v0.1.32

Electron and React are the product authority

T4 Code has standardized on the Electron desktop shell and canonical React renderer. The abandoned
Flutter migration, its duplicate platform targets, and its CI and release plumbing have been
removed. macOS is the primary desktop target, Linux remains supported, and React/Capacitor Android
plus the responsive Tailnet browser/PWA remain compatibility clients for paired hosts.

The standardization preserves T4's standalone host, typed wire, OMP authority boundary, current
session and transcript behavior, native Browser workspace, terminal, files, review, secure
credentials, and signed update path. The public demo now builds from the same React client shipped
inside Electron, eliminating a second product implementation.

Session controls without lock takeover

New sessions created in T4 Code now restore their semantic thinking-level and fast-mode state after
attachment and transport reconnects. Existing sessions, including sessions owned by an OMP TUI,
remain observer-only: T4 does not issue the legacy state read that can start a supervisor and claim
the session lock.

Pull-request CI now treats client runtime changes as bridge-boundary changes and runs both the
current-runtime and pinned-legacy continuity gates.

A session rail built for large libraries

T4 Code v0.1.32 makes a large session library easier to navigate. The rail now supports text search, activity filters, newest/oldest sorting, grouped and flat layouts, collapsible project folders, and saved display preferences. Those controls follow the Codex desktop organization model while keeping OMP as the source of truth.

Project menus can create a session in that folder, reveal the folder in the system file manager, collapse the group, or hide it from the rail. Hidden projects are not deleted and can be restored from the filter menu. The reveal action is deliberately narrow: the host accepts only project paths already present in its session catalog.

Faster transcripts and easier context sharing

Opening a large session paints its newest saved transcript entries before older history finishes loading. The composer can insert bounded file references from the active workspace, and the session menu can export a transcript without exposing hidden host state. Session activity labels now follow authoritative runtime events, so a settled session no longer appears busy because of stale client-side timing.

Workspace polish and stable empty panes

The workspace shell, transcript, home pane, composer, and supporting panes now share a clearer and denser visual hierarchy. Empty activity, agent, file, review, and terminal panes keep their normal header and close control visible, so an empty result never traps the user in a pane without navigation.

More reliable macOS upgrades

When a bundled OMP upgrade temporarily fails to stop the existing macOS service, T4 Code now retries the stop-and-replace sequence. This avoids leaving the installed backend half-updated during normal desktop upgrades while preserving the existing signed-runtime checks.

The bundled backend now also recovers from an inactive Unix socket when the crashed owner's process ID still appears alive. It confirms the endpoint is unreachable more than once and revalidates every ownership file before reclaiming it, while leaving a responsive backend untouched.

T4 now owns the host service

T4 Code now packages its own standalone t4-host executable instead of running the network host inside OMP. The desktop replaces the old service definition directly and automatically repairs a stopped default service when the local connection falls back to reconnecting. The service label and local socket stay stable, so ordinary local clients and administrative commands keep using the same connection point.

OMP remains the authority for session files, locks, agent execution, credentials, and takeover decisions. The smaller omp bridge --stdio command exposes only the versioned authority operations T4 needs. T4 validates the exact t4-omp-authority/1 bridge before accepting an OMP installation and rejects older appserver-only runtimes.

Native Browser workspace

The desktop app now includes a built-in Browser workspace that is distinct from the existing host-backed Browser Preview workspace. Its tabs expose stable native surface state for navigation and rendering. New tabs use the credential-isolated isolated-session profile. Authenticated profiles are never selected automatically: each use requires the exact user-selected profile with explicit opt-in.

Native Browser automation is bounded to its surface contract. Touch input is currently unsupported and returns a capability error. The desktop closes native Browser surfaces and releases their supporting controllers when the renderer reloads, the window closes, or the app stops.

Host Browser Preview workspace

Session-linked Host Browser Previews continue to open in their dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.32 vendors app-wire 0.7.0 from integration commit 796bb7dc, source tree 0c195a01ba0bb98fbf4d4863aee59bf23a6e81b7. The frozen package remains compatibility evidence; T4 owns the active omp-app/1 wire schema.

