v0.41.0

Release 0.41.0 moves Watcher client grading onto the server's hook endpoint, replaces the single session-read permission with granular findings, content, and aggregate grants plus temporary access requests, and corrects how Codex permission decisions are recorded.

Breaking changes

• Changed: API: the sessions:read:any permission is removed; API keys that used it to read other users' sessions lose access unless they are granted sessions:findings:read:any (grades and tool-call decisions, which may include transcript excerpts) and/or sessions:content:read:any (summaries and full transcripts), plus sessions:aggregates:read:any for organization metrics. Prepare the new grants and refresh credentials before upgrading, keeping the legacy grant until the upgrade completes; built-in admins retain full access and members retain their own sessions. See the session read permissions release note.
• Changed: Self-host and Watcher Cloud: custom WorkOS roles that relied on sessions:read:any must be updated the same way before upgrading, or users on those roles will see only the restricted session view or no other users' sessions. Admins and the built-in org-viewer role receive aggregate access automatically; proxy deployments keep using the trusted role header with admin, org-viewer, or member.
• Changed: API: sessions:write:any no longer authorizes grading other users' stored sessions. Update integrations with sessions:grade:any, add content access for caller-selected graders, and grant the read permissions needed to retrieve results.
• Changed: Analyzer: the dashboard and its aggregate APIs are organization-wide only and no longer offer a personal view. Users missing some aggregate permissions see a no-permission tile; users with no organization-wide permission are taken to the sessions list showing only their own sessions. Grant sessions:aggregates:read:any to roles that should still see the dashboard.
• Changed: Watcher client: custom triage or gateway graders pinned in managed settings no longer run in live blocking; live grading uses the server's managed monitors. Move the custom grader's rule into the managed monitors' Custom Instructions and remove the pin. Steps are in the client-grading release note.
• Changed: Self-host and Watcher Cloud: organizations that distribute managed settings through MDM must save the exact document their MDM ships in the Analyzer, because the server now grades against the saved document (built-in defaults if none is saved) plus each machine's local changes.
• Changed: Self-host: update servers before clients. A new client against a server without native transcript support cannot have its calls graded; those calls take the grading-failure decision, with no fallback to the old request. Follow Update Watcher.
• Changed: Watcher client: paused mode evaluates nothing on the client. Deny command rules and always-deny thresholds that previously still applied while paused no longer do; paused calls go to the coding agent's own permission flow unjudged.
• Changed: Watcher client: watcher update now verifies the installer against GitHub's release record and requires HTTPS access to api.github.com as well as github.com; on networks that block api.github.com, client updates stop and retry hourly. Allow outbound HTTPS to api.github.com for client machines.
• Changed: Self-host: rolling the server back to an older release after this upgrade no longer makes clients follow it, because the updater refuses non-immutable releases and retries hourly. Reinstall clients manually at the target version using the steps in the client and self-hosting update docs.
• Changed: Watcher client: watcher update and watcher downgrade refuse releases 0.35.0 and earlier, exiting with the reason and making no changes. Use the manual reinstall steps in the client docs if an older version is required.
• Changed: Self-host: distinct tool invocation identities (v3 sessions) are now enabled by default in the startup setting, Compose, and Helm. Upgrading from 0.33 or earlier, including version-skipping upgrades, needs a false-first rollout: set the flag to false before deploying any compatible writer, replace every API replica and ingestion writer so all run 0.34.0 or later, back up the database, then enable true in a separate rollout. If the setting is unset or empty, deploying this release activates v3 immediately. Existing explicit false overrides keep creating v2 sessions; existing sessions keep their stored version. See the distinct tool invocations release note.
• Changed: Self-host: once v3 sessions exist, disabling the flag does not make rollback to pre-0.34 code safe. Roll back only to 0.34.0 or later, or restore the pre-activation database backup with its matching release, which discards later writes.
• Changed: API: the hook endpoint refuses a Claude Code transcript whose branches would make parsing walk the file many times over (for example a long session with many abandoned rewinds at its end) with a 422 instead of parsing it; the limit is listed in the hooks API limits. POST /v1/ingest uploads are unaffected.
• Changed: Self-host and Watcher Cloud: Qwen Code system prompts that carry a managed auto-memory section now hash differently, so each Qwen Code conversation in progress at the upgrade opens one new session at its next capture; conversations already split are not merged.
• Changed: API: Qwen Code memory-recall side queries (a two-message request with a single forced respond_in_schema tool) are no longer recorded. Gateway captures skip them; synchronous raw-hook gateways evaluate them ephemerally, so the call still gets a decision but no session, transcript, decision, or grade is stored, while grading usage is still counted. Add a respond_in_schema threshold or rule to avoid model grading of these requests.
• Changed: Self-host: this release adds database migrations, including an index built concurrently with no downtime; run them before starting the new code.

Live

• Changed: Watcher client grading now runs through the server's pre-tool-use hook with the coding agent's own Claude Code or Codex transcript, so the client and any gateway on the same conversation share one judgment per call; transcripts too long for a monitor are truncated in the middle instead of failing grading, and a triage that exceeds its time limit falls through to the gateway instead of escalating.
• Fixed: Codex permission decisions are recorded as they happened: approving a call and then pressing Esc, approvals that arrive after an escalation expired, answers from Codex's "Approve for me" reviewer, and calls made inside long-running Code Mode programs no longer show up as human denials, duplicates, or unresolved calls; a request whose turn was interrupted while Watcher was still grading it is now denied instead of running; and a denial that ended a session now reaches the Analyzer instead of being dropped.
• Fixed: After a laptop wakes from sleep, Watcher refreshes its credentials right away instead of showing "Sign in" and failing tool-call reviews for several minutes.

Analyzer

• Added: Session content access controls: users without access to another user's session can request temporary access (8 hours by default), administrators review and revoke requests on a new Access Requests page, and an Organization setting can require administrators to go through the same request process.
• Added: A "Slack alert details" setting under Organization → Data Privacy can send metadata-only alerts that keep severity, score categories, decisions, attribution, and links but omit summaries, finding text, action items, and raw tool details.
• Fixed: Sessions that Codex or OpenCode compacted now keep their earlier turns, tool calls, and decisions in the default view, with a "Context compacted" card marking the boundary (also shown for Claude Code compactions), and reasoning turns from Bedrock, Vertex, and Antigravity captures no longer appear twice.

API

• Added: POST /v1/hooks/pre-tool-use accepts the coding agent's own transcript file (format: claude-code-jsonl or codex-jsonl), grades each call with the whole conversation as context, stores it the way a direct upload would, reuses a completed judgment for the same call reported under another tool name, and reports which stage failed in grading_error.stage.
• Added: Hook callers can send only new messages with append_after instead of resending the whole conversation; successful appends return the anchor to reuse on the next request, and role-grade and hook responses now include a cost_usd estimate.
• Changed: The hook endpoints accept request bodies up to 64 MiB (previously 8 MiB), so long screenshot-heavy gateway captures are no longer refused; the self-host nginx and Helm defaults were raised to match.

Other

• Changed: A self-hosted Triage model override no longer needs structured-output support; triage now replies with a plain score, and scores may run slightly lower than before.