preview, the `render_structured_block` text previews, every callsite in `renderers.rs`). Switched those two wrappers to render the toggle as `<div class="expandable-toggle">` so it falls onto its own line in block-flow; the `span` wrapper (used only by the MCP key=value chips in tool headers — `tool_renderers/mod.rs::render_mcp_args`) keeps its inline `<span>` because those chips must stay on a single line. New `div.expandable-toggle { display: block; margin-top: 0.4rem; }` rule in `frontend/styles/tools/base.css` gives the block-form toggle breathing room from the content above and only targets the `<div>` form so it can't regress the inline span path. The `ExpandableLines` `.write-truncated.expandable-toggle` toggle was already a `<div>` and is unaffected aside from picking up the same `margin-top` (which sits cleanly above its existing `border-top` separator).

## 2.5.99

- **Eliminate hand-rolled wire envelopes in claude-session-lib portal frames, codex approval result, history-replay fallback, and the frontend optimistic echo (clusters B + D of the `json!` audit).** Six production `serde_json::json!` payload-construction sites replaced with typed structs so the wire shape lives in source and a serde rename — or a missed field — fails at compile time rather than silently shipping the wrong envelope. `claude-session-lib/src/io_task.rs` (3 sites): the rate-limit-give-up notice, the per-retry "retrying in Xs" notice, and the unparsable-message fallback now construct `shared::PortalMessage::text(...).to_json()` rather than hand-rolled `{"type":"portal","content":[{"type":"text",…}]}` — using the already-existing typed `PortalMessage` constructor that other paths use. `session-lib/src/session.rs`: the `IoCommand::CodexApproval.result` payload now goes through a tiny inline `CodexApprovalResult { decision: &'a str }` typed struct instead of `json!({"decision": decision})`. `backend/src/handlers/websocket/web_client_socket.rs` `replay_history`: the fallback wrapper used when a DB row's `content` column doesn't parse as JSON now goes through a typed `FallbackMessageContent { message_type, content }` struct. `frontend/src/pages/dashboard/session_view/component.rs` `send_text_input`: the local optimistic-echo stub pushed onto `pending_sends` now goes through a typed `OptimisticUserMessage { message_type, content, pending, created_at }` struct (`_pending`/`_created_at` serde renames preserved). Wire-shape-preserving — every replacement serializes byte-identical to its `json!` predecessor. Cluster A (the `_sender` injection triplet) and cluster C (the codex event frames in `codex-session-lib`) are intentionally deferred — A is a small dedup PR on its own and C overlaps the broader transcript-rendering work in #822.

## 2.5.98

- **Fix `AskUserQuestion` answers crashing the Claude CLI with `undefined is not an object (evaluating 'q.map')`.** `build_permission_response` in `frontend/src/pages/dashboard/session_view/permission_handler.rs` built the `AskUserQuestion` answer payload as a bare `shared::api::PermissionAnswers` — i.e. `{ "answers": { … } }` and nothing else. The Claude CLI echoes whatever `updatedInput` the permission response carries straight into the `tool_use_result` it emits, and the CLI frontend then reads `tool_use_result.questions` and calls `questions.map(...)`. With `questions` dropped, that field is `undefined` and every `AskUserQuestion` answer round-trip aborted with `undefined is not an object (evaluating 'q.map')` — the form rendered and the user could pick an option, but the answer never landed. The `claude-codes` crate documents this exact failure: its `ToolPermissionRequest::answer_questions` helper and the `test_ask_user_question_answer_preserves_questions_in_updated_input` regression test both exist specifically to keep `questions` on the wire, and `AskUserQuestionInput` is `{ questions, answers, metadata }`. The `AnswerQuestions` arm now echoes the original `perm.input` (which already carries `questions` and any `metadata`) verbatim and merges the collected answers into an `answers` object, keyed by question `header` — matching the `claude-codes` `answer_questions` contract — with a fallback to the full question text when a question omits its header. The now-unused `PermissionAnswers` struct is removed from `shared/src/api.rs`. Codex `AskUserQuestion` (`requestUserInput`) flows through the same arm and gains the same `questions`-preserving shape; it has no typed answer-handler that would reject the additional fields, so echoing the full input is strictly more information than the prior bare-`answers` payload. Two `permission_handler` unit tests pin the contract: `questions` survives the round-trip, and `answers` is header-keyed (with the text fallback).

## 2.5.97

- **Backend no longer panics when `SESSION_SECRET` is unset — falls back to a random ephemeral secret.** `backend/src/main.rs` previously branched on `args.dev_mode`: a missing `SESSION_SECRET` generated a random cookie key in dev but `panic!`'d outright in production, and the JWT secret separately fell back to the hard-coded literal `"dev-mode-jwt-secret-not-for-production"` in dev (also `panic!` in prod). Two problems: (1) a production deploy that forgot the env var was a hard crash / total outage rather than a degraded boot, and (2) the dev JWT fallback was a *known constant* — anyone could forge a valid proxy/launcher JWT against any dev instance, the exact "secret in source" footgun. Both modes now share one path: `SESSION_SECRET` is resolved once into a `String`; when absent, a random 64-byte secret is generated via `Key::generate().master()` (the same CSPRNG the dev cookie key already used) and hex-encoded, then used for *both* the signed-cookie key and the proxy-token JWT secret — symmetric with the env-var-provided path. A loud `WARN` fires on the fallback explaining that cookies and tokens will not survive a restart. Net effect: `SESSION_SECRET` is the env var you should set in production (a stable 64+ byte value, so cookies and launcher/proxy JWTs survive a redeploy — see the auth-rejection-loop class of bug), but an unset value degrades to ephemeral-random rather than crashing, and the hard-coded dev JWT string is gone. No const secret is ever baked into the binary.

## 2.5.96

- **Tool-result images now center within the message block and frame to the image width.** `.tool-result-image` in `frontend/styles/markdown.css` was a plain block `div` (`width: auto`), so its border frame always spanned the full message-block width while the `<img>` inside sat left-aligned at its natural size — a small screenshot rendered as a tiny picture pinned to the top-left of a wide empty bordered box. Changed the container to `width: fit-content; max-width: 100%; margin: 0.5rem auto`: the frame now shrink-wraps the image (so a small image gets a snug frame instead of a sprawling one), is still capped at the block width (a large image fills the block exactly as before), and `margin-inline: auto` centers it horizontally. The `<img>` rules are unchanged (`max-width: 100%; max-height: 600px; object-fit: contain`), so images are still never upscaled past their natural resolution. CSS-only change; the lightbox overlay and the `[image]` content-block tag are untouched.

## 2.5.95

- **Shutdown banner auto-dismisses on reconnect; new update-available banner with a reload-to-vX.Y.Z button after a backend version bump.** Before this PR, the `.server-shutdown-banner` only cleared on receipt of a `UserSpendUpdate` (or any other unrecognized `ServerToClient` frame) — if the server came back up quiet for a while, the banner stayed pinned at the top with stale text long after the WS had reconnected. After this PR, `frontend/src/hooks/use_client_websocket.rs` clears `shutdown_reason` unconditionally on every successful `connect_to::<ClientEndpoint>`, so a clean reconnect drops the banner immediately regardless of message timing. Same hook now also refetches `/api/config` on each (re)connect, remembers the first version it sees (`known_version`), and on every subsequent reconnect compares the freshly-fetched `server_version` against that anchor via a new `is_newer_version(prev, next)` helper (semver-tuple compare with a string-inequality fallback for non-semver tags like `dev` / `main-abc123` — prefers over-prompting to missing an upgrade). When the version advanced, the hook exposes the new version through a new `UseClientWebSocket::update_available: Option<String>` field. `frontend/src/pages/dashboard/page.rs` renders the update-available banner with a `Reload to v2.5.95`-style button that calls `window.location().reload()`; the update banner takes precedence over the shutdown banner (same slot in the layout, accent-blue chrome instead of warning-orange, persistent until the user clicks reload). The previous shutdown banner's `⚠` emoji + raw inline spans are gone — replaced by a smaller pulsing CSS dot (`prefers-reduced-motion` honored) and tighter typography in `frontend/styles/session-layout.css`, with matching mobile clamps in `frontend/styles/session-mobile.css`. No wire-shape change: the hook still consumes `ServerToClient::ServerShutdown { reason, reconnect_delay_ms }` exactly as before; the version detection rides entirely on the existing `/api/config` `AppConfig.server_version` field. Six new unit tests in `use_client_websocket::tests` pin `is_newer_version` across patch / minor / major bumps, same-version, downgrade, and the unparseable-fallback path.

## 2.5.94

- **Unified `DiffCard` component for Claude `Edit` + Codex turn / file-patch diffs (closes #823).** Three near-identical-but-divergent diff rendering paths collapse into one shared Yew component. Before: `tool_renderers/edit.rs::render_edit_tool` wrapped its diff in `.tool-use.edit-tool` → `.tool-use-header` → `.diff-container` (the framed background lived only here, in `markdown.css`); `codex_renderer.rs::render_turn_diff` wrapped its diff in `.claude-message.assistant-message` → `.tool-use-section` with the literal "Turn Diff (cumulative)" label and **no** `.diff-container`, so Codex cumulative diffs sat naked against the message background; `codex_renderer.rs::render_file_change_patch` did the same naked treatment, then nested N `.file-change-entry` blocks inside one outer `.tool-use-section` with a "File Changes (patch)" label so a turn touching 5 files rendered as one outer card containing 5 unframed inner diffs. After: new `DiffSource` enum (`OldNew { old, new }` for Claude, `Unified { text }` for Codex) and new `<DiffCard source file_path? kind? replace_all? cumulative? />` Yew component in `frontend/src/components/diff.rs` handle all three call sites; per-line styling still funnels through the existing `render_diff_html` helper so the parser tests (`parse_single_hunk`, `parse_multiple_hunks`, `parse_blank_context_lines`, `parse_no_newline_marker_skipped`, `parse_without_file_headers`, `parse_unprefixed_line_falls_back_to_context`) pass unchanged. The card carries the framed `.diff-card-body` background uniformly, so Codex diffs now get the same visual treatment Claude has always had. Codex file-patch flattens from one-outer-card-with-N-nested-entries to N independent `DiffCard`s (one per file, each with its own kind chip + path + framed body) — picks up "maximum shared rendering" by reusing Claude's per-file shape verbatim. Headers expose three optional chips: `kind` (Codex per-file `add`/`update`/`delete` with the diff-line color palette), `cumulative` (Codex turn-level diff label so the wire semantic survives), `replace_all` (Claude `Edit { replace_all: true }`). New `frontend/styles/tools/diff.css` registers in `index.html` and houses the full `.diff-card{,-header,-title,-path,-kind,-cumulative,-replace-all,-body}` chrome plus the `.diff-view` / `.diff-line` / `.diff-marker` / `.diff-content` per-line styling lifted out of `markdown.css` (where they didn't belong). `markdown.css` shrinks accordingly — the only residual is `.read-file-path` which is consumed by the Read tool renderer. Dead public fns `render_diff_lines` and `render_unified_diff` removed (callers all migrated to `<DiffCard>`); internal `render_diff_html` / `parse_unified_diff` / `compute_line_diff` / `longest_common_subsequence` stay since `DiffCard` calls them. First concrete unification PR for the #822 spec — pattern (one shared Yew component + `DiffSource` enum that bridges agent-specific wire shapes + dedicated CSS file under `styles/tools/`) is reusable for the reasoning/bash/plan unifications still to come.

## 2.5.93

- **Codex bash command lifecycle dedup — collapse `started` → `completed` into one card (closes #776).** Codex events for the same item (e.g. a bash command's `item.started` immediately followed by `item.completed`) used to render as two near-identical cards in the transcript: a "running" card then a "completed" card with the same command text. New `CodexItem::id()` method and free fn `codex_event_item_id(json) -> Option<String>` in `frontend/src/components/codex_renderer.rs` extract the per-item identifier off the typed `CodexEvent::Item{Started,Updated,Completed}` enum (no JSON-poking — typed dispatch over `CodexItem`'s eight variants, falling through `Unknown` as `None`). New `visible_group_indices(category, messages) -> Vec<usize>` helper in `message_renderer/mod.rs` runs in the `MessageGroupRenderer` `IdentityGroup` arm: for `GroupCategory::Codex` it builds a `HashMap<item_id, last_index>` over the group's messages and keeps an index only if it's the last occurrence of its `item_id` (or if it has no item_id at all — turn-level events, deltas, errors stay visible because they're standalone signals, not lifecycle stages). For non-Codex categories it returns `(0..len).collect()` unchanged so Assistant / Portal / User grouping is byte-identical to before. The group header's count badge now reflects visible-card count, not raw event count, so a deduped run reads as "× 1" (badge hidden) instead of misleading "× 3". Six new tests in `mod tests`: `codex_command_lifecycle_dedupes_to_completed` (the regression target for #776), `codex_command_started_updated_completed_dedupes_to_completed` (full triple), `codex_two_distinct_items_each_keep_one_card` (per-id, never across items), `codex_non_item_events_always_visible` (turn.completed stays even when a same-id pair around it deduplicates), `visible_group_indices_is_codex_only` (Assistant / Portal / User get pass-through even with codex-shaped JSON), and `codex_items_without_id_do_not_collapse` (missing id ⇒ "definitely not the same item"). 26 message_renderer tests pass (20 prior + 6 new), full workspace clippy clean.

## 2.5.92

- **PR 4/4 of #809: residual `SessionView` orchestrator cleanup (closes #809).** Final slice of the SessionView decomposition EPIC, following the `PermissionHandler` (#816), `TasksPanel` (#817), and `InputBar` (#818) sub-component extractions. After the three sub-components landed, `frontend/src/pages/dashboard/session_view/component.rs` sat at 989 LOC — most of the irreducible orchestrator (WS connect/reconnect, scrollback rendering, awaiting-input gate, sub-component dispatcher wiring) but still carrying a clump of pure helpers (msg-type classification, metadata injection, autoscroll-transition math, pending-send echo reconciliation, `is_claude_awaiting`, `extract_user_text`, `message_type_tag`) inline, the 88-LOC `derive_task_events` function (which only `TasksPanel` consumes), and a duplicated 25-LOC inline `msg_type` derivation that ran twice over the codebase (once in the `LoadHistory` REST replay loop, once in `handle_received_output` on the live wire path) — any classification change had to land in both call sites in lockstep, and the live path's `handle_received_output` (~111 LOC) interleaved that derivation with `Result` cost-flash tracking, task-event dispatch, audio-cue side effects, `_created_at` JSON injection, and the pending-send echo-matching loop. New file `frontend/src/pages/dashboard/session_view/helpers.rs` lifts the four already-pure helpers (`message_type_tag`, `extract_user_text`, `autoscroll_transition`, `is_claude_awaiting`) plus three new ones: `classify_output_msg_type(&str) -> String` (collapses the two-site `ClaudeOutput` parse + system-subtype disambiguation + `ClaudeMessage` fallback into one helper consumed by both `LoadHistory` and `handle_received_output`), `inject_message_metadata(content, created_at, role_user, user_id, sender_name) -> String` (collapses the four-site `_created_at` / `_sender` JSON injection — was duplicated in the `LoadHistory` per-row map closure and the `handle_received_output` post-process — into one pure helper that returns the input unchanged for non-object JSON or parse failures so malformed wire frames still flow through to the message list), and `reconcile_pending_sends(&mut Vec<String>, msg_type, output)` (lifts the pending-send drain logic — the `user`-echo content-match path with the multi-tab safety check and the `assistant`/`result` clear-all path for slash commands — out of `handle_received_output` so the multi-tab "don't consume unrelated entries" invariant is unit-testable without mounting the component). `derive_task_events` moves to `tasks_panel.rs` alongside the `TaskEvent` / `TaskStatus` types it produces — the live (`Date.now()`) vs replay (`Date.parse(created_at_iso)`) timestamp-source split that the panel ultimately consumes now lives in the same module as the consumer, so a future panel refactor doesn't have to chase down a helper in `component.rs`. The 111-LOC `handle_received_output` slims to ~50 LOC of orchestration (parse → cost flash → task dispatch → audio → activity → metadata-inject → reconcile-pending → push); the `LoadHistory` arm's inline 60-LOC closure slims to a `handle_load_history` helper of ~45 LOC (classify → derive tasks → emit activity → map-inject-metadata → push). Twenty-five new unit tests in `helpers::tests` (188 frontend tests total, up from 163) cover the three new helpers: five `classify_output_msg_type` shapes (garbage, assistant, user, portal-via-fallback, error-via-fallback), five `inject_message_metadata` shapes (non-user/user-with-attribution/user-without-attribution/invalid-JSON/non-object-JSON), six `reconcile_pending_sends` shapes (empty no-op, user-echo first-match-remove, user-echo no-match-keeps, assistant clear-all, result clear-all, other-msg-type ignored), plus the three relocated `autoscroll_transition` cases, four `is_claude_awaiting` cases (last-signal-result-true, last-signal-assistant-false, noise-types-skipped, empty-history-false), four `extract_user_text` cases (top-level-content / message.content-blocks fallback / non-user / no-text), and one `message_type_tag` per-variant case. Wire shape unchanged — same `ClientToServer::ClaudeInput` / `PermissionResponse` / `Interrupt` / `FileUploadStart` / `FileUploadChunk` frames at the same dispatch points, same `_created_at` / `_sender` JSON injection shape (and same fallback-to-raw behavior on parse failure), same audio cue + `on_activity` emission per live output, same 100-message scrollback cap on both `LoadHistory` and `WsEvent::Output` paths, same `Date.parse`-based reconnect-replay watermark from `WsEvent::Output(.., created_at)` (closes #784), same 10-attempt exponential-backoff reconnect ladder, same scroll-listener at-bottom gate at 50 px. `component.rs` drops from 989 to 727 LOC (-262 / -26%). **Deliberately left in the orchestrator** (with reasoning): WS connect / reconnect + exponential-backoff state machine (genuinely the orchestrator's job — it owns the `ws_sender`, the `reconnect_attempt` counter, and the timer Drop guard, and there's only one consumer), the `handle_ws_event` dispatch table (a 60-LOC `match` on `WsEvent` variants — each arm is 3–10 LOC of either `send_message`-to-self or single field mutation, which is the actual orchestrator shape; extracting per-variant handlers would just rename the indirection), the `rendered()` scroll-listener attachment (DOM-side, can't be tested without the browser), the three `render_*_sub_component` methods (one-line `html!` mounts that exist purely as readability landmarks for which sub-component is which), and the `dispatch_tasks` one-line helper (forwards through the stored `Option<Callback>` once). The residual at 727 LOC is now a "what does this component do" outline — a new contributor can read the `SessionViewMsg` enum (one variant per orchestrator concern, all glue), the `update()` dispatch (now a 130-LOC table where each arm fits on one screen), and the three sub-component renderers, and hold the wire shape in their head. Pure refactor; closes the EPIC.