The verified OMP 17.0.5 runtime is built from commit fc0c3913 and tagged t4code-17.0.5-appserver-13. It provides the bounded authority bridge used by T4's standalone host and no longer exposes the old public appserver launchers. It pages snapshot-consistent session inventories across bounded frames, marks over-limit inventories partial, and allows lifecycle actions only when a lock is missing or provably stale. It also keeps session-list metadata sparse before bridge encoding, publishes xd:// mounts atomically with their transport tools, and preserves bounded newest-first transcript paging, stale-owner recovery, privacy-safe local project reveal, lazy session indexing, cross-session attention and transcript search, and the negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• fix(release): keep source verification dependency-free by @wolfiesch in #153
• fix(release): separate repair control from source by @wolfiesch in #154
• fix(release): install Bun for desktop packaging by @wolfiesch in #155
• fix(release): separate publication control from source by @wolfiesch in #156
• fix(release): preserve historical notes compatibility by @wolfiesch in #157
• fix(release): separate site control from source by @wolfiesch in #158
• fix(release): use validated site release identity by @wolfiesch in #159
• release: ship session control compatibility in v0.1.32 by @wolfiesch in #160

Full Changelog: v0.1.31...v0.1.32

v0.1.31

Electron and React are the product authority

T4 Code has standardized on the Electron desktop shell and canonical React renderer. The abandoned
Flutter migration, its duplicate platform targets, and its CI and release plumbing have been
removed. macOS is the primary desktop target, Linux remains supported, and React/Capacitor Android
plus the responsive Tailnet browser/PWA remain compatibility clients for paired hosts.

The standardization preserves T4's standalone host, typed wire, OMP authority boundary, current
session and transcript behavior, native Browser workspace, terminal, files, review, secure
credentials, and signed update path. The public demo now builds from the same React client shipped
inside Electron, eliminating a second product implementation.

A session rail built for large libraries

T4 Code v0.1.31 makes a large session library easier to navigate. The rail now supports text search, activity filters, newest/oldest sorting, grouped and flat layouts, collapsible project folders, and saved display preferences. Those controls follow the Codex desktop organization model while keeping OMP as the source of truth.

Project menus can create a session in that folder, reveal the folder in the system file manager, collapse the group, or hide it from the rail. Hidden projects are not deleted and can be restored from the filter menu. The reveal action is deliberately narrow: the host accepts only project paths already present in its session catalog.

Faster transcripts and easier context sharing

Opening a large session paints its newest saved transcript entries before older history finishes loading. The composer can insert bounded file references from the active workspace, and the session menu can export a transcript without exposing hidden host state. Session activity labels now follow authoritative runtime events, so a settled session no longer appears busy because of stale client-side timing.

Workspace polish and stable empty panes

The workspace shell, transcript, home pane, composer, and supporting panes now share a clearer and denser visual hierarchy. Empty activity, agent, file, review, and terminal panes keep their normal header and close control visible, so an empty result never traps the user in a pane without navigation.

More reliable macOS upgrades

When a bundled OMP upgrade temporarily fails to stop the existing macOS service, T4 Code now retries the stop-and-replace sequence. This avoids leaving the installed backend half-updated during normal desktop upgrades while preserving the existing signed-runtime checks.

The bundled backend now also recovers from an inactive Unix socket when the crashed owner's process ID still appears alive. It confirms the endpoint is unreachable more than once and revalidates every ownership file before reclaiming it, while leaving a responsive backend untouched.

T4 now owns the host service

T4 Code now packages its own standalone t4-host executable instead of running the network host inside OMP. The desktop replaces the old service definition directly and automatically repairs a stopped default service when the local connection falls back to reconnecting. The service label and local socket stay stable, so ordinary local clients and administrative commands keep using the same connection point.

OMP remains the authority for session files, locks, agent execution, credentials, and takeover decisions. The smaller omp bridge --stdio command exposes only the versioned authority operations T4 needs. T4 validates the exact t4-omp-authority/1 bridge before accepting an OMP installation and rejects older appserver-only runtimes.

