Changelog

Bug Fixes

• Fixed: "Failed to persist license state" error: Every CodePulse installation hit this error on every license state change. The SQLite migration for the usage_month column used an expression default (strftime(...)) which SQLite rejects in ALTER TABLE ADD COLUMN. The migration failed silently, leaving the column missing. Fixed with a constant default followed by an UPDATE.
• Fixed: Dashboard Quick Stats showing misleading zeros: Sessions Today and Commits Reviewed are premium-only metrics sourced from API cost tracking and commit review engine respectively. Free-tier users saw confusing "0" values. Now displays a lock icon with a gold "Upgrade" link to the pricing page instead.
• Fixed: Commit approval timeout too short: APPROVAL_BRIDGE_TIMEOUT increased from 120 seconds to 360 seconds (6 minutes). Mobile users on phone calls or temporarily away from their device had commits auto-denied with "Commit timed out - Denied (120)" before they could respond.
• Fixed: Timeout layers misaligned: Three independent timeout values (CLI hook timeout, hook script HTTP timeout, bridge approval timeout) were out of sync at 120s, 120s, and 360s respectively. The CLI killed the hook process at 120s while the bridge waited alone for 240 more seconds with no one listening. All three layers now aligned at 360 seconds.
• Fixed: Hook crash silently auto-allows commands: When the hook script crashed for any reason, the outer catch swallowed errors silently with no output. Claude Code received nothing, treated it as "no decision," and auto-allowed the command — including git commits — without Telegram approval. Now outputs a PreToolUse deny response on crash (fail-closed), blocking the command safely while keeping Claude's context clean.

Bug Fixes

• Fixed: "Failed to persist license state" error: Every CodePulse installation hit this error on every license state change. The SQLite migration for the usage_month column used an expression default (strftime(...)) which SQLite rejects in ALTER TABLE ADD COLUMN. The migration failed silently, leaving the column missing. Fixed with a constant default followed by an UPDATE.
• Fixed: Dashboard Quick Stats showing misleading zeros: Sessions Today and Commits Reviewed are premium-only metrics sourced from API cost tracking and commit review engine respectively. Free-tier users saw confusing "0" values. Now displays a 🔒 lock icon with a gold "Upgrade" link to the pricing page instead.
• Fixed: Commit approval timeout too short: APPROVAL_BRIDGE_TIMEOUT increased from 120 seconds to 360 seconds (6 minutes). Mobile users on phone calls or temporarily away from their device had commits auto-denied with "Commit timed out - Denied (120)" before they could respond.
• Fixed: Timeout layers misaligned: Three independent timeout values (CLI hook timeout, hook script HTTP timeout, bridge approval timeout) were out of sync at 120s, 120s, and 360s respectively. The CLI killed the hook process at 120s while the bridge waited alone for 240 more seconds with no one listening. All three layers now aligned at 360 seconds.

Bug Fixes

• Fixed: Questions invisible on stop cards: Claude's stop messages put context first and the question last. The old truncate(message, 500) cut at 500 characters — always removing the question. New truncatePreserveTail() with 3,000-character limit preserves both the beginning (context) and end (question). Telegram supports 4,096 characters — the old limit was 7x too aggressive.
• Fixed: "Claude Needs Your Input" card design: Replaced the triple exclamation header (❗❗❗ CLAUDE NEEDS YOUR INPUT ❗❗❗) that spanned two rows on mobile with a clean single-line 🔴 Claude Needs Your Input. Removed separator line clutter and centered the footer for better readability.
• Fixed: STATUS_CARD 30-second timeout: The "Reply within 30s or Claude stops" timeout was nearly impossible for mobile users. Hook processing + push notification delivery consumed 10-15 seconds, leaving only 15-20 seconds to read and respond. Increased to 240 seconds — matching the QUESTION_CARD timeout.
• Fixed: False "Reply sent to Claude" after timeout: When a user tapped "Reply" then typed their answer after the stop timed out, they saw "Reply sent to Claude" even though Claude had already stopped. The pendingStopReplies entry survived the timeout. Now clearPendingStopReplies(stopId) is called on timeout, ensuring users always see "Question expired" when replying late.

New Features

• Session Intelligence Digest: When Claude finishes a task and enters wait_for_instructions, the /loop watchdog evaluates the session risk score. Medium-risk sessions (score ≥16) receive an enriched digest card showing file heat map, test cycle sequence, bash failure rate, and a risk assessment. High-risk sessions (score ≥31) auto-trigger T4 QA verification.
• Digest Card Buttons: Medium-risk cards offer three actions: [▶ Continue] (resume session), [🔍 Run QA Check] (manually trigger T4 verification), and [⏹ End Session] (stop Claude). High-risk cards show [🔍 QA in Progress...] as T4 runs automatically.
• getDigestSnapshot() API: New method on SessionIntelligenceEngine returns a structured snapshot with risk score, file heat map (top 5 by edit count), test cycle sequence (last 10), bash health metrics, and scope drift detection.