## 2.5.91

- **PR 3/4 of #809: extract `InputBar` sub-component from `SessionView`.** Third slice of the SessionView decomposition EPIC, following the `PermissionHandler` (#816) and `TasksPanel` (#817) extractions. `frontend/src/pages/dashboard/session_view/component.rs` was still carrying the entire input-bar lifecycle alongside everything else — the textarea `NodeRef`, the file-input `NodeRef`, the voice-button `NodeRef`, twenty `SessionViewMsg` variants (`SendInput`, `UpdateInput`, `HistoryUp`, `HistoryDown`, `VoiceRecordingChanged`, `VoiceTranscription`, `VoiceInterimTranscription`, `VoiceError`, `ToggleVoice`, `ToggleSendModeDropdown`, `CloseSendModeDropdown`, `SendWiggum`, `FilesSelected`, `FileUploadProgress`, `FileUploaded`, `FileUploadError`, `DragEnter`, `DragLeave`, `UploadDismiss`, `Noop`), thirteen state fields (`input_ref`, `input_text`, `was_focused`, `command_history`, `is_recording`, `interim_transcription`, `voice_button_ref`, `send_mode_dropdown_open`, `file_input_ref`, `upload_progress`, `upload_files`, `upload_departing`, `upload_dismiss_timer`, `drag_hover`), seven helper methods (`get_input_text`, `set_input_text`, `handle_send_input_with_mode`, `render_interim_transcription`, `render_upload_bar`, `render_voice_input`, `render_send_button`), the per-keystroke autoresize closures (`handle_input` / `handle_keydown` / `handle_paste` / `handle_dragover` / `handle_dragleave` / `handle_drop`), and the `spawn_local` chunk-upload pipeline (image → `FileUploadStart` → many `FileUploadChunk` frames → combined `ClaudeInput` follow-up) — totalling roughly 600 LOC of input-bar state and view code interleaved with WebSocket plumbing, cost-tracking, history loading, permission wiring, and task-panel wiring. None of the small testable pieces (the human-readable file-size formatter, the combined upload-message composer) were unit-testable: every assertion required mounting the full `SessionView` with a Yew `Context` and dispatching `WsEvent`s. New file `frontend/src/pages/dashboard/session_view/input_bar.rs` lifts the entire input-bar UI lifecycle into a struct `InputBar` Yew component owning the textarea `NodeRef`, the mirrored input text (for restore after WS reconnect re-renders), the `CommandHistory`, the send-mode dropdown toggle, the file-input `NodeRef`, the upload-progress / upload-departing / upload-files state and the dismiss `Timeout`, the drag-hover flag, the voice-button `NodeRef`, the `is_recording` / `interim_transcription` voice state, and the `was_focused` flag for focus-transition detection. The bar emits typed `(String, SendMode)` plain-text sends via `on_send_text` (parent packages into `ClientToServer::ClaudeInput` + the optimistic local-echo entry); typed `ClientToServer` raw frames via `on_send_frame` (used by the file-upload pipeline to stream `FileUploadStart` / `FileUploadChunk` / the combined-message `ClaudeInput` over the parent's WS sender); and a `MessageSent` ping via `on_message_sent` (parent forwards to the dashboard's `on_message_sent` prop). Wiring uses the same dispatcher-registration pattern as `PermissionHandler` / `TasksPanel`: on `create`, `InputBar` hands its inbound-event `Callback<InputBarInbound>` up to the parent via the `on_register` prop, and the parent stashes it on a single `input_bar_dispatcher: Option<Callback<InputBarInbound>>` field; the only inbound event today is `FocusTextarea`, which `PermissionHandler::on_refocus_input` routes through so the textarea regains focus after a permission answer without the child needing the parent's `NodeRef` (the now-unused `refocus_textarea` helper in `permission_handler` is deleted with no replacement). The twenty input-bar `SessionViewMsg` variants, the thirteen state fields, the seven helper methods, and the eight per-keystroke closures are all deleted from `component.rs` (net –633 LOC: 1622 → 989) and replaced by four thin wiring variants (`InputBarDispatcherRegistered`, `SendText(String, SendMode)`, `SendFrame(ClientToServer)`, `MessageSent`), one `input_bar_dispatcher` field, one `send_text_input` helper, and the new `render_input_bar` render method which mounts the sub-component. The duplicated file-size formatting (four near-identical `if/else` ladders across the upload bar and the combined-message composer) collapses into one pure `format_file_size(u64) -> String` helper; the upload-message composition (with its "user text + blank line + header + bullet list" shape) moves to `build_upload_message(&str, &[(String, u64)]) -> String`. Eleven new unit tests in `input_bar::tests` cover the four `format_file_size` branches (under 1 KiB, 1 KiB–1 MiB, at-or-above 1 MiB, boundary at exactly 1024 / 1024² bytes), the four `build_upload_message` shapes (with user text, without, three-file ordering, empty list defensive), and the slash-command pass-through contract (`/clear` / `/help` / `/cost` are plain text that flows to the proxy as-is — the bar does no interception — and an empty / whitespace-only input is rejected before any WS frame fires). Wire shape unchanged — same `ClientToServer::ClaudeInput` / `FileUploadStart` / `FileUploadChunk` frames at the same dispatch points, same combined upload message (verbatim format string), same `Send` / `Wiggum` / `Send with attachment(s)` dropdown options, same keyboard shortcuts (Enter to send, Shift+Enter for newline, ArrowUp/ArrowDown for history with the on-first-line / on-last-line cursor gate, Ctrl+M to toggle voice), same drag-hover class, same upload-progress bar with the 2 s post-completion dismiss + 400 ms collapse animation. Pure refactor; the residual `SessionViewCore` slice ships in the final PR under #809.

## 2.5.90

- **PR 2/4 of #809: extract `TasksPanel` sub-component from `SessionView`.** Second slice of the SessionView decomposition EPIC, following the `PermissionHandler` extraction (#816). `frontend/src/pages/dashboard/session_view/component.rs` was still carrying the entire sub-agent / background-bash task UI lifecycle alongside everything else — the `TaskStatus` / `TaskEntry` types and their `with_started_at` / `new` constructors, six state fields (`active_tasks: HashMap<String, TaskEntry>`, `tool_use_to_task: HashMap<String, String>`, `tasks_panel_open: bool`, `task_tick_handle: Option<Interval>`, `tab_anim: Option<&'static str>`, `tab_departing: bool`), four `SessionViewMsg` variants (`TaskTick`, `ToggleTasksPanel`, `ClearTabPulse`, `FinishDeparture`), four helper methods (`ensure_task_tick`, `schedule_clear_pulse`, `render_tasks_sidebar`, `render_task_pill`), and two large blocks of in-line `shared::ClaudeOutput` parsing (one in the `LoadHistory` REST replay path that ran twice over every history row due to a pre-existing duplicated `tool_result` fallback block, one in the live-WS `handle_received_output` path) — totalling roughly 330 LOC of task-state management interleaved with WebSocket plumbing, cost-tracking, file uploads, voice transcription, history navigation, and permission wiring. The task-state mutations, the 1 s tick interval that kept elapsed-time labels live, the entering / progress / departing tab animations, and the 10 s post-completion prune window all had to share the same `update()` arm with everything else, and none of them were independently testable: every assertion about the start → progress → complete transition or the missing-start placeholder race required mounting the full `SessionView` with a Yew `Context` and dispatching `WsEvent`s. New file `frontend/src/pages/dashboard/session_view/tasks_panel.rs` lifts the entire tasks-drawer UI lifecycle into a struct `TasksPanel` Yew component owning the `active_tasks` map, the `tool_use_id → task_id` reverse index, the `tasks_panel_open` toggle, the `task_tick_handle` interval, and the `tab_anim` / `tab_departing` animation state, with a typed `TaskEvent` enum (`Started`, `Progress`, `Notification`, `ToolResult`) the parent emits from a new pure `derive_task_events(&ClaudeOutput, created_at_iso, live: bool) -> Vec<TaskEvent>` helper that captures the two timestamp paths in one place (replay parses the row's server-assigned `created_at`; live falls back to `js_sys::Date::now()`). Inbound events arrive through a `TasksInbound` envelope with three variants — `ClearForReplay` (fired once at the start of a `LoadHistory` batch), `Replay(TaskEvent)` (state mutation only, no animation), and `Live(TaskEvent)` (state mutation + animation hint) — so the live and replay paths share the same state-application code (`apply_event`) while keeping the animation side effects isolated to the live branch (`apply_event_live`). Wiring uses the same dispatcher-registration pattern as `PermissionHandler`: on `create`, `TasksPanel` hands its inbound `Callback<TasksInbound>` up to the parent via the `on_register` prop, and the parent stashes it on a single `tasks_dispatcher: Option<Callback<TasksInbound>>` field; the parent's WS-output and REST-load paths each parse the typed `ClaudeOutput`, call `derive_task_events`, and forward each resulting `TaskEvent` through `dispatch_tasks`. The four task-related `SessionViewMsg` variants, the six state fields, the `TaskStatus` / `TaskEntry` definitions, and the four helper methods are all deleted from `component.rs` (net –333 LOC: 1955 → 1622) and replaced by one thin wiring variant (`TasksDispatcherRegistered`), one `tasks_dispatcher` field, one `dispatch_tasks` helper, and the new `render_tasks_panel` render method which mounts the sub-component. Elapsed-time rendering moves to a pure helper pair (`format_elapsed(&TaskEntry) -> String`, `format_secs(u64) -> String`) so the `1m 0s` boundary, the `duration_ms`-vs-`completed_at - started_at` precedence rule, and the defensive `Failed` -with-no-completion fallback are all testable without a `Date`. Thirteen new unit tests in `tasks_panel::tests` cover the happy-path lifecycle (start → progress → complete preserving `started_at` and overriding usage numbers from notification), the missing-start race conditions (progress and notification each insert placeholders with the supplied fallback timestamp), the `tool_result` reverse-index lookup (unknown `tool_use_id` is a no-op; matching one completes the running task; a duplicate `tool_result` after completion must NOT overwrite the existing `completed_at` so the 10 s prune window doesn't drift), the `ClearForReplay` reset semantics, the `format_secs` boundary at 60 s, the three `format_elapsed` branches (running, completed-with-`duration_ms`, completed-without-`duration_ms`-falls-back-to-`completed_at - started_at`), the `Failed` -with-no-completion defensive `0s`, and the `running_count` filter. Wire shape unchanged — same `ClaudeOutput::System::{task_started, task_progress, task_notification}` parsing in the same dispatch order, same `ContentBlock::ToolResult` fallback for `--print` mode, same `tasks-drawer` / `tasks-tab-hint` / `tasks-sidebar-panel` / `task-pill` CSS class shape, same entering / progress / departing pulse durations (600 ms / 400 ms / 500 ms), same 1 s tick cadence, same 10 s post-completion prune, same `started_at` sort order, same `Sub-agent` / `Background Bash` / `Task` label mapping. Pure refactor; the two remaining slices (`InputBar`, `SessionViewCore`) ship in follow-up PRs under #809.

## 2.5.89

- **PR 1/4 of #809: extract `PermissionHandler` sub-component from `SessionView`.** First slice of the SessionView decomposition EPIC. `frontend/src/pages/dashboard/session_view/component.rs` was carrying the full permission-request lifecycle alongside everything else — five `SessionViewMsg` variants (`PermissionSelectUp`, `PermissionSelectDown`, `PermissionConfirm`, `PermissionSelectAndConfirm`, `ApprovePermission`, `ApprovePermissionAndRemember`, `DenyPermission`, `SetQuestionAnswer`, `ToggleQuestionOption`, `SubmitAllAnswers`) and five state fields (`pending_permission: Option<PendingPermission>`, `permission_selected: usize`, `multi_select_options: HashMap<usize, HashSet<usize>>`, `question_answers: QuestionAnswers`, `permission_ref: NodeRef`) and five helper methods (`handle_permission_select`, `handle_permission_confirm`, `handle_approve_permission`, `handle_deny_permission`, `handle_submit_answers`) totalling roughly 150 LOC of selection-state management interleaved with WebSocket plumbing, task-panel lifecycle, file uploads, voice transcription, and history navigation. None of that state was independently testable — touching the keyboard-nav math required mounting the full component with a `Yew::Context`. New file `frontend/src/pages/dashboard/session_view/permission_handler.rs` lifts the entire permission-request UI lifecycle into a struct `PermissionHandler` Yew component owning a request slot + selection index + multi-select set + per-question answer map + dialog focus ref, with a typed `PermissionResponseKind` enum (`Approve { remember }`, `Deny`, `AnswerQuestions(QuestionAnswers)`) that the handler emits when the user answers — the parent translates each variant into the existing `ClientToServer::PermissionResponse` wire frame through a new pure `build_permission_response(request_id, kind, &perm) -> shared::PermissionResponseFields` helper in the same module, keeping the wire-shape translation adjacent to the typed enum it serializes. Wiring uses the dispatcher-registration pattern: on `create`, `PermissionHandler` hands its inbound-request `Callback<PendingPermission>` up to the parent via the `on_register` prop, and the parent stashes it on a `permission_dispatcher: Option<Callback<PendingPermission>>` field; when `WsEvent::Permission` lands on the wire the parent forwards through the dispatcher (and stashes a snapshot in `last_permission_request` so the wire-frame translation can read `input` / `permission_suggestions` without an echo through the callback). A second prop `on_pending_changed: Callback<bool>` keeps `SessionView.has_pending_permission` in sync for the `is_awaiting` computation, and `on_refocus_input: Callback<()>` lets the parent re-focus its textarea after a response without the child needing the parent's `NodeRef`. The five permission-related `SessionViewMsg` variants, the five state fields, and the five helper methods are all deleted from `component.rs` (net –166 LOC) and replaced by three thin wiring variants (`PermissionDispatcherRegistered`, `PermissionPendingChanged`, `PermissionAnswered`) plus the new render method `render_permission_handler` which mounts the sub-component. Selection math moved to three pure helpers in the new module — `max_option_index(&PendingPermission) -> usize`, `next_selection(current, max, delta) -> usize`, `resolve_standard_choice(selected, has_suggestions) -> StandardChoice` — so the keyboard-navigation behavior (Allow/Deny vs Allow/Allow & Remember/Deny vs AskUserQuestion option-count) is testable without a Yew `Context`; thirteen new unit tests in `permission_handler::tests` cover the navigation wrap-around (up/down with wraparound at both ends), the option-count derivation for each tool shape (standard, with suggestions, AskUserQuestion with options / no questions / unparseable input), the standard two/three-option layout mapping (including out-of-range index defensive fallback), and the wire-frame translation contract for each `PermissionResponseKind` variant (approve drops suggestions when `remember == false`, approve keeps them when `remember == true`, deny clears input and sets the `"User denied"` reason, AnswerQuestions builds the question-text-keyed `PermissionAnswers` map). Wire shape unchanged — same `ClientToServer::PermissionResponse` frames at the same dispatch points, same `PermissionDialog` presentational component renders the card, same keyboard shortcuts (`↑`/`k` up, `↓`/`j` down, `Enter`/`Space` confirm, click-to-select-and-confirm), same focus-on-mount-when-focused behavior. Pure refactor; the three remaining slices (`TasksPanel`, `InputBar`, `SessionViewCore`) ship in follow-up PRs under #809.

## 2.5.88

- **SessionView: route autoscroll through `Msg`, drop `Rc<RefCell<bool>>` side channel (closes #808).** `frontend/src/pages/dashboard/session_view/component.rs` previously kept `should_autoscroll` as an `Rc<RefCell<bool>>` so the scroll-listener closure could mutate the flag from outside the Yew `update()` cycle. The closure cloned the `Rc`, took a `borrow_mut()` on every scroll event, and only sent `SessionViewMsg::AutoscrollChanged` (a unit variant — no payload) when the flag flipped, leaving the `update()` arm with nothing to do except return `true` for a re-render; the state mutation already happened in the closure. This wove a parallel mutation path around Yew's owned-state contract — anyone reading the field had to think about whether the closure had grabbed `borrow_mut()` mid-render, and a future caller that mutated `should_autoscroll` from a non-closure site would silently de-sync from whatever the listener thought. Replaces the `Rc<RefCell<bool>>` field with a plain `bool` mutated only through the typed `SessionViewMsg::AutoscrollChanged(bool)` arm (now carrying the at-bottom reading as payload). The scroll listener captures only the component link (no shared state), dispatches the reading on every scroll event, and the `update()` arm gates re-renders through a new pure helper `autoscroll_transition(current: bool, new_at_bottom: bool) -> Option<bool>` returning `Some(next)` on a transition and `None` when nothing changed — extracted so it's unit-testable without a Yew `Context`. Three new tests in `pages::dashboard::session_view::component::tests` cover the no-transition / scroll-up / scroll-back-down cases. Removed `std::cell::RefCell` and `std::rc::Rc` imports. Behavior is unchanged: same 50 px at-bottom threshold, same transition-only re-render semantics (now expressed in `update()` rather than the closure), same JumpToLive snap, same pill render gating.

## 2.5.87

- **Consolidate message classifier into one parse-once dispatch (closes #805).** `frontend/src/components/message_renderer/mod.rs::classify` previously composed three free predicates — `should_group_with_assistant`, `is_plain_text_user`, and `is_codex_event` — that each independently deserialized the wire JSON into a `ClaudeMessage` (or `CodexEvent`). For every message the grouper inspected, the assistant predicate parsed once, then the inner `match serde_json::from_str::<ClaudeMessage>(json)` re-parsed it, then `is_plain_text_user` re-parsed it inside a guard, then on Codex sessions the `CodexEvent` parse closed the loop — up to four JSON parses per message just to compute the group identity. Worse, the two-predicates-then-dispatcher shape was a multi-source-of-truth: adding a new `ClaudeMessage` variant meant updating the predicate set and the `classify` match arm in lockstep, and the existing predicate ordering invariant (user-tool-result envelopes MUST land in Assistant before plain-text User can claim them) was only enforced by the order the `classify` function happened to call its helpers in. This PR collapses the three predicates into one `match serde_json::from_str::<ClaudeMessage>(json)` dispatch inside `classify` itself: the variant is decoded once, the `ClaudeMessage::User(msg)` arm decides between the Assistant (tool-result envelope) and User (plain-text) categories on the already-parsed value via two new pure helpers `user_is_tool_result_envelope(&UserMessage) -> bool` and `user_is_plain_text(&UserMessage) -> bool` (taking the parsed struct, not the JSON string), and the `CodexEvent` parse is gated behind the `agent_type == Codex` check so Claude-only sessions never run it. The user-tool-result-before-plain-text invariant is now expressed structurally — both helpers are called in sequence inside the single `User` arm, so a future refactor can't re-order them without also changing the arm shape. The three free predicates and their docblocks are deleted, replaced by a single docblock on `classify` that enumerates the variant ordering and names the regression target (#758) for each rung. Three existing tests that asserted directly against the removed predicates (`user_tool_result_classifies_with_assistant`, `user_tool_result_with_top_level_content_still_groups`, `real_user_text_does_not_group_with_assistant`) are rewritten to assert against `classify_category(&json)` instead — the externally-observable category is the actual contract. New `classifier_exhaustive_over_realistic_messages` parametrized test feeds one canonical wire shape per recognized variant (assistant tool_use, user tool_result envelope, plain-text user, portal, codex item.started, system, result, error, unparseable garbage) at the classifier under `AgentType::Codex` (the strictly-larger surface — Claude shapes classify identically on both agent types) and asserts the right `GroupCategory` (or `None`) fires for each — so a new variant landing in `ClaudeMessage` or `CodexEvent` forces an explicit decision about which category it joins rather than silently falling through to `None`.

