v0.15.0

Watcher 0.15.0 adds organization-level usage limits with visibility in both the Analyzer and Watcher Live, introduces an automated deep security review for high-risk sessions, and removes an insecure Watcher Live feature. It also brings expanded self-host documentation and several security dependency updates.

Changes

• Watcher Live: The in-browser terminal feature has been removed after a security review found it allowed unauthenticated command execution on your machine. Sessions started outside Watcher are still discovered and monitored via hooks as before — Watcher simply no longer hosts or spawns a terminal for them. No action is required: existing local and MDM-managed settings files continue to load normally, with the removed terminal-related options silently ignored.
• Added: Watcher Live now shows a clear error message when grading fails because your organization has reached its usage limit.
• Added: Watcher Live now displays its installed version in the toolbar.
• Changed: the environment variable used to configure the API URL has been renamed for clarity; the previous name is still accepted, so existing configurations keep working.
• Fixed: updated a bundled frontend dependency to address a potential denial-of-service vulnerability.

Analyzer

• Added: the Analyzer now shows your organization's current usage against its monthly grading limit, with a banner when the limit is exceeded and grading has stopped.
• Added: session search now also matches the session owner's name, not just the session ID or name.
• Added: the Analyzer sidebar now shows the deployment's version and your role in the organization.
• Added: the Monitors page now shows a monitor's ID with a button to copy it; the same control is used to copy a session ID on the transcript page.

API

• Added: sessions flagged as high-risk by real-time monitoring now receive an automated, in-depth security review once they finish.
• Added: organizations can now have monthly grading usage limits enforced, configurable via deployment defaults or per-organization settings.
• Added: the authentication profile response now includes an explicit organization ID field alongside the existing one.
• Changed: session summaries for continuously active sessions now refresh automatically at least once every 24 hours, instead of staying frozen at the first summary.
• Fixed: grading requests that persist results now run to completion and save their work even if the client disconnects, instead of being cancelled with nothing saved.
• Fixed: updated a bundled dependency to address a potential denial-of-service vulnerability.

Other

• Added: the self-host deployment bundle (compose file, Terraform modules, support bundle collector) is now published on the public release channels alongside the client binary and SDK, with checksums for verification.
• Added: new self-host documentation covering security and data handling, backup and restore operations, the custom grader rollout runbook, and MDM rollout for managed devices.
• Fixed: documented a required CORS configuration step for the Analyzer's Members tab to work in self-host single sign-on deployments.
• Fixed: corrected outdated environment variable and log message references in the self-host and cloud connectivity documentation.