v0.1.8-rc.2

Android

• revoking a device from this phone also clears a hold on a machine that came from that device's head, kept from a CLI 0.1.0 preview. (#1795)
• a link chip with a title on a site other than GitHub shows the site's name after the title. (#1774)
• Approving a device from a pairing link now asks you to confirm first; security hardening for pushes, the recovery key clipboard and screens that show secrets. (#1767)
• the status bar icon sits level with other apps' icons. (#1713)

iOS

• revoking a device from this iPhone also clears a hold on a machine that came from that device's head, kept from a CLI 0.1.0 preview. (#1795)
• notifications show a question only when it is the one the push names, and the inbox shows an error while your devices list fails its checks. (#1780)
• a link chip with a title on a site other than GitHub shows the site's name after the title. (#1774)
• Security hardening for notification buttons, pairing screens and image backups. (#1775)

Web

• revoking a device from this browser also clears a hold on a machine that came from that device's head, kept from a CLI 0.1.0 preview. (#1795)
• /privacy leads with a short summary per category; the details are in collapsed sections. (#1790)
• a link chip with a title on a site other than GitHub shows the site's name after the title. (#1774)
• Time format's default is now called Browser, since it follows the browser's language. (#1706)

Desktop

• the browser opens only from your own click, and GitHub sign-in accepts only a sign-in finished in the browser it started in. (#1758)
• Time format follows the Mac's 12/24-hour setting. (#1706)
• Settings → Updates picks an update channel, Stable or Release candidates, in place of the Release candidates switch. (#1696)

CLI

• Setup rewrites other tools' config files atomically and quotes unusual paths safely, and update gives up on a stalled or oversized download. (#1782)
• an answer to a Claude Code subagent that finished before reading it goes to the parent session. (#1792)
• starbridge settle --all needs a terminal, and agents no longer run settle --all or settle --session without asking; Codex, Cursor and Antigravity ask before settle. (#1773)
• The installers refuse to downgrade the CLI unless STARBRIDGE_DOWNGRADE=1, hooks only start a recorded CLI path that only you can write, and ask --session from inside an agent asks as that agent's own session. (#1765)
• updates are no longer held by a future-dated timestamp, run ids stay with their session, and Cursor's stop hook stops repeating "No answer yet" after three. (#1784)
• the CLI refuses oversized images and bounds server, run and CodexBar output instead of trusting it. (#1783)
• Antigravity asks before running a quoted or prefixed starbridge command, and a rogue local language server can no longer exhaust the agent. (#1764)
• Setup and starbridge update install the Claude Code plugins and the Pi package at the exact commit of the CLI's signed release. (#1776)
• The local agent hands Codex sessions their answers only with the codex that setup found; ask --input no longer sets where answers go. (#1759)
• Permission prompts keep a shell command at the keyboard when redacting a secret would hide what it runs, or when it is too long to show whole. (#1726)
• settle, waiting, working, wait and answers --session show the card's question beside its id, and a card that closed already says how and when. (#1704)
• an answer to a card a Claude Code subagent asked goes back to that subagent. (#1707)
• decision ids are three words, such as d_amber-otter-lantern. Ids from before keep working. (#1700)

Server

• Caddy's error log no longer records query strings or credential headers of failed requests. (#1793)
• Web Push and UnifiedPush endpoints must use port 443 unless their host is in ALLOW_PRIVATE_PUSH_ENDPOINTS, and an account's subscriptions name at most 8 push services. (#1769)
• a request body must arrive within 2 minutes, and pairing waits are capped per address and in all. (#1777)
• when its storage nears full, the server drops the oldest unanswered questions of the accounts holding the most after 7 days, and bun server.js purge ACCOUNT empties one account. (#1781)
• a page of items holds at most 4 MB, questions past it list without their images until shown, and an account reads at most 128 MB of items a minute. (#1785)
• a self-hosted server refuses to start with an OWNER_TOKEN under 16 characters. (#1728)
• an app's GitHub sign-in that comes back through the browser is checked against the app's PKCE verifier on the server too. (#1725)