## 2.5.86

- **Tool renderers: extract generic `ToolInput` dispatch helper (closes #803).** The 12 per-tool renderers in `frontend/src/components/tool_renderers/*.rs` each duplicated the same `serde_json::from_value::<ToolInput>(input.clone()).ok().and_then(|t| match t { ToolInput::Bash(b) => Some(b), _ => None })` boilerplate, with the hand-typed match arm spelling out the expected variant. A typo in the variant name (or a rename of the upstream `ToolInput` variant in `claude-codes`) would silently fall through to the `_ => None` arm and trigger the hand-written default, with no compile-time error and no runtime warning — the user just saw a blank or "?" placeholder where their Bash/Edit/Grep/etc. card should have been. Introduces a `FromToolInput` trait in `frontend/src/components/tool_renderers/mod.rs` (local equivalent of `TryFrom<ToolInput>`, which can't be implemented directly because both the trait and the variant structs are foreign — orphan rules) implemented for `BashInput`, `ReadInput`, `EditInput`, `WriteInput`, `GlobInput`, `GrepInput`, `TaskInput`, `WebFetchInput`, `WebSearchInput`, `TodoWriteInput`, `AskUserQuestionInput`, and `ExitPlanModeInput` via a single `impl_from_tool_input!(Variant, InnerStruct)` macro; a generic `extract_tool_input::<T: FromToolInput>(input: &Value) -> Option<T>` collapses the deserialize-and-match dance to a single typed call site. Each of the 12 call sites in `bash.rs`, `edit.rs`, `search.rs`, `task.rs`, `interactive.rs`, and `mod.rs::render_read_tool` collapses from 5–8 lines of boilerplate to a one-line `extract_tool_input::<BashInput>(input).unwrap_or(BashInput { … })`. Behavior is unchanged — same JSON parse, same variant gate, same fallback defaults — but the variant-name dispatch is now centralized in the macro expansion, so a future rename of an upstream variant becomes a single compile-error site in `mod.rs` instead of 12 silently-broken renderers. Pure cleanup: no new features, no wire-shape change, no behavior change.

## 2.5.85

- **Split `frontend/styles/tools.css` (971 LOC monolith) into per-tool stylesheets (closes #806).** Before this PR, every tool renderer's CSS — bash, read, glob/grep, todowrite, askuserquestion, exitplanmode, task, webfetch, websearch — lived in a single 971-line file, and that same file also carried non-tool message styling (thinking blocks, result-message stats bar, user/error/overload/rate-limit/compaction/task-subagent/raw messages), citation chips, and the "new content block renderer" family (server-tool-use, mcp-tool-use/result, code-execution-result, container-upload, unknown-block). Reorganized into `frontend/styles/tools/` with one stylesheet per renderer family — `base.css` (shared `.tool-meta`, `.tool-badge` variants, `.tool-header-spacer`, `.bash-command-inline / .glob-pattern-inline / .grep-pattern-inline` header chips, `.expandable-toggle`, `.tool-arg-entry`), `bash.css`, `read.css`, `search.css` (glob + grep), `task.css`, `todowrite.css`, `askuserquestion.css`, `exitplanmode.css`, `webfetch.css`, `websearch.css`. Non-tool styling that was squatting in tools.css moved into `messages.css` where it actually belongs (thinking block, all the per-message-type styles, raw-message fallback, tooltip helper, content-block renderers, citations). `frontend/index.html` swaps the single `<link rel="css" href="styles/tools.css">` for one `<link>` per tool file in alphabetical order with `base.css` first so the cascade order matches the prior single-file order. Pure reorganization: zero selector behavior change verified by diffing `^[.#][^{]*\{` selector lines between `git show HEAD:frontend/styles/tools.css` and `cat frontend/styles/tools/*.css frontend/styles/messages.css` — same set of selectors, same set of full selector lines (including the multi-line `.bash-command-inline, .glob-pattern-inline, .grep-pattern-inline` group preserved in `base.css`).

## 2.5.84

- **`TaskEntry` constructor dedupes 6 identical field-literal sites (closes #804).** `frontend/src/pages/dashboard/session_view/component.rs` was constructing `TaskEntry` at six call sites (the three task lifecycle arms — `task_started` / `task_progress` / `task_notification` — in each of two parallel dispatch paths: the `LoadHistory` REST hydration loop and the live `WsEvent::Output` handler) with identical 10-field struct literals; the only variation between sites was `task_type`, `description`, and whether `started_at` came from a parsed `msg.created_at` ISO string (REST hydration path) or `js_sys::Date::now()` (live path). Every new `TaskEntry` field was a stale-default landmine — a missing site silently shipped sessions with the new field defaulted. Replaces all six literals with two constructors on `impl TaskEntry`: `TaskEntry::new(task_type, description)` (uses `js_sys::Date::now()` for the live path) and `TaskEntry::with_started_at(task_type, description, started_at)` (for the REST-hydration path where the original timestamp is recoverable from the persisted message); `new` is implemented as a one-liner over `with_started_at`. Both take `impl Into<String>` so call sites can pass `&'static str` literals (`"local_agent"`) without an explicit `.to_string()`. Defaults — `status: TaskStatus::Running`, all `Option<_>` fields `None` — are centralized in the constructor. Pure cleanup: no behavior change, no wire change, no DB change.

## 2.5.83

- **Codex item renderers: extract `tool_card` combinator + dedupe error renderer (closes #807).** `frontend/src/components/codex_renderer.rs` had 8 per-item render functions (`render_agent_message`, `render_reasoning`, `render_command_execution`, `render_file_change`, `render_mcp_tool_call`, `render_web_search`, `render_todo_list`, `render_item_error`) where the 5 tool-style variants (`CommandExecution`, `FileChange`, `McpToolCall`, `WebSearch`, `TodoList`) hand-rolled the same `<div class={item_card_classes(completed)}><div class="message-body"><div class="tool-use-section"><div class="tool-use-header"><span class="tool-icon">…</span><span class="tool-name">…</span><span class="tool-meta">…</span></div>…body…</div></div></div>` chrome — adding a new tool-style codex item or tweaking the wrapper (as #802 just did for the in-progress styling) meant editing 5 near-duplicate sites. New private `tool_card(icon: &str, name: String, status: Option<String>, body: Html, completed: bool) -> Html` helper centralizes the wrapper, the `tool-use-section`, the icon/name/optional-meta header, and threads `item_card_classes(completed)` exactly once; each of the 5 tool-style renderers shrinks to: compute icon/name/status/body, then call `tool_card`. The 3 non-tool-style renderers (`render_agent_message` uses a `message-header` badge instead of a tool-use-section; `render_reasoning` uses a `thinking-block`; `render_error_block` uses an `error-message-display` chrome) are left as their own functions because their HTML chrome is structurally different from the tool-style cards — squeezing them through a single combinator would require an `Option<_>` for every chrome dimension (header style, body class, badge text) and obscure the actual difference. `render_thread_error` and `render_item_error` were byte-for-byte identical (same chrome, same `"Unknown error"` fallback, same `"Error"` badge text) so they're collapsed into a single `render_error_block`. The trait shape suggested in the issue (`fn icon(&self) -> &'static str; fn name(&self) -> &'static str; fn status_text(&self, completed: bool) -> Option<String>; fn body(&self) -> Html;`) didn't quite work because `body()` for `CommandExecution` needs to thread `exit_code` into both the status meta line and an `is_error` class on the output `<div>` — three of the variants' bodies need to read more than one field, and `CommandExecution`'s status text depends on both `exit_code` and `completed`. The free-fn-per-variant + shared `tool_card` combinator gets the same dedup payoff (the wrapper boilerplate lives in one place, the in-progress styling work from #802 is now a one-line change in `tool_card`) without forcing every variant's renderer through a single typed contract that doesn't quite fit. Wire shape and CSS hooks are unchanged — `cargo test --workspace` (all `codex_renderer::tests` passing pre- and post-refactor) and `cargo clippy --workspace --all-targets -- -D warnings` are clean; net file size drops from 1139 to 1119 LOC.

## 2.5.82

- **Visual styling for `item.started` vs `item.completed` codex events.** Before this PR, only `render_command_execution` distinguished an in-flight bash command (`status: "running…"`) from a finished one — every other `CodexItem` variant rendered identically whether it was streaming or done. Hard to tell at a glance whether a file-change card is still being computed or already written, whether an MCP tool call is mid-RPC, whether the agent is still typing. The dispatcher already plumbs a `completed: bool` into `render_item`; this PR threads it through `render_agent_message`, `render_reasoning`, `render_file_change`, `render_mcp_tool_call`, `render_web_search`, and `render_todo_list` (the remaining per-item renderers), each of which now consults a new `item_card_classes(completed: bool) -> &'static str` helper that returns `"claude-message assistant-message codex-item"` for completed items and adds the modifier class `codex-item-in-progress` for `item.started` / `item.updated` events. New CSS rules in `frontend/styles/messages.css`: a pulsing tokyo-night-orange dot (`#e0af68`) prepended to each in-flight item's tool-use / message header via `::before` (1.5 s ease-in-out infinite, 0.45 → 1.0 opacity), 0.82 opacity dimming on the headline text (`.tool-name` / `.assistant-text` / `.thinking-content`), and italic orange `.tool-meta` so the "in_progress" / "running…" status word stands out. The dedup pass added by #776 means in-flight cards naturally disappear once `item.completed` lands (replaced with the completed card), so this styling only ever shows during the live mid-stream window — and historical sessions reloaded from the DB show the styled-as-completed cards regardless. `@media (prefers-reduced-motion: reduce)` skips the pulse animation and shows a static dot instead. `render_file_change` and `render_mcp_tool_call` also now fall back to status text `"in progress"` / `"in_progress"` when the wire `status` is absent and `completed == false` (matching the existing fall-back-to-"completed" behavior). `render_item_error` is unchanged — errors don't have an in-flight state.

## 2.5.81

- **Reconnect replay uses server-assigned timestamps, not `Date.now()` (closes #784).** Silent data-loss fix on the WebSocket reconnect path. The previous behavior: `frontend/src/pages/dashboard/session_view/component.rs` set `last_message_timestamp` from `js_sys::Date::new_0().to_iso_string()` (browser "now") in two places — the `WsEvent::HistoryBatch` handler and the per-message `handle_received_output` end — then sent that string back as `RegisterFields.replay_after` on reconnect, which `backend/src/handlers/websocket/web_client_socket.rs::replay_history` parses and feeds into `messages::created_at.gt(after)`. Any clock skew between the browser and the server, or a message already in flight at the moment the client stamped the watermark, dropped messages whose `created_at` happened to land at-or-before the browser's "now" — the user never saw them, the proxy never knew, no warning, no metric, just gaps in the chat that look like normal stream behavior. **Wire shape change**, kept minimal: `shared::ServerToClient::ClaudeOutput` gains a `#[serde(default, skip_serializing_if = "Option::is_none")] created_at: Option<String>` field carrying the persisted DB row's `created_at` in the exact ISO microsecond format (`%Y-%m-%dT%H:%M:%S%.6f`) the backend's `replay_history` parser accepts, and `shared::ServerToClient::HistoryBatch` gains a matching `last_created_at: Option<String>` summary field set to the newest row's timestamp in the batch. Both are `Option<_>` + `#[serde(default)]` so older clients / hand-rolled JSON keep parsing; pre-#784 wire frames round-trip unchanged (new `wire_compat_pre_784_omits_created_at` test pins it). **Backend** (`backend/src/handlers/websocket/message_handlers.rs::handle_claude_output`): the DB insert is reordered to happen **before** the broadcast and switched from `.execute(&mut conn)` to `.get_result::<Message>(&mut conn)` so the inserted row's `created_at` flows directly into the `ServerToClient::ClaudeOutput` frame — same `RETURNING *` semantics the slash-command path in `web_client_socket.rs::handle_web_input` now also uses for the portal-message broadcast. If the insert fails the broadcast still goes out with `created_at: None` rather than dropping the message — the frontend keeps its prior watermark and a future timestamped message heals it. `replay_history` in the same file (which after #788 also gained SQL-side pagination on the no-`replay_after` branch) now injects `_created_at` into each history-batch JSON object (matching the REST list-messages path's wire shape) and sets the new `HistoryBatch.last_created_at` field from the latest row, computed once outside the per-row map. **Frontend** (`frontend/src/pages/dashboard/session_view/websocket.rs`): `WsEvent::Output` and `WsEvent::HistoryBatch` grow a second tuple element carrying the server-assigned timestamp (`Option<String>`), the `handle_proxy_message` translator folds the new field into the event and additionally folds `created_at` into the content JSON as `_created_at` (so the per-message TimeAgo renderers and downstream consumers see the same shape `replay_history` already produces). **Component** (`frontend/src/pages/dashboard/session_view/component.rs`): the two `last_message_timestamp = Some(js_sys::Date::new_0()...)` sites are replaced with conditional updates from the server-supplied timestamp — `if let Some(ts) = created_at { self.last_message_timestamp = Some(ts); }`. The watermark is **never** set from a browser clock anywhere in the live-message path; on initial load it's still seeded from the REST `MessageData.created_at` (which is already the server's row timestamp), so the round-trip is end-to-end honest now. Two DB-backed regression tests added to the existing `replay_tests` module in `backend/src/handlers/websocket/web_client_socket.rs` (reusing the #788-introduced `make_user`/`make_session`/`seed_messages`/`cleanup`/`try_pool` helpers — same auto-skip-on-missing-`DATABASE_URL` pattern): `replay_history_strict_gt_round_trips_server_timestamp` seeds three rows, formats the middle row's `created_at` exactly the way the broadcast path formats it, feeds it back as `replay_after`, and asserts only the strictly-newer row is returned plus `last_created_at` matches the newest row plus the injected per-message `_created_at` matches; `replay_history_no_watermark_returns_all_and_advances_high_water` pins the initial-connect path (`None` watermark → full history + `last_created_at` set to newest). Five frontend unit tests in `frontend/src/pages/dashboard/session_view/websocket.rs::tests` pin the WS → WsEvent translation directly via a `Callback<WsEvent>` capture: `claude_output_with_created_at_emits_server_timestamp` (the round-trip + `_created_at` injection contract), `claude_output_without_created_at_emits_none_watermark` (pre-#784 backend keeps prior watermark), `history_batch_propagates_server_last_created_at`, `history_batch_without_last_created_at_emits_none` (empty/pre-#784 batches don't clobber), and `error_envelope_emits_none_watermark` (the non-DB live-message path that's the historical regression hot-spot). Wire-shape roundtrip + `wire_compat_pre_784_omits_created_at` tests added to `shared/src/endpoints.rs`. One existing `make_client_msg` test helper (`session_manager.rs`) and the existing `server_to_client_output_roundtrip` test in `shared/src/endpoints.rs` updated for the new `created_at` field.

## 2.5.80

- **History APIs: SQL-side pagination with default limit (closes #788).** Both history-read paths used to materialize the full session message list and let the frontend trim it locally: `backend/src/handlers/messages.rs::list_messages` ran `messages::table.filter(session_id = ?).order(created_at.asc()).load(...)` with no limit on every `GET /api/sessions/{id}/messages` call, and `backend/src/handlers/websocket/web_client_socket.rs::replay_history` did the same when `replay_after` was absent (initial WS connect / hard refresh). The frontend then dropped everything past `MAX_MESSAGES_PER_SESSION = 100` (in `frontend/src/pages/dashboard/types.rs`) by `drain(0..excess)`-ing from the front of the chronological vector — so for any session over the render window, every reload pushed `O(session_lifetime)` bytes over the wire just to discard most of them. Push the trim into SQL. The REST handler gains a typed `ListMessagesQuery { limit, before, after }` extractor with `limit` defaulting to `AppState.message_retention_count` (the same env-driven 100 that already governs DB retention), clamped to a hard `MAX_LIST_MESSAGES_LIMIT = 1000`; negative or zero limits and combined `before`+`after` cursors return `400 BAD_REQUEST` via `AppError::BadRequest`; both cursors accept the dual ISO-format the WS path already used (with a trailing-`Z` strip for the `js_sys::Date::to_iso_string()` shape the frontend emits). The default and `before` branches run `order(created_at.desc()).limit(N)` and `.reverse()` the result in memory so the wire shape stays chronological — the frontend's `WsEvent::HistoryBatch` arm and the REST `MessagesResponse` consumer both `extend()` into a chronological vector and trim from the front, so newest-first-on-the-wire would silently corrupt the order. The `after` branch keeps the natural `order(created_at.asc()).limit(N)` for forward-pagination. `replay_history` on the WS path takes the same `initial_replay_limit: i64` (threaded in from `AppState.message_retention_count` once at connection time) and applies the same `desc + limit + reverse` for the no-`replay_after` branch; the `replay_after` branch is unchanged (a reconnect/focus-regain caller needs the full delta to stay consistent — bounding it would silently drop messages). **Wire shape unchanged on both endpoints**: `MessagesListResponse` keeps `messages` + `total` (the `total` field is now the page length, not the session-wide row count, but the current frontend ignores it — older clients that key off it see a smaller-but-valid number rather than a stale unbounded count); `ServerToClient::HistoryBatch { messages: Vec<Value> }` keeps the same `messages` vector, just shorter. Frontend audit: `frontend/src/pages/dashboard/session_view/component.rs` already does the `drain(0..excess)` truncation against `MAX_MESSAGES_PER_SESSION = 100` on both `LoadHistory` (REST) and `WsEvent::HistoryBatch` (WS) paths, so a server-side trim to the same window is fully a no-op for the rendered output — no frontend changes needed. Coverage: 8 new pure unit tests in `messages.rs::tests` pin the ISO-cursor parser (fractional, second-precision, trailing-`Z`, garbage) plus the query-param defaults / full-form round-trip and the `MAX_LIST_MESSAGES_LIMIT` constant; 3 new DB-touching tests in `messages.rs::db_tests` exercise the actual query path with 250 seeded messages (default returns last 100 chronological, `before=stamps[30]&limit=10` returns rows 20..30, `after=stamps[20]&limit=10` returns rows 21..30); 1 new DB-touching test in `web_client_socket.rs::replay_tests` exercises the no-`replay_after` path (200 seeded messages → 100 returned, oldest-first). DB tests use the same auto-skip-on-no-`DATABASE_URL` harness pattern from `session_access.rs::db_tests` so CI without a database stays green.

