EpiScope 0.10

Added

• Ad-hoc insights over the sessions you picked. The Analyze Sessions
  toolbar dropdown runs What Was Done or Ask a Question… over the selected
  rows — the table now allows multi-selection, and a selected group header
  stands for all of its sessions. With nothing selected the scope is everything
  the table currently shows, filters applied; a range brushed on the chart
  clips both the metrics and the conversations the run reads. Results are
  ordinary reports in the same Insights list as the scheduled ones.
• Rename a session. Rename… in the row's context menu edits the title in
  place, Restore Original Title puts the provider's back. The alias is
  EpiScope's own, kept per session id, survives reindexing, and works for every
  provider; the table, the filter field, chart labels, the status-bar menu and
  notifications all use it, and the original title stays in the tooltip.
• Codex lifecycle hooks. EpiScope installs its own handlers in
  ~/.codex/hooks.json, so a Codex session reports thinking, permission and
  finished states the moment they happen instead of being inferred from its
  rollout file. Existing hooks and the legacy notify command are left
  untouched, and Codex may ask you to approve the new handlers once in
  /hooks; until then the rollout fallbacks keep working.
• Settings → Integrations shows what the Claude Code and Codex integrations
  are actually doing: installed, needs repair, custom script, disabled by the
  tool, or unparseable config — with a Repair button that backs up a
  user-managed file before restoring the managed one.
• Codex Desktop tasks are first-class. They are recognised from the
  rollout itself, carry the app's icon, open at the exact thread even when the
  task is weeks old, take their name from the Desktop sidebar, and a task with
  no project is labelled Projectless instead of a scratch directory. Codex's
  internal helper rollouts no longer appear as sessions of their own.
• Remcode sessions are identified from Remcode's own catalog and open at
  the exact session in the app, instead of showing the generic
  non-interactive badge with nowhere to go.

Changed

• Full-text search results are newest first. Text rank only breaks ties, so
  a broad query no longer buries this morning's work under an old message whose
  term frequency happened to score better.
• The status-bar fleet menu keeps up while it is open: sessions appear and
  disappear, move between Needs attention and Active, and their times keep
  running without closing and reopening the menu.
• Claude's state bridge moved to ~/.claude/hooks/episcope-state.sh and is
  driven by PostToolBatch and StopFailure — a batch that failed now ends
  the turn instead of leaving it thinking, and an existing tab-state.sh from
  a dotfiles repo is left alone.
• Opening a failed turn records that you have seen it for notification
  purposes, but the amber menu-bar blink stays until the session actually
  reports a new state.

Fixed

• Sessions in worktrees and dot-directories are found again. Recent Claude
  Code builds also fold /.claude/ into --claude-, so a transcript could no
  longer be located by re-encoding its working directory; discovery keeps the
  exact path it saw.
• A deep scan that failed part-way left a stub that file size and mtime alone
  turned into a permanent cache hit — the session kept showing no tokens, cost
  or changes until the whole index was rebuilt.
• A session resumed after /clear is no longer presented as Cleared once its
  transcript has activity newer than the handoff.
• Codex limits survive the way Desktop works: a resumed task keeps its original
  date folder, so limits are read from the rollouts that are actually open;
  several recent files are tried when the newest one has not reported yet; and
  a known account snapshot is kept through transient read misses, with each
  window rolling to zero at its own reset.
• Several Codex Desktop tasks sharing one helper process are tracked
  separately instead of collapsing into whichever rollout was seen last, and a
  long turn whose start scrolled out of the rollout tail is no longer read as
  idle.
• Claude Code installed by its native installer is bound to its terminal again
  — the launcher is a symlink to a version-named executable, which the wrapper
  check used to reject.
• Upgrading the index format no longer rebuilds every transcript: the new Codex
  provenance is read from one record per rollout, so the upgrade costs seconds
  instead of a multi-gigabyte re-read. A cold scan also stopped reading forked
  transcripts twice.
• Multi-row selection is preserved across the background indexer's refreshes,
  and an in-place rename is not overwritten by a live repaint mid-edit.

Security

• The state hook publishes each signal as a fresh private file and renames it
  into place, so a planted sig-<id> symlink cannot redirect the write, and it
  parses the hook's JSON with plutil rather than letting hook-controlled text
  reach the shell. A session id that is not filename-safe is ignored.
• Neither integration overwrites a file it does not own: a script at the
  reserved path without EpiScope's marker is left alone by the automatic
  install, and explicit Repair saves it as .user.bak first — replacing only
  the reserved symlink, never its target.
• A Claude wrapper process is accepted as a session's host only when a
  conventional launcher path is owner-only writable and resolves to exactly the
  running executable.