Native Browser workspace

The desktop app now includes a built-in Browser workspace that is distinct from the existing host-backed Browser Preview workspace. Its tabs expose stable native surface state for navigation and rendering. New tabs use the credential-isolated isolated-session profile. Authenticated profiles are never selected automatically: each use requires the exact user-selected profile with explicit opt-in.

Native Browser automation is bounded to its surface contract. Touch input is currently unsupported and returns a capability error. The desktop closes native Browser surfaces and releases their supporting controllers when the renderer reloads, the window closes, or the app stops.

Host Browser Preview workspace

Session-linked Host Browser Previews continue to open in their dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.31 vendors app-wire 0.7.0 from integration commit 796bb7dc, source tree 0c195a01ba0bb98fbf4d4863aee59bf23a6e81b7. The frozen package remains compatibility evidence; T4 owns the active omp-app/1 wire schema.

The verified OMP 17.0.5 runtime is built from commit fc0c3913 and tagged t4code-17.0.5-appserver-13. It provides the bounded authority bridge used by T4's standalone host and no longer exposes the old public appserver launchers. It pages snapshot-consistent session inventories across bounded frames, marks over-limit inventories partial, and allows lifecycle actions only when a lock is missing or provably stale. It also keeps session-list metadata sparse before bridge encoding, publishes xd:// mounts atomically with their transport tools, and preserves bounded newest-first transcript paging, stale-owner recovery, privacy-safe local project reveal, lazy session indexing, cross-session attention and transcript search, and the negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• style: workspace shell, transcript, and home empty state aesthetic polish by @wolfiesch in #76
• fix: preserve pane title and close button when Agents, Activity, or Review is empty by @wolfiesch in #77
• fix: retry transient macOS service upgrades by @wolfiesch in #81
• feat(web): match Codex rail organization by @wolfiesch in #82
• release: ship T4 Code 0.1.29 by @wolfiesch in #83
• test(web): add unit tests for terminal paste guard by @dylantirandaz in #78
• test(web): add unit tests for usage format helpers by @dylantirandaz in #79
• fix(web): use locale-independent lowercase in search matching by @dylantirandaz in #80
• release: ship T4 Code 0.1.30 by @wolfiesch in #89
• feat(browser): add native desktop Browser workspace by @riverpilot in #88
• feat(web): add transcript export to the session menu by @dylantirandaz in #87
• feat(web): add composer file-reference picker by @dylantirandaz in #85
• refactor: move T4 host ownership into monorepo by @wolfiesch in #90
• feat: paint cold transcript tails before full history by @wolfiesch in #91
• fix(host): harden migrated host boundaries by @wolfiesch in #92
• chore(runtime): adopt OMP appserver 9 by @wolfiesch in #94
• fix(ui): make session activity state truthful by @wolfiesch in #96
• fix: automatically recover local OMP service by @wolfiesch in #97
• feat: replace the OMP-hosted appserver with the T4 host by @wolfiesch in #95
• release: ship the standalone T4 host in v0.1.30 by @wolfiesch in #99
• chore: add Taskfile development commands by @wolfiesch in #100
• feat: add workspace super-app foundation by @wolfiesch in #101
• feat: unify workspace action entrypoints by @wolfiesch in #103
• docs: establish T4 Hub collaboration foundation by @wolfiesch in #105
• docs: keep Hub planning speed-first by @wolfiesch in #107
• feat(flutter): add native T4 client for Android, iOS, and macOS by @wolfiesch in #104
• feat(flutter): make transcript opening feel instant by @wolfiesch in #93
• feat: search project files from Quick Open by @wolfiesch in #106
• docs: align Hub planning with official OMP adapter by @wolfiesch in https://github....

v0.1.28

Faster startup, reliable phone access, and a browser demo

T4 Code v0.1.28 makes the normal first-run path substantially easier. The bundled OMP backend now opens its socket before scanning session history, builds the session list from small bounded previews, and loads a full transcript only when that session is first used. On a real Mac profile with 831 sessions, initial indexing fell from 59.2 seconds to 4.0 seconds while preserving complete transcripts on demand.

Phone access configured through the desktop QR flow now restores itself when the app launches. If the private gateway stopped after a reboot or app update, T4 reinstalls the same verified configuration and waits for a healthy local runtime instead of leaving the saved phone route broken.