## 2.5.79

- **File upload: byte-cap per chunk + duplicate-index rejection (closes #785).** Static review surfaced two real bugs in the chunked file-upload path on `backend/src/handlers/websocket/web_client_socket.rs::handle_file_upload_chunk` / `handle_file_upload_start`. **Bug 1: server-side budget bypass.** The old `MAX_TOTAL_CHUNKS = 51_200` constant assumed 1 KB chunks (i.e. a 50 MB total budget), but the server never enforced any per-chunk *byte* size — `FileUploadChunk.data` is base64-encoded bytes on the wire, and the server forwarded each chunk to the proxy unchecked. A client sending 10 MB chunks against the chunk-count cap got `10 MB * 51_200 = 512 GB` of effective per-upload budget; with the `total_size: u64` declared field unchecked against the running total, the only real limit was the WS frame size. **Bug 2: duplicate-chunk early completion.** `received_count: u32` was incremented on *every* `FileUploadChunk` arrival, not on first arrival of a distinct `chunk_index` — so a client sending the same `chunk_index` `total_chunks` times tripped the `received_count >= total_chunks` completion branch, the upload was reported done, and the proxy received `total_chunks` copies of the same chunk with the other indices missing (garbage payload). Fix replaces `received_count: u32` with `received_indices: HashSet<u32>` and tracks `received_bytes: u64` alongside; chunk arrival now goes through a new pure `validate_and_record_chunk(upload, chunk_index, decoded_len) -> ChunkOutcome` step that returns `Ignore` for duplicate-index / out-of-range chunks (no counter bump, no forwarding), `Abort` with a static reason string for the byte-cap violations (drops the `PendingUpload` entry so subsequent chunks for the same `upload_id` are rejected as unknown), and `Accept` / `AcceptAndComplete` for the happy path — with `AcceptAndComplete` gated on `received_indices.len() == total_chunks` (unique-index completion, not arrival-count completion). New `MAX_CHUNK_BYTES = 64 * 1024` constant caps the decoded length of any single chunk; new `effective_max_total_bytes` field on `PendingUpload` is derived from `PORTAL_MAX_IMAGE_MB` at `Start` time and the binding cap on running decoded bytes is `min(total_size, effective_max_total_bytes)` — a smaller declared `total_size` doesn't let you exceed the server cap, and the server cap doesn't let you exceed an honestly-declared `total_size`. `Start` itself now rejects uploads where `total_size > effective_max_total_bytes` so over-large uploads die at handshake time instead of mid-stream, and base64 decode happens upfront on each chunk so a decode failure aborts the upload before the proxy sees garbage. `MAX_TOTAL_CHUNKS` is retained but raised to `65_536` (`MAX_TOTAL_CHUNKS * MAX_CHUNK_BYTES` is now ~3.2 GiB upper bound, but the byte caps are the binding limit so this constant is just a sanity guard against obviously-pathological `total_chunks` values). Wire shape unchanged. Five unit tests against the pure validator pin the validation rules (`duplicate_chunk_index_is_ignored_and_does_not_complete`, `out_of_range_chunk_index_is_ignored`, `per_chunk_byte_cap_aborts_upload`, `running_total_byte_cap_aborts_upload`, `distinct_chunks_in_any_order_complete_the_upload`, `declared_total_size_is_the_binding_cap_when_smaller_than_server_cap`); two async end-to-end tests against `handle_file_upload_chunk` with a real `SessionManager` assert (a) distinct chunks get forwarded and the pending entry clears on completion while duplicate-index chunks do NOT get forwarded, and (b) an oversize chunk aborts the upload, drops the pending entry, and is never forwarded to the proxy.

## 2.5.78

- **Image fetches require auth + ownership/membership check (closes #786).** Information-disclosure fix: `GET /api/images/{id}` was registered as an unauthenticated route (`backend/src/main.rs`) and `backend/src/handlers/images.rs::serve_image` only matched the path UUID, so the bytes were effectively world-readable to anyone the URL had ever leaked to — shared chat links, server-side logs, browser history, `Referer` headers. The route is now gated on the same `extract_user_id(&app_state, &cookies)` cookie-session helper every other authenticated handler in the router uses; no extractor / cookie ⇒ `401 UNAUTHORIZED`. `StoredImage` (the bounded LRU value added by #787) gained two new fields — `user_id: Uuid` (the inserting user, mandatory) and `session_id: Option<Uuid>` (the session the image was extracted from, when known). On a fetch, the handler short-circuits to `200 OK` if `entry.user_id == current_user_id`; otherwise it falls back to a `session_members` membership probe for `entry.session_id` (mirroring `messages.rs::verify_session_access`, so shared-session collaborators still see images posted by their teammates) and returns `404 NOT_FOUND` on any deny — same wire shape as a true miss, so the response can't be used as an existence oracle on guessed UUIDs. `Cache-Control` flipped from `public` to `private` so a shared cache between us and the browser doesn't fan a per-user payload out to other clients. Insert callsites updated: `backend/src/handlers/websocket/message_handlers.rs::extract_portal_images` (the base64-extraction path in `handle_claude_output`) now does an early `sessions::table.find(sid).select(user_id)` lookup and threads `(user_id, Some(session_id))` into `store_base64`; if the lookup fails the extraction is *skipped* entirely so nothing un-owned can ever land in the cache. `backend/src/handlers/websocket/image_upload_socket.rs` changed `authorize_upload` to return `Option<Uuid>` so the resolved `user_id` from the proxy token is captured at `Start` time and threaded into `start_upload` alongside the `session_id` already on the frame; on `Complete` the finalized entry inherits both fields. **Wire-compat caveat:** images that were inserted by an older backend (before this PR landed) have no `user_id` attached and would always 404 — but the bounded LRU from #787 means only live entries from the current process are reachable in the first place, so older message images that get re-fetched naturally 404 today regardless. Net effect: a re-fetched image from a long-dead session may 404 instead of returning bytes; acceptable since the alternative was leaking those bytes to unauthenticated callers. Four new unit tests in `backend/src/handlers/images.rs` cover the field round-trip on both insert paths (`stored_image_carries_owner_user_id`, `finalize_upload_carries_owner_and_session`) and the existing eviction/TTL/base64 tests are updated to pass the new args. End-to-end DB-backed coverage for the handler-level access matrix (owner / non-owner / session-member / no-cookie) requires the same Postgres test harness #780 noted as missing; the handler logic is intentionally kept to one ownership compare + one `EXISTS` query so it stays reviewable until that harness lands.

## 2.5.77

- **Privilege-escalation fix: enforce editor/owner role on session-mutating actions (closes #781).** Static review surfaced that `verify_session_access` in both `backend/src/handlers/messages.rs` and `backend/src/handlers/websocket/auth.rs` accepted *any* `session_members` row regardless of role, and the downstream mutating call sites (`handle_web_input` / `handle_permission_response` / `Interrupt` / file-upload start+chunk in `web_client_socket.rs`, plus `stop_session` and `create_message` over REST) never re-checked the role — so a viewer-role member could send `ClaudeInput`, approve permission prompts, interrupt the in-flight turn, stream a file upload, POST `/api/sessions/{id}/messages`, or POST `/api/sessions/{id}/stop` against a session they were only supposed to read. New `backend/src/handlers/session_access.rs` module centralizes the layered rules: `can_mutate_role(role: &str) -> bool` is the pure role-string predicate (true for `"owner"` or `"editor"`, false for `"viewer"` and unknown roles, including the case-sensitivity check); `verify_session_mutator(conn, session_id, user_id) -> Result<Session, AppError>` is the REST-side check that returns the typed session row or `AppError::NotFound` (matches the existing handler error shape — we 404 rather than 403 to avoid leaking session existence to non-members); `is_session_mutator(app_state, session_id, user_id) -> bool` is the WebSocket-side check, re-queried on every mutating message so role revocations take effect immediately for already-connected viewers (rather than caching the role on the connection state and going stale). All three respect the owner-without-members-row invariant — `sessions.user_id == user_id` is checked first and short-circuits the membership join, so sessions that predate the `session_members` table or that lost their owner row for any reason continue to work. Gated sites: `messages.rs::create_message` (REST), `sessions.rs::stop_session` (REST), `sessions.rs::delete_session` (REST, now also accepts the owner-row fallback), `web_client_socket.rs::handle_web_input` (WS — sends a typed `ServerToClient::Error` back so the frontend can surface "permission denied"), `web_client_socket.rs` `FileUploadStart` / `FileUploadChunk` / `PermissionResponse` / `Interrupt` arms (WS — silently dropped with a warn-level log). Unit tests on `can_mutate_role` cover owner/editor/viewer plus the empty-string, unknown-role, and case-sensitivity branches.

## 2.5.76

- **Frontend WS sender: queued mpsc, eliminate drop-on-concurrent (closes #783).** `frontend/src/pages/dashboard/session_view/websocket.rs::send_message` previously wrapped the `ws_bridge` split sink in `Rc<RefCell<Option<Sender>>>` and ran a `take()` / `await sink.send()` / restore dance inside a per-call `spawn_local`. Two concurrent callers raced into the `take`-returned-`None` gap: caller B's `if let Some(_) = ...` arm silently fell through and the outgoing message was dropped without surfacing any error. The file-upload path in `component.rs` (`FilesSelected`) is the in-the-wild trigger — for every uploaded file it pushes a `FileUploadStart` envelope followed by a tight loop of base64-encoded `FileUploadChunk` envelopes through the same sender, with one of them additionally followed by a `ClaudeInput` summary frame; the original code could lose any of those chunks under realistic browser scheduling. The fix replaces the take/restore wrapper with the producer half of a `futures_channel::mpsc::unbounded::<ClientToServer>()`: `WsSender` becomes `UnboundedSender<ClientToServer>` (the public alias in `pages/dashboard/types.rs` changed, but is `Clone` like the prior `Rc` so all existing `Option<WsSender>::clone()` / `Some(ref sender)` call sites kept compiling unchanged); the `connect_websocket` task spawns one extra `spawn_local` that owns the underlying `ws_bridge` sink and pulls from the receiver in a loop, `await`ing each `sink.send()` to completion before pulling the next item. `send_message(&WsSender, ClientToServer)` collapses to a one-line `let _ = sender.unbounded_send(msg);` — synchronous, non-async, no `borrow_mut`, no drop window. Three new unit tests pin the queue semantics directly against `try_next()` (no executor required): `send_message_enqueues_all_messages_in_order` pushes 64 messages and asserts in-order receipt, `send_message_is_synchronous_push` asserts immediate visibility without an executor spin, and `concurrent_pushes_from_clones_lose_nothing` interleaves 100 pushes across two cloned `UnboundedSender`s and asserts zero loss — the exact pattern that broke under the old implementation.

## 2.5.75

- **Launcher registration: atomic duplicate check (closes #790).** `backend/src/handlers/websocket/launcher_socket.rs::handle_launcher_socket` previously did a check-then-insert pair across separate `SessionManager::find_duplicate_launcher(&hostname, user_id)` and `SessionManager::register_launcher(launcher_id, conn)` calls, with arbitrary `.await` points (the `LauncherRegisterAck` send) between them. Two simultaneous connections from the same `(user_id, hostname)` could both pass the duplicate check and both insert into the `launchers` `DashMap` (keyed by `launcher_id`), leaving the user double-registered and confusing downstream consumers (`get_launchers_for_user`, `stop_session_on_launcher`, the launcher list page). Fixed by introducing a private `launcher_dedup: Arc<DashMap<(Uuid, String), Uuid>>` index alongside the existing `launchers` map and replacing the racy pair with a single `try_register_launcher(launcher_id, connection) -> Result<(), String>` method: it `entry((user_id, hostname)).or_insert(launcher_id)` so the check-and-claim happens under one `DashMap` shard lock, returns `Err(existing_launcher_name)` if the slot was already claimed, and only mutates `launchers` after winning the reservation. `unregister_launcher` now does a paired `remove_if` on the dedup index, gated on the slot still pointing at us, so a newer same-(user, host) registration's reservation can't be evicted by a stale teardown. The max-launchers-per-user cap is intentionally left unchanged (it's a separate, less-impactful race outside this issue's scope). New regression test `concurrent_registrations_dedupe_to_single_entry` spawns 10 `tokio::spawn` tasks all trying to register the same `(user_id, hostname)` and asserts exactly one succeeds + the `launchers` map ends with exactly one entry; two further unit tests cover the serial duplicate-rejection path and the unregister-releases-slot invariant.

## 2.5.74

- **Bounded `ImageStore` with TTL + byte-cap LRU eviction (closes #787).** `backend/src/handlers/images.rs` was holding every uploaded / inlined image in a process-wide `Arc<DashMap<Uuid, StoredImage>>` with no eviction path. On long sessions with image-heavy output (Claude inlining base64 PNGs over the WebSocket, or proxies streaming chunked uploads via `/ws/session/upload`) the map grew without bound and would eventually OOM the backend. The store is now a `mini_moka::sync::Cache<Uuid, Arc<StoredImage>>` configured with a weigher that returns each entry's byte length so `max_capacity` is interpreted as a total-bytes budget, plus a `time_to_live` so un-fetched entries age out automatically; over the cap, the least-recently-used image is evicted first. Values are wrapped in `Arc` because `Cache::get` returns by clone — without the indirection every fetch would copy the raw image bytes. The chunked-upload accumulator (`pending: Arc<DashMap<Uuid, PendingUpload>>`) is unchanged; only the served-images map is bounded (in-flight uploads have their own per-message size cap via `PORTAL_MAX_IMAGE_MB`). Two new env vars plumb the caps through `AppState`: `PORTAL_IMAGE_STORE_MAX_MB` (total served-cache bytes, default **256**) and `PORTAL_IMAGE_STORE_TTL_SECS` (per-entry TTL, default **3600** = 1 h). Defaults live as `pub const`s on the `images` module so `main.rs` can fall back symbolically. Three new unit tests cover (a) inserting beyond the byte cap evicts entries so the surviving set fits under the cap, (b) entries fetched past the TTL return `None`, and (c) the base64 roundtrip path still works end-to-end; the eviction test uses `Cache::run_pending_tasks` to flush the asynchronous maintenance task synchronously. URL auth on `/api/images/{id}` is **not** changed by this PR — that's the separate issue #786 and a separate PR (they'd conflict on imports in the serve handler if combined).

## 2.5.73

- **Real auth-bypass fix: require `auth_token` validation on existing-session proxy reattach (closes #780).** Static review caught that `backend/src/handlers/websocket/registration.rs::register_or_update_session` reactivated *any* row matched by `params.claude_session_id` without verifying ownership — the existing-session branch only did the `verify_and_get_user` token resolution for the *new-session* path inside `create_new_session`, so a client that knew or guessed another session's UUID could attach as that proxy via `ProxyToServer::Register`, then read user input flowing into the session, forge `ClaudeOutput` / `SequencedOutput`, persist messages under the victim's `user_id`, and even mark unrelated sessions as `replaced` via the `replaces_session_id` path. Compounding the bug, `backend/src/handlers/websocket/proxy_socket.rs::handle_proxy_message` called `session_manager.register_session(key, tx)` *before* calling `register_or_update_session`, wiring the attacker's WebSocket into `SessionManager.sessions` (the routing table used by `send_to_session` for `SequencedInput`) prior to any DB check — so even with the auth check in place, a colliding-UUID attacker could briefly receive input messages destined for the legitimate proxy and the disconnect-cleanup path could clobber the legitimate registration's connection generation. Fix lands in three pieces:
  - **Token validation on every branch.** `register_or_update_session` now resolves `auth_token` → `user_id` (via the existing `proxy_tokens::verify_and_get_user`, with the same dev-mode `testing@testing.local` fallback the new-session path used) *before* either branch runs. A new `user_is_authorized_for_session(conn, session_id, user_id)` helper checks both the `sessions.user_id` owner column and the `session_members` sharing table (since historical owner rows aren't always mirrored into `session_members`), and the existing-session branch gates the reactivation update on that check. The `replaces_session_id` path is gated on the same check — without it, a valid-token user could mark *any* session as `replaced` purely by attaching `replaces_session_id` to their own registration. On authorization failure the response shape is identical to the not-found case (`SESSION_NOT_FOUND_ERROR = "Session not found or not authorized"`) so a UUID-guess probe can't distinguish "row doesn't exist" from "row exists but you don't own it", avoiding a session-ID oracle.
  - **Defer socket registration until after DB auth.** `handle_proxy_message`'s `Register` arm no longer calls `session_manager.register_session` up front; it only registers (and binds `session_key` / `connection_gen` / `db_session_id` for the cleanup path) on `result.success`. The send-side `tx` channel is unaffected by this reordering, so the `RegisterAck { success: false }` still flushes to the failing client through the same `send_task` that handles success-path replies.
  - **Clean close on auth failure.** `handle_proxy_message` now returns `ControlFlow<()>`; the `Register` arm returns `ControlFlow::Break(())` on failure, and the WS loop breaks out so no further `ProxyToServer` messages are accepted on a session that never authenticated. The cleanup path then `drop`s the owned `tx` handle and `await`s the `send_task` to natural completion, ensuring the failure `RegisterAck` flushes to the wire before the WebSocket closes (previously `send_task.abort()` could race the ack — fine for the success path because proxies keep the connection alive, race-prone for the immediate-close path this PR adds).
  - Two unit tests in `mod tests` of `registration.rs` pin the externally-observable contract: `unauthorized_reattach_error_shape_matches_not_found` asserts the unauthorized-reattach error is the same `SESSION_NOT_FOUND_ERROR` constant the not-found path returns (so the oracle stays closed even if a future refactor parametrizes either branch's error message), and `session_not_found_error_does_not_leak_existence` asserts the string contains none of `"token"`, `"forbid"`, `"auth"` to keep any well-meaning future edit from accidentally re-exposing existence info. End-to-end DB-backed coverage for the wrong-token / right-token reattach cases would require a Postgres test harness that doesn't yet exist in this crate; the helper extraction (`user_is_authorized_for_session`) keeps the authorization logic small and reviewable for the next person who adds that harness.

## 2.5.70

- **PR 4/4 of #758: group-level time-ago footer.** Closes the message-grouping roadmap. The three group renderers added by PR 2 (`render_portal_group`) and PR 3 (`render_user_group`, `render_codex_group`) now mirror the assistant-group treatment from PR 1: pull the **last** message's `_created_at` ISO via `extract_raw_iso(messages.last())` and render a `.message-footer` containing a live-updating `<TimeAgo iso={iso} />`. The existing `.claude-message .message-footer { justify-content: flex-end; }` puts the chip in the bottom-right corner exactly as the roadmap spec called for. Mechanical three-line change per renderer, gated on `if let Some(iso)` so pre-`_created_at` messages still render cleanly. All 19 `message_renderer` unit tests continue to pass — no new tests because the change is presence-only and the underlying `TimeAgo` component already has its own coverage.

## 2.5.69

- **PR 3/4 of #758: User + Codex grouping with explicit predicate ordering.** Extends the categorized `MessageGroup` from PR 1 and the Portal grouping from PR 2 with two new `GroupCategory` variants:
  - **`User`** (key prefix `"u"`, Tokyo Night orange `#e0af68` accent) collapses consecutive plain-text human prompts into a single `You × N` card. New `is_plain_text_user` predicate accepts either `UserMessage.content: Some(String)` (optimistic-send envelope) or `UserMessage.message.content: Some([Text { .. }, …])` (Claude echo shape) — and *only* if every nested block is `Text`. That all-Text guard is critical: a tool-result envelope is also user-shaped, but it belongs with the surrounding assistant turn. New `tool_result_user_envelope_stays_in_assistant_group` test pins that ordering invariant so a future predicate reshuffle can't silently re-route Read tool-results into User.
  - **`Codex`** (key prefix `"x"`, Tokyo Night purple `#bb9af7` accent) collapses consecutive `CodexEvent` events of any non-`Unknown` variant. The new `is_codex_event` predicate parses the wire JSON via `crate::components::codex_renderer::CodexEvent` and returns true on any successfully-recognized variant — silent streaming deltas (`PlanDelta`, `ReasoningTextDelta`, etc.) still get grouped semantically; they just render to empty cells inside the wrapper.
  - **Predicate ordering** in `classify` is now Assistant → Portal → User → Codex, with a `**Predicate ordering matters**` docblock that names *why* each rung sits where it does. Assistant runs first because user-shaped tool-result envelopes are user-typed but belong with the assistant turn; Portal next because portal frames have their own shape; User after Assistant has already claimed the tool-result envelopes; Codex last because its events are dispatched through a different enum.
  - New `render_user_group` and `render_codex_group` in `renderers.rs` mirror the PR 2 `render_portal_group` shape: one `.message-group.user-group` / `.message-group.codex-group` wrapper with a single badge + count header, with per-message rendering delegated back to `render_user_message` / `CodexMessageRenderer`. New CSS in `frontend/styles/messages.css` adds the accent borders, faint tinted backgrounds, and the same chrome-stripping overrides on nested `.user-message` / `.claude-message` so each run reads as a single visual unit — stylelint clean.
  - 7 new unit tests in `mod tests`: `plain_text_user_classifies_into_user_group`, `tool_result_user_envelope_stays_in_assistant_group` (predicate-ordering regression target), `serial_user_text_collapses_into_user_group`, `user_run_breaks_on_intervening_assistant`, `codex_event_classifies_into_codex_group`, `serial_codex_events_collapse_into_codex_group`, `codex_run_breaks_on_intervening_portal` (mixed-stream split coverage). 19 tests pass in `message_renderer` now (12 prior + 7 new). Full workspace clippy clean.

