Sentinel v0.7.0

Features

• site: re-record the Optimize hero clip so the savings climb on camera
  • replace the date-selector pan with a push-in on the Compression savings that counts up live from a low number to the real $15,951.72 / 1.37B tokens
  • keep the steady "content reduced 75%" headline on screen while the dollar and token counters spin up
• site: open hero carousel demos in a click-to-open lightbox
  • click any hero carousel clip (or press Enter/Space) to open it full size in a centered modal with native playback controls
  • show a hover and focus expand affordance on the active clip, and pause the inline carousel videos while the lightbox is open
  • close the lightbox on backdrop click, the X button, or Escape, with body-scroll lock and focus moved into the dialog
• site: play 15 feature demo videos in the carousel and pillar lightboxes
  • add the 15 recorded demo clips and first-frame poster images under public/videos and flip every feature and pillar entry to hasVideo
  • stack the carousel clips so a tab switch plays instantly, crossfade between slides, and hydrate the island eagerly so the first click is never lost
  • open pillar demos in a click-to-open lightbox with full playback controls, closable by backdrop, button, or Escape
  • remove the placeholder poster SVGs now that real recordings and JPEG posters exist
• app: add a demo-clip recording pipeline for the marketing videos
  • add demo-recordings: a mock IPC bridge, a fake macOS desktop stage, a synthetic-cursor Playwright recorder, and per-slug recipes that drive the real React UI and composite branded bookends with ffmpeg
  • add video-bookends: branded HTML intro and outro scenes plus a headless capture script that renders them to 1920x1080 MP4
  • add a record-demo-clip skill documenting the run procedure and the recording gotchas
  • git-ignore rendered clips and scratch harnesses; the shipped clips live under packages/site/public/videos
• optimize: detect when Claude Code bypasses Sentinel's proxy and explain the empty Optimize tab (#17)
  • add a capture-health tracker that compares OTEL api_request activity against real (non-probe) proxy /v1/messages traffic and flags proxy-bypassed when telemetry flows but no API calls reach the proxy
  • surface a banner on the Optimize tab that explains the bypass and tailors the fix by whether settings.json already points ANTHROPIC_BASE_URL at Sentinel (file correct: look for an OS env or higher-precedence settings override; file wrong: fix the base URL)
  • add a get_capture_health IPC plus a capture_health_changed broadcast that fires only on real state transitions
  • read ANTHROPIC_BASE_URL into the OTEL drift inspector's observed env without changing the metrics drift classification
  • feed the tracker via new onRealMessagesRequest (proxy) and onApiRequestEvent (OTEL receiver) callbacks, excluding probes and count_tokens from the proxy count
• site: add a pulsating ion-engine plume under the hero mascot
  • Add a thruster beneath the robot head: an outer layer rides the mascot's float so the plume stays glued to the head, while an inner plasma flame swells and flickers, so it looks like the mascot fires a small rocket to sustain its float
  • Honor prefers-reduced-motion by settling the plume into a calm static state
• site: refresh marketing copy, add pillar sections, and animate the hero
  • Reframe usage and metrics copy away from "limits Claude Code hides" toward the overage status and Team/Enterprise budget Claude Code does not surface
  • Frame multi-account around managing the accounts you own rather than pooling to beat limits
  • Cover the sandbox and all three optimization levers (curated subagents, compression, code execution) in the feature copy
  • Move Optimize to the second slot in the feature carousel
  • Add pillar deep-dive sections for multi-account, security, and optimization with sub-feature cards and demo placeholders
  • Animate the hero with a floating mascot, breathing glow, sonar pulse rings, and a staggered entrance
  • Add a faint hero dot-grid and a soft ambient glow behind the feature and pillar sections
  • Expand the demo shot list and add poster placeholders for the new sub-feature clips
  • Attribute the footer copyright to Intevity
• accounts: replace round-robin with a single "Auto" account-switching mode
  • Rename the Manual/Round-robin toggle to Manual/Auto and remove the Balance strategy; Auto always uses the earliest-reset engine
  • Auto-migrate persisted settings on load (switchingMode 'round-robin' → 'auto', drop roundRobinStrategy) so beta users keep rotation with no data loss
  • Show the account currently serving requests (email + plan) in the header instead of a round-robin pill, updating live via a new routed_account_changed broadcast
  • Add an "Account Switching" label with an info modal explaining Manual vs Auto, aligned right with a divider next to Refresh/Add Account
  • Remove the rotation-strategy selector from Settings and delete the RoundRobinStrategyMenu component
  • De-brand "round-robin" across Settings, the tour step/illustration, the Usage/Metrics pool views, and the marketing site
• accounts: add dev-only demo mode to mask account identity in recordings
  • Add demoMode.ts to mask every account's email, name, and organization in the UI (dev builds only) for screen recordings
  • Add a Settings toggle for demo mode and thread masking through the accounts/daemon hooks and the IPC layer
• security: reorganize Settings into sub-tabs and consolidate all security config under Settings → Security
  • Split the Settings → Security tab into Scanning / Permissions / Isolation / Sync sub-tabs and the Data tab into Retention / Features / Telemetry, persisting the active sub-tab across restarts
  • Move the tool-permission rules editor inline into Settings → Security → Permissions and remove the standalone SecurityRulesOverlay modal
  • Fold the scanning allowlist and sandbox isolation config into the Settings → Security sub-tabs as the single source of truth
  • Reduce the top-level Security dashboard to a live monitor with compact quick-toggles plus a Configure deep-link into the relevant sub-tab
  • Point the header shield icon directly at Settings → Security → Permissions
  • Add a search box to Permission bypasses and a shared SearchInput used consistently across detectors, allowlist, bypasses, and rules
  • Extract reusable AllowlistPanel, PermissionRulesPanel, and FilterChip components from the removed overlay
• security: surface sandbox isolation on the Security page, setup wizard, and tour
  • add a first-class Isolation card to the Security page with master and leg toggles, live capability status, and a link to configure domains and paths
  • add an opt-in Isolation step to the Security Setup Wizard (off by default; writes the policy only when the user enables it)
  • add a first-run tour step that points at the Isolation card on the Security tab
  • open the Security overlay directly to the Isolation tab from the card's Configure link
• security: add OS-level sandbox isolation via @anthropic-ai/sandbox-runtime
  • add a canonical IsolationPolicy model (network/filesystem/credentials) with pure mappers onto Claude Code's settings.json sandbox block and the sandbox-runtime config
  • Leg A: bidirectionally sync the policy into ~/.claude/settings.json#/sandbox, mirroring the permissions claude-sync engine (push/pull, merge/import/export, file watcher, first-enable marker)
  • Leg B: wrap code-mode MCP stdio children in the OS sandbox via SandboxManager, with per-platform capability detection and graceful degrade when the host cannot enforce
  • add sandbox IPC (sandbox_sync_pull, get_sandbox_status, get_sandbox_capability) and an Isolation tab in the Security overlay for editing domains, paths, and credentials
  • ship the seccomp/srt-win helper binaries beside the sidecar in build-sidecar and resolve them at runtime; Windows is network-only
  • opt-in and off by default; the daemon starts, stops, and refreshes the sandbox engines on settings changes

