agit-v0.2.22

Added

• Remote control can attach to a supported native Claude Code conversation so
  multiple clients can send and steer messages, answer tool approvals and
  questions, stop the current turn, and change supported models while the native
  process remains the only transcript writer. The integration is installed by
  daemon startup and setup. A native process started before installation may
  need /reload-plugins before it accepts remote controls.
• Fresh native Claude conversations accept remote attachment before their first
  message. Native tool activity, compaction, questions and supported commands
  remain visible across reconnects. Only controls confirmed by the runtime are
  advertised; changing an active permission mode or answering an effort
  confirmation dialog is not supported by the native integration.

Fixed

• Bursts of remote conversation events recover from the session journal without
  closing the control connection or leaving the composer stuck restoring.
  Operation receipts retain an independent output budget while history catches up.
• An explicitly refused Codex resume releases its opening reservation after
  cleanup, so subsequent attachment attempts do not remain permanently busy.
• Pending remote input cannot block tool approval or interruption. Ordered model
  changes, process and turn checks, and replayable receipts preserve operation
  order without repeating a prompt or stopping a later turn after reconnecting.
• Completed and interrupted native Claude turns are archived into ordinary Agit
  session history. Upload recovery retains pending publication through daemon
  replacement and waits until the complete captured prefix is published.
• Resuming a native conversation honors the explicitly requested authorized
  project and preserves its existing archive identity.
• Starting private Git commands from a large resident daemon preserves private
  file permissions without copying the daemon's memory into each child process.

Full Changelog: agit-v0.2.21...agit-v0.2.22

agit-v0.2.21

Fixed

• Manual milestones and runtime stop hooks preserve each completed native
  continuation when a long-running goal reuses the same user prompt. Settlement
  extends a retained partial turn without skipping later completions or saving
  an already retained completion twice.

Full Changelog: agit-v0.2.20...agit-v0.2.21

agit-v0.2.20

Fixed

• Remote terminal creation and input carry replayable receipts. A matching web
  client can recover a lost response without opening another shell or executing
  typed input again, while preserving input order and workspace isolation.
• Remote approval recovery reads authoritative pending requests so a lost reply
  does not apply the same decision twice. Codex stop retries target the selected
  native turn and cannot interrupt a later turn.
• Remote model settings recover across controller reconnects and expose the
  effective Codex reset model. Sequenced permission state allows controllers to
  reconcile a settings change without repeating an uncertain mutation.
• Steering rejected while a conversation is idle is distinguished from an
  uncertain delivery so the client can safely send it as a new turn.

Full Changelog: agit-v0.2.19...agit-v0.2.20

agit-v0.2.19

Fixed

• Background remote-control archive recovery allows long commits and uploads to
  finish instead of interrupting them after a fixed request timeout. Recovery
  remains cancellable on shutdown and retains its pending publication receipts.
• Opening a saved conversation reads its verified archive boundary without
  waiting for the next turn's settlement locks. Native claim and publication
  checks continue to prevent a stale boundary from hiding uncached messages.
• Local daemon diagnostics include bounded failure details for archive landing,
  commits, and publication so a repository problem can be diagnosed directly.

Full Changelog: agit-v0.2.18...agit-v0.2.19

agit-v0.2.18

Changed

• Remote control imports existing history when a session is resumed or explicitly
  watched in a workspace. Completed turns are archived in the workspace's Agit
  repository and uploaded automatically; a missing repository is created private.
  Collection and upload retries continue after the viewer disconnects and recover
  after a daemon restart without requiring another prompt.
• Remote history can return only messages after a verified canonical archive
  checkpoint. The matching backend and web update read saved history from ordinary
  Agit session storage and combine it with the device's uncached messages, without
  maintaining a separate web transcript.
• Remote viewers receive context-compaction activity from supported runtimes.

Fixed

• Starting remote control after switching Cloud accounts enrolls the daemon for
  the current account and disables grants from the previous enrollment. Existing
  local conversation history remains available.
• Archive retries remain pending until the workspace publication target is ready,
  and recover when a confirmed push already retains the requested turn.
• Native Codex and Claude collection waits for the runtime's explicit completion
  boundary instead of archiving a partial turn between tool calls. Interrupted
  Codex turns also settle and upload their completed transcript.