## 2.5.68

- **PR 2/4 of #758: portal-message grouping + UTC disconnect/reconnect stamps (closes #711).** Two pieces ship together:
  - **Portal grouping.** `GroupCategory` gains a `Portal` variant (key prefix `"p"`); `classify(json)` returns `Some(GroupCategory::Portal)` for any `ClaudeMessage::Portal(_)` after the Assistant check (so an assistant turn between portal frames correctly breaks the run). `MessageGroupRenderer` dispatches the `Portal` arm to a new `renderers::render_portal_group(messages, ts)`, which renders a single `claude-message message-group portal-group` block with one `Portal × N` header and a vertical body of trimmed per-message `render_portal_message(_, None)` cards. Two new tests in `mod tests` cover the happy path (`serial_portal_messages_collapse_into_one_group`) and the break case (`portal_run_breaks_on_intervening_assistant`). CSS in `frontend/styles/messages.css` adds `.portal-group` (teal `#7dcfff` left border + faint teal bg), `.portal-group-body` (column flex, small gap), and `.portal-group-body .portal-message` overrides (strip per-card border / bg / margin so the group looks unified) — stylelint clean.
  - **UTC disconnect/reconnect stamps.** `SessionState` in `claude-session-lib/src/proxy_session/mod.rs` gains a `disconnected_at_utc: Option<chrono::DateTime<chrono::Utc>>` field paired with the existing monotonic `disconnected_at: Option<Instant>` — captured at the same instant in both `ConnectionResult::Disconnected` and `ConnectionResult::ServerShutdown` arms, and cleared together on the successful-reconnect path. The reconnect portal text now appends two indented UTC lines below the existing "**Proxy reconnected** after Xm Ys (reason)" header: `disconnected at YYYY-MM-DDTHH:MM:SSZ (UTC)` and `reconnected at YYYY-MM-DDTHH:MM:SSZ (UTC)`. The wall-clock stamps make it possible to align reconnect events against external logs (server crashes, networking blips) instead of only knowing relative durations — particularly useful when reconnect runs span multiple events and the user is reading them after the fact in the grouped view from this PR's first piece.

## 2.5.67

- **Typed-dispatch `is_codex_terminal_event` in `frontend/src/components/codex_renderer.rs` (closes #757).** Follow-up to #737 (typed codex delta renderers) and #730 (typed codex dispatch). The terminal-event probe used to parse the wire line into a `serde_json::Value`, poke `val.get("type")?.as_str()?`, and string-match against `"turn.completed"` / `"turn.failed"` / `"item.started"` / etc. Now it deserializes into the typed `CodexEvent` enum (defined in the same file since #737) and `matches!` on the terminal variants directly: `TurnCompleted` / `TurnFailed` → `Some(true)`; `ItemStarted` / `ItemUpdated` / `ItemCompleted` / `TurnStarted` / `ThreadStarted` → `Some(false)`; everything else (`Error`, the six streaming-delta variants, and the `#[serde(other)] Unknown` catch-all) → `None`, preserving prior behavior bytewise. Eliminates the last stringly-typed dispatch in the codex frontend path — per CLAUDE.md's typed-interfaces rule, the next codex SDK rename here is now a compile error instead of a silent `Some(false)`/`None` regression. Existing unit tests (`terminal_event_turn_completed`, `terminal_event_turn_failed`, `terminal_event_item_completed_is_not_terminal`, `terminal_event_unknown_returns_none`) cover the round trip and continue to pass unchanged.

## 2.5.66

- **Typed `ResultMessage.modelUsage` map in the result-message renderer (closes #756).** `frontend/src/components/message_renderer/renderers.rs:1284-1293` used to `model_usage.as_object()`-iterate a `serde_json::Value` and re-poke each entry's `costUSD` via `.as_f64()`; the local `frontend::message_renderer::types::ResultMessage::model_usage` field was also typed as `Option<Value>` and (latently broken) lacked a `#[serde(rename = "modelUsage")]`, so the wire camelCase key the upstream `claude-codes::ResultMessage` re-serializes was silently never matched. Now `shared::api::ModelUsageEntry` (camelCase-renamed `#[derive(Serialize, Deserialize)]` with `inputTokens` / `outputTokens` / `cacheReadInputTokens` / `cacheCreationInputTokens` / `costUSD` / `webSearchRequests`, all `#[serde(default)]`) and `shared::api::ModelUsage` (a `BTreeMap<String, ModelUsageEntry>` alias) carry the typed shape, the local `ResultMessage::model_usage` is `Option<ModelUsage>` with the `modelUsage` rename, and the renderer iterates the typed map directly (`entry.cost_usd`). New roundtrip tests in `shared/src/api.rs` cover the per-entry and full-map wire shapes lifted from claude-codes' own `test_result_with_new_fields`. The typed mirror lives in `shared` rather than upstream because `claude-codes::ResultMessage.model_usage` is still `Option<serde_json::Value>` in 2.1.141; SDK issue [meawoppl/rust-code-agent-sdks#140](https://github.com/meawoppl/rust-code-agent-sdks/issues/140) tracks the typed adoption upstream, and the local alias is tagged `TODO(SDK #140)` so it's trivial to rip out once that lands.

## 2.5.65

- **Typed `ContentBlock` dispatch in `render_structured_block` (closes #755).** `frontend/src/components/message_renderer/renderers.rs::render_structured_block` previously took `&serde_json::Value` and poked `block.get("type").as_str()` then `block.get("text").as_str()` to dispatch text/image — same JSON-poking footgun the #729 (shim) and #733 (session_view) refactors removed: any next SDK rename silently breaks the renderer with no compile error. The function now takes `&shared::ContentBlock` (re-exported from `claude_codes::io::ContentBlock`, already present in `shared::lib.rs`) and dispatches via `match` on typed variants — `Text(t) => ExpandableText { t.text }`, `Image(_) => "[image]" pill`, and a typed catch-all that pretty-prints the variant's serialized form for any other block type. The caller in `render_content_blocks` (the `ToolResultContent::Structured(blocks)` arm) deserializes each `serde_json::Value` from the SDK's `Vec<Value>` into `shared::ContentBlock` at the boundary via `serde_json::from_value`, with a JSON pretty-print fallback if the wire shape isn't recognized — preserves prior behavior for unknown/malformed blocks while making the text/image render paths compile-time-checked against the SDK shape. `ToolResultContent::Structured` upstream is still typed as `Vec<Value>` in `claude-codes` 2.1.141, so the boundary parse is the closest typed shape available without an upstream change.

## 2.5.64

- **Typed `Citation` struct for content-block citations (closes #754).** `frontend/src/components/message_renderer/renderers.rs::render_citations` was iterating a `Vec<serde_json::Value>` and per-entry JSON-poking `cite.get("url")`, `cite.get("title")`, and `cite.get("cited_text")` — the last typed-interface gap left on the assistant text-block render path. The `citations` field on `ContentBlock::Text` in `frontend/src/components/message_renderer/types.rs` is now `Vec<shared::Citation>`, a new `#[derive(Serialize, Deserialize)] struct Citation { url, title, cited_text }` in `shared::api` with all-optional `#[serde(default)]` fields. `claude-codes` 2.1.141 also stores citations as `Vec<serde_json::Value>` on `TextBlock` (`src/io/content_blocks.rs:168`), so the local definition stays for now and SDK issue [meawoppl/rust-code-agent-sdks#142](https://github.com/meawoppl/rust-code-agent-sdks/issues/142) has been filed proposing the typed shape upstream — once it lands we can drop `shared::Citation` and re-export from `claude-codes` per the typed-interfaces rule. Wire shape is unchanged: unknown fields like `type: "web_search_result_location"` are silently dropped (regression-tested), older messages that omit `citations` entirely keep parsing via `#[serde(default)]`, and empty citations still serialize to nothing via `skip_serializing_if = "Option::is_none"`. The renderer's URL/title fallback logic (`title → cited_text → "source"`, `url → "#"`) is preserved exactly. Unit tests cover the full round-trip, the unknown-field-ignored path, and the empty-frame default.

## 2.5.63

- **Fix #758 (PR 1/4): Categorized `MessageGroup` + Assistant grouping bug fix.** Two things landed together:
  - Refactored `MessageGroup` from the binary `Single | AssistantGroup(Vec)` shape into `Single | Grouped { category: GroupCategory, messages }` with a single `classify(&str) -> Option<GroupCategory>` entry point that decides which run a message belongs to. `GroupCategory` is `Assistant`-only in this PR; `Portal` / `User` / `Codex` come in subsequent roadmap PRs without further enum churn. `group_messages` is one pass; categories accumulate as long as `classify` returns the same variant. `Single` stays a distinct variant so the common one-message case avoids the group-wrapper render path and keeps its Yew key stable independent of category.
  - Fixed the long-standing "serial Read tool uses don't roll into one block on Claude" regression. The previous `should_group_with_assistant` predicate bailed early on `msg.content.is_some()` — but the top-level `content` field is the optimistic-send envelope shape and can leak onto real Claude echoes through the cross-process wire wrapping (the exact production path that did this isn't pinned, but the regression test reproduces). The predicate now looks only at the **nested** `message.content` blocks; the stale top-level field is ignored.
  - Four new unit tests in `frontend/src/components/message_renderer/mod.rs::tests` cover (a) canonical user-tool-result grouping, (b) serial Read tool uses collapsing into one group, (c) the fragile `content` early-bail (regression target), and (d) plain-text user messages staying ungrouped.

## 2.5.62

- **Typed `ephemeral_1h` / `ephemeral_5m` cache-creation token fields in the frontend message renderer (closes #753).** `frontend/src/components/message_renderer/renderers.rs::extract_ephemeral_cache` previously read `usage.cache_creation: Option<serde_json::Value>` and JSON-poked `.get("ephemeral_1h_input_tokens").and_then(|v| v.as_u64())` / `.get("ephemeral_5m_input_tokens").and_then(|v| v.as_u64())` — silent regression bait the next time the SDK renames a field. The `claude-codes` SDK already exposes a typed `CacheCreationDetails` struct with `ephemeral_1h_input_tokens: u32` and `ephemeral_5m_input_tokens: u32` (no upstream change needed). Now: `shared::lib.rs` re-exports `CacheCreationDetails` from `claude_codes`, the local lenient `UsageInfo` in `frontend/src/components/message_renderer/types.rs` types `cache_creation` as `Option<CacheCreationDetails>` instead of `Option<serde_json::Value>`, and `extract_ephemeral_cache` reads the typed `u32` fields directly (widening to `u64` for the tooltip arithmetic). No wire-shape change — the JSON field names and types are bytewise identical to what the prior `serde_json::Value` parse accepted.

## 2.5.61

- **Typed dispatch for `SystemMessage.extra` per subtype (closes #752).** Continues the typed-interface push from #722 / #723 / #724 / #735 / #736 / #743. The three system-message renderers in `frontend/src/components/message_renderer/renderers.rs` (`render_init_bar`, `render_compaction_completed`, `render_task_notification`) used to JSON-poke `msg.extra.as_ref().and_then(|v| v.get("fast_mode_state").as_str())` / `v.get("summary")` / `v.get("status")` / `v.get("usage")` etc. — silent regression bait if the wire renames a field, exactly the pattern PR #743's `CodexPermissionInput` envelope retired on the codex side. Each renderer now `serde_json::from_value::<T>(extra.clone())` into a typed struct once per branch and reads named fields off it. The init bar uses a new `shared::InitExtra { fast_mode_state }` (mirroring the SDK's already-typed `InitMessage::fast_mode_state`); the task notification uses a new `shared::TaskNotificationExtra { status, task_id, usage }` (a narrow mirror of `claude_codes::TaskNotificationMessage`'s renderable subset — the SDK type's required `session_id` / `summary` are already consumed by the lenient `SystemMessage`'s typed top-level fields and never appear in the flattened `extra`); the compaction renderer uses a new `shared::CompactionExtra { summary, leaf_message_count, message_count, duration_ms, content, text }` with helper methods `summary_text()` and `message_count()` that mirror the historical `summary` → `content` → `text` and `leaf_message_count` → `message_count` fallback chains. The compaction extra is necessary because `claude_codes::CompactBoundaryMessage` only exposes `compact_metadata { pre_tokens, trigger }` and not the per-compaction summary stats the UI surfaces — filed upstream as [`rust-code-agent-sdks#141`](https://github.com/meawoppl/rust-code-agent-sdks/issues/141) with a `TODO(SDK rust-code-agent-sdks#141)` marker on `CompactionExtra` so the local mirror can be deleted (and the renderer switched to `CCSystemMessage::as_compact_boundary()`) when upstream lands. **Wire shape is unchanged bytewise** — `extra` stays a `#[serde(flatten)] Option<serde_json::Value>` on the lenient `SystemMessage`, the new typed structs are deserialize-only views over the same bytes, and `#[serde(default)]` on every field of every mirror means any frame that omits them still parses (yielding `None`).

## 2.5.60

- **Typed `ToolInput::ExitPlanMode` access in `frontend/src/components/tool_renderers/interactive.rs` (closes #751).** Renderer-side parity to #740's permission-dialog refactor. `render_exitplanmode_tool` was reading `input.get("allowedPrompts").and_then(|v| v.as_array())` and then per-entry `.get("tool").as_str()` / `.get("prompt").as_str()` — the same silent-regression bait #740 fixed on the permission-card side. Replaced with `serde_json::from_value::<ToolInput>(input.clone())` matching `ToolInput::ExitPlanMode(epm)` and reading `epm.allowed_prompts: Option<Vec<AllowedPrompt>>` typed; iteration uses typed `p.tool` / `p.prompt` directly. `AllowedPrompt`, `ToolInput`, and `ExitPlanModeInput` are already re-exported from `shared` (landed in #740) — no shared/upstream changes needed. Render layout, CSS classes, and the empty-list fallback are unchanged. The sibling `render_askuserquestion_tool` JSON-poke is tracked separately in #750.

## 2.5.59

- **Typed `ToolInput::AskUserQuestion` dispatch in the AskUserQuestion renderer (closes #750).** `frontend/src/components/tool_renderers/interactive.rs::render_askuserquestion_tool` no longer pokes `input.get("questions").as_array()` and per-entry `.get("header") / .get("question") / .get("multiSelect") / .get("options") / .get("label") / .get("description")` on raw `serde_json::Value`. It now deserializes the renderer's `Value` into `claude_codes::tool_inputs::ToolInput`, matches `ToolInput::AskUserQuestion(AskUserQuestionInput)`, and reads typed `questions: Vec<Question>` with typed `header: String`, `question: String`, `multi_select: bool`, and `options: Vec<QuestionOption>` (label + optional description). The `answers: Option<HashMap<String, String>>` lookup is also typed now — no more `.as_object()` / `.as_str()` JSON peeking. Same icons, CSS classes, multi-select badge, comma-split answer-matching, and empty-list fallback on deserialization failure. `shared` re-exports `AskUserQuestionInput`, `Question`, and `QuestionOption` from `claude_codes::tool_inputs` so the frontend stays free of a direct `claude-codes` dep. The ExitPlanMode branch in the same file is unchanged — that one is tracked by #751.

## 2.5.58

- **`render_task_tool` uses typed `ToolInput::Task` instead of JSON-poking (closes #749).** Follow-up to 2.5.48 (#735) / 2.5.49 (#736): the Task subagent renderer in `frontend/src/components/tool_renderers/task.rs` was the third claude-side renderer still reading `input.get("description") / input.get("subagent_type") / input.get("run_in_background")` against `serde_json::Value`. It now deserializes its `serde_json::Value` input into `claude_codes::tool_inputs::ToolInput`, matches `ToolInput::Task(TaskInput)`, and reads the typed `description: String`, `subagent_type: SubagentType` (via `.as_str()`, which handles `Unknown(_)` for forward-compat), and `run_in_background: Option<bool>` fields directly. Same icon, same CSS classes, same `"?"` / `"agent"` / `false` fallbacks when deserialization fails — just no more silent-null bait the next time the SDK renames a field. `shared` now re-exports `TaskInput` alongside the existing `TodoItem` / `TodoStatus` / `TodoWriteInput` / `ToolInput` re-exports.

## 2.5.57

- **`render_webfetch_tool` / `render_websearch_tool` use typed `ToolInput::WebFetch` / `ToolInput::WebSearch` instead of JSON-poking (closes #748).** Both renderers in `frontend/src/components/tool_renderers/search.rs` now deserialize their `serde_json::Value` input into `claude_codes::tool_inputs::ToolInput`, match the relevant variant, and read typed `WebFetchInput { url: String, prompt: String }` / `WebSearchInput { query: String, … }` fields directly — no more `input.get("url")` / `input.get("prompt")` / `input.get("query")`. Same icons, same CSS classes, same `?` fallback when deserialization fails. `shared` now re-exports `WebFetchInput` and `WebSearchInput` so the frontend can use them without a direct `claude-codes` dep. The Glob/Grep portions of the same file remain JSON-poked under #747.

## 2.5.56

- **Typed `ToolInput::Glob` / `ToolInput::Grep` dispatch in `frontend/src/components/tool_renderers/search.rs` (closes #747).** `render_glob_tool` and `render_grep_tool` previously pulled fields out of their `serde_json::Value` input by string name: `input.get("pattern")`, `input.get("path")`, `input.get("glob")`, `input.get("type")`, and the suspicious `input.get("-i")`. Both renderers now deserialize the value into `claude_codes::tool_inputs::ToolInput` once and match the appropriate variant (`ToolInput::Glob(GlobInput)` / `ToolInput::Grep(GrepInput)`), reading typed fields directly — `pattern: String`, `path: Option<String>`, `glob: Option<String>`, `file_type: Option<String>` (the SDK already handles the `#[serde(rename = "type")]`), and `case_insensitive: Option<bool>` (the SDK already handles the `#[serde(rename = "-i")]`, so what looked like a JSON-poke smell on the consumer side turned out to be fully typed upstream — no SDK gap). Same icons, same CSS classes, same `"?"` fallback when deserialization fails or the variant doesn't match; just no more string-name field probing. `shared::lib` now re-exports `GlobInput` and `GrepInput` alongside the existing `ToolInput` / `TodoWriteInput` / `TodoItem` / `TodoStatus` re-exports so the frontend doesn't need a direct `claude-codes` dependency. The WebFetch and WebSearch renderers in the same file remain untouched — they're tracked separately in #748.

## 2.5.55

- **Typed `ToolInput::Read` dispatch in `render_read_tool` (closes #746).** The Read tool renderer in `frontend/src/components/tool_renderers/mod.rs` was poking `input.get("file_path").as_str()` / `input.get("offset").as_i64()` / `input.get("limit").as_i64()` against `serde_json::Value`. Replaced with `serde_json::from_value::<ToolInput>(input.clone())` matching `ToolInput::Read(ReadInput { file_path, offset, limit })`, then reading typed fields (`String` and `Option<i64>`) directly. `shared` now re-exports `ReadInput` so the renderer doesn't take a direct `claude-codes` dep. Range-info formatting, CSS classes, the `"?"` fallback path, and the icon are unchanged.

