v0.37.0

Watcher 0.37.0 hardens the Tailscale Aperture gateway integration: more coding agents are recognized, conversations stay in one session across compaction, forks and resumes, and Claude Code policy rules now cover the matching tools of other agents. The Watcher client also stops losing Codex transcript tails and closes several command-rule bypasses.

Breaking changes

• Changed: API: within one organization, an upload to POST /v1/ingest attributed to a user (a signed-in Watcher client, or a sessions:write:any or admin caller naming identity.login_name) whose Claude Code session ID or Codex thread ID already names another user's session is now rejected with HTTP 409 and body {"detail": {"code": "session_owner_conflict", ...}}, and that copy is not stored; previously it became a separate session. In a multi-trajectory request, earlier trajectories stay stored and later ones are not processed. Integrations must handle the new 409 response.
• Changed: API: for gateway hooks (the Aperture hook, and generic-hook requests whose external_ids include claude_code or codex), tool thresholds and command rules keyed to Claude Code tool names (Bash, Read, Write, Edit, ...) now also apply to the matching tools of Codex, OpenCode, Gemini CLI, Qwen Code, Mistral Vibe, Antigravity CLI and Claude Cowork, so custom Bash allow rules now allow those agents' shell commands and their file reads auto-allow on Read's thresholds instead of being graded. Check that your Bash allow rules are acceptable for those agents' shell commands; see "Tool names and policy" in the hooks documentation.
• Changed: API: rules keyed exactly to another agent's native tool name (for example bash, run_shell_command, exec_command) can still deny and escalate on gateway hooks but no longer allow on their own; exact native-name threshold entries keep precedence. Express allows against the canonical Claude Code tool names instead.
• Changed: Self-host deployment: the optional Terraform RDS module now defaults new databases to PostgreSQL 17. Before applying the updated module to an existing installation, set rds_engine_version to the PostgreSQL major version you are currently running; major upgrades remain a separate operator procedure described in the 0.37.0 upgrade guide.
• Changed: API: sessions from OpenCode, Gemini CLI, Antigravity CLI, Qwen Code and Mistral Vibe captured through Aperture are now recorded with agent_platform values opencode, gemini_cli, antigravity_cli, qwen_code and mistral_vibe instead of other. A session filter on other alone no longer finds new sessions from these agents; sessions recorded before the upgrade keep other.
• Changed: API: Aperture captures that carry a client X-Session-Id header (or a pi agent session ID) and no native conversation ID are now grouped by that ID rather than by transcript. If your client sends X-Session-Id to Aperture, keep it constant for exactly one conversation: reusing it merges conversations, and rotating it per request splits every capture into its own session.
• Changed: API: Gemini CLI is no longer a supported agent through the Aperture integration, and the Supported agents page marks its Google routes as not supported. Captures carrying Gemini CLI's user agent are still recorded and their tool calls graded, but its helper requests are now recorded as ordinary turns, usually each as its own session, and a turn whose response carried reasoning starts a new session.
• Changed: Watcher client: when a developer's Watcher sign-in and their Aperture login resolve to different users, the client's upload of a conversation that Aperture already recorded is refused with 409 session_owner_conflict, its decisions are not sent, and each later hook event retries and is refused again; previously the client's copy was stored as a separate session.
• Changed: API: generic-hook integrations that send skip_rules (including the Python SDK's local evaluator) now have the deterministic threshold and rule stages re-run on the server for calls whose tool names are translated to Claude Code tools, so decisions may differ from the caller's local evaluation.

Live

• Changed: The built-in read-only command approvals now apply only to complete literal pipelines, so unsafe sibling commands still reach grading, while narrowly matched read commands and routine validation no longer wait on grading.
• Fixed: The Watcher client keeps uploading a Codex thread after a turn that exited in the middle of a tool call, and no longer loses the last minutes of a context window when Codex compacts mid-turn; previously the Analyzer, trailing review and deep review never saw that activity.
• Fixed: Command rules no longer let unsupported shell syntax, oversized commands or malformed policies bypass review; large patches and MCP tool calls are evaluated instead of escalating, and incomplete rule evaluation is sent to grading, keeping human review only when grading is skipped.

Analyzer

• Added: Sessions from OpenCode, Gemini CLI, Antigravity CLI, Qwen Code and Mistral Vibe recorded through Aperture now show their agent name and have their own Platform filter chip instead of appearing as "Other".
• Added: Codex conversations compacted through Aperture show a "Context compacted" card, and user messages carried over by the compaction are labelled as such; when Watcher first saw the conversation after the compaction, the card says so.
• Fixed: Opening a long trajectory in a large session is much faster, and automatic session summaries and deep reviews no longer stall for organizations with very long sessions.

API

• Added: The Aperture integration now records and grades more agent traffic: Antigravity CLI's enterprise (ADC) Vertex route, Codex requests identified by Codex's own client metadata regardless of user agent, Claude Code's Explore subagent, and any Claude Code request whose response proposes a tool call, which is never skipped as a background request.
• Fixed: Codex conversations observed through Aperture stay monitored after a client tool search, a built-in web search or a remote compaction; when Codex compacts locally, earlier turns are kept in the same trajectory and graders see a compaction notice; Codex tool names now keep their namespace, so MCP tools and Codex tool groups match the names Codex's own hooks report.
• Fixed: Fewer spurious or split sessions through Aperture: Codex helper threads (titles, recaps, auto-review, thread descriptions) and Claude Code's usage-limit check no longer create sessions; a conversation forked under a new ID gets its own session instead of taking over the original's; OpenCode conversations resumed on a later day stay in one session; and each Antigravity CLI tool step is stored once.

Other

• Added: The API documentation now covers the monitor customization endpoint (permissions, the instructions body and its 32,768-character limit, replacement and clearing) and defines severity score bands for session verdicts and tool-call scores.
• Changed: The Supported agents page now lists Codex CLI on OpenAI and OpenRouter and OpenCode on Anthropic, OpenAI, Bedrock and OpenRouter as fully supported through Aperture, recommends an HTTP custom provider for Codex because Aperture refuses its WebSocket transport, and states that Claude Tag is not currently supported, with its setup instructions removed.
• Changed: The Aperture hook configuration example now recommends a 60-second timeout and explains that a shorter timeout can cancel deliveries queued behind a stalled upload, so their tool calls are never recorded or graded.