Changelog

Release history — all CodePulse updates in one place - Page 4

All Releases Features Fixes Improvements

featureApril 19, 2026

CodePulse v2.3.107 — QR pairing firewall rule + multi-NIC hardening

Production hardening for QR pairing: installer now provisions a Windows Firewall rule, Rust ranks multi-NIC machines correctly, and a StrictMode unmount race in the retry handler is fixed.

QR Pairing Production Hardening (TAB-510 — TAB-482 Phase 6)

Windows Firewall rule provisioned by the installer — The NSIS installer now adds an inbound TCP allow rule named "CodePulse QR Pairing" scoped to $INSTDIR\codepulse-panel.exe, eliminating the undifferentiated first-run OS firewall dialog. The uninstaller removes the rule as Step 2 of 6 so the path reference is still resolvable at teardown time. A new check_firewall_rule Tauri command surfaces a gold-styled warning banner if the rule is missing, and fails open on unexpected netsh exit codes to avoid blocking pairing over a diagnostics misread.
Multi-NIC ranking replaces first-interface selection — local_ip() gave way to a ranked enumeration via list_afinet_netifas() with is_usable_lan rejecting loopback, link-local, Docker bridges, and all IPv6, and lan_preference_rank ordering 192.168.x > 10.x > other private > Tailscale CGNAT > WSL2/Hyper-V. Tiebreakers use a u32-packed numeric IP value for reboot-stable ordering. A grey "Trouble connecting?" hint appears when more than one candidate is detected.
StrictMode retry race fixed — unmountedRef is now reset to false inside the useEffect setup on each mount. Previously, React StrictMode's mount-unmount-remount cycle could leave the flag permanently true, silently killing every retry attempt in PairingCard.

featureApril 18, 2026

CodePulse v2.3.106 — QR pairing goes live end-to-end

Pair a Telegram bot in under 30 seconds by scanning a QR code. LAN HTTP server, Telegram polling, .env persistence, and a React PairingCard UI all ship together as the first working release of the TAB-482 epic.

QR Pairing — First Working Release (TAB-482 Epic)

LAN HTTP server and QR generation (TAB-506) — An axum server binds to the machine's primary LAN IP (not 0.0.0.0) and serves a nonce-bound HTML form. The pairing URL is rendered as an SVG QR code via fast_qr. Bot-token submissions are validated against the nonce using a timing-safe compare, and a monotonic session_epoch re-verify eliminates the TOCTOU race between status check and state commit.
Telegram polling and user_id capture (TAB-507) — After the phone POSTs the bot token, a background task long-polls getUpdates until the /start message is received and captures the sender's user_id automatically. The service is stopped before polling begins to avoid a 409 Conflict and is restarted on every exit path. Bot tokens are scrubbed from reqwest error messages before logging, closing TAB-470's support-log exfiltration vector.
.env write, service restart, and token event (TAB-508) — finalize_pairing writes TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, and TELEGRAM_ALLOWED_USERS to .env via an atomic tmp+fsync+rename sequence, merges rather than overwrites the allowed-users list to preserve co-admin setups, and restarts the service with the new credentials. Only a masked token ever crosses the IPC boundary.
React PairingCard UI (TAB-509) — A 777-line component covers the four visual states (starting, waiting_for_token, waiting_for_user, complete) and is wired into both FirstRunWizard (first-time setup) and Configuration (re-pair), behind a <details> fallback so the existing manual form stays available. Gold brand styling throughout, shared Spinner/Checkmark primitives extracted to Icons.tsx.

featureApril 17, 2026

CodePulse v2.3.105 — QR pairing scaffold

Backend scaffold for QR-based Telegram bot pairing — dependencies and Tauri command stubs land. No user-visible flow yet; the end-to-end experience ships in v2.3.106.

QR Pairing Scaffold (TAB-505)

Foundation for the QR pairing epic — Adds the fast_qr and axum dependencies, introduces the pairing.rs module, and registers three Tauri command stubs (start_pairing, receive_token, cancel_pairing) that return Err(...) placeholders. This is a preparatory release — the user-visible pair-in-30-seconds QR flow arrives in v2.3.106 once Phases 2-5 are wired in.

fixApril 15, 2026

CodePulse v2.3.104 — Park UltraPlan command, revert v2.3.103 experiment

Parks the UltraPlan command path because the underlying CLI lacks the --remote flag required for cloud sessions. Reverts the v2.3.103 raw keyword detection experiment.

UltraPlan (TAB-580)

Park the command, revert the experiment — The v2.3.103 raw keyword detection change is reverted, and the UltraPlan command itself is parked because the Claude Code CLI does not yet expose a --remote flag needed to target cloud execution sessions. Restores the prior XML-wrapped, plan-mode routing so the remaining UltraPlan features keep working unchanged while we wait for upstream CLI support.

featureApril 15, 2026

CodePulse v2.3.103 — UltraPlan raw keyword detection test

Experimental change to UltraPlan keyword detection — drops XML wrapping and plan mode to test whether raw keyword parsing improves cloud-session routing.