## 2.5.54

- **`render_edit_tool` / `render_write_tool` use typed `ToolInput::Edit` / `ToolInput::Write` instead of JSON-poking (closes #745).** Follows #735 (TodoWrite) and #736 (ExitPlanMode). The two renderers in `frontend/src/components/tool_renderers/edit.rs` previously did `input.get("file_path").and_then(|v| v.as_str()).unwrap_or("unknown file")` / `get("old_string")` / `get("new_string")` / `get("replace_all").as_bool()` / `get("content").as_str()` against the raw `serde_json::Value` envelope — same silent-regression bait the prior typed-dispatch PRs killed elsewhere (next wire rename returns `None`, the renderer silently displays defaults). Both functions now `serde_json::from_value::<ToolInput>(input.clone())`, match `ToolInput::Edit(EditInput)` / `ToolInput::Write(WriteInput)`, and read typed `file_path: String`, `old_string: String`, `new_string: String`, `replace_all: Option<bool>` (Edit) and `file_path: String`, `content: String` (Write). Same icons, CSS classes, layout, and the same "unknown file" / empty-content fallback when the input doesn't deserialize as the expected variant (preserves behavior for malformed in-flight frames). `shared` now also re-exports `EditInput` and `WriteInput` so the frontend uses them without taking a direct `claude-codes` dependency, matching the `TodoItem` / `TodoStatus` re-export pattern from #735.

## 2.5.53

- **`render_bash_tool` uses typed `ToolInput::Bash` dispatch instead of JSON-poking (closes #744).** The frontend Bash tool renderer in `frontend/src/components/tool_renderers/bash.rs` was reading `input.get("command")`, `input.get("description")`, `input.get("timeout")`, and `input.get("run_in_background")` against a raw `serde_json::Value` — silent-regression bait if `claude-codes` renames a field. Now `render_bash_tool` deserializes its `serde_json::Value` into `claude_codes::tool_inputs::ToolInput`, matches the `Bash(BashInput)` variant, and reads typed fields directly: `bash.command: String`, `bash.description: Option<String>`, `bash.timeout: Option<u64>`, `bash.run_in_background: Option<bool>`. Same rendered output, same CSS classes, same empty-command fallback when the wire shape doesn't deserialize. `shared` now re-exports `BashInput` alongside the existing `ToolInput` re-export so the frontend doesn't need a direct `claude-codes` dependency. Follows the same typed-dispatch pattern as `render_todowrite_tool` (#735, 2.5.48) and the ExitPlanMode permission dialog (#736, 2.5.49).
## 2.5.52

- **Shared typed `CodexPermissionInput` envelope (closes #725 and #731).** Builds on 2.5.45's typed-dispatch refactor (#723 / #730) by typing the *other* half of the wire boundary: the `IoEvent::CodexPermissionRequest.input` IPC payload that the codex app-server bridge in `codex-session-lib/src/handler.rs` sends and the frontend's `format_permission_input` in `frontend/src/pages/dashboard/types.rs` consumes. Before 2.5.45 both ends JSON-poked the same field names from opposite sides of the wire; 2.5.45 typed the proxy *read* (typed-match on `ServerRequest::*Approval(p)`) but the cross-process *write* still serialized into a stringly-typed `serde_json::Value` blob via `serde_json::json!({...})`, and the frontend's consumer still picked it apart with `input.get("itemId").and_then(|v| v.as_str())`. Now: `shared::CodexPermissionInput` is a `#[serde(tag = "tool", rename_all = "camelCase")]` enum with one variant per codex approval type (`FileChange`/`ApplyPatch`/`Bash`/`ExecCommand`/`Permissions`/`McpElicitation`/`AskUserQuestion`), `IoEvent::CodexPermissionRequest` drops the redundant `tool_name: String` field (the variant is now the discriminant — call `input.tool_name()` for the human-readable key the cross-agent `SessionEvent::PermissionRequest` envelope still carries because the claude path comes through it too), `handler.rs` constructs each variant directly from the SDK's typed param struct (so the proxy-emission half is now compile-time-checked against the SDK shape — `serde_json::json!({…})` literals are gone), and the frontend's `format_permission_input` round-trips the wire `Value` into the typed enum before dispatching on variants (with the historical JSON-poke arms retained for claude-side tool inputs, which use a different IPC envelope from `claude-codes::tool_inputs::ToolInput` and are out of scope here — see #735/#736). The wire envelope on `ProxyToServer::PermissionRequest` / `ServerToClient::PermissionRequest` stays `serde_json::Value` — both sides now use a typed serde-derived round trip through that wire, which preserves backward compat with in-flight frames from older proxies while making the next codex SDK shape change a compile error rather than a silent `null`. New unit tests in `shared/src/api.rs` cover the round-trip and the optional-fields-omitted case the 0.129.3 wire frames hit.

## 2.5.51

- **Typed HTTP response structs for `/api/auth/me`, `/api/sessions`, and `/api/admin/users` (wave 1 of #734).** Added `shared::api::MeResponse`, `shared::api::SessionsResponse`, `shared::api::AdminUserEntry`, and `shared::api::AdminUsersResponse` so the four call sites that used to `serde_json::Value::get("…")` the response now deserialize against a typed struct shared with the backend handler. Backend `me` returns `MeResponse` directly (lifted from the old in-handler `UserResponse`); admin `list_users` returns `AdminUsersResponse` carrying `Vec<AdminUserEntry>`. Frontend pages (`dashboard/page.rs`, `hooks/use_sessions.rs`, `settings/sessions_panel.rs`, `admin/mod.rs`) now `.json::<TypedStruct>()` instead of poking field names. **Wire shape is unchanged bytewise** — fields keep their existing names and `#[serde(default)]` covers older partial responses; the sessions endpoint still serializes the full `Session` row + `my_role` flatten and the shared `SessionInfo` deserialize silently drops the extras it doesn't need. Subsequent waves (settings panels, voice config, admin sessions/stats, etc.) remain tracked in #734.

## 2.5.50

- **Typed-dispatch refactor in `frontend/src/pages/dashboard/session_view/component.rs` (closes #733).** Replaced five `serde_json::from_str::<Value>` + `.get("type")` / `.get("content")` JSON pokes with typed `ClaudeMessage` parses. The most-recent-meaningful-message filter, the history-replay `msg_type` classification, and the live-output fallback `msg_type` classification now derive the wire `type` tag from a small `message_type_tag(&ClaudeMessage) -> &'static str` helper instead of probing the raw JSON. The pending-send echo matching at the "user" branch now extracts the user-text payload via a typed `extract_user_text(&ClaudeMessage) -> Option<String>` helper that walks `UserMessage::content` (the optimistic-send + codex synthesized-echo shape) or, when absent, concatenates `ContentBlock::Text` blocks from `message.content` (the Claude `--replay-user-messages` shape) — which also fixes the latent bug where the bytewise `Value` compare silently never matched against Claude's nested-blocks echo. **No behavior change** to the downstream `msg_type` string contract or the message storage shape — the broader in-memory `Vec<String>` → `Vec<ClaudeMessage>` refactor flagged in the issue stays out of scope for this PR.

## 2.5.49

- **Typed `ToolInput::ExitPlanMode` access in `frontend/src/pages/dashboard/permission_dialog.rs` (closes #736).** The ExitPlanMode permission card was reading `perm.input.get("allowedPrompts").and_then(|v| v.as_array())` and then per-entry `.get("tool").as_str()` / `.get("prompt").as_str()` on the inner objects — silent regression bait if the wire renames a field. Replaced with `serde_json::from_value::<ToolInput>(perm.input.clone())` matching `ToolInput::ExitPlanMode(epm)` and reading `epm.allowed_prompts: Option<Vec<AllowedPrompt>>` typed; iteration uses typed `p.tool` / `p.prompt` directly. `ToolInput`, `ExitPlanModeInput`, and `AllowedPrompt` are now re-exported from `shared` so the frontend doesn't need a direct `claude-codes` dep. The `perm.input: serde_json::Value` envelope stays — per-tool inputs have different shapes; typed decoding happens at the dispatch site. Render layout, CSS classes, and other permission-tool branches (Bash, Edit, Write) are unchanged — they remain separate issues.

## 2.5.48

- **`render_todowrite_tool` uses typed `ToolInput::TodoWrite` instead of JSON-poking (closes #735).** The frontend renderer now deserializes its `serde_json::Value` input into `claude_codes::tool_inputs::ToolInput`, matches the `TodoWrite(TodoWriteInput)` variant, and reads each `TodoItem`'s typed `content: String` and `status: TodoStatus` enum (`Completed` / `InProgress` / `Pending` / `Unknown(_)`). Same icons, same CSS classes, same empty-list fallback when deserialization fails — just no more `.get("todos").as_array()` / `.get("status").as_str()`. `shared` now re-exports `TodoItem`, `TodoStatus`, `TodoWriteInput`, and `ToolInput` so the frontend can use them without taking a direct `claude-codes` dependency.

## 2.5.47

- **Typed query-param parse on the banned page (closes #732).** `frontend/src/pages/banned.rs` no longer pokes `web_sys::UrlSearchParams::get("reason")` against the URL; it uses `yew_router::use_location().query::<BannedQuery>()` with a `#[derive(Deserialize)] struct BannedQuery { reason: Option<String> }`, and `serde_urlencoded` handles URL decoding so the manual `js_sys::decode_uri_component` block is gone.

## 2.5.46

- **Typed frontend renderers for codex streaming-delta events.** `turn/diff/updated`, `item/fileChange/patchUpdated`, and `turn/plan/updated` previously fell through `CodexEvent`'s `#[serde(other)] Unknown` arm and got dumped as raw pretty-printed JSON in the transcript. Now `CodexEvent` carries typed variants for all six slash-named delta methods the proxy forwards (the three above plus `item/plan/delta`, `item/reasoning/summaryPartAdded`, `item/reasoning/textDelta`); the first three render as real cards (cumulative unified diff, per-file patches, numbered plan with status icons) and the latter three are typed no-op stubs that suppress the raw-JSON dump without aggregating delta state. The per-line HTML emission was extracted out of `render_diff_lines` into a private `render_diff_html` helper, and a new public `render_unified_diff(diff: &str)` parses unified-diff strings (skipping `--- `, `+++ `, `@@ ` headers and the `\\ No newline at end of file` marker, classifying body lines by leading char with a context fallback) and feeds the same helper. Both the claude `Edit` tool renderer and the new codex diff renderers go through `render_diff_html`, so styling stays in lockstep. Tests cover `parse_unified_diff` (single hunk, multi-hunk, blank context, no-newline marker, missing file headers, unprefixed lines) and round-trip each new `CodexEvent` variant through `serde_json::from_str`.

## 2.5.45

- **Closes #723: dispatch `handle_codex_server_message` on the typed `codex_codes::Notification` / `codex_codes::ServerRequest` enums instead of stringly-typed `match method.as_str()` + `params.get("…")` JSON-poking.** The previous shape lowered every typed param struct back to `serde_json::Value` just to re-read fields by string name — losing every compile-time guarantee the SDK provides (PR #721 was a concrete instance: codex 0.129.3 dropped `FileChangeRequestApprovalParams.changes`, the lookup silently returned `null`, the FileChange dialog rendered `{"changes": null}`). Now both halves of the handler match on the typed variants directly: `Notification::TurnCompleted(p) => p.turn`, `Notification::Error(p) => p.error.message`, `Notification::DeprecationNotice(p) => p.summary` (which actually carries the wire text — the old `params.get("notice")` always returned the `"(no message)"` default because `notice`/`message` never existed on the typed schema), `ServerRequest::FileChangeApproval(p) => { itemId: p.item_id, reason: p.reason, grantRoot: p.grant_root }`, `ServerRequest::ExecCommandApproval(p) => p.command.join(" ")`, and so on for every variant the SDK exposes. The intermediate `let (method, params) = notif.into_envelope()` and `let params: Value = match &request { … to_value(p) … }` re-serialize preambles are gone. Frontend-facing JSON shape (`IoEvent::CodexPermissionRequest::input` field names and types) is preserved verbatim — `format_permission_input` keeps working unchanged. New unit tests in `codex-session-lib/src/handler.rs` cover the FileChange / ExecCommand / Bash / ApplyPatch / TurnCompleted / Error / ItemStarted / McpElicitation dispatch paths.

## 2.5.44

- **Typed-dispatch refactor in `proxy/src/shim.rs` (closes #724).** The shim's stdout and stdin readers used to route lines by JSON-poking the wire `type` field — `value.get("type").and_then(|t| t.as_str())` for the stdout user-echo filter, the stdout msg_type dispatch, and the stdin `control_response` detect, plus `block.get("type")` inside `extract_user_text`. Each site now parses the line into a typed `claude_codes::ClaudeOutput` up front and dispatches on enum variants: `Some(ClaudeOutput::User(user))` triggers user-echo filtering (with `extract_user_text` walking `user.message.content` typed and matching `ContentBlock::Text` blocks), `Some(ClaudeOutput::ControlResponse(_))` is dropped from the portal stream, `Some(ClaudeOutput::ControlRequest(req))` runs the existing `ControlRequestPayload::CanUseTool` permission branch, and any other typed variant is buffered for portal delivery. The stdin reader reads the `request_id` from `ControlResponsePayload::{Success, Error}` instead of poking a top-level field. **No wire/protocol change** — every line still passes through to VS Code bytewise when `forward_to_vscode == true`, and lines that don't match `ClaudeOutput` (non-JSON, or valid JSON like `stream_event` that the typed enum doesn't model) fall back to a raw `Value` parse so they still reach the portal (with the prior `stream_event` portal-filter preserved). The next claude-codes wire-shape change that adds or renames a variant now gets caught at compile time on this codepath instead of silently falling through the dispatch.

## 2.5.43

- **Bump `claude-codes` 2.1.140 → 2.1.141.** Pure addition upstream — adds `ToolPermissionRequest::answer_questions(answers, request_id)`, a typed helper for replying to `AskUserQuestion` approvals that preserves the original `questions` array in the `updatedInput` payload (manual `{answers: {...}}` responses drop it, which crashes downstream viewers that call `tool_use_result.questions.map(...)`). Not yet used by agent-portal — existing AskUserQuestion approval path can switch to the helper in a follow-up.

## 2.5.42

- **Tag `agent_type` per-message at the proxy emission boundary instead of capturing it from registration.** The 2.5.40/2.5.41 design captured `agent_type` from the proxy's `Register` and threaded it through `proxy_socket.rs` into every insert site. That was functionally correct today (one connection = one io_task = one agent) but wrong shape for any future multi-agent / sub-agent session: every insert site would silently mis-attribute the day a single `/ws/session` connection started ferrying messages from more than one agent. Now `ProxyToServer::SequencedOutput` and `ProxyToServer::ClaudeOutput` carry `agent_type: AgentType` on each message, the proxy reads `config.agent_type` at every emission site (output forwarder, wiggum portal messages, replay loop, codex raw output, connection-portal banner, shim mode), and `proxy_socket.rs` trusts the per-message tag — the `session_agent_type` capture is gone, as is the error-and-drop guard for pre-Register output. The live broadcast `ServerToClient::ClaudeOutput` also grew an `agent_type` field so the frontend's in-flight messages can be tagged the same way as the historical-read path. **Wire compat caveat:** pre-2.5.42 proxies don't send `agent_type` on output messages; `#[serde(default)]` makes them parse as `AgentType::Claude`, which is a presumed misattribution for any in-flight codex session running an older proxy until the proxy upgrades.

## 2.5.41

- **Drop the SQL DEFAULT and the orphan fallback from the messages `agent_type` migration; require every callsite to specify it explicitly.** The 2.5.40 migration set `DEFAULT 'claude'` on the column and filled any null rows with `'claude'` before the NOT NULL alter — both were silent claude-fallbacks that would mistag codex sessions if any future out-of-band INSERT path forgot the field. Now: no column DEFAULT (out-of-band inserts that omit `agent_type` fail with a NOT NULL violation, which is the point), and no orphan fallback (the join-backfill is the only source of truth; if the NOT NULL alter fails, you have orphan messages whose session got deleted without cascading — fix that before re-running). On the Rust side, `proxy_socket.rs`'s `session_agent_type` is now `Option<AgentType>` initialized to `None`; any `ClaudeOutput` / `SequencedOutput` arriving before `Register` is logged at `error!` and dropped rather than silently tagged as claude.

## 2.5.40

- **Add `agent_type` column to the `messages` table** (`VARCHAR(16) NOT NULL`) so readers know which agent's wire format each message's `content` JSON came from instead of guessing by JSON-poking the `type` field. Migration backfills from the parent session's `agent_type` for every existing row via a join. All three insert sites are now populated: `handle_claude_output` in `backend/src/handlers/websocket/message_handlers.rs` takes the agent type as a new parameter threaded from the proxy's `Register` message (captured into `session_agent_type` in `proxy_socket.rs`); the slash-command portal insert in `web_client_socket.rs` and the `create_message` HTTP handler both read it from the parent `Session` row. The new field is exposed to the frontend automatically via `MessageWithSender`'s `#[serde(flatten)] message: Message` and a matching `#[serde(default)] pub agent_type: String` on `MessageData` in `frontend/src/pages/dashboard/types.rs`. Frontend dispatcher gating is deferred — issue #723 will refactor codex dispatch separately, at which point consumers can branch on `agent_type` instead of probing `content.get("type")`.

## 2.5.39

- **Decommingle `claude-session-lib` into three crates.** `claude-session-lib` previously housed both `claude_io_task` and `codex_io_task` along with codex-specific helpers and an `IoEvent::CodexPermissionRequest` variant — the crate name lied. Split:
  - New **`session-lib`** owns the agent-agnostic core: `Session<A: Agent>` generic, `trait Agent` with `spawn_io_task`, the unified `IoCommand` / `IoEvent` / `SessionEvent` enums, `SessionConfig` / `SessionSnapshot` / `PendingPermission`, `OutputBuffer`, `PendingOutputBuffer`, `HeartbeatTracker`, `probe_all_agents`, `SessionError`.
  - **`claude-session-lib`** now contains only Claude-specific bits: `pub struct ClaudeAgent` with `impl session_lib::Agent`, `claude_io_task` (incl. the upstream-429 rate-limit retry state machine), `spawn_claude`, and `proxy_session/*` (wiggum mode, portal reminder, image upload, ws_reader). The `proxy_session` connection loop stays here and is now generic over `A: Agent`, so both Claude- and Codex-backed sessions can use it; splitting it is deferred to a future PR.
  - New **`codex-session-lib`** contains `pub struct CodexAgent`, `codex_io_task`, and `handle_codex_server_message` (the existing stringly-typed `match method.as_str()` dispatch is preserved verbatim — issue #723 will refactor to typed `ServerRequest` matching in a follow-up PR).
- Launcher's `process_manager.rs` adds an `AnySession` enum (`Claude(Session<ClaudeAgent>)` / `Codex(Session<CodexAgent>)`) so a single in-process map can hold mixed-agent sessions; the dispatch happens at `match config.agent_type` in `AnySession::new`.
- Proxy keeps using `Session<ClaudeAgent>` directly — the proxy binary never spawns Codex.
- `SessionError::ClaudeError(claude_codes::Error)` is gone — per-agent crates now collapse SDK errors into `SessionError::Agent(String)` so `session-lib`'s error surface stays SDK-free.

## 2.5.38

- CLAUDE.md: codify typed-interface preference + upstream-first rule, lifted from the codex `item/fileChange/requestApproval` regression in 2.5.38 / PR #721.

