v0.43.0

This release brings GitHub Copilot CLI under the Watcher client, adds per-agent enable/disable controls and more resilient transcript delivery, and introduces a deployment-owned managed settings file and the always-on background worker for self-hosted deployments.

Breaking changes

• Added: The Watcher client now monitors GitHub Copilot CLI by default (unless an explicit agents.enabled list omits copilot; add copilot to that list to enable it). In enforce mode a Watcher allow, including an allow from the grading-failure policy, bypasses Copilot's own deny rules and permission prompts; move those restrictions into Watcher command rules, or run watcher agents disable copilot after upgrading and before starting new Copilot sessions (administrators can instead disable Copilot in organization settings before rollout). Upgrade the server first: against an older server, Copilot uploads wait in the retry queue and Copilot calls needing grading receive the grading-failure policy until the server is on this release or later.
• Added: Self-host operators can mount a deployment-owned managed settings file at /etc/watcher/managed-settings.yaml on the API. When the file exists at startup, the organization's settings are locked for the life of the process: the Analyzer Managed Settings page becomes read-only, both admin write paths return 409 managed_settings_locked, and settings_distribution is forced to watcher. Edits to the file reload without a restart (an invalid rewrite keeps the last good content in force), but an invalid or unreadable file at startup aborts API startup, and unlocking requires removing the file and restarting the API.
• Changed: Conversations recorded through either hook endpoint (gateway captures, format: "raw" provider pairs and format: "watcher" transcripts) now store each inline base64 image as a watcher-elided-image:<media type>;bytes=<n>;sha256=<hex> marker; session and message API responses return the marker in the image block's image field instead of the data URI, and the Analyzer shows an "Image not stored" placeholder with the digest. Watcher client uploads keep their images as recorded. Image-bearing hook conversations in progress at upgrade fork once into a new branch or session, and grades retained on a scrubbed-then-re-recorded image session may stay detached.
• Changed: The generic hook endpoints can now answer HTTP 503 with Retry-After: 1 and detail.code image_capacity_exhausted when image processing is full; nothing has been evaluated or recorded, so retry the whole request after the interval.
• Changed: Per-agent settings use agents.enabled maps, which clients 0.42.0 and older ignore (they report settings errors in watcher doctor and monitor every supported agent). Upgrade clients before switching the organization document to a map; until then keep a list (agents.permission: locked works on every client), and convert local choices back to a list before rolling back to a list-only client. Lists remain supported through November 30, 2026 but now trigger watcher doctor warnings locally and Analyzer warnings for saved organization lists.
• Changed: Claude Code Observe mode no longer waits for grading; grades run in the background and only Claude Code's own prompts gate the call, so a grade may land after the call has run. Enforce mode still waits for Watcher's decision.
• Changed: .watcher-ignore is now checked across every folder a Claude Code or Codex transcript records, so a session that worked in an ignored folder and then left it receives the grading-failure policy on graded calls for the rest of the session.
• Changed: Grading for Claude Code and Codex is bounded by the hook's whole-call budget; a grade that outlasts it returns 504 (timed out) and is handled by the grading-failure policy.
• Changed: Stored Copilot tool calls and decisions keep Copilot's native tool names rather than Claude Code names (local rules still match supported names through translation), and an incremental Copilot append can return 409 when the stored parser state is missing, the delta depends on earlier events, or a still-open call ID is reused; resend the session as a full upload.
• Changed: Copilot sessions close when their owning process exits, including a kill that skips the final callback; a Copilot call running longer than 15 minutes next to another working conversation on the same process shows as closed until its next callback.
• Changed: Transcript upload progress and duplicate-answer tracking are now kept per server rather than per person; existing progress stays usable until the next upload records its server, and API key rotation keeps it.
• Changed: A recorded decision with a human answer whose tool-use message never reached the server stops retrying after eight drain passes instead of retrying hourly, so it may never appear on the server.
• Changed: Session summaries are now produced by the background-job worker from a session's latest triage call rather than by a scheduled summarizer. Summaries refresh at most every 15 minutes, reflect the session as triage saw it, and activity after the last triage call (or sessions no triage call reached) is summarized only once the session has been idle for 12 hours; self-hosted deployments need both the grading scheduler (async-grading profile) and the background-job worker running to receive these summaries.
• Changed: Every self-hosted deployment now runs the background-job worker: Docker Compose starts it without a profile, and the Helm chart adds a worker Deployment (operationWorker.enabled, on by default) that needs the same database and model-provider access as the API. PostgreSQL 17 is the stated minimum; on an older database the worker logs "Operation queue requires PostgreSQL 17+" and restarts, and requested deep reviews and summaries wait until the database is upgraded. Follow the "Upgrade PostgreSQL" section of the self-hosting updates guide.
• Changed: The default Triage model is now openai/gpt-6-luna. Self-hosted deployments that use the default must have OpenAI access to that model before upgrading, or set a Triage model override in server-config.yaml (openai/gpt-5.6-luna remains available). Watcher Cloud needs no action.
• Changed: Deep Review severities are recalibrated to stop rating authorized work as high: gateway summaries are treated as unverified hypotheses, Codex harness turns are not read as human instructions, and sub-agents without a parent context are not scored 7+ for missing authorization alone. Fewer sessions reach the 7+ band, so triage queues or alerts keyed on that threshold will match fewer cases, and pre- and post-upgrade severities are not directly comparable.
• Changed: pi traffic captured through a gateway is recorded as agent platform pi instead of claude_code (API-key pi through the raw hook was previously other); sessions recorded before the upgrade keep their old value, so agent_platforms filters should include both, and a pi conversation in flight at upgrade starts a second session. pi tool calls are now translated for policy (bash to Bash, read/write/edit to Read/Write/Edit with path read as file_path, grep to Grep, find to Glob), so file-path rules and the .watcher-ignore escalation now apply to them, and a raw-hook caller's skip_rules no longer skips the canonical rules for such calls.
• Changed: Routine gateway capture skips (missing_response and excluded_conversation) are no longer written to the server logs; they are counted in the hook skipped-count metric, tagged by reason, stage and user-agent family. Log-based alerts or runbooks keyed on those reasons stop matching, and a non-coding-agent capture that would also have failed conversion is now reported as excluded_conversation rather than malformed_capture.
• Changed: The client/server compatibility rule is now directional and time-based: a server supports every client that was the latest public release at any point in the previous calendar month or since, and nothing has to support a client newer than its server. Keep client mirrors at or below the server's version; after a rollback or a server upgrade that jumps past the window, login-agent clients move to the server's version within about 2.5 hours, while other clients need watcher update or a mirror redeploy, or step the server through intermediate releases.
• Changed: The standalone Copilot SDK commands and the public SDK method WatcherLoginAuth.validate_project_location are removed. Anyone who installed the SDK's Copilot hook should delete ~/.copilot/hooks/watcher-sdk-copilot.json so Copilot calls are not graded twice.
• Changed: During a rolling upgrade, sessions ingested by the old release are not attributed to a delivery source and stay "Source unknown" in the new Session capture card until they are uploaded again.
• Fixed: Claude Code conversations previously stored under a copied parent's session ID can receive a 409 on their old anchor; a full upload creates a separate session under the current conversation ID, so such a conversation is split once between the old and new sessions.
• Fixed: Codex conversations routed through a layer that wraps exec and apply_patch as JSON functions are no longer stored twice on every compaction; affected sessions live at upgrade fork once more and then deduplicate, and existing duplicate branches are left in place.