UltraPlan (TAB-580)

Raw keyword detection experiment — UltraPlan no longer wraps the user's prompt in XML tags and no longer enters plan mode before routing. This release tests whether the LLM reliably picks up "ultraplan" keywords from the raw message body alone, which would simplify the execution path and remove an entire layer of prompt plumbing. Rolled back in v2.3.104 after the cloud-session path was found to lack a required --remote flag.

fixApril 14, 2026

CodePulse v2.3.102 — Exempt .example/.sample from Safety Check

Files ending in .example or .sample are now exempt from the excluded path safety check. This prevents false positives when working with template configuration files.

Bug Fixes

Exempt .example/.sample files from excluded path check — The safety module's excluded path check was flagging files like .env.example and config.sample as sensitive, preventing Claude from reading or modifying them. These template files are safe to access (they contain placeholder values, not real secrets), so the check now exempts paths ending in .example or .sample.

fixApril 14, 2026

CodePulse v2.3.101 — UltraPlan UI Cleanup

Removed the dead 'Open in Browser' text button from UltraPlan cards. The URL button now only appears when a session URL is actually available.

Bug Fixes (TAB-580)

Remove dead "Open in Browser" text button — The UltraPlan card included a plain-text "Open in Browser" button that was never functional (Telegram requires URL buttons for external links). Removed the dead button and ensured the URL button variant only renders when a valid session URL is available.

fixApril 14, 2026

CodePulse v2.3.100 — Escape All Angle Brackets in User Prompts

All angle brackets in user prompts are now escaped, not just the 5 previously allowlisted tags. Closes a potential prompt injection vector via crafted XML-like input.

Security Fix (TAB-581)

Escape ALL angle brackets in user prompts — The previous implementation only escaped 5 specific allowlisted XML tags (<task>, <context>, etc.) in user input before passing it to the LLM. Any other angle-bracket content passed through unescaped, creating a potential prompt injection vector where crafted XML-like input could interfere with the system prompt structure. All angle brackets are now escaped universally, with the allowlist applied only after escaping to restore known-safe structural tags.

featureApril 14, 2026

CodePulse v2.3.99 — UltraPlan Phase 3: Cloud Execution + PR Cards

UltraPlan now detects cloud execution completion and shows a PR notification card with a direct link when the task creates or updates a pull request.

New Features (TAB-580, Phase 3)

Cloud execution detection — UltraPlan monitors the CLI session for completion signals. When the task finishes, the Telegram card updates automatically from "Executing..." to a completion summary with the number of files changed and a brief description of what was done.
PR notification card — If the executed task creates or updates a pull request, a dedicated PR card appears with the PR title, branch name, and a direct link to the PR on GitHub. This closes the loop from planning to PR without leaving Telegram.

fixApril 14, 2026

CodePulse v2.3.98 — UltraPlan Per-User Bridge Map

UltraPlan now uses a per-user bridge map, extracts regex constants, and adds a dedicated executing keyboard to prevent cross-user session conflicts.

Bug Fixes (TAB-580)

Per-user bridge map — UltraPlan sessions were stored in a global map keyed only by session ID. In multi-user setups, this could cause one user's execution to interfere with another's. The map is now keyed by userId:sessionId, preventing cross-user conflicts.
Regex constants extracted — Inline regex patterns used for URL and plan parsing were extracted into named constants for readability and to ensure consistent behavior across the module.
Dedicated executing keyboard — Added a purpose-built Telegram inline keyboard for the "executing" state, showing a Stop button and progress indicator.

featureApril 18, 2026

CodePulse v2.3.106 — QR pairing goes live end-to-end

QR Pairing — First Working Release (TAB-482 Epic)

LAN HTTP server and QR generation (TAB-506) — An axum server binds to the machine's primary LAN IP (not 0.0.0.0) and serves a nonce-bound HTML form. The pairing URL is rendered as an SVG QR code via fast_qr. Bot-token submissions are validated against the nonce using a timing-safe compare, and a monotonic session_epoch re-verify eliminates the TOCTOU race between status check and state commit.
Telegram polling and user_id capture (TAB-507) — After the phone POSTs the bot token, a background task long-polls getUpdates until the /start message is received and captures the sender's user_id automatically. The service is stopped before polling begins to avoid a 409 Conflict and is restarted on every exit path. Bot tokens are scrubbed from reqwest error messages before logging, closing TAB-470's support-log exfiltration vector.
.env write, service restart, and token event (TAB-508) — finalize_pairing writes TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, and TELEGRAM_ALLOWED_USERS to .env via an atomic tmp+fsync+rename sequence, merges rather than overwrites the allowed-users list to preserve co-admin setups, and restarts the service with the new credentials. Only a masked token ever crosses the IPC boundary.
React PairingCard UI (TAB-509) — A 777-line component covers the four visual states (starting, waiting_for_token, waiting_for_user, complete) and is wired into both FirstRunWizard (first-time setup) and Configuration (re-pair), behind a <details> fallback so the existing manual form stays available. Gold brand styling throughout, shared Spinner/Checkmark primitives extracted to Icons.tsx.