Bug fixes

• optimize: reach bridged MCP servers from subagents and stop repeated retrieve prompts (#35)
  • Inject a managed code-mode block into ~/.claude/CLAUDE.md so bridged MCP servers are reachable from subagents, which get no skill advertisement, in every project including plugin agents
  • Preload the sentinel-code-mode skill into installed Bash-capable curated agents while code mode is active, and strip it when the last server reverts
  • Auto-allow mcp__sentinel__retrieve so Claude Code never prompts for Sentinel's own read-only, loopback-gated retrieval tool (durable, user-global, covers subagents)
  • Auto-allow the code-mode endpoint curl so subagents can call bridged servers without a native Bash prompt
  • Detect CLAUDE.md block drift in get_code_mode_status, self-heal it at daemon startup, and add a Repair action to the Optimize context panel
  • Tear down the block, curated preloads, and allow rules cleanly on revert-to-zero and retrieval uninstall
• app: center the demo recorder push-in and add a parametrized savings ramp
  • fix the zoompan focal math so the push-in stays centered on the window; the previous scaled-space formula shoved the frame off-center past about 1.6x zoom
  • let __demo_ramp take from and ms so a recipe can spin the savings up from any starting fraction, and add __demo_ramp_set to freeze the totals low before the climb
  • rewrite the optimize recipe to freeze the savings low, push in on the money tiles, then climb to the real total
• site: replace the clipped Intevity footer logo with a full, padded mark
  • The footer logo PNG was a 12x14 crop with the orange mark flush to every edge (its bottom row clipped), so it read as cut off at any display size; replace it with the full-resolution mark re-cropped from source with transparent padding, rendered via object-contain so it stays crisp, centered, and slightly smaller
• tray: show pooled usage in Auto mode instead of a stale single-account 0%
  • Map the daemon's renamed "auto" switching-mode string to the pool-average tray branch; it had silently fallen back to Off, so the tray showed one account's 5h utilization and dropped to 0% right after that account's window reset
  • Rename the SwitchingMode::RoundRobin variant to Auto and keep "round-robin" as a defensive parse alias
  • De-brand the tray status label "Round-robin pool · NN%" to "Pool · NN%"
  • Add a regression test asserting "auto" never parses to Off and that Auto routes through the pool-average branch
• security: make the auto-mode banner accurate by dropping unknowable session/process counts
  • replace the Security-page auto-mode banner's session and process tallies with a single, provable state: auto mode is active when the manual override is on or an auto-mode beta header was seen within the 60s freshness window
  • remove the pgrep process scan (which also counted the Claude desktop app and non-proxied processes), FIFO session pruning, the 4-hour session timeout, and per-session tracking — none could be known accurately from the proxy
  • re-broadcast permissions_status on each fresh detection so the banner's "detected Ns ago" stays live instead of going stale
  • simplify AutoModeStatus to active/source/lastDetectedAt and drop the ActiveClaudeSession type
  • collapse the banner UI to one state with a "detected Ns ago" line; remove the expandable per-session list and "N processes running"
  • delete enforcer.process-count.test.ts and rework the auto-mode tests to assert active/source/lastDetectedAt; re-baseline the mock budget (-1 file / -2 sites) to clear the deleted file