## 2.5.37

- **Bump `codex-codes` 0.129.2 → 0.129.3 and absorb the SDK rewrite.** Upstream 0.129.3 (PR #138) regenerated every wire type from the schema and shipped [SDK #134](https://github.com/meawoppl/rust-code-agent-sdks/issues/134)'s structured `ParseError`. Three concrete consequences for agent-portal:
  - **`codex_io_task` rewrite** in `claude-session-lib/src/session.rs` against the new API: `ThreadStartParams` lost its `Default` impl (15 Option fields, all `skip_serializing_if`), so we now build it via `serde_json::from_value(json!({}))` matching the SDK's own usage example; `ThreadStartResponse::thread_id()` is gone — use `resp.thread.id`; `TurnInterruptParams` now requires both `thread_id` and `turn_id`, so we track the active turn id from each `turn/started` notification and pass it on interrupt; `TurnStartParams::reasoning_effort` is now `effort` and the struct gained more Option fields, so we build it the same way; `UserInput::Text` gained a required `text_elements: Option<...>` we set to `None`.
  - **`CodexFrameCaptureLayer` retired** (the tracing-snooping workaround from 2.5.30 — which didn't actually capture in production anyway). The `Error::Json` arm in `codex_io_task` becomes `Error::Deserialization(ParseError)` and reads `raw_line` / `raw_json` / `method` / `error_message` directly off the struct. The portal message gets a real fenced ```json block with the offending frame, complete with the JSON-RPC `method` name. Supersedes the long-pending #708 revert PR.
  - **Cleanup:** removed `claude-session-lib/src/codex_frame_capture.rs`, its module export from `lib.rs`, the install lines in `launcher/src/main.rs` and `proxy/src/main.rs`, and the `tracing-subscriber` dep from `claude-session-lib/Cargo.toml`. Per-layer EnvFilter rewiring reverted to the original registry-level EnvFilter.
- **Net diff** is a small set of one-line API shape changes + one architectural pull-out, exactly proportional to a major SDK refactor.

## 2.5.36

- Session pill agent-type watermark (Anthropic asterisk / OpenAI knot) is now 10% smaller — 88×88 → 80×80 — with the left offset adjusted from −28px to −24px so the icon's horizontal center stays at the same x=16 in pill coords. Vertical center is unchanged.

## 2.5.35

- **Rate-limit retry: bump cap from 4 attempts/30s to 30 attempts/60s.** The original 2.5.29 settings gave up after ~1 minute of sustained throttling, which was too short for the rate-limit windows Anthropic actually applies (multi-minute holds are common). With 30 attempts at full-jitter exponential backoff capped at 60s, the upper bound on retry wall time is ~30 minutes of patience before we surface the "send your message again" portal note — and any earlier success short-circuits, so well-behaved limits unblock as soon as the window opens. Counter still resets on every fresh user input and every successful turn.

## 2.5.34

- **Bump `codex-codes` 0.129.1 → 0.129.2** and wire it through `codex_io_task`. The dep bump picks up [SDK #135](https://github.com/meawoppl/rust-code-agent-sdks/issues/135) (`AppServerBuilder::config_override` + `extra_args`). The call-site change parses each codex session's `SessionConfig::extra_args` (the existing "Extra args" launch-dialog text input — already wired through to the launcher) into two buckets:
  - tokens of the form `-c key=value` / `--config key=value` become `builder.config_override(k, v)` (rendered as `-c k=v` **before** the `app-server` subcommand, since `-c` is a global codex flag);
  - everything else becomes `builder.extra_args(...)` (appended **after** `--listen stdio://`).
  - Lets a user type e.g. `-c sandbox_mode=workspace-write -c approval_policy=on-request --strict-config` in the launch dialog and have each token land in the right slot on the spawned codex command line. No structured UI for sandbox/approval pickers yet — that's a follow-up.

## 2.5.33

- **Route the codex 0.130+ message types to user-facing UI instead of letting them fall through to "Unknown Codex request".** Followup to 2.5.32 which got the typing in. Each new message type now has a purpose-built dispatch arm:
  - **Approval requests** wire into the existing `CodexPermissionRequest` event with sensible \`tool_name\`s and trimmed input payloads, so the user gets the existing approve/deny dialog for each:
    - \`execCommandApproval\` → \`tool_name: "ExecCommand"\` (command + cwd + parsedCmd)
    - \`applyPatchApproval\` → \`tool_name: "ApplyPatch"\` (file-change map + grant-root + reason)
    - \`item/permissions/requestApproval\` → \`tool_name: "Permissions"\` (cwd + permissions profile + reason)
    - \`item/tool/requestUserInput\` → \`tool_name: "AskUserQuestion"\` (reuses the Claude AskUserQuestion renderer — the Codex question shape is structurally compatible)
    - \`mcpServer/elicitation/request\` → \`tool_name: "McpElicitation"\` (server name)
  - **Internal/system requests** (no user action to take) emit a portal text message so the user sees what was requested without blocking the agent:
    - \`item/tool/call\`, \`account/chatgptAuthTokens/refresh\`, \`attestation/generate\`
  - **Notifications**:
    - \`deprecationNotice\` / \`guardianWarning\` → portal text (high-visibility)
    - \`item/plan/delta\`, \`turn/plan/updated\`, \`turn/diff/updated\`, \`item/reasoning/summaryPartAdded\`, \`item/reasoning/textDelta\`, \`item/fileChange/patchUpdated\` → typed structured events the frontend can opt into rendering (currently fall through to the existing raw-codex display but with a stable \`type\` tag for follow-up renderers)
    - Pure-status notifications (\`mcpServer/oauthLogin/completed\`, \`account/login/completed\`, etc.) stay silent (debug log)
- **Frontend**: extended \`format_permission_input\` in \`frontend/src/pages/dashboard/types.rs\` so the new tool_names (\`ExecCommand\`, \`ApplyPatch\`, \`Permissions\`, \`McpElicitation\`) get readable one-line summaries in the permission card instead of dumping a JSON blob.

## 2.5.32

- **Bump `codex-codes` 0.128.0 → 0.129.1.** Upstream added eight new `ServerRequest` variants and roughly ten new `Notification` variants modeling codex CLI 0.130+ protocol additions (tool-input prompts, MCP elicitations, generic permission requests, dynamic tool calls, ChatGPT auth-token refresh, attestation, apply-patch approval, exec-command approval, plus plan/diff/reasoning delta notifications). Extended the proxy's `ServerRequest` match in `claude-session-lib/src/session.rs` to cover all of them — each new variant serializes its typed param struct back to `Value` so the downstream string-dispatch keeps working. New approval-type methods (`ApplyPatchApproval`, `ExecCommandApproval`, `PermissionsRequestApproval`, etc.) currently fall through to the existing `_ => warn!("Unknown Codex request: {}", method)` arm, which surfaces them as raw codex frames in the transcript — purpose-built UIs for each new approval type are a follow-up. New notifications flow through `notif.into_envelope()` and hit the existing string-dispatch's `_ => debug!` arm without code changes.

## 2.5.31

- **Probe installed agent CLIs when the launch dialog opens.** Previously the only signal that a launcher was missing `codex` or `claude` was a session that spawned then vanished within a second with a misleading `exited normally (code 0)` log. The launch dialog now asks the selected launcher to scan its PATH the moment the user opens it (and again on every launcher dropdown change), and surfaces the result inline:
  - Agent dropdown labels show `Claude (not installed)` / `Codex (not installed)` when the binary isn't on the host's PATH.
  - A red inline warning sits under the agent picker when the selected agent is missing.
  - A grey "Checking installed agents..." note shows while the probe is in flight.
- Plumbing:
  - Extracted the `which` + `--version` probe into `claude_session_lib::probe` so it's reusable outside the spawn-time diagnostic.
  - New `shared::AgentInstall { agent_type, installed, resolved_path, version }`.
  - New WS request/response pair: `ServerToLauncher::ProbeAgents { request_id }` → `LauncherToServer::ProbeAgentsResult { request_id, agents }`.
  - Backend correlates responses via a parallel `pending_probe_requests` map (mirrors the existing directory-listing pattern).
  - New REST endpoint `GET /api/launchers/{id}/probe-agents` that triggers the round-trip and returns the install state with a 5 s timeout.

## 2.5.30

- **Attach the raw Codex frame to typed-decode-failure portal messages.** When a codex frame fails our bundled `codex-codes` schema (the canonical `missing field 'callId'` mismatch with codex CLI 0.130.0's approval requests, see #703), the proxy interrupted the turn but left the user without the offending frame's content — making upstream bug reports hard to file. A new `CodexFrameCaptureLayer` tracing layer watches codex-codes' `[CLIENT] Received: <raw>` DEBUG events at runtime and stashes the last 8 frames in a process-wide ring buffer. On `Error::Json` the codex I/O task drains the most-recent entry (overwhelmingly the offending frame, since capture happens microseconds before the typed-decode failure on the same thread) and emits it as a portal message with a fenced JSON block, ready to copy-paste. The layer declares per-callsite `Interest::always()` only for `codex_codes::client_async` DEBUG events, so it sees them even when `RUST_LOG=info,…` would otherwise suppress them — without flooding journald (the fmt-layer EnvFilter is now per-layer, not global). Installed in both `launcher/src/main.rs` and `proxy/src/main.rs`.

## 2.5.29

- **Auto-retry upstream-429 turns with full-jitter exponential backoff.** When Anthropic's API rate-limits a request, `claude --print` doesn't fail — it streams an assistant message starting with `API Error: Server is temporarily limiting requests (not your usage limit) · Rate limited` and emits a `Result` with `is_error: true`. From the user's POV the session just ate a turn and went quiet. `claude_io_task` now caches the last user input, watches each turn for that exact shape, and on a match auto-retries with `delay ∈ [0, min(30, 2^attempt)]` seconds (full-jitter prevents N concurrent stuck sessions from re-firing in lockstep when the limit window resets). Up to 4 retries per user input; each retry emits a portal message announcing the wait and attempt count; on max-out we surface a final portal note asking the user to resend. If a new user input arrives during the backoff, it cancels the retry and runs normally — the user can always override automation. Counter resets on every fresh user input and on every successful turn.

## 2.5.28

- **Stop rendering protocol-agnostic messages as "Codex Raw" blocks on Codex sessions.** The synthetic user-echo (PR #691, fixing the "Codex Raw" pile-up) and the backend's `Portal` envelope both have `type: "user"` / `type: "portal"` and parse cleanly as `ClaudeMessage` — but the old dispatch sent every message on a Codex session straight to the Codex renderer, which only knows codex-specific shapes (`item.*`, `turn.*`) and falls anything else through to the "raw JSON" catch-all. The user saw their own input echoed as a JSON dump. Dispatch now matches on the message shape first (any recognized `ClaudeMessage` variant renders the same on both agents) and only routes the remaining unknown-shape messages to the Codex renderer.

## 2.5.27

- **Agent-type watermark behind session pills.** Each pill now shows the actual brand mark of the agent backing it — Anthropic's stylized burst behind Claude sessions, OpenAI's hex-knot behind Codex sessions — anchored to the left edge of the pill, clipped to the rounded silhouette via the existing `overflow: hidden`, sized to overflow the corner a bit. Light grey at 0.22 opacity, sits below the foreground text and indicators so legibility is unchanged. The old "Codex" text badge is removed since the watermark carries the same signal.
- New static assets: `frontend/assets/anthropic-mark.svg` (recolored to white from the source SVG so it tints down to the Tokyo Night palette cleanly) and `frontend/assets/openai-mark.png` (alpha-cut from the source PNG, RGB-negated so the logo reads light on the dark pill).

## 2.5.26

- **Fix #703 — codex sessions no longer wedge after a typed-decode failure.** The 2.5.22 patch for #695 kept the session alive after `codex-codes` failed to deserialize a frame, but silently dropped the frame. When the lost frame was a server→client approval request (the `callId`-missing variant in codex 0.130.0's `item/{commandExecution,fileChange}/requestApproval`), codex blocked the turn waiting for a reply it would never get; the proxy stayed in `turn_active = true` and rejected every subsequent user prompt with `Received input while Codex turn is active`. From the user's POV the session looked alive but ignored them. Now, on `codex_codes::Error::Json` during an active turn, `claude-session-lib` (a) emits a `turn.failed` event to the frontend so the hang is visible, and (b) sends `turn/interrupt` so codex unblocks and emits `turn/completed` (Interrupted), which clears the flag through the normal path. If `turn_interrupt` itself errors, the flag is force-cleared to avoid a permanent wedge.

## 2.5.25

- Awaiting pill border + indicator back to red (`--error`) instead of orange. The pulse animation stays gone (#684's complaint was the strobing, not the color).

## 2.5.24

- **Session pill colors: blue focus ring, no more pulsating red on awaiting pills.** The 2.5.11 "bright-red active pill indicator" was too loud; the awaiting-pulse animation made it worse for any tab the agent was still chewing on. Now:
  - **Focused pill**: accent-blue border + soft blue background tint + 2 px blue ring.
  - **Awaiting pill** (agent still working): subtle orange border, no animation. The existing in-pill indicator glyph still picks up an orange tint to flag the state without the page strobing.
  - **Focused + awaiting**: focus state dominates — keeps the blue ring/background; the indicator glyph alone signals "still working."
- Dropped the `@keyframes awaitingPulse` rule.

## 2.5.23

- **Fix #692 — portal reminder no longer bloats the user transcript.** Two parts:
  - Reflowed `claude-session-lib/portal_reminder.md` to single-line paragraphs and bullets. The previous 72-column hand-wrapping turned every continuation into a new visual line in the rendered preview; long-line markdown lets the renderer reflow to the available width.
  - Dropped the user-bound `PortalMessage::reminder` emission entirely. The collapsed "Portal features" block on the frontend was content the user already knew (they built the portal), and the actually-useful side — re-priming the agent's affordance knowledge after a fresh start / compaction — is the stdin injection, which stays. The `PortalContent::Reminder` enum variant and its frontend renderer are kept around so historical DB rows still deserialize cleanly.
- **Filter Claude's user-message echo of `<system-reminder>` wrappers.** When the proxy injects the reminder via stdin, Claude echoes it back on stdout as a `ClaudeOutput::User` whose content is the raw `<system-reminder>…</system-reminder>` text. Forwarding that to the frontend leaked the wrapper text into the transcript as if the user had typed it. The output forwarder now detects user-message echoes whose first text block starts with `<system-reminder>` and drops them before forwarding.

## 2.5.22

- **Fix #695 — codex sessions no longer die on typed-decode errors.** Codex CLI 0.130.0 emits at least one frame type (likely a notification with a `callId` field our bundled `codex-codes` 0.128.0 doesn't model) that fails strict deserialization. Previously the proxy turned that into `SessionError::CommunicationError` and killed the session; from the user's POV the agent just vanished mid-turn. Now `codex_io_task` matches on `codex_codes::Error::Json` specifically, logs a warning, and continues the loop so the rest of the session stays alive. Other error variants (I/O, protocol, server-closed) still terminate as before.

## 2.5.21

- **Fix #678 — macOS ARM64 CI no longer flakes on broken-shim runner images.** The 2.5.8 PATH workaround was based on a wrong theory: on affected `macos-14` images, the files at `~/.cargo/bin/{cargo,rustc}` are *both* actually `rustup-init`, not toolchain shims. `dtolnay/rust-toolchain@1.92.0` exits 0 on these images but leaves the install half-broken — `rustup run` couldn't help either, because cargo internally invokes `rustc -vV` and got `rustup-init 1.29.0` back. Replaced the dtolnay step on all four macOS jobs (`build-proxy-macos-arm64`, `build-launcher-macos-arm64`, `build-macos-arm64`, `build-macos-intel`) with an explicit `rm -rf ~/.cargo ~/.rustup` followed by a fresh `curl | sh -s -- -y --default-toolchain 1.92.0 --profile minimal` install. Plain `cargo build` works after that. Dropped the obsolete PATH workaround.

## 2.5.20

- **Add a triple-click "Update & Restart" button to the Launchers panel.** Lets an operator push a launcher to fetch the latest agent-portal release from GitHub and restart itself, straight from the dashboard. Three-stage confirmation prevents fat-finger accidents:
  - **Click 1**: gray "Update & Restart" → yellow "Wait, really?"
  - **Click 2**: yellow → red "Are you absolutely positively sure?"
  - **Click 3**: red → muted "Restarting…" (POSTs `/api/launchers/:id/update`)
- Backend translates the POST into a new `ServerToLauncher::UpdateAndRestart` WebSocket message; the launcher receives it, calls `portal_update::check_for_update` (the same path as the `agent-portal update` CLI subcommand), then `service::restart()` via systemctl/launchctl. If the launcher isn't running under a service manager it just exits and relies on an external supervisor to respawn.

## 2.5.19

- **Fix "Codex Raw" pending messages piling up at the bottom of the transcript.** Codex's app-server protocol doesn't echo user input back the way Claude's CLI does, so the frontend's optimistic-send pending entry never matched anything and accumulated on every send. The pending entries were rendered through the Codex renderer (which doesn't recognize the `{type: "user", _pending: true}` shape) and fell into the "Codex Raw" catch-all. Fix: `codex_io_task` now emits a synthetic user echo (parses as `ClaudeOutput::User` with a top-level `content` field) right before kicking off the Codex turn, so the frontend's existing content-match pending-clear path fires identically for both agents. Portal-reminder injections wrapped in `<system-reminder>` tags are filtered out of the echo path so they stay invisible to the user.

## 2.5.18

- **Bump `codex-codes` 0.101.1 → 0.128.0.** Upstream restructured `ServerMessage` from the loose `{ method, params }` envelope into typed enums (`Notification(Notification)` and `Request { id, request: ServerRequest }`). Adapted the proxy's Codex dispatcher in `claude-session-lib/src/session.rs` to:
  - Match `ServerMessage::Notification(notif)` and recover `(method, params)` via `notif.into_envelope()` — keeps the existing string-based downstream dispatch intact.
  - Match `ServerMessage::Request { id, request }`, pull the method via `request.method()`, and serialize the typed param struct (`CmdExecApproval`, `FileChangeApproval`, or `Unknown`) back to a `Value` so the rest of the approval-flow code is unchanged.
- Three new `Notification` variants are now modeled (`AccountRateLimitsUpdated`, `McpServerStartupStatusUpdated`, `RemoteControlStatusChanged`); they fall through to our existing `_ => Skip` arm via `notif.into_envelope()`, so they're handled implicitly without further code.

## 2.5.17

- **Inject a "portal features reminder" into the agent at session start and after each context compaction.** Reminds the agent which portal-specific features are available (auto-formatted links, KaTeX, image rendering, AskUserQuestion, session sharing, etc.) so it can actually use them after a fresh start or a compaction-induced amnesia. The reminder is wrapped in `<system-reminder>` tags on the agent side and emitted as a collapsed `PortalContent::Reminder` block on the frontend so it doesn't clutter the transcript.
- The reminder body lives in `claude-session-lib/portal_reminder.md` as a readable markdown file (baked into the binary via `include_str!`), and operators can override it at runtime by pointing `PORTAL_REMINDER_FILE` at a readable path. Missing/unreadable overrides log a warning and fall back to the bundled default. Documented in `Dockerfile`, `docs/DEPLOYING.md`, `docs/DOCKER.md`, and `CLAUDE.md`.
- Extracted the duplicated "is this a compaction-end marker?" predicate into `shared::is_compaction_boundary(&CCSystemMessage)`. The Claude CLI emits this boundary under several subtype spellings (`compact_boundary`, `compaction`, `context_compaction`, `summary`) and three call sites were inlining the disjunction — they now all go through the shared helper.

