DevMate 4.0.0

• One local runtime per instance directory with a single SQLite state store, an explicit operation registry, and identical access through MCP, the CLI, the localhost workbench and the ChatGPT/Claude MCP App.
• Direct tool surface for the connected model: line-paged reads, glob find, ripgrep search, exact-replacement workspace_edit, write/mkdir/move/delete with restorable per-file history, read-only Git status/diff/log/show/blame/branches, and shell_run with real shell semantics (PowerShell on Windows), full owner environment, disk-spooled output paged by cursor, long-running processes, stdin and whole-tree stop.
• Tool results send bulk text once as plain content; tool hints distinguish read-only, ordinary writes, destructive and open-world operations; the server delivers working instructions including the registered projects.
• Connections through routes you own: official OpenAI Secure MCP Tunnel, a managed Cloudflare named tunnel on your own domain, any external HTTPS reverse proxy, or OpenSSH reverse forwarding. Public traffic enters through a separate ingress port that serves only MCP and OAuth; the control port refuses proxied requests. connection.verify proves the public route with a real MCP round trip.
• One-call delegation to locally installed coding agents (agents_delegate / agents_result) on top of the Codex, Claude, Gemini and Grok adapters, with native approvals surfaced in the workbench.
• Editor awareness: the VS Code window publishes its active file, selection, open files and language diagnostics, so editor_diagnostics shows compiler, type and lint errors without a build; project_overview returns Git state, the project's agent instructions, scripts and layout in one call.
• Find and search are driven by ripgrep, honour .gitignore and have no tree-size limit. In VS Code nothing has to be installed for this: when PATH has no rg, the runtime uses the copy the editor ships, and remembers it for use without an editor.
• Guided setup: DevMate: Configure Connection, Copy MCP URL, Copy One-Time Sign-In Code and Doctor in VS Code; devmate doctor on the command line. Connection credentials are stored in the private instance directory instead of environment variables.
• The event journal, idempotency receipts and restorable file versions are pruned after retentionDays (default 30).
• The model carries a short list of tool definitions; every other operation is reachable through operations_call without spending context.
• Official MCP TypeScript SDK 2.3 for the 2026-07-28 protocol, also serving clients on the 2025 revisions, and the MCP Apps standard for the workbench.
• One runtime per instance, guaranteed by the operating system: any number of VS Code windows, Obsidian and the CLI can start it at the same moment and all join the same process. A record left by a crash never blocks a start. Editors with devMate.autoStart bring a crashed runtime back; an explicit stop is respected.
• The CLI is a complete entry on its own, with no editor required: start, stop, restart, serve, status, doctor (also when nothing is running), logs, project add|list|remove, connect, secret set (read from standard input), mcp-url, login-code, ui --open, and every operation by name.
• Folder sharing in VS Code is explicit and adjustable: by default a trusted folder is shared read and write and the window says so once; Change Folder Sharing makes any folder read only or takes it out, and devMate.shareFolders changes the default (readWrite, readOnly, ask, never). A status bar item shows the runtime state, and editors with built-in MCP support discover the local endpoint automatically.
• devmate mcp serves MCP over standard input and output for clients that start their servers as a program, starting the runtime when needed and surviving its restart.
• Deleting a large file keeps a restorable copy (up to 256 MiB); larger ones need an explicit force. project_overview points out folders that carry their own instruction file.
• Command lines are displayed and recorded without the credentials written inline in them. Every text input has an upper bound.
• The operations are defined by area under runtime/operations/; runtime/service.mjs is the registry that authorizes every call. npm run lint checks for mistakes.
• What is shared, and how far, is decided at the owner's computer (editor, devmate project add, local workbench). A client connected through MCP cannot share a folder, widen read-only access, lift the protection of credential files, change how a capability engine is set up, or answer an agent's approval or question; a workbench embedded in a chat app is such a client too. It can always narrow. A folder taken out stays out, also through the folder above it or inside it. There is no tool for sharing a folder: the model is told to ask the owner.
• Two permission profiles, chosen by the owner at their computer (devmate access, DevMate: Change Permission Profile, Permissions… in Obsidian). Guarded is the default. Full access is for driving everything from a chat client: the owner's connected client may share folders, widen access, read credential files, set up engines, answer agents and run the doctor, and what an agent the owner delegated to asks permission for is granted automatically and recorded. It applies at once, and members keep exactly their grants. The devmate command line run through a connected client's shell is answered as that client.
• capability_query and operations_query run what only reads, so clients that ask before every change do not ask for a status or a list. An answer to an agent's question can be plain text.
• VS Code starts the runtime with the editor by default (devMate.autoStart); Obsidian can do the same with Start the runtime with Obsidian. Both bring a crashed runtime back and leave one you stopped alone.