The public site now ships a no-install browser demo with fixture sessions, panes, agent views, and browser previews. The left rail also has clearer grouping and larger touch targets.

Signed Mac backend startup

The v0.1.27 signing fix remains in place. Packaging waits for the Promise-based signer to finish before notarization begins. The signed, bundled OMP backend can load OMP's native module, with that permission applied only to the OMP executable inside the app. The top-level T4 Code app and its Electron helpers keep normal library validation enabled.

The v0.1.26 tag did not publish release files: its Mac job stopped when notarization detected that the legacy callback signer had returned before signing finished. No partial v0.1.26 GitHub Release was published.

The protected release job verifies this boundary in both the DMG and ZIP before publication. It also checks the original OMP download's pinned size and SHA-256 hash, the project's exact Developer ID certificate and Team ID, hardened runtime, secure timestamp, stapled notarization ticket, and Gatekeeper result. Signing secrets are never bundled into the app.

The v0.1.25 signed-backend integrity fix remains in place: the app accepts either the exact original OMP download or an executable signed with the project's pinned Developer ID certificate, then copies and rechecks the actual signed bytes atomically.

One inbox for sessions that need attention

The attention inbox gathers sessions waiting for a decision, confirmation, or reply. It keeps the host authoritative: T4 projects the host's events into a useful list, deduplicates repeated signals, and routes an action back through the owning session instead of inventing local state.

Older runtimes remain usable. Attention controls appear only when the connected host advertises the required contract.

Clearer connection health

Session screens now distinguish reconnecting, delayed, and degraded transport states. Provider diagnostics explain what T4 last confirmed and whether it is safe to act, rather than collapsing every interruption into a generic disconnected message.

Faster bounded projections

Transcript and attention projections now avoid repeated full-history work where a bounded update is sufficient. Ordering, deduplication, retention, and host-authority checks remain intact.

Browser preview workspace

Session-linked browser previews now open in a dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.28 vendors app-wire 0.6.1 from integration commit e3e15c03, source tree e0f32b279eb4b8cbc403e47d765a226bee99c99f. The client contract remains omp-app/1.

The verified OMP 17.0.5 runtime is built from commit 25295f6f and tagged t4code-17.0.5-appserver-6. It provides the appserver used by the desktop and remote workflows, including bounded lazy session indexing, cross-session attention and transcript search, and the complete negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• Polish rail information hierarchy by @wolfiesch in #69
• fix: restore configured phone access on launch by @wolfiesch in #73
• feat: publish no-install browser demo by @wolfiesch in #71
• feat: organize the session library by @wolfiesch in #74
• Release T4 Code 0.1.28 with fast startup and restored phone access by @wolfiesch in #75

Full Changelog: v0.1.27...v0.1.28

v0.1.27

Signed Mac backend startup

T4 Code v0.1.27 completes the signed Mac backend fix. Packaging now waits for the Promise-based signer to finish before notarization begins. The signed, bundled OMP backend can load OMP's native module, with that permission applied only to the OMP executable inside the app. The top-level T4 Code app and its Electron helpers keep normal library validation enabled.

The v0.1.26 tag did not publish release files: its Mac job stopped when notarization detected that the legacy callback signer had returned before signing finished. No partial v0.1.26 GitHub Release was published.

The protected release job verifies this boundary in both the DMG and ZIP before publication. It also checks the original OMP download's pinned size and SHA-256 hash, the project's exact Developer ID certificate and Team ID, hardened runtime, secure timestamp, stapled notarization ticket, and Gatekeeper result. Signing secrets are never bundled into the app.

The v0.1.25 signed-backend integrity fix remains in place: the app accepts either the exact original OMP download or an executable signed with the project's pinned Developer ID certificate, then copies and rechecks the actual signed bytes atomically.

One inbox for sessions that need attention

The attention inbox gathers sessions waiting for a decision, confirmation, or reply. It keeps the host authoritative: T4 projects the host's events into a useful list, deduplicates repeated signals, and routes an action back through the owning session instead of inventing local state.