EpiScope 0.9

[0.9] — 2026-08-17

Added

• A proper Settings window (⌘,) brings Alerts, Sources and Insights into
  one system-style sidebar. It exposes notification permission, previews the
  selected alert sound, and lets every analysis prompt be edited and restored
  without finding its file in Application Support.
• A totals strip under the session table adds up the rows currently on
  screen: tokens, changes, turns, user messages, cost and permission wait. It
  follows filtering, grouping, column visibility and live session state.
• Stop Session ends a live Claude Code or Codex CLI session from the table.
  Work in progress and permission prompts require confirmation; Delete stops a
  running CLI process EpiScope owns first and waits for it to exit before
  moving its transcript to the Trash.
• A 30-day chart window, with four-hour bars and date guides every two
  days. The optional Chart Window Only setting limits the table to the same
  period, so the chart, rows and totals describe one fleet slice.
• Explicit fork, parked and cleared lifecycle states. A conversation parked
  with ⌃B points to its continuation, a fork that added no work is marked
  superseded, and /clear marks the previous conversation Cleared.

Changed

• Directory replaces Path in the default table. It shows only the final
  project-directory name and keeps the table compact; the complete Path is now
  a separate column, hidden by default and available from the column picker.
• Last Activity now means conversation activity, read from timestamped
  transcript records. Provider bookkeeping can still update a file's mtime
  without making an old session look newly active.
• Claude Desktop Code tabs offer the ordinary CLI actions their mirrored
  transcripts support — Copy Resume Command and Delete — while Stop remains
  unavailable because the tab is owned by the desktop app.
• Parked and cleared sessions remain available as history but no longer count
  as running, accumulate busy or permission-wait time, animate the menu bar, or
  raise chimes and notifications.

Fixed

• Forked and parked transcripts no longer double-count inherited tokens, turns,
  user messages or changed lines; each copied record is charged to one session.
• Empty Codex rollouts created by IDE metadata are hidden until they contain a
  real conversation. During an index-format upgrade, the previous complete
  index stays visible until the replacement is ready.
• Claude technical runtime labels no longer replace the user-facing session
  description, and new provider-generated prompt wrappers are not mistaken for
  titles.
• Custom Sources can point at a mounted home or backup: recognised Claude Code,
  Codex and Claude Desktop roots are found below the selected directory and
  merged into the local snapshot. Built-in source rows no longer enable
  inapplicable Sync, Clear Cache or Remove actions.
• IntelliJ-family sessions open the existing project instead of creating a new
  one, and finished turns are surfaced even when the hosting application's
  window focus cannot be observed.
• Switching Insights prompt templates cannot save template A's pending text
  over template B. Empty overrides are rejected, and empty files left by an
  older release no longer shadow the bundled prompt.
• Live totals update when a session starts, stops or waits, and repaint when a
  relevant column is shown or hidden.
• The 30-day usage and limits grids stay on local midnight across
  daylight-saving changes.
• A live Codex session no longer causes a full process-table walk every second;
  that fallback is limited to SDK-driven Claude sessions that need it.

Security

• Stop and Delete no longer trust a PID read from provider-owned state alone.
  EpiScope validates the executable and structured argv, captures the kernel
  process start time, rechecks the identity after confirmation, and for Codex
  verifies the process that owns the exact rollout file. PID reuse or a session
  restarted while a sheet is open fails closed: nothing is signalled or
  deleted.
• /clear is recognised only from the exact structured hook-success record;
  matching text nested inside untrusted transcript content cannot reset a
  session's title or lifecycle state.

EpiScope 0.8

Menu-bar monitor for Claude Code, Codex and Claude Desktop sessions on macOS.

Install — download EpiScope-0.8.dmg below and drag the app to /Applications, or:

brew install --cask AlmazKo/tap/episcope

Requires macOS 14.0 (Sonoma) or newer. Universal binary, signed and notarized.

Added

• Codex as an analysis engine — Insights can run through codex exec as
  well as claude -p. The Codex entry names no model: ~/.codex/config.toml
  already holds one, and which names a CLI accepts moves faster than a menu can
  track. Containment matches the Claude run — a read-only sandbox, no inherited
  MCP servers, and nothing persisted to the operator's Codex history.
• A time range dragged on the chart narrows the table to the sessions that
  billed tokens inside it. A drag has to travel 10 pt before it counts, so a
  plain click stays a click; clicking the chart clears the range and the
  selection together.
• A bar explains itself on hover — a panel beside it names the interval and
  the total, then breaks the total down by the sessions stacked in it, largest
  first, each line leading with its figure and carrying the swatch its segment
  is drawn in.
• A session's lifecycle on the usage chart's axis.
• Columns are picked by right-clicking the table header, the same list
  Settings offers.
• An empty table says why it is empty and names the narrowing responsible,
  with a Show all button that drops range, filter text and selection at once.
• Resilient session sources, and Insights runs link back to the sessions
  they were built from.
• Claude Desktop Code tabs open by their own route — recent builds mirror a
  tab's transcript under the CLI id while addressing the tab as local_<uuid>,
  and claude://code/<cli-id> was accepted and then silently dropped.

