0.5.2: the sidecar restarts itself, and subagents get their own task

This release fixes three ways winnow did less than it seemed to. Update with:

claude plugin update winnow@winnow

The next session start replaces a running 0.5.1 sidecar.

Fixed

The sidecar restarts itself. It exits after 45 idle minutes, and until now only a new session brought it back, so a session that sat idle that long ran unjudged from then on, with nothing to say so. On the machine this was measured on, 5,887 large results passed through that way over 18 days, against 7,435 judged. Now the module starts the sidecar again when it doesn't answer and resends the result. If it can't be started, results pass through untried for a minute and winnow says so once.

Subagents are judged against their own task again. Since 0.5.0 the module read the task with $.session.messages(), which returns the main conversation even inside a subagent. So a subagent's results were judged against your last message to the main session instead of the subagent's instructions, the bug 0.3.4 had fixed. On the same machine about 95% of judged results came from subagents. The module now sends no task, and the sidecar reads it from the end of the transcript: the subagent's own when there is one, found by session id even after the session has changed directory.

Large results no longer wait on a copy of the whole conversation. The same call copied the entire conversation into the module on every large result. In one long session that cost about 3.5 s per result, whether the sidecar was up or not.

Changed

winnow serve --stop now also tells sessions that are already open not to restart the sidecar; the next session start clears that. The README has a Turning it off section.

Tested live on Claude Code 2.1.286. On 2.1.277 a subagent's tool calls don't reach the module, so they pass through untouched.

0.5.1 — the sidecar stops taking requests from web pages

First tagged release. It fixes a security issue in the resident sidecar, so update if you run winnow:

claude plugin update winnow@winnow

The next session start replaces a running 0.5.0 sidecar automatically.

Security

The sidecar acted on requests a web page could send. It listens on 127.0.0.1:47311 and accepted any POST that reached it. A page you visited could send a form-style request (a CORS "simple request", so no preflight) that spent your judge key, wrote into ~/.winnow/cache, or stopped the service. It now rejects any request carrying an Origin header and any that isn't Content-Type: application/json, neither of which a cross-origin page can send without a preflight. Reported in #1 by @MrJev, fixed in #2 by @Ashfaqbs.

~/.winnow is private. It holds the full text of everything winnow hid, the decision log and your keys, and it was created 0755 with 0644 files, so on a shared machine another user could read it. New files are now 0600, and the directory is tightened to 0700 on every start, which also fixes existing installs.

Grep honors the exclusion list. A Grep across ~/.winnow, or across a directory you added to WINNOW_EXCLUDE_PATHS, used to be judged while a Read of the same files was not.

There's now a SECURITY.md with private vulnerability reporting turned on, and a threat model saying what's in and out of scope.

Also fixed

• A malformed or negative Content-Length now gets a 400, instead of a dropped connection or a thread held until the client hangs up.