EpiScope 0.10

Added

• Ad-hoc insights over the sessions you picked. The Analyze Sessions
  toolbar dropdown runs What Was Done or Ask a Question… over the selected
  rows — the table now allows multi-selection, and a selected group header
  stands for all of its sessions. With nothing selected the scope is everything
  the table currently shows, filters applied; a range brushed on the chart
  clips both the metrics and the conversations the run reads. Results are
  ordinary reports in the same Insights list as the scheduled ones.
• Rename a session. Rename… in the row's context menu edits the title in
  place, Restore Original Title puts the provider's back. The alias is
  EpiScope's own, kept per session id, survives reindexing, and works for every
  provider; the table, the filter field, chart labels, the status-bar menu and
  notifications all use it, and the original title stays in the tooltip.
• Codex lifecycle hooks. EpiScope installs its own handlers in
  ~/.codex/hooks.json, so a Codex session reports thinking, permission and
  finished states the moment they happen instead of being inferred from its
  rollout file. Existing hooks and the legacy notify command are left
  untouched, and Codex may ask you to approve the new handlers once in
  /hooks; until then the rollout fallbacks keep working.
• Settings → Integrations shows what the Claude Code and Codex integrations
  are actually doing: installed, needs repair, custom script, disabled by the
  tool, or unparseable config — with a Repair button that backs up a
  user-managed file before restoring the managed one.
• Codex Desktop tasks are first-class. They are recognised from the
  rollout itself, carry the app's icon, open at the exact thread even when the
  task is weeks old, take their name from the Desktop sidebar, and a task with
  no project is labelled Projectless instead of a scratch directory. Codex's
  internal helper rollouts no longer appear as sessions of their own.
• Remcode sessions are identified from Remcode's own catalog and open at
  the exact session in the app, instead of showing the generic
  non-interactive badge with nowhere to go.

Changed

• Full-text search results are newest first. Text rank only breaks ties, so
  a broad query no longer buries this morning's work under an old message whose
  term frequency happened to score better.
• The status-bar fleet menu keeps up while it is open: sessions appear and
  disappear, move between Needs attention and Active, and their times keep
  running without closing and reopening the menu.
• Claude's state bridge moved to ~/.claude/hooks/episcope-state.sh and is
  driven by PostToolBatch and StopFailure — a batch that failed now ends
  the turn instead of leaving it thinking, and an existing tab-state.sh from
  a dotfiles repo is left alone.
• Opening a failed turn records that you have seen it for notification
  purposes, but the amber menu-bar blink stays until the session actually
  reports a new state.

Fixed

• Sessions in worktrees and dot-directories are found again. Recent Claude
  Code builds also fold /.claude/ into --claude-, so a transcript could no
  longer be located by re-encoding its working directory; discovery keeps the
  exact path it saw.
• A deep scan that failed part-way left a stub that file size and mtime alone
  turned into a permanent cache hit — the session kept showing no tokens, cost
  or changes until the whole index was rebuilt.
• A session resumed after /clear is no longer presented as Cleared once its
  transcript has activity newer than the handoff.
• Codex limits survive the way Desktop works: a resumed task keeps its original
  date folder, so limits are read from the rollouts that are actually open;
  several recent files are tried when the newest one has not reported yet; and
  a known account snapshot is kept through transient read misses, with each
  window rolling to zero at its own reset.
• Several Codex Desktop tasks sharing one helper process are tracked
  separately instead of collapsing into whichever rollout was seen last, and a
  long turn whose start scrolled out of the rollout tail is no longer read as
  idle.
• Claude Code installed by its native installer is bound to its terminal again
  — the launcher is a symlink to a version-named executable, which the wrapper
  check used to reject.
• Upgrading the index format no longer rebuilds every transcript: the new Codex
  provenance is read from one record per rollout, so the upgrade costs seconds
  instead of a multi-gigabyte re-read. A cold scan also stopped reading forked
  transcripts twice.
• Multi-row selection is preserved across the background indexer's refreshes,
  and an in-place rename is not overwritten by a live repaint mid-edit.

Security

• The state hook publishes each signal as a fresh private file and renames it
  into place, so a planted sig-<id> symlink cannot redirect the write, and it
  parses the hook's JSON with plutil rather than letting hook-controlled text
  reach the shell. A session id that is not filename-safe is ignored.
• Neither integration overwrites a file it does not own: a script at the
  reserved path without EpiScope's marker is left alone by the automatic
  install, and explicit Repair saves it as .user.bak first — replacing only
  the reserved symlink, never its target.
• A Claude wrapper process is accepted as a session's host only when a
  conventional launcher path is owner-only writable and resolves to exactly the
  running executable.