v1.4.0

TL;DR

• Analyze local Claude Code, Codex, and OpenCode costs by project and model with bundled Gryph pricing, token efficiency, and budget alerts.
• Explore the same cost report in the local SPA with session totals and input/output token breakdowns.
• Activate Linux updates transactionally by restarting and attesting the new daemon, then restoring the exact prior installation if activation fails.
• Diagnose protection state faster with a polished terminal report and explicit CLI/daemon version-skew repair.

Added

• Local cost analytics: agentjail cost summarizes Claude Code, Codex, and OpenCode
  spend by project and model, with JSON output, token efficiency, and optional
  daily/per-project budget alerts backed by bundled Gryph pricing (ADR
  0120-bundled-model-pricing).
• Cost dashboard contract: the local UI can consume the same typed report,
  including unique session totals and per-model input/output token counts.
• Local Cost dashboard: the SPA presents project, model, session, token,
  spend, efficiency, and budget data without sending transcripts off-device.

Changed

• Doctor terminal report: agentjail doctor now renders a concise,
  structured health summary while preserving typed output for automation.

Fixed

• Transactional manual updates: Linux now activates swapped binaries by
  restarting the supervised daemon; activation failure restores the exact
  prior binary and role-path state, then restarts the restored daemon.
• Headless systemd recovery: daemon restart derives a missing user-bus
  environment only after validating the runtime directory and bus socket are
  owned by the current user and have safe types and permissions.
• Daemon version attestation: agentjail doctor compares the installed CLI
  with the running daemon and repairs stale or pre-version-reporting processes.

Security

• Human-only daemon recovery: CLI and direct systemd restart paths are
  permanently policy-locked, mirrored by degraded offline enforcement, and
  the CLI requires control-token access plus typed confirmation on /dev/tty.
• Attested update activation: manual updates now require a versioned daemon
  ping before commit, audit terminal outcomes over the authenticated control
  socket, and restore the prior generation on restart or attestation failure.
• Bounded local analytics: transcript readers cap periods, files, records,
  and JSONL line size; sanitize terminal metadata; and open OpenCode SQLite with
  an enforced read-only URI plus query_only.