v0.18.0

Watcher 0.18.0 changes how the packaged client starts by default, refines the Managed Settings and Monitors pages in the Analyzer, and fixes issues with stuck approvals and sign-in for proxied deployments.

Breaking changes

• Live: Running the packaged watcher command with no arguments now starts Watcher in the background and enables start-on-login, instead of running attached to the terminal. Use watcher --foreground to keep the previous behavior.

Live

• Added: The client now accepts WATCHER_API_KEY as the organization API key, alongside the existing XYLON_API_KEY, and Watcher can now run inside a Docker container alongside a coding agent; see the new client documentation for a validated setup.
• Fixed: Escalation decisions in Claude Code no longer get stuck showing "approval needed" indefinitely when grading is slow. An escalation left unanswered for over an hour now resolves as timed out instead of waiting forever.
• Fixed: Proxy-based authentication deployments no longer misread an authentication error as "never signed in," which could block a tool call behind a sign-in the user had no way to complete.

Analyzer

• Added: A new Managed Monitors page lets admins enter org-wide custom instructions that managed monitors will apply; existing custom monitors are now grouped separately as deprecated.
• Changed: The Managed Settings page now leads with the two most common controls, enforcement mode and default profile, with everything else moved into a collapsible "Advanced settings" section.

Other

• Changed: Newly created organizations, including fresh self-host installations, now have Watcher distribution enabled by default, so the first managed settings document saved in the Analyzer reaches machines automatically. Existing organizations and installations keep their current setting. New MDM customers should explicitly turn distribution off when setting up a new organization to avoid two systems managing the same file.