Full Changelog: agit-v0.2.17...agit-v0.2.18

agit-v0.2.17

Added

• Remote control on the web can send messages into a Claude Code session that is
  running in another process, such as the Claude desktop app or the claude CLI,
  through Claude Code's cross-session messaging (Claude Code 2.1.224 or later). The
  running session stays the only writer of its transcript: a message sent during a
  turn is read between tool calls, and an idle session starts a new turn with it.
  In bypass-permissions mode, the device owner's messages go through a relay that
  agit's Claude Code Stop hook (installed by agit setup) starts once a turn ends
  in that mode; Claude Code holds everyone else's messages, and the owner's while
  no relay runs, for approval on the machine. Only a workspace owner may send
  messages to a session whose transcript shows it has ever run in
  bypass-permissions mode, or records no permission mode at all.

Fixed

• agit push <owner/repo@branch> --to <existing repository> (and agit project sync
  copies of sessions claimed elsewhere) no longer push the source repository's
  main file line. The destination keeps its own main; before, the copy failed
  as a rejected non-fast-forward, or fast-forwarded the destination's shared files
  to the source's. A destination the push creates still receives the source's main.
• A Claude Code prompt whose record starts with a runtime-injected block, such as the
  worktree reminder the desktop app puts ahead of a session's first message, is
  kept as the turn's prompt instead of being dropped with the injection, whether
  the reminder is a separate text block or leads the same string. Such a session
  lost its opening prompt, and one with a single prompt had no turn to save or
  upload.
• Remote control publishes a turn that finished while the device's sign-in had
  lapsed as soon as authentication recovers, instead of waiting for the next turn.
• Opening a device from the web no longer stalls when the device's first discovery
  reply is lost: the controller retries the read-only discovery once.

Full Changelog: agit-v0.2.16...agit-v0.2.17

agit-v0.2.16

Added

• Each settled commit records the runtime's own name for the session in
  session/meta.json as title: the latest Claude Code title (custom-title,
  falling back to an older transcript's summary) or the Codex thread name from
  session_index.jsonl. A rename appears from the next settlement on. The
  agit: unnamed and agit <owner/repo@branch> placeholders that agit's own
  SessionStart hook assigns are not recorded. The title is protected like other
  metadata observations and is not part of encrypted metadata projection.

Changed

• Privacy processing runs in a bounded local worker. Detected secrets receive
  reversible placeholders when their originals can be saved. Incomplete scans
  keep completed replacements; unavailable storage, scan failures and timeouts
  skip the affected privacy work and let conversation operations continue.

• Signed-in accounts obtain an automatically generated cloud dictionary key.
  Without a usable key, mappings remain in private local pending storage. Push,
  login and fetch schedule encrypted dictionary synchronization independently;
  another signed-in device can restore mappings after synchronization succeeds.

• Local default, global user and repository user rules share one policy path.
  Explicit blocks override allows, and allows override heuristic findings.
  Recovery records survive rule changes without becoming permanent block rules.

• Uploads require no secret-finding review or cloud privacy-policy resolution.
  Existing Git history is preserved. LFS payloads are outside privacy processing;
  their authorization, availability and integrity checks remain in place.

• This release requires the matching backend update to remove older server
  privacy gates. A skipped local transformation may retain original sensitive
  content, and pending dictionaries become recoverable on other devices only
  after successful encrypted synchronization.

• Project Stop hooks start session uploads in a background process and return
  immediately. Project status reports the resulting upload state.

Fixed

• Automatic project binding installs hooks for available runtimes that support
  them; other runtime sessions remain publishable through project sync.

• Live output preserves every emitted fragment and the remaining stream tail
  when local privacy processing is unavailable.

• Legacy native message identifiers stored as secret placeholders can be restored
  without changing unmasked carrier identities.

• agit project sync publishes a session that another repository already claims, such
  as one started from a desktop RC project, as a separate copy of that claim's branch
  in the project repository, instead of failing with "session already belongs to another
  repository". The original claim and the RC project's own publication target are
  unchanged; each later sync refreshes the copy. --history none keeps excluding such
  earlier sessions.