Changed

• Analysis failures appear in the runs list, not in a dialog. The runs are
  scheduled, so a modal landed over unrelated work to report something already
  on screen. A failure that never started is recorded too, rather than only
  raising the alert that used to be its sole trace.
• The Sources picker leaves the toolbar — which sources count is decided in
  Settings → Session Sources…, the one place that governs them.
• The README leads with what the app is for, and shows it.

Fixed

• The chart's crosshair never appeared: cursor rects are computed once and
  cached, and the chart is still empty when that first happens.
• A press painted a one-pixel range before travelling anywhere, so a click meant
  to clear things flashed a selection.
• The hover marker sat against the bar's left edge — it was placed from the time
  axis, which maps a bucket's start rather than the bar's middle.
• Codex runs reported their reason as an exit code and a stderr warning it
  prints on healthy runs too; the actual message arrives in the event stream.
• Line churn is counted from unlabelled Edit results.

EpiScope 0.7

Menu-bar monitor for Claude Code, Codex and Claude Desktop sessions on macOS.

Install — download EpiScope-0.7.dmg below and drag the app to /Applications, or:

brew install --cask AlmazKo/tap/episcope

Requires macOS 14.0 (Sonoma) or newer. Universal binary, signed and notarized.

Added

• Menu-bar fleet chart — the status item draws six fixed slots, one per
  session that is busy or needs you: dashes scroll while a session works, the
  bar turns red and blinks at 1 Hz on a permission prompt, amber at 0.5 Hz when
  a turn is waiting on you. The dropdown splits into Needs attention and
  Active, each row with a coloured state icon.
• Error state — a Claude API stream that dies without a Stop hook, or a
  Codex turn that ends in a terminal error, shows a neutral Error badge in the
  table instead of masquerading as Idle or Busy. Deliberately not an attention
  state: no blink, no sound, no banner.
• Session context in notifications — a banner carries the session's
  AI-generated description, so several waiting sessions are tellable apart
  without opening the app.
• Host application icons — any app hosting a session gets its real icon,
  including terminals EpiScope has no adapter for.

Changed

• One owner for expensive work. Every transcript walk, index pass, chart
  fold and CLI run goes through a single scheduler: exclusion groups (at most
  one walk at a time, structurally), leases so a minutes-long child process
  holds its group without parking a thread, coalescing that also sees work
  already running, and launch admission so a cold start belongs to the visible
  table rather than the full-text backfill.
• Incremental scanning for all three providers. Codex and Claude Desktop
  folded their whole transcript on every pass — up to 12 MB re-decoded once a
  second for a live session; they now fold only the appended tail. The
  rate-limit walk and the tool-activity summary stopped re-reading the corpus
  as well.
• Per-provider behaviour lives on the type. SessionProvider answers with
  exhaustive switches, so a new provider fails to compile instead of silently
  inheriting Claude's answer; the project-directory codec has one home.

Fixed

• Codex and Claude Desktop sessions were silently missing from every daily and
  weekly report, which therefore understated the fleet's cost.
• The weekly report was lost every Monday: the week was marked done before the
  run started, and the run was then refused because the daily one was still
  preparing.
• Deep search returned nothing for the whole session on a fresh install — the
  read connection opened before the database file existed and never retried.
• The chart grouped and coloured half the projects under paths the table never
  showed, because a hyphenated project name decodes ambiguously from its
  directory.
• Clicking the Model, Name or Started headers moved the sort arrow without
  reordering anything.
• A live Codex or Claude Desktop row blanked its title, project and cost once a
  second while being rescanned.
• Codex token accounting and rate-limit window mapping.

Security

• cc-open interpolated a value from ~/.claude/state/cc-states.json into
  AppleScript source, so a forged snapshot could run arbitrary commands from a
  row double-click or a notification tap. Window and tab now go in as
  arguments.
• Rendered Markdown made any URL clickable and the system opener honours
  file://, so a link in model output was one click from launching something.
  Only web links stay clickable.
• Session ids from other tools' files named files we create and delete without
  validation, so a crafted id could empty an arbitrary file once a second.
• Analysis packets (verbatim conversation text) moved out of world-readable
  /private/tmp; the analysis run no longer inherits the user's own tool
  permissions or MCP servers.
• A symlinked ~/.claude/settings.json is written through rather than
  replaced, so a dotfiles repo keeps owning the file, and an edit that lands
  mid-merge is no longer lost.