Improvements

• Configurable Thresholds: Three new config fields control digest behavior: SESSION_DIGEST_ENABLED, SESSION_DIGEST_MIN_RISK (default 16), and SESSION_DIGEST_AUTO_QA_THRESHOLD (default 31). Startup validation warns when thresholds are inverted.
• TCVF Dependency Warning: Startup now warns when SESSION_DIGEST_ENABLED=true but TCVF_ENABLED=false — digests require TCVF intelligence data to compute risk scores.
• Idempotent Digest Delivery: Only one digest card per MCP wait cycle. The digestSentForWaitIds set prevents duplicates and is cleaned up in all 4 disposal paths.

Technical

• sessionIntelligence field added to GET /mcp/status response for external watchdog consumption.
• session_digest type added to POST /notify with threshold gating, idempotency, and per-waitId tracking.
• Idempotency marked after successful callback (not before try) to prevent poisoning on transient Telegram failures.
• 12 new tests covering snapshot generation, notify flow, idempotency, and threshold behavior.

New Features

• MCP Heartbeat Watchdog (Layer 2.5): An external /loop watchdog that runs in the developer's own Claude Code session and monitors the keep-alive connection every 15-20 minutes. When problems are detected, Telegram alert cards are sent directly to the user — not terminal output. Three alert types: bridge-down (🔴), no active MCP wait (🟡), and stale heartbeat ping (🟠).
• GET /mcp/status Endpoint: Rich health-check returning bridge liveness, MCP wait state, ping freshness, and configuration values. Used by the /loop watchdog and available for external monitoring.
• POST /notify Endpoint: Internal notification endpoint that accepts watchdog alert types and routes them to Telegram. 60-second throttle prevents alert storms. Validated against a type whitelist.
• Watchdog Telegram Cards: Three card templates with actionable buttons. [Restart Session] shuts down the PersistentCliBridge. [Check Status] shows current bridge state inline.

Improvements

• Liveness Ping Interval: A setInterval inside handleMcpWait() updates lastPingSentAt every 5 seconds. If the event loop hangs, the interval stops and /mcp/status reports growing lastPingAgeMs — signaling staleness.
• Configurable Endpoints: MCP_STATUS_ENDPOINT_ENABLED and NOTIFY_ENDPOINT_ENABLED config flags allow disabling either endpoint. WATCHDOG_STALE_PING_THRESHOLD_MS (default 30s) configures the stale ping detection threshold.

Technical

• Ping interval handle stored on PendingMcpWait interface for explicit cleanup in all 4 disposal paths (resolve, timeout, stale cleanup, shutdown).
• 16 new tests covering status responses, notify types, throttling, error handling, and edge cases.
• /loop command variants documented in CLAUDE.md for copy-paste usage.

New Features

• 9-Class Exploit Taxonomy: Embedded adversarial security intelligence directly into three existing CodePulse features — CommitReviewEngine, /review command, and T4 verification pipeline. Nine exploit classes detect vulnerabilities that were previously invisible: INJECTION, SECRETS, CODE_QUALITY, FAIL_OPEN, RACE_CONDITION, STATE_LEAK, BYPASS, PRIVILEGE_ESCALATION, and INPUT_VALIDATION. Zero additional API cost — the intelligence is baked into existing Haiku prompts.
• Exploit-Class Challenge Templates: T4 verification now generates targeted security challenges based on detected exploit classes. Critical classes (INJECTION, SECRETS, BYPASS) are prioritized over warning classes. Each challenge asks Claude to prove the vulnerability was actually addressed.
• Security Findings in GitHub PR Reviews: The /review command now includes structured security findings in GitHub PR review comments, with severity icons and fix suggestions.

Improvements

• Per-Project Exploit Class Isolation: In multi-project mode, exploit classes from one project cannot contaminate another project's T4 challenges. Each project has its own isolated exploit class storage.
• Single Source of Truth: VALID_EXPLOIT_CLASSES consolidated from 3 duplicated arrays into one constant, preventing future drift.
• Per-Exploit-Class Metrics: Dashboard stats endpoint now tracks finding counts per exploit class for trend visibility.
• TypeScript Clean Build: Resolved all 5 pre-existing TypeScript compilation errors. tsc --noEmit now passes with zero errors.

Technical

• 40+ new tests across 4 test files covering security findings parsing, exploit-class challenge injection, session intelligence storage, and commit review integration.
• COMMIT_REVIEW_DETAIL_ITEM template updated to show exploit class in expanded Details view.
• T4 verdict card now shows [EXPLOIT_CLASS] label on failed security challenges.
• GitHub markdown injection prevented with escapeMd() for message and fix fields.

Bug Fix

• Real-Time Text Forwarding: When Claude Code writes a summary, URL, or analysis and then launches a long-running tool (Agent, Bash), the text now appears on Telegram immediately instead of being held for 5-15 minutes until the tool finishes. Previously, text before an Agent call was buffered and only delivered with the final result — or lost entirely if the response was too large.