CI & build

• skip the app build, test, and Playwright jobs for site-only PRs
  • Add a changes-detection job that gates Quality Checks and Playwright E2E on whether a PR touches files outside packages/site/** and docs, so marketing-site-only changes no longer rebuild and test the desktop app
  • Keep commit-lint running on every PR so release-note hygiene is never skipped

Maintenance

• site: format the settings reference doc with Prettier
  • apply Prettier to settings.mdx so the repo-wide format check passes; the file predates the check running on site-only PRs
• app: centralize integer and currency formatting in lib/format.ts
  • extract formatInt (thousands-separated) and formatUsd into packages/app/src/lib/format.ts with unit tests
  • use formatInt for request, opportunity, and subagent counts in the Optimize and Compression dashboards so large counts read with separators
  • replace the duplicated inline formatUsd helpers in OptimizeDashboard and the chart shared utilities with the shared one
• site: rename the round-robin guide to automatic account switching
  • retitle the guide to "Set up automatic account switching" and move it to /docs/guides/auto-switching/
  • align the Accounts page, Settings reference, and docs index on the Auto / automatic-switching naming
  • soften user-facing "rotation" wording to "the Auto pool"; keep the roundRobinStrategy/poolExcludedIds setting keys and the token-rotator.ts developer reference accurate
• site: replace placeholder screenshots with real captures
  • swap the 15 labeled placeholder PNGs for real Sentinel UI captures
  • drop the notification-history screenshot and its reference (no capture exists); keep the alerts notification-history section prose
  • remove the notification-history row from documentation/SCREENSHOTS.md
• site: add a Starlight documentation site under /docs (#31)
  • integrate @astrojs/starlight at /sentinel/docs/, keeping the hand-built marketing homepage at the site root
  • add ~30 documentation pages across Getting Started, Features, Guides, Reference, and Developers
  • add product screenshots, the Sentinel mascot logo, and Starlight theme CSS branded to match the marketing site
  • add a Docs link to the site nav and footer
  • slim the README to a concise overview now that full documentation lives on the site
• e2e: disambiguate the Switch-pill locator from the account-switching info button
  • Use exact: true in switch-account.spec so getByRole('button', { name: 'Switch' }) no longer also matches the new 'How account switching works' info button (its accessible name contains 'switching'), which tripped Playwright strict mode after the Auto-switching UI change
• apply Prettier formatting to sandbox, demo-mode, and site files
  • Run prettier --write across files that drifted from the repo code style so the CI format check passes
• attribute authorship to Intevity and tighten tour hold-time copy
  • Set the Tauri crate author to Intevity
  • Clarify that the security approval hold is 60 seconds by default and configurable per profile
• update README for the Off/Auto model, sandbox, and optimization
  • Replace the removed round-robin/Balance/Earliest-reset model with the Off/Auto switching model
  • Add sandbox isolation and token optimization (curated subagents, compression, code execution) to the feature list
  • Reframe usage around overage and the hidden Team/Enterprise budget rather than basic rate limits
  • Attribute the MIT copyright to Intevity

Full changelog: v0.6.3...v0.7.0