Docs

• the Mac and iPhone icon badge, and the CLI minimum version. (#1711)

All pull requests (47)

• Release 0.1.8-rc.2 (#1801)
• CLI: harden setup's file writes, quoting, downloads and inputs (#1782)
• Caddy's error log: no query string, no credential headers (#1788) (#1793)
• Load test: accounts full of large questions, listed from cursor 0 (#1787) (#1800)
• Mod: an answer a subagent never read goes to the parent when it finishes (#1729) (#1792)
• Heads: forgetting a member also drops the pre-#1627 heads passed on from it (#1730) (#1795)
• Desktop tests: pick the stack's ports while every socket is open (#1786) (#1791)
• CLI: settle --all is no longer an own command or allowed without a prompt (#1773)
• Desktop: bind sign-in to the browser that started it; open the browser only from a click (#1758)
• CLI: refuse installer rollbacks, check cli-path's owner, hold ask --session to the asker (#1765)
• Deploy by image digest, the one staging ran (#1743)
• /privacy: a short summary per category, details collapsed (#1789) (#1790)
• /privacy: match the 2026-10-14 privacy audit (#1752)
• CLI: expire future timestamps, bind run ids to their session, evict old state, cap Cursor follow-ups, replace only its own symlink (#1784)
• CLI: bound images, run progress, server text, poll waits, pages and CodexBar output (#1762) (#1783)
• Antigravity: prompt for quoted starbridge commands, refuse redirects, cap what a language server can make the agent hold (#1764)
• Demo: start over when a reviewer deletes the demo account (#1740) (#1754)
• Sign in with Apple: fetch Apple's keys at most once a minute (#1739) (#1751)
• Push: Web Push only to port 443, at most 8 push hosts per account (#1769)
• Pairings: cap result waits in all and per address; requests get 2 minutes (#1777)
• Server: shorten the largest accounts' retention when storage is full, and an operator purge (#1781)
• Items: page by bytes, and limit reads per account (#1785)
• iOS: note heads only for machine-signed items; match fetched decision ids; require an account to verify a directory (#1780)
• Link chips: show the host after a title on a non-GitHub link; landing cache keyed on the public origin (#1774)
• Server: refuse an OWNER_TOKEN under 16 characters, and any on starbridge.run (#1720) (#1728)
• Server: check an app's PKCE verifier against the challenge its code came back with (#1725)
• Setup: install the Claude Code plugins and the Pi package at the release's commit (#1776)
• Ask: take delivery routes and session kind from the environment only (#1759)
• Permissions: never redact a command word (#1726)
• Deploy boxes check the staging and CI gate themselves (#1727)
• Gradle dependency verification; release builds skip the HTTP mirror (#1778)
• Deploy: the server container runs read-only with no capabilities; Caddy's admin API on a root-only socket (#1717) (#1770)
• Deploy: a failed service's logs stay on the box, out of the public Actions log (#1771) (#1772)
• Deploy: first setup turns root SSH login off; secrets reach the box without a temp folder (#1766)
• CI: main skips an e2e part only on an artifact traced to a run that passed it (#1732) (#1750)
• Git hooks: install never replaces a hook with an older one (#1733) (#1742)
• docs/ci.md: say what a runner wipes between jobs, and that Docker makes a job root on its box (#1718) (#1741)
• iOS: check a notification button's category, drop odd push ids, cover pairing secrets, keep images out of backups (#1756) (#1775)
• Android: harden the pairing link, pushes, secrets and the Quotas widget setup (#1767)
• Internal Android builds: next patch's slots once the final is tagged (#1747)
• Android: the status bar icon sits level with other apps' icons (#1712) (#1713)
• Docs: the icon badge, and the CLI minimum version (#1710) (#1711)
• CLI: commands name the card's question and say when it closed (#1697) (#1704)
• Subagents: an answer goes back to the subagent that asked (#1702) (#1707)
• Time format: Browser on the web, macOS's own choice in the Mac app (#1705) (#1706)
• Decisions: ids are three words (#1697) (#1700)
• Desktop: Settings' update channel adds Tip, the builds of