Older runtimes remain usable. Attention controls appear only when the connected host advertises the required contract.

Clearer connection health

Session screens now distinguish reconnecting, delayed, and degraded transport states. Provider diagnostics explain what T4 last confirmed and whether it is safe to act, rather than collapsing every interruption into a generic disconnected message.

Faster bounded projections

Transcript and attention projections now avoid repeated full-history work where a bounded update is sufficient. Ordering, deduplication, retention, and host-authority checks remain intact.

Browser preview workspace

Session-linked browser previews now open in a dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.27 vendors app-wire 0.6.1 from integration commit e3e15c03, source tree e0f32b279eb4b8cbc403e47d765a226bee99c99f. The client contract remains omp-app/1.

The verified OMP 17.0.5 runtime is built from commit 772e5e41 and tagged t4code-17.0.5-appserver-5. It provides the appserver used by the desktop and remote workflows, including faster startup, cross-session attention and transcript search, and the complete negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• fix: await mac signing before notarization by @wolfiesch in #72

Full Changelog: v0.1.26...v0.1.27

v0.1.25

Automatic backend installation on signed Macs

T4 Code v0.1.25 fixes first-launch backend installation in signed Mac builds. Apple signing adds a cryptographic signature to the bundled OMP executable, which changes its file hash after the original public download was verified. The app now accepts either the exact original download or an executable signed with the project's exact Developer ID certificate, then copies and rechecks the actual signed bytes atomically.

The protected release job still verifies the original OMP download's pinned size and SHA-256 hash before packaging. It then reopens the DMG and ZIP and checks their certificate and Team ID, hardened runtime, secure timestamp, stapled notarization ticket, and Gatekeeper result before publication. Signing secrets are never bundled into the app.

One inbox for sessions that need attention

The attention inbox gathers sessions waiting for a decision, confirmation, or reply. It keeps the host authoritative: T4 projects the host's events into a useful list, deduplicates repeated signals, and routes an action back through the owning session instead of inventing local state.

Older runtimes remain usable. Attention controls appear only when the connected host advertises the required contract.

Clearer connection health

Session screens now distinguish reconnecting, delayed, and degraded transport states. Provider diagnostics explain what T4 last confirmed and whether it is safe to act, rather than collapsing every interruption into a generic disconnected message.

Faster bounded projections

Transcript and attention projections now avoid repeated full-history work where a bounded update is sufficient. Ordering, deduplication, retention, and host-authority checks remain intact.

Browser preview workspace

Session-linked browser previews now open in a dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.25 vendors app-wire 0.6.1 from integration commit e3e15c03, source tree e0f32b279eb4b8cbc403e47d765a226bee99c99f. The client contract remains omp-app/1.

The verified OMP 17.0.5 runtime is built from commit 772e5e41 and tagged t4code-17.0.5-appserver-5. It provides the appserver used by the desktop and remote workflows, including faster startup, cross-session attention and transcript search, and the complete negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• fix: install signed bundled OMP runtime by @wolfiesch in #67

Full Changelog: v0.1.24...v0.1.25

v0.1.24

Signed and notarized on macOS

T4 Code v0.1.24 is the first macOS release signed with the project's pinned Developer ID identity and notarized by Apple. The protected release job reopens both the DMG and ZIP, checks their certificate and Team ID, hardened runtime, secure timestamp, stapled notarization ticket, and Gatekeeper result, and stops publication if any of them drift.

Local development can still produce an explicitly unsigned package without release credentials. Signing secrets are available only to the protected release job and are never bundled into the app.

One inbox for sessions that need attention

The attention inbox gathers sessions waiting for a decision, confirmation, or reply. It keeps the host authoritative: T4 projects the host's events into a useful list, deduplicates repeated signals, and routes an action back through the owning session instead of inventing local state.

Older runtimes remain usable. Attention controls appear only when the connected host advertises the required contract.

Clearer connection health

Session screens now distinguish reconnecting, delayed, and degraded transport states. Provider diagnostics explain what T4 last confirmed and whether it is safe to act, rather than collapsing every interruption into a generic disconnected message.