Full Changelog: agit-v0.2.15...agit-v0.2.16

agit-v0.2.15

Changed

• New repositories use ordinary publication by default again. Without
  --encryption or a privacy.encryption preference, agit push, agit init,
  agit repo create and the init wizard create repositories that publish original
  history and need no viewing password. Encryption is an explicit opt-in chosen at
  creation with --encryption=true or agit config privacy.encryption true, after
  which agit privacy init sets the viewing password. agit privacy init still
  creates a missing repository encrypted unless false is chosen, and existing
  repositories keep the mode they were created with. A separate agit push --to
  destination created from an encrypted repository stays encrypted unless
  --encryption=false or a privacy.encryption preference chooses otherwise.
• Local repositories set up by 0.2.13 or 0.2.14 without an explicit --encryption
  choice follow the new default. If push.auto is on and the repository does not
  exist on the Hub yet, the next automatic push creates it as an ordinary repository,
  private unless push.visibility says otherwise. To keep such a repository
  encrypted, run agit privacy init OWNER/REPO first, or set
  agit config --global privacy.encryption true.
• A checkout initialized with agit init --encryption=true refuses its first push
  to an existing repository that uses ordinary publication, instead of silently
  publishing original history there; pass --encryption=false to publish anyway,
  or push to a new repository name to create an encrypted one.
• Encrypted agit share links require an encrypted repository. Sharing from an
  ordinary repository needs --public; without it the command now says so and
  uploads nothing, instead of asking for a publication that cannot exist. Encrypted
  links for ordinary repositories are not available in this release.

Fixed

• Ordinary pushes from scripts, CI and agent sessions no longer require --yes;
  a person at a terminal is still asked to confirm the destination, and declining
  or cancelling that prompt publishes nothing. Secret findings still block
  publication unless --allow-secrets is given, and encrypted publication keeps
  its confirmation.
• Automatic ordinary pushes after settlement, and Remote Control publication to an
  ordinary repository, no longer need a prior explicit push. push.auto authorizes
  them and they pass the same identity, access and secret checks as a manual push.
  Outside Remote Control, a missing repository is created with the visibility a
  non-interactive first push uses. Encrypted repositories still require an explicit
  push to confirm their policy and viewing recipient before automatic publication.
• Remote Control retires temporary runtime sources automatically once their
  directories disappear.

Full Changelog: agit-v0.2.14...agit-v0.2.15

agit-v0.2.14

Added

• agit project bind enrolls a selected directory and its unbound subdirectories
  in an existing repository, with explicit history import and automatic upload
  choices. project sync retries synchronization, project status reports local
  results, and project unbind pauses project capture. Codex and Claude Code hooks
  preserve existing session claims and enforce the current project policy before
  publishing.

Fixed

• Repeated Remote Control history reads reuse bounded, authenticated secret
  dictionary records and compiled protection patterns. Changed ciphertext,
  keys, or protection rules invalidate the corresponding cached state.
• Release builds optimize for runtime speed to reduce history projection and
  secret scanning latency.
• Remote Control retries failed local session saves while idle, without requiring
  another user turn to resume archiving.
• Push uses authenticated remote history to avoid rescanning already-published
  objects, while continuing to inspect new objects and their selected LFS payloads.
  Use --audit when a complete history review is needed.
• Native history reads take authenticated, bounded dictionary snapshots without
  waiting for a dictionary writer. Conservative pattern filtering avoids scanning
  history for secret patterns that cannot occur while preserving redaction rules.
• Compatible Cloud servers can read native history through a scoped project
  controller without opening a separate session controller. Project controllers
  remain read-only and cannot subscribe to or change a conversation.
• Completed RC turns retain durable archive jobs until protected publication has
  a receipt. A daemon restart retries pending jobs without starting the model or
  requiring a viewer to open the conversation.
• Settlement subprocesses retry temporary executable-busy failures within a
  bounded window while retaining the current authority lease.

Full Changelog: agit-v0.2.13...agit-v0.2.14

agit-v0.2.13

Changed

• Installations that skip install scripts are counted. An installation whose
  installer recorded no install receipt, such as one run through npx, with
  npm --ignore-scripts, or by a package manager that skips install scripts,
  now records one from its first user command, marked
  receipt_origin=first_command; installer receipts are marked
  receipt_origin=installer. Setup, hooks, MCP, RC, background processes and
  commands an installer runs never record it, so a create-agit receipt keeps its
  acquisition key. Installations whose statistics state predates this release,
  or whose AGIT_HOME already held older state, are never reported this way. See
  First-command receipt.