## 2.5.16

- **Fix #684 — KaTeX hasn't actually been rendering math on any page load.** The Subresource Integrity hash on the `<script>` tag for KaTeX's `auto-render.min.js` in `index.html` did not match the file the CDN actually serves. Browsers silently refuse to execute scripts whose SRI hash mismatches, so `window.renderMathInElement` never landed on the page, and every call to our `renderMathInNode` helper silently no-op'd. Verified by a standalone harness (`frontend/dev-tools/katex-isolated.html`) that loads the same scripts from the same CDN and reports "renderMathInElement not on window". Replaced the stale hash with the real `sha384-43gviWU0YVjaDtb/GhzOouOXtZMP/7XUzwPTstBeZFe/+rCMvRwr4yROQP43s0Xk`.
- Also hardened `katex-helper.js` with a queue-and-retry path for the unlikely cold-load case where the helper fires before the CDN scripts finish loading, and added diagnostic logging so future failures surface in the browser console instead of being silently swallowed.
- Added a regression test confirming math in messages mixing `<thinking>` HTML blocks + fenced ```latex``` code + display `$$…$$` survives the markdown placeholder round-trip into `Event::Text`. This disproved earlier hypotheses that the bug was in our markdown pipeline.

## 2.5.15

- Pills are now 180 px wide (was 150 px, +20%) and the vertical rail tray shrinks from 240 → 200 px to match — no more dead space on the right of the column.

## 2.5.14

- Surface speech-to-text errors instead of silently ending the recording. Previously, when the backend speech recognition task failed early (bad credentials, recognizer setup error, Google API rejecting the stream, …), the result channel just closed and the WebSocket handler blindly emitted `VoiceEnded`, so the user saw the mic button "return immediately" with no explanation. Now the recognition task reports its final status via a oneshot channel, and the handler emits `VoiceError` with the actual error string when something went wrong.

## 2.5.13

- Session pills now have an explicit **150 px** width in both horizontal and vertical rail modes — previous content-driven sizing kept getting pushed by long folder names hitting min-content widths inside the flex children. `.pill-name` is `flex: 1; min-width: 0` so it fills the remaining space and ellipsizes cleanly. Vertical-mode `width: 100%` override removed.
- Trim the gap between the last visible message and the input bar: dropped the 0.5 rem bottom padding I added in 2.5.11 and shrunk the input form's top padding from 0.5 → 0.3 rem.

## 2.5.12

- Actually shrink the session pill width — #680's `.pill-name` change only knocked ~14% off the outer pill since the surrounding chrome stayed the same size. Pill-name width 120 → 100 px, pill horizontal padding 0.75 → 0.55 rem, and inter-item gap 0.5 → 0.35 rem, for ~25% total outer-width reduction in horizontal mode.

## 2.5.11

- Trim message stream right/bottom padding to match the previously-halved left side (1.5 rem → 0.75 rem right; bottom 0 → 0.5 rem)
- Tighten the `>` input prompt on both sides (negative left margin to match the existing negative right margin)
- Bright-red active pill indicator (was accent blue) so the focused session is immediately obvious
- Pill text width shrunk by 20 % (150 → 120 px) and the `▼` menu toggle now sits above the text in stacking order (z-index 2) so it stays readable when folder/branch labels are long

## 2.5.10

- Fix #676 — LaTeX math no longer drops when a message mixes equations with markdown that contains `_` (e.g. `$\sigma_{1D}$`). Math regions (`$…$`, `$$…$$`, `\(…\)`, `\[…\]`) are now extracted before markdown parsing so pulldown-cmark can't split equation text on emphasis-meta characters; the math is restored verbatim in `Event::Text` so KaTeX auto-render can find the delimiters in a single DOM text node. Skips inline-code, fenced-code, and `$5`-style dollar amounts.
- Fix #675 — Copy button icon swapped to the canonical Lucide two-overlapping-rectangles glyph so the copy affordance is immediately readable.
- Tighten horizontal spacing between the `>` prompt and the input textarea (negative margin-right of 0.35 rem on `.input-prompt`).

## 2.5.9

- Expand the rail position setting from horizontal/vertical to four choices: **Top**, **Bottom**, **Left**, **Right**. Top is unchanged (default); Bottom places the rail under the input bar; Left and Right place the rail as a 240 px column on either side. Existing `horizontal`/`vertical` localStorage values are auto-migrated to `top`/`left`.
- Halve the left padding on the message stream (1.5 rem → 0.75 rem) so message bodies sit closer to the left edge.

## 2.5.8

- CI: prepend `$HOME/.cargo/bin` to PATH on macOS jobs in `ci.yml` and `release.yml` to work around a `macos-14` runner image variant where a preinstalled `rustup-init` shadowed the rustup-managed `cargo` shim, causing intermittent `error: unexpected argument 'build' found` failures

## 2.5.7

- Bump `claude-codes` 2.1.117 → 2.1.140 — fixes a latent proxy data-loss bug where the structured `tool_use_result` field (e.g. AskUserQuestion's `{questions, answers}`, Bash's `{stdout, stderr, exit_code}`) was being dropped by the typed serde round-trip in the proxy on the way to the frontend
- Also picks up `UserMessage.timestamp` (CLI-emitted ISO-8601 timestamp echoed alongside tool results)

## 2.5.6

- Force pills to actually stack vertically in vertical-rail mode (the previous fix laid out the wrapper as a left column but pills inside the rail still flowed horizontally on some browsers). Adds `!important` on `flex-direction: column` and `overflow-x/y` for the vertical rail, plus `align-items: stretch` so pills take full column width.

## 2.5.4

- Fix vertical pill rail orientation: previous CSS selector targeted the wrong element (`.session-rail` is wrapped in `.session-rail-container`, so a direct-child combinator never matched); now styles the wrapper for the left-column layout

## 2.5.3

- Stabilize expand/collapse state of message components across new messages: bash command toggle, `ExpandableText` "... more chars", and image viewer no longer reset when later messages arrive
- Keys for message groups and grouped messages now derive from `_created_at` instead of position, so inserting a user message between assistant groups stops invalidating later groups' identity

## 2.5.2

- Pause auto-scroll when the user scrolls up to read older output; new messages no longer yank the view to the bottom
- Show a floating "Jump to live ↓" pill in the messages area when tailing is paused; click to resume

## 2.5.1

- Add Appearance tab in Settings with a horizontal-vs-vertical toggle for the session pill rail
- Preference persists in browser localStorage (`claude-portal-rail-orientation`)
- Vertical layout puts the pill rail down the left side; horizontal keeps the current top-bar layout

## 2.5.0

- Chunked image uploads over a new `/ws/session/upload` stream (#666)
- Large images (>= 1 MB on disk) now stream from proxy to backend as raw binary chunks, bypassing the WS frame size cap that previously stuck sessions in reconnect loops
- Avoids base64 encoding on the wire for large images — chunks are sent as native binary WebSocket frames
- Backend reassembles chunks in an in-memory upload buffer, enforces `PORTAL_MAX_IMAGE_MB`, then publishes the image at `/api/images/{uuid}` like before
- Proxy now rejects images over the cap locally (textual portal message) instead of queueing oversized payloads that fail forever on replay

## 2.4.37

- Move "time ago" label from message header to small unobtrusive footer at bottom-right of assistant messages

## 2.4.36

- Left-justify copy button in user/portal message headers (was pushed to far right)

## 2.4.35

- Show live-updating "X minutes ago" label on assistant message headers, with exact local time tooltip

## 2.4.34

- Place copy button next to model name in assistant headers (was at far right)

## 2.4.33

- Add clipboard copy button to message headers (assistant, user, portal) to copy raw markdown text

## 2.4.32

- Fix splash page not scrollable on mobile (overflow:hidden was on body instead of session container)

## 2.4.31

- Add stable keys to grouped assistant messages to preserve expanded state on new messages

## 2.4.30

- Disable Google STT single-utterance mode to prevent immediate session end on quiet/silent mic inputs (common on macOS)

## 2.4.29

- Clear pending send queue when assistant/result arrives (fixes stuck pending state for slash commands)
- Match pending sends by content on user echo so lost messages don't consume unrelated entries

## 2.4.28

- Up/down arrows in input now move cursor between lines; history navigation only triggers at the first/last line

## 2.4.27

- Render LaTeX math in messages via KaTeX (`$inline$`, `$$display$$`, `\(...\)`, `\[...\]`)

## 2.4.26

- Serve large images via HTTP instead of WebSocket (partially addresses #655)
- Backend extracts base64 images >64KB from portal messages, stores in memory, replaces with `/api/images/{uuid}` URLs
- Frontend renders both URL and base64 image sources
- Eliminates WS frame size issues for large images

## 2.4.25

- Add 5-second query timeout to retention cleanup tasks (#616)
- Cap retention deletes at 1000 messages per cycle to avoid long-running queries

## 2.4.24

- Limit launcher registrations to 10 per user (#617)

## 2.4.23

- Reduce spend broadcast interval from 5s to 30s and skip when no clients connected (#618, #614)
- Use single aggregate query instead of per-user queries for spend updates

## 2.4.22

- Fix stuck reconnect loop: drop pending messages after 5 consecutive replay failures (#650)

## 2.4.21

- Click truncated bash commands to expand full command text

## 2.4.20

- Fix false autolinks: angle-bracket Rust paths like `<crate::Type>` no longer render as clickable URLs

## 2.4.19

- Fix iOS keyboard gap: use position:fixed on mobile to track visual viewport

## 2.4.18

- Fix iOS Safari scroll bounce creating stuck dead space below messages

## 2.4.17

- Optimistic send: user messages appear instantly with a pending indicator, confirmed when server echoes back

## 2.4.16

- Linkify URLs in inline code spans, error messages, and file content previews

## 2.4.15

- Linkify URLs in code blocks, tool results, expandable text, and thinking blocks

## 2.4.14

- Show session init info bar with model, version, fast mode, MCP servers, and tool count

## 2.4.13

- Show truncation warning when assistant message hits max_tokens
- Add service tier and inference region to model name tooltip
- Add ephemeral cache details to usage tooltip

## 2.4.12

- Show cost, stop reason, fast mode, errors, and permission denials in result stats bar
- Add model usage breakdown to result timing tooltip

## 2.4.11

- Bump claude-codes to 2.1.117
- Render new content block types: ServerToolUse, WebSearchToolResult, McpToolUse, McpToolResult, CodeExecutionToolResult, ContainerUpload
- Render web search citations on text blocks
- Show unknown content blocks as collapsible JSON instead of silently dropping them

## 2.4.10

- Add token renewal button in settings credentials panel
- Add local-time tooltip on message headers

## 2.4.9

- Fix pill scroll-into-view when tabbing to off-screen sessions

## 2.4.8

- Purge expired device flow codes every 60 seconds (#615)

## 2.4.7

- Global thin scrollbar styling (6px, subtle, matches dark theme)

## 2.4.6

- Add sortable columns to admin users table (Email, Name, Status, Sessions, Spend, Created)

## 2.4.5

- Fix admin stats 500: cast SUM(bigint) to ::bigint in raw SQL queries (#627)
- Add raw SQL type safety guidance to CLAUDE.md

## 2.4.4

- Unify config directory: launcher now uses `~/.config/agent-portal/` (same as proxy)
- Migrate launcher config from TOML to JSON (`launcher.toml` -> `launcher.json`)
- Auto-migrate old `~/.config/claude-portal/launcher.toml` on startup
- Both proxy and launcher use `directories::ProjectDirs` for consistent paths across platforms
- Update install script to use new config path and JSON format

## 2.4.3

- Add GitHub link to minimal splash page footer

## 2.4.2

- Add `SPLASH_TEXT` env var for minimal login page (heading + sign-in button + version + bug link)
- When unset, the full marketing splash page is shown as before

## 2.4.1

- Replace rust-embed + startup brotli/gzip compression with memory-serve (build-time compression, zero startup cost)
- Remove rust-embed, brotli, flate2, mime_guess dependencies
- Closes #613

## 2.4.0

- Upgrade axum 0.7 to 0.8, ws-bridge 0.1 to 0.2, tokio-tungstenite 0.24 to 0.28
- Upgrade tower-cookies 0.10 to 0.11, tower_governor 0.4 to 0.8
- Migrate route paths from `:param` to `{param}` syntax

## 2.3.15

- Add `agent-portal service logs` command with `-n` (line count) and `-f` (follow) options

## 2.3.14

- Resume existing Claude sessions on launcher restart instead of creating new ones

## 2.3.13

- Fix admin stats page crashing on non-401/403 error responses

## 2.3.12

- Render each message in assistant groups as its own component so only new messages re-render
- Revert thread_local expanded state hack (no longer needed)

## 2.3.11

- Fix expanded "... more chars" content collapsing when new messages arrive

## 2.3.10

- Upload progress bar fills over 1.5s minimum and collapses with animation after completion

## 2.3.9

- Defer stale session cleanup on backend startup to give proxies time to reconnect, fixing sessions disappearing from the pills menu after a backend restart

## 2.3.8

- Add `agent-portal service start`, `stop`, and `restart` subcommands

## 2.3.7

- Fix awaiting-input detection to skip noise message types (portal, error, system, rate_limit_event)
- Extract shared `is_claude_awaiting` function used by both REST load and WebSocket paths

## 2.3.6

- Auto-delete completed cron sessions to prevent UI clutter (costs preserved)
- Hide cron sessions by default in the session rail

## 2.3.5

- Fix admin stats endpoint returning empty body due to SQL type mismatch (COALESCE returns numeric, Diesel expects float8)

## 2.3.4

- Fix send bar not clearing after sending with attachments

## 2.3.3

- Consolidate remaining duplicate user ID extraction into shared auth module
- Convert scheduled_tasks and proxy_tokens handlers to use AppError

## 2.3.2

- Add unified AppError type for backend handlers with structured error responses
- Consolidate duplicate auth extraction into shared `auth::extract_user_id`
- Convert sessions, messages, launchers, and sound_settings handlers to use AppError

## 2.3.1

- Remove stale cli-tools crate and dead API types
- Remove unused dependencies from backend, proxy, launcher, and shared

## 2.3.0

- Auto-renew launcher auth tokens over WebSocket when within 7 days of expiry
- Add token expiry warning icon on session pills for sessions from launchers with expiring tokens
- Add Launchers tab to Settings page with manual token renewal button
- Add POST /api/launchers/:id/renew-token endpoint for manual token renewal

## 2.2.3

- Fix Codex sessions failing to start from launcher: resolve binary path via `which` before spawning

## 2.2.2

- Add favicon and browser tab icon for link previews

## 2.0.4

- Fix multiline user input getting flattened when rendered in message history

## 2.0.3

- Bake user's PATH into systemd/launchd service so spawned agents can find `claude`

## 2.0.2

- Fix install script: `agent-portal install` → `agent-portal service install`

## 2.0.1

- Version bump to 2.0.1

## 1.3.49

- Add Linux aarch64 support (CI builds, auto-update, install script)

## 1.3.48

- Fix session reconnect race: old connection cleanup no longer overwrites newer connection's registration

## 1.3.47

- Fix oneshot drop race causing launcher sessions to not reconnect on server restart

## 1.3.46

- Show proxy version badge in session pill, color-coded by staleness

## 1.3.44

- Break up settings.rs into sub-components (TokensPanel, SessionsPanel, SoundsPanel)

## 1.3.43

- Update claude-codes to 2.1.51 (typed enums for message fields)
- Handle unparsable CLI messages gracefully instead of crashing sessions

## 1.3.42

- Detect subagent task completion via tool_result fallback when task_notification is missing (--print mode)

## 1.3.41

- Add repo URL to pill menu with 3-state display: PR link, repo link, or "No Repository Detected"
- Proxy detects GitHub repo URL via `gh repo view` and sends it alongside branch/PR info

## 1.3.40

- Break up admin.rs into sub-components per tab (overview, users, sessions, raw messages)
- Review and update all docs for accuracy across 15 files
- Fix subagent completion handling in history loading path to preserve task data
- Replace catch-all status mapping with explicit CCTaskStatus variant matching

## 1.3.38

- Add "Add machine" button to launch dialog for setting up new launchers
- Remove Service section from settings Credentials tab

## 1.3.37

- Move install under service subcommand (`agent-portal service install`)

## 1.3.36

- Add agent install setup under Service section in Credentials settings tab

## 1.3.35

- Add bash-style Tab completion to launch dialog path input

## 1.3.34

- Fix launch dialog bugs and refactor DirBrowser

## 1.3.33

- Prevent duplicate launchers per host-user and fix tilde expansion

## 1.3.32

- Launcher cleanup: fix task abort, URL dedup, send error logging, config path

## 1.3.31

- Show session details (name, host, directory, branch, agent) in portal message on connect/reconnect

## 1.3.30

- Unify admin and settings page layout styles

## 1.3.29

- Fix transparent admin/settings overlay background

## 1.3.28

- Move bug report to bottom-right link with bug emoji

## 1.3.26

- Fix Shift+Tab keyboard hint text

## 1.3.25

- Keep server shutdown banner until first message received from reconnected server

## 1.3.24

- Remove unused dead code methods from CommandHistory

## 1.3.23

- Fix result message duplicating previous assistant message text

## 1.3.22

- Fix launcher crash: install ring crypto provider for rustls 0.23

## 1.3.21

- Fix sparkline tick subpixel rendering artifacts via GPU compositing

## 1.3.20

- Fix tasks drawer pull-tab clipped by overflow:hidden on drawer container

## 1.3.19

- Add `agent-portal login` subcommand for explicit authentication
- Add `agent-portal install` subcommand to install as system service
- Add `agent-portal update` subcommand to update binary and restart service
- Install script no longer auto-installs system service
- Updated frontend setup instructions with 3-step flow (install, login, service)

## 1.3.18

- Differentiate task and portal message colors (tasks=purple, portal=teal)
- Sparkline tick colors now match their message type colors

## 1.3.17

- Rename agent-launcher to agent-portal
- Make launcher the default install path (install script downloads agent-portal, installs as service)
- Launch button available to all users (not just admin)
- Launch dialog shows install instructions when no launchers are connected
- agent-portal recommends service install when run interactively

## 1.3.16

- Backend sends max image size to proxies via RegisterAck; proxy uses it instead of local env var
- Remove frontend image size check (backend/proxy is authoritative)

## 1.3.15

- Fix stale subagent entries persisting across page reloads by clearing task state on history reload
- Tasks sidebar panel now slides in/out with the drawer instead of instantly appearing/disappearing

## 1.3.14

- Refactor sender attribution: store actual sender user_id in DB, reconstruct display info at query time

## 1.3.13

- Add user name attribution to messages in shared sessions

## 1.3.12

- Increase default image max size from 2 MB to 10 MB

## 1.3.11

- Update claude-codes to 2.1.49 (String-to-enum migration for subtype, stop_reason, status)
- Re-export `CCSystemSubtype` from shared

## 1.3.10

- Use typed claude-codes structs for task parsing instead of raw JSON field access
- Parse task_type, task_status, and task_usage via typed deserialization in both component logic and renderers

## 1.3.9

- Tasks sidebar: header bar toggles open/close (removed separate X button)
- Tasks sidebar: show running task count in title bar

## 1.3.8

- Add widget protocol specification (`docs/WIDGET_PROTOCOL.md`)

## 1.3.7 and earlier

- See git history for previous changes.