Faster bounded projections

Transcript and attention projections now avoid repeated full-history work where a bounded update is sufficient. Ordering, deduplication, retention, and host-authority checks remain intact.

Browser preview workspace

Session-linked browser previews now open in a dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.24 vendors app-wire 0.6.1 from integration commit e3e15c03, source tree e0f32b279eb4b8cbc403e47d765a226bee99c99f. The client contract remains omp-app/1.

The verified OMP 17.0.5 runtime is built from commit 772e5e41 and tagged t4code-17.0.5-appserver-5. It provides the appserver used by the desktop and remote workflows, including faster startup, cross-session attention and transcript search, and the complete negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• test(protocol): preserve provider transport diagnostics by @wolfiesch in #55
• fix: recognize dynamic site deployment runs by @lyc-aon in #56
• test: make tooling fixtures portable on macOS by @wolfiesch in #57
• feat(web): add session transport health by @wolfiesch in #58
• feat: add cross-session attention inbox by @wolfiesch in #59
• perf: speed bounded projections and correct click timing by @wolfiesch in #61
• feat(release): sign and notarize macOS builds by @wolfiesch in #63
• feat: implement browser preview workspace and resolve authenticated-only selection gap by @wolfiesch in #60
• release: prepare T4 Code 0.1.24 by @wolfiesch in #65
• feat: add cross-session transcript search by @wolfiesch in #62
• feat: productize desktop and phone onboarding by @wolfiesch in #64
• Release T4 Code 0.1.24 for OMP 17.0.5 by @lyc-aon in #66

Full Changelog: v0.1.23...v0.1.24

v0.1.23

File edits protect newer work

T4 Code v0.1.23 pins every file draft to the host revision that produced it. If another process changes the file before Save reaches OMP, T4 keeps the draft and marks it Conflict. It does not overwrite the newer host copy. After a successful save, T4 reloads the confirmed revision before accepting another edit.

Hosts and profiles use one registry

The Hosts screen, settings, desktop service manager, and mobile connections now resolve the same remote-target records. Switching an Android connection to another OMP profile returns to that profile's session list instead of leaving a stale session open.

Settings includes a capability explorer for the selected host. It shows the commands and features negotiated from the live appserver, so unavailable controls have a concrete reason. The read-only setup doctor reports OMP discovery, profile counts, service state, and Tailnet reachability without printing tokens or private paths.

Useful while OMP reconnects

Desktop builds retain the recent session inventory on disk. The last confirmed list appears during startup or a network interruption, marked as cached and read-only. A fresh appserver snapshot replaces it after reconnect; cached data never authorizes a write.

Retryable connections continue with bounded backoff, and profile changes return to an authoritative session list. Two clients still receive the same session revisions and lifecycle results.

Read responses aloud

A completed assistant response has Read response aloud when the device provides both speech and stop controls. Reading starts only after a tap, fenced code is omitted, a second response replaces the first, and leaving the session stops playback.

Runtime provenance

T4 Code v0.1.23 vendors app-wire 0.5.9 from integration commit 5633bdd7, source tree 4d8794bad6fc57d86058a46dc4698fcca14263e5. The client contract remains omp-app/1.

The matching OMP 17.0.4 runtime is built from commit be0301f5 and tagged t4code-17.0.4-appserver-4. It adds the versioned Agent View lifecycle contract, session-owned cancellation, macOS system-temp aliases, workspace-native build artifacts, retry-safe release metadata, lock-aware session observation, complete transcript reconciliation, missing-lock-only promotion, and the cooperative /continue-in-t4 handoff.

The integration is based on the official upstream v17.0.4 tag, commit 3fdd85ab. Official upstream OMP v17.0.4 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon.

The macOS build is unsigned and unnotarized. Gatekeeper will block the first launch. After copying T4 Code to Applications, run:

xattr -dr com.apple.quarantine "/Applications/T4 Code.app"

Verify downloads with SHA256SUMS.txt.