Live

• Added: watcher agents list, enable and disable let you turn monitoring on or off per coding agent; choices are kept across profile switches, administrator locks take priority, and with unreadable settings startup warns and keeps installed hooks.
• Added: Claude Code and Codex transcripts finish uploading after failed or interrupted uploads, with retries that back off and stop after about a day; sessions that are disabled or owned by someone else are rechecked every 15 minutes, and excluded sessions are dropped.
• Fixed: Several recording gaps for Claude Code and Codex: denied tool calls now appear with their permission decisions on Claude Code 2.1.300; a call interrupted with Esc while Watcher was grading, and a Codex escalation left open when Codex is killed, are recorded instead of staying unsynced or pending; the final reply of a Claude Code turn is no longer missed; a Claude Code rewind no longer makes the client re-upload the transcript endlessly or land chunked uploads on the wrong branch; and Codex terminal-input (write_stdin) approvals now attach to their call.

Analyzer

• Added: Open a single tool call to see its arguments, result and findings without loading the surrounding transcript, with specific notices for restricted sections; the same detail is available through a new API endpoint and Python SDK method.
• Added: The dashboard shows a Session capture card with the share of observed sessions that arrived through the Watcher client, a gateway, the Watcher SDK or another source.

API

• Added: Session lists, searches and details report every recorded delivery path for a session, and decision reads include the delivery path plus the API key ID and name in effect when the decision was evaluated.
• Added: Watcher SDK example integrations for Hermes Agent (blocking review and recording through its shell hooks, labelled "Hermes Agent" in sessions) and Agent Router, the gateway formerly called Envoy AI Gateway, with streaming support and model-proposed alternatives after a refusal.
• Fixed: Newer Codex rollout line types (realtime_item, retained_context, additional_tools) are skipped silently instead of logging warnings and fabricating tool calls that could make uploads fail.