Improvements

• Smart Flush Targeting: Text is only flushed before potentially long-running tools (Agent, Bash, Task, WebFetch, WebSearch). Fast tools like Read, Edit, Glob, and Grep do not trigger a flush, preventing notification spam during /approve_all rapid tool bursts.
• Buffer Safety: The text buffer is cleared at the start of every turn and on shutdown, preventing stale text from a previous abnormal exit (security kill, hang timeout, OOM) from leaking into subsequent turns.
• Unicode-Safe Truncation: Real-time text messages are truncated at 3,500 characters (conservative limit for Telegram's 4,096 UTF-8 byte cap) to handle multi-byte Unicode safely.

New Features

• Built-in Auto-Updater: CodePulse now checks for updates automatically via the system tray menu. Click "Check for Updates" to download and install new versions silently. Every installer is signed with ed25519 (minisign) and verified before installation. This is the last version you need to install manually — all future updates arrive automatically.
• GitHub Actions CI/CD: Full release pipeline in the cloud. Push a v* tag and GitHub Actions builds the service exe, launcher exe, NSIS installer, signs for the auto-updater, uploads to Cloudflare R2, deploys the Worker, and creates a GitHub Release — all on a Windows runner with zero local resources needed.
• One-Command Release: release.ps1 -Version "X.Y.Z" bumps version in all 6 files, builds all components, signs, uploads, deploys, and tags in a single command.
• Selective Builds: The release pipeline detects what changed since the last release tag and only rebuilds affected components. Service-only changes skip the launcher build entirely, cutting most releases from 2 minutes to 10 seconds.

Improvements

• Version Bump Automation: All 6 version files (package.json, constants.ts, launcher package.json, tauri.conf.json, Cargo.toml, NSIS script) are bumped atomically by the release script. No more manual edits across multiple files.
• Auto-Updater Manifest: Each release generates and uploads an update.json manifest to Cloudflare R2, containing the version, download URL, and cryptographic signature. The launcher checks this endpoint on demand.
• Git Tagging: Release tags are created and pushed automatically as part of the pipeline, triggering the CI/CD workflow.

Technical

• Tauri v2 updater plugin with installMode: "quiet" (passes /S to the NSIS installer for silent upgrades).
• Updater public key embedded in tauri.conf.json; private key stored as GitHub Actions secret.
• Rust cache (Swatinem/rust-cache@v2) reduces CI build time from ~20 minutes to ~5-7 minutes on subsequent runs.

UX Improvements

• Inline Save Configuration: Added a prominent "Save Configuration" button directly next to "Test Connection" in the Telegram section, so users no longer need to scroll to the bottom of the page to save their settings.
• Save Guidance Banner: After a successful Telegram connection test, a gold-tinted hint banner appears prompting the user to save and restart the service — making the required next step immediately clear.
• Persistent Save State: The "Saved" indicator now persists when switching between tabs. Previously, navigating away from Configuration and returning would reset the button to its unsaved state even though no changes were made.
• Uninstall from Help Tab: Added an "Uninstall CodePulse" button to the Help & Resources screen, launching the system uninstaller directly from within the app.
• Footer Link Fix: The "Made by 4brainiacs" link in the Help tab now correctly points to the GitHub organization page instead of the marketing website.

Critical Fixes

• Process Detection Rewrite: Bun-compiled binaries are invisible to Windows tasklist and taskkill (Win32 process enumeration). Replaced all process management with PowerShell Get-Process and Stop-Process (.NET API), which correctly detects and controls Bun-compiled services.
• Service Startup Crashes: Fixed TELEGRAM_ALLOWED_USERS throwing on empty value — now falls back to TELEGRAM_CHAT_ID. Fixed hook script path resolution pointing to the wrong directory in compiled binaries.
• Nested Session Detection: Stripped the CLAUDECODE environment variable before spawning Claude Code CLI, preventing instant "no output for 180s" errors when CodePulse itself runs inside a Claude Code terminal.
• Approval Bridge Default: Changed .env.example default for APPROVAL_BRIDGE_ENABLED from false to true, fixing new installations silently skipping the entire Telegram approval pipeline.

UX Improvements

• Async IPC: All service start/stop/status commands now run asynchronously via spawn_blocking, eliminating the 2-3 second UI freeze during service operations.
• Loading Animation: The Start/Stop Service button shows a pulsing dots animation while the operation is in progress.
• Error Banners: Service errors are displayed inline on the dashboard instead of failing silently.
• Smart Activity Feed: Recent Activity now parses JSON log format, filters out noisy internal messages (bridge requests, path resolution), and displays clean timestamps with color-coded log levels.

Telegram Commands

• /license and /subscribe: Now gracefully fall back to codepulse.at/pricing when Stripe API keys are not configured, instead of showing "Failed to create checkout session."