What's Changed

• feat: add redacted setup doctor by @wolfiesch in #29
• refactor: share platform boundary contracts by @wolfiesch in #33
• feat: ship v0.1.23 multi-profile polish by @wolfiesch in #32
• refactor: share remote target registry by @wolfiesch in #37
• feat: ship headless follow-up capabilities by @wolfiesch in #38
• refactor: add protocol provider boundary by @wolfiesch in #39
• perf: add VPS Electron benchmark harness by @wolfiesch in #40
• Automate OMP compatibility maintenance by @lyc-aon in #42
• perf: add browser paint phase measurements by @wolfiesch in #43
• fix(web): reserve macOS titlebar controls by @wolfiesch in #45
• test: harden protocol provider contracts by @wolfiesch in #44
• perf: reveal stable transcripts sooner by @wolfiesch in #46
• chore: pin Agent View lifecycle contract by @wolfiesch in #41
• perf: paint warm transcript before list mount by @wolfiesch in #47
• perf: benchmark OMP Codex transports by @wolfiesch in #49
• feat: add global Agent View by @wolfiesch in #48
• chore: pin verified Agent View runtime by @wolfiesch in #50
• fix: harden maintainer deferral and Sol privileges by @lyc-aon in #51
• fix(web): keep compaction status semantic row singular by @lyc-aon in #52
• fix: restore v0.1.22 runtime provenance by @lyc-aon in #53
• release: ship T4 Code v0.1.23 by @lyc-aon in #54

Full Changelog: v0.1.22...v0.1.23

v0.1.22

Follow a terminal session

Sessions running as a plain omp TUI on the host now appear in T4 Code v0.1.22, marked Active elsewhere. While the TUI owns the session, T4 follows its durable transcript: complete records, including saved images, appear as they land on disk. Every write control is disabled with the reason instead of failing later.

Ownership copy never guesses:

• A confirmed live lock is the only state called Active in another app.
• A lock that has gone quiet reads as Waiting to take over; T4 promotes on its own once the session settles.
• A malformed or unrecognized lock keeps the session read-only as "ownership unclear". T4 never names an owner it cannot confirm.

While another app owns the session, stopping the turn and session management stay with that app; T4 says so on each disabled control. If following is not available yet, T4 shows the last saved copy and catches up on its own.

Continue in T4

Run /continue-in-t4 in the OMP TUI, or just exit it. The TUI tears down normally, and T4 takes over in two confirmed steps:

1. The host reports the session lock gone. A writable takeover happens only when the lock is freshly missing; a live owner is never displaced.
2. T4 reconciles the complete transcript, line by line, against what the host has on disk.

Input returns only after both steps pass. Nothing is typed into a session another app still owns, and no transcript line is lost in the handoff.

Reconnect that does not give up

Retryable transport failures now stay in the reconnect loop indefinitely, with backoff capped at 10 seconds. A network drop, a laptop sleep, or a host restart ends in a reconnected session instead of a dead one. Anything the host did not confirm stays marked unconfirmed the whole time.

Mobile rail fix

On narrow screens, live output from the session you are already reading no longer closes the session rail you just reopened. Opening a different session still closes the rail, as before.

Runtime provenance

T4 Code v0.1.22 vendors app-wire 0.5.8 from integration commit 33615123, source tree e36475dc81dd4c3703eb207ae466f85947b33525. The client contract remains omp-app/1.

The matching OMP 17.0.0 runtime is built from commit f909a289 and tagged t4code-17.0.0-appserver-6. This revision adds lock-aware external session observation, complete line-by-line transcript reconciliation, missing-lock-only session promotion, the cooperative /continue-in-t4 TUI handoff, and deterministic session file ordering. Terminal-session following requires this runtime; older appserver builds keep working without it. Fork CI requires the release commit to descend from the exact official base.

The integration is based on the official upstream v17.0.0 tag, commit d5cd24f3. Official upstream OMP v17.0.0 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon.

The macOS build is unsigned and unnotarized. Gatekeeper will block the first launch. After copying T4 Code to Applications, run:

xattr -dr com.apple.quarantine "/Applications/T4 Code.app"

Verify downloads with SHA256SUMS.txt.

