Changelog — Fixes

Bug fixes and regressions resolved. — Page 7

All Releases Features Fixes Improvements

fixMarch 27, 2026

CodePulse v2.3.30 — Stale Conversation History Fix

Fixed stale conversation history being injected into plan generation prompts, causing Haiku to generate plans about previous requests.

Bug Fixes (TAB-516)

Fixed: Stale conversation history in plans and resumed sessions — Old conversation history was injected into plan generation prompts, causing Haiku to generate plans about previous requests instead of the current one. The plan generator now uses only the current message context, ensuring accurate and relevant plan output.

fixMarch 27, 2026

CodePulse v2.3.29 — UX Polish

Fixed send logs button hover state and hidden the WMIC console window flash during system info collection.

Bug Fixes

Fixed: Send logs button hover state — Improved button styling for the send logs action in the support panel.
Fixed: WMIC console window flash — Hidden the console window that briefly appeared during system info collection on Windows. The WMIC process now runs with a hidden window style, eliminating the visual flash.

fixMarch 27, 2026

CodePulse v2.3.28 — PermissionRequest: TCVF Path + Always Allow Learning

Adversarial review of v2.3.27 found 3 more PermissionRequest gaps: the TCVF T3 deny path used the wrong format, decisions weren't recorded for learning, and commit-message edits were silently discarded.

Fixes (TAB-515)

TCVF T3 deny path now emits the correct PermissionRequest format — Same root cause as v2.3.27; the deny branch missed the eventType check.
resolveRequest now records decisions for PermissionRequest events — Was a no-op for those events, which broke "Always Allow" learning for MCP tools.
updatedInput (commit-message edits) no longer silently discarded — PermissionRequest events without an input field now log a warning instead of dropping the user's edits without trace.

fixMarch 27, 2026

CodePulse v2.3.27 — PermissionRequest Auto-Approve Format Fix

MCP tools matching auto-approve patterns silently failed because the bridge returned PreToolUse-format responses to PermissionRequest events. Now branches on event type.

Fixes (TAB-515)

PermissionRequest events now get the correct response format — When the approval engine auto-approved a PermissionRequest event (e.g. Linear MCP tools matching AUTO_APPROVE_PATTERNS), the bridge returned a PreToolUse-format response. Claude Code did not understand the wrong shape and silently blocked MCP tool calls — users saw "I'm unable to proceed — the Linear MCP tool requires your permission" but no approval card appeared. The immediate allow/deny paths now check eventType and emit the matching response format, restoring auto-approval for MCP tools.

fixMarch 27, 2026

CodePulse v2.3.26 — Send Logs Fresh-Eyes Security Review

Three medium findings from re-review of /send_logs: Worker error HTML escape, userId null guard, premium tier check based on tier (not licenseKey presence).

Fixes (TAB-514)

Worker error responses now HTML-escaped before rendering in Telegram — Prevented an XSS-via-crafted-error vector.
userId null guard added before getState() — Matches the pattern used by other Telegram command handlers.
Premium gate now checks tier === 'premium', not just licenseKey presence — Free-tier users with an expired key can no longer bypass the gate.
Static ESM import for os module + clearer bridge-vs-network error messages.

fixMarch 27, 2026

CodePulse v2.3.25 — Premium Auto-Enable + /send_logs Review Fixes

Adversarial review of TAB-512/514: configured-port respect, bridge-enabled guard, opt-out via .env override, clearer error messages.

Fixes

/send_logs now respects the configured APPROVAL_BRIDGE_PORT — Was hard-coded to 18321; users who set a custom bridge port saw collection failures.
Bridge-enabled guard added before log collection — Skips the bridge path entirely when APPROVAL_BRIDGE_ENABLED=false.
Premium auto-enable no longer overrides explicit .env values — Auto-enable applies only when the env var is undefined; users who set a feature to false can opt out cleanly.
Error message no longer claims "check your internet" — Distinguishes bridge HTTP errors from real network issues.

fixMarch 27, 2026

CodePulse v2.3.23 — Send Logs: Chief Architect Final Review

Final review pass on diagnostic log submission: real system info, crash report collection, fail-closed rate-limit increment, button cursor states.

Fixes (TAB-470)

Real system info in the diagnostic payload — RAM, CPU, and uptime are now populated rather than placeholder values.
Crash reports collected from the diagnostics directory — Adds historical context for debugging.
Rate-limit increment moved before the GitHub API call — Fail-closed behavior: a failed POST still consumes the per-hour quota, preventing retry storms.
Polished disabled-state cursor + UTF-8 stderr slicing safety in Rust.

fixMarch 27, 2026

CodePulse v2.3.22 — Send Logs: Fresh-Eyes Review Fixes

Second fresh-eyes review of diagnostic log submission: license-key KV verification, full sanitization coverage, code-fence escape, IP redaction, type coercion.

Fixes (TAB-470)

License key now verified in KV (not just format-checked) — Worker rejects submissions where the key is well-formed but unknown.
stopStats added to server-side sanitization — Previously slipped through the redaction layer.
Triple-backtick content escaped before being wrapped in code fences — Prevents user-controlled log lines from breaking out of the issue's <details> blocks.
errorLog properly wired through bridge and Rust paths — Was empty in fallback mode.
Numeric field type coercion + IP redaction added — Defense-in-depth for malformed or sensitive payloads.

fixMarch 27, 2026

CodePulse v2.3.21 — Send Logs: First Adversarial Review Fixes

First-pass review of the diagnostic log submission feature: UTF-8 boundary safety in Rust, Worker-side license validation, PII sanitization, GitHub Issue body size guard.

Fixes (TAB-470)

UTF-8 boundary panic in Rust string slicing fixed — Byte-level string slicing in the Tauri backend could panic on multi-byte characters; switched to char-boundary safe slicing.
Cloudflare Worker now validates license key existence — Previously accepted any submission; now verifies the key is present in KV before creating the issue.
Server-side PII sanitization — healthReport is sanitized on the service path; version labels and markdown table cells are escaped against injection.
GitHub Issue body size guard — Truncates oversized payloads to stay under the 65KB limit instead of failing the POST.

fixMarch 22, 2026

CodePulse v2.1.30 — Diagnostics Tab Fixes

Fixed stale version display, test pollution in crash reports, and version preservation across service restarts.

Bug Fixes

Fixed: Diagnostics version showing stale 2.1.20: The Diagnostics tab read the service version from a static health-report.json file written at startup — never refreshed. Added a version field to the /health endpoint so the launcher can show the live running version. Falls back to the static report version when the service is not running.
Fixed: Test pollution in crash reports: The crash-context unit tests wrote real crash reports to the production %APPDATA%\CodePulse\diagnostics/ directory, creating fake "crash 11" entries that appeared in the Diagnostics tab. Tests now redirect to a temporary directory and clean up after themselves.
Fixed: Version not preserved across service restart: When the service restarted, the version field was briefly lost (null) for ~5 seconds until the next status poll. All three state-update paths (refresh, start, stop) now consistently preserve the last known version when the service returns null.