• Session reuse and invitation counts on the Hub. When agit run continues
  a session line or forks from a point on one, it sends the Hub one receipt
  naming the repository, the source session ID and commit, whether the run
  continues or forks, and the per-process operation ID, so the Hub can count
  how often sessions are picked up. A continue is reported once the session is
  ready to launch, a fork once its branch exists, and a --mine fork to the
  repository it copied. The receipt is sent in the background only for
  checkouts of the configured Hub, only from a settled session, and never with
  renewed credentials: an expired sign-in sends nothing. A Hub that is
  unreachable or refuses it never changes the run's output or exit code.
  agit fork and agit resume stay offline.
  agit repo invite <owner/repo>@<branch> also tells the Hub which session its
  link opens. The download attribution headers still carry no arguments or
  names. See
  Session reuse and invitations.

Fixed

• Remote Control can return a fresh, bounded native history page with watch
  admission, avoiding a separate network round trip when opening a conversation.
  Native history transfers negotiate compression, preserving complete tool
  results and compatibility with older clients and servers. Optional history
  reads do not block the daemon or prevent a successful live subscription.

• Device name changes synchronize to Cloud without enrolling another device.

• Failed session publication retries while the conversation is idle, so a
  transient upload failure does not require another user message to recover.

• agit login checks that it can save credentials under AGIT_HOME before it
  asks the Hub for anything. An agent sandbox that refuses writes there no
  longer uses up the human's approval: login stops with the directory to allow
  and says no login request was created, and agit login --complete leaves the
  approved sign-in unclaimed so the same command finishes it later. If saving
  still fails after sign-in, the new Hub session is signed out again.

• Signing in from an agent no longer fails when the agent runtime stops the
  waiting agit login. Every browser and device-code request is recorded
  privately under AGIT_HOME when the Hub creates it, and
  agit login --complete without a value finishes it from any later process,
  including an interrupted agit login --device. --complete now waits for
  the approval for up to 90 seconds (--wait <seconds>, 0 checks once)
  instead of checking once, keeps waiting through a failed poll, keeps the
  request when the wait runs out, and forgets it when the Hub says it expired
  or was already used. Running the printed --complete command again after
  the sign-in finished reports success instead of "no longer valid". A new
  agit login finishes a request the human already approved instead of
  replacing it. agit whoami --check, agit commit and commands that stop
  with "not logged in" first claim an approved request once, and otherwise
  point to agit login --complete instead of a new login. Signing out cancels
  a sign-in still being claimed: a session approved after agit logout is
  signed out again instead of saved, and a session a concurrent sign-in saved
  while agit logout ran is revoked with the credentials it removes. A second
  agit login --complete or a new agit login started while another process
  claims the same sign-in waits for it and reports success instead of "no
  longer valid" or a new login link.

• Local state problems read as local problems. agit whoami --check reports
  an unwritable home or a held credential lock instead of "can't reach" the
  Hub, agit doctor checks that AGIT_HOME is writable, and every command
  that meets one exits with the precondition code. Messages name the agit lock
  another process holds and say that agit's lock files are released when their
  process exits and must not be deleted; credential locks give up after a
  bounded wait, and session locks say what they are waiting for.

• Re-importing a session describes its claim: a registration is saved by the
  import, a saved session says where and how to record later turns, and a
  session saved elsewhere says how to move it. The link file path is no longer
  offered as a next step, and a failed import restores the session's previous
  link, including none.

• A session targeted at main is refused before anything is adopted or
  created, with the reason and an example branch in the caller's syntax.

• agit push leaves an origin that already points at the destination alone
  and writes a changed one under the repository lock, so a manual push and a
  hook's auto-push no longer collide on .git/config. Git failures on a held
  lock say not to delete it while a git process runs; a refused write says the
  checkout is not writable instead.

• agit setup recognizes its own hooks by their arguments, so installing from
  another executable path replaces the old entry instead of adding a second
  one.

Full Changelog: agit-v0.2.12...agit-v0.2.13