• With several editor windows open, read-only tools follow the window in use rather than the one that reported last; a call that names a workflow or an agent has named its project.
• With several projects a change must name its project; read-only tools may follow the editor. workspace_edit keeps CRLF line endings, text in UTF-16 or the computer's own encoding can be read, text files up to 32 MiB are read in pages, and listings, blame, log and search say what they left out or cut.
• The command line installs on its own from devmate-cli-<version>.tgz, with no dependencies. devmate mcp never sends a call twice that may already have started.
• Linux and macOS: commands run in bash, stopping a command ends its whole process group, a runtime started from a desktop icon finds the usual tool directories, a Git older than 2.41 is named instead of failing every Git tool, and the instance lock survives two simultaneous starts after a crash. Verified on Ubuntu 24.04 with the full test suite and end-to-end checks; macOS has not been run yet.
• Finding files checks each folder once per call instead of once per file, which more than halves a find over a few thousand files. A path that runs through a file is reported as not_directory on every system, and replacing a file on Windows rides out the moment a scanner still holds it.
• VS Code starts the runtime automatically only when the editor comes up or the workspace becomes trusted; a runtime its user stopped stays stopped.
• The stored state carries a format number and the release that wrote it, so an older release refuses newer state with a clear message; state files are written atomically, and a damaged identity, record or credential file no longer blocks a start.
• Obsidian: sharing a vault asks for read and write, read only or not now, and can be changed or stopped later; stop and restart ask first; the packaged plugin no longer depends on dynamic imports or the browser's fetch.
• VS Code: no separate ripgrep install (the editor's own copy is used when PATH has none), settings take effect without reloading, a window with several shared folders is told about approvals in all of them, and sharing changed elsewhere shows at once.
• The localhost workbench is entered through a single-use link; the owner token is never given to a browser. The session belongs to its browser tab and travels in a request header: there is no cookie that other local web services would receive.
• OAuth sign-in accepts the public client metadata of ChatGPT, Claude, Claude Code, Codex and VS Code, issues refresh tokens, and no longer applies to clients on the owner's own computer.
• A connector that cannot start is reported instead of hidden, the public route is re-verified periodically, cloudflared readiness comes from its own endpoint, connectors orphaned by a crash are cleaned up, and a stored credential applies with connection.restart.
• A cancelled or timed-out tool call only stops waiting; the command or agent task it started continues and stays reachable. Tool calls report progress to clients that ask for it.
• A tag X.Y.Z on main verifies that commit, builds once and publishes that build: a GitHub release (VS Code extension, the Obsidian plugin as an archive and as the three files Obsidian downloads, the command line package, checksums, build provenance) and the VS Code Marketplace version. Open VSX and npm are prepared and stay off until switched on. One command states a new version in every file; npm run check fails when they disagree.
• The extension is tested in a real VS Code on every change: two editors and a third window start together and must share one runtime. It needs VS Code 1.101 or newer. Command and setting texts are available in English and Simplified Chinese, and the Marketplace page has its changelog.
• A request as large as the file tools accept fits through MCP, also through devmate mcp, where a refused or failed request no longer affects the others in flight. What tools say about other tools uses the names a model can call; a missing resource is answered with the code the specification requires.
• The names and parameters of the tools and the names of the operations are recorded, and a test fails when one changes unnoticed.
• VS Code: a getting-started walkthrough; the DevMate view lists the runtime and the folders of the window, with its actions in the title bar and a Start button while nothing runs; in a remote window the workbench opens through the forwarded port. A new icon.
• Obsidian: the plugin carries the runtime as plain, readable text instead of an encoding of it (the plugin file is a quarter smaller), checks the files on disk without unpacking them again, and starts after the app is ready.
• A runtime that runs for weeks cuts its own log, and stops when its instance directory is deleted under it. A folder cannot be moved into itself. On Windows the program that ends a process tree is started by its full path.
• A command that was still running when its runtime died is ended by the next runtime of that instance, and only that very process: a process id that has passed to another program is left alone.
• When several entries start the runtime at the same moment, the ones that lose no longer leave a half-started process behind that could bring a stopped runtime back.
• Sign-in (OAuth) also works for a client that publishes no description of itself: the owner registers it under auth.clients with its name and redirect addresses. It is a public client like any other, with PKCE.
• Command output written in the system's own encoding (GBK, Shift_JIS, a Windows-125x page) is read as text, line by line, beside UTF-8.
• Obsidian, found by driving the plugin in a real Obsidian: the active note and selection reach the runtime as soon as the vault is shared; a taken port names the setting to change; an earlier error no longer stays on screen; the doctor counts only what needs attention.