Changelog

Fixes (TAB-515)

• PermissionRequest events now get the correct response format — When the approval engine auto-approved a PermissionRequest event (e.g. Linear MCP tools matching AUTO_APPROVE_PATTERNS), the bridge returned a PreToolUse-format response. Claude Code did not understand the wrong shape and silently blocked MCP tool calls — users saw "I'm unable to proceed — the Linear MCP tool requires your permission" but no approval card appeared. The immediate allow/deny paths now check eventType and emit the matching response format, restoring auto-approval for MCP tools.

Fixes (TAB-514)

• Worker error responses now HTML-escaped before rendering in Telegram — Prevented an XSS-via-crafted-error vector.
• userId null guard added before getState() — Matches the pattern used by other Telegram command handlers.
• Premium gate now checks tier === 'premium', not just licenseKey presence — Free-tier users with an expired key can no longer bypass the gate.
• Static ESM import for os module + clearer bridge-vs-network error messages.

Fixes

• /send_logs now respects the configured APPROVAL_BRIDGE_PORT — Was hard-coded to 18321; users who set a custom bridge port saw collection failures.
• Bridge-enabled guard added before log collection — Skips the bridge path entirely when APPROVAL_BRIDGE_ENABLED=false.
• Premium auto-enable no longer overrides explicit .env values — Auto-enable applies only when the env var is undefined; users who set a feature to false can opt out cleanly.
• Error message no longer claims "check your internet" — Distinguishes bridge HTTP errors from real network issues.

New Features

• Premium features auto-enable on license validation (TAB-512) — Pulse, Guardian, ErrorWatch, Bridge, CommitReview, MCP Heartbeat, and TCVF now flip on automatically when the service confirms premium status. Users no longer need to edit .env by hand to activate paid features.
• /send_logs Telegram command (TAB-514) — Collects diagnostic logs from the running service and submits them to GitHub from Telegram, mirroring the launcher button (TAB-470) for remote debugging.
• /manage surfaces specific Worker errors (TAB-513) — "No Stripe customer", "key not found", and similar conditions are reported with their actual message instead of a generic failure.

Fixes (TAB-470)

• Real system info in the diagnostic payload — RAM, CPU, and uptime are now populated rather than placeholder values.
• Crash reports collected from the diagnostics directory — Adds historical context for debugging.
• Rate-limit increment moved before the GitHub API call — Fail-closed behavior: a failed POST still consumes the per-hour quota, preventing retry storms.
• Polished disabled-state cursor + UTF-8 stderr slicing safety in Rust.

Fixes (TAB-470)

• License key now verified in KV (not just format-checked) — Worker rejects submissions where the key is well-formed but unknown.
• stopStats added to server-side sanitization — Previously slipped through the redaction layer.
• Triple-backtick content escaped before being wrapped in code fences — Prevents user-controlled log lines from breaking out of the issue's <details> blocks.
• errorLog properly wired through bridge and Rust paths — Was empty in fallback mode.
• Numeric field type coercion + IP redaction added — Defense-in-depth for malformed or sensitive payloads.

Fixes (TAB-470)

• UTF-8 boundary panic in Rust string slicing fixed — Byte-level string slicing in the Tauri backend could panic on multi-byte characters; switched to char-boundary safe slicing.
• Cloudflare Worker now validates license key existence — Previously accepted any submission; now verifies the key is present in KV before creating the issue.
• Server-side PII sanitization — healthReport is sanitized on the service path; version labels and markdown table cells are escaped against injection.
• GitHub Issue body size guard — Truncates oversized payloads to stay under the 65KB limit instead of failing the POST.

New Features (TAB-470)

• Send Diagnostic Logs button in the Help tab — One click collects sanitized logs (from the running service endpoint, or log files as fallback) and POSTs them to a Cloudflare Worker which creates a structured GitHub issue with system info, health report, stop stats, hook events, and log sections in expandable <details> blocks. Rate-limited to 3 submissions per hour per license key.

Bug Fixes

• Fixed: Diagnostics version showing stale 2.1.20: The Diagnostics tab read the service version from a static health-report.json file written at startup — never refreshed. Added a version field to the /health endpoint so the launcher can show the live running version. Falls back to the static report version when the service is not running.
• Fixed: Test pollution in crash reports: The crash-context unit tests wrote real crash reports to the production %APPDATA%\CodePulse\diagnostics/ directory, creating fake "crash 11" entries that appeared in the Diagnostics tab. Tests now redirect to a temporary directory and clean up after themselves.
• Fixed: Version not preserved across service restart: When the service restarted, the version field was briefly lost (null) for ~5 seconds until the next status poll. All three state-update paths (refresh, start, stop) now consistently preserve the last known version when the service returns null.

New Feature

• [Wait Quietly] Button on Status Cards: When Claude sends a status update ("Claude:" card with "Reply within 240s"), you previously had only two choices: [Reply] (which caused an infinite loop of cards) or [Stop] (which killed the session). The new [Wait Quietly] button redirects Claude to the wait_for_instructions MCP tool — the session stays alive, no more cards appear, and you can send a message whenever you're ready to continue.

How It Works

When you tap [Wait Quietly]:

1. Claude enters a quiet waiting state (MCP wait_for_instructions)
2. The card updates to "Waiting quietly. Send a message when ready."
3. No more status cards appear
4. The session stays alive — send a Telegram message anytime to resume

This only affects status cards (pass classification). Question cards ("Claude Needs Your Input") are unchanged — they don't have a loop problem.