Full Changelog: v0.1.21...v0.1.22

v0.1.21

Session profile chooser

T4 Code v0.1.21 makes profile ownership explicit when you create a session. The visible New action becomes New ▾ when several local OMP profile targets are configured. Its chooser lists the current and other connected profiles, configured profiles that are offline as Not connected, and an Open Hosts shortcut to start them. The profile you pick owns the session; with one eligible target, New creates directly there. Nothing switches silently.

Android saved hosts

The Android app now manages saved hosts instead of remembering a single address. It keeps up to 16 saved Tailnet gateway addresses, stored as plain HTTPS origins with no secrets inside. Switch, add, and remove are separate actions.

Adding a host probes the address first and saves only on success. Back or Escape cancels a probe in flight, and a probe that finishes after you cancel cannot save. Removing a host deletes exactly that entry and rolls back its metadata; pairing credentials stay scoped to each host in the Android Keystore, so removing one host never touches another's credentials. Existing installs migrate their saved address into the list automatically.

Each saved host is one remote appserver serving one OMP profile. Android does not list multiple profiles behind a single saved address; running several profiles side by side remains a desktop feature, one local appserver per profile.

Runtime provenance

T4 Code v0.1.21 vendors app-wire 0.5.7 from integration commit ee1b794f, source tree 421e29e6ed9203113345906e2d24c042949d0f61. The client contract remains omp-app/1.

The matching OMP 17.0.0 runtime is built from the same commit ee1b794f and tagged t4code-17.0.0-appserver-4. This revision scopes each appserver to its OMP profile, adds host-scoped usage and broker-status commands, reports semantic thinking and fast state, and bounds project catalog resolution. Fork CI requires the release commit to descend from the exact official base.

The integration is based on the official upstream v17.0.0 tag, commit d5cd24f3. Official upstream OMP v17.0.0 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon.

The macOS build is unsigned and unnotarized. Gatekeeper will block the first launch. After copying T4 Code to Applications, run:

xattr -dr com.apple.quarantine "/Applications/T4 Code.app"

Verify downloads with SHA256SUMS.txt.

Full Changelog: v0.1.20...v0.1.21

v0.1.20

Named local profiles

T4 Code v0.1.20 discovers the named OMP profiles on your machine (the ~/.omp/profiles layout plus the default) and runs a separate appserver for each one. Every profile is its own local host with its own socket, service registration, and log directory. The Hosts screen starts, stops, or restarts a profile and can mark it to start with T4; the default profile keeps starting automatically.

Host-aware settings and account visibility

Settings carry an explicit host selector, and each connected host keeps its own staged drafts. For hosts that grant broker.read, a one-sentence status line reports where that host's accounts come from: local files, a connected broker endpoint, or a missing token. The line never includes credentials, and hosts that cannot answer are labeled unsupported instead of guessed at.

A per-host Usage screen reads provider limits, usage windows, and reset times through usage.read. Reports show their age and are labeled stale after five minutes. Provider-specific metadata and raw payloads are dropped before anything reaches the screen.

Semantic session controls and continuity

The thinking menu lists Off, Auto, and only the concrete effort levels the current model supports, in the order the host reports them. Off floors to the provider's minimum on models that cannot disable reasoning, and fast mode is offered only when the model supports it. A control change from a second client converges everywhere as host-confirmed state, and reconnects resume the session without duplicate output.

Runtime provenance

T4 Code v0.1.20 vendors app-wire 0.5.7 from integration commit ee1b794f, source tree 421e29e6ed9203113345906e2d24c042949d0f61. The client contract remains omp-app/1.

The matching OMP 17.0.0 runtime is built from the same commit ee1b794f and tagged t4code-17.0.0-appserver-4. This revision scopes each appserver to its OMP profile, adds host-scoped usage and broker-status commands, reports semantic thinking and fast state, and bounds project catalog resolution. Fork CI requires the release commit to descend from the exact official base.

The integration is based on the official upstream v17.0.0 tag, commit d5cd24f3. Official upstream OMP v17.0.0 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon.

The macOS build is unsigned and unnotarized. Gatekeeper will block the first launch. After copying T4 Code to Applications, run:

xattr -dr com.apple.quarantine "/Applications/T4 Code.app"

Verify downloads with SHA256SUMS.txt.

Full Changelog: v0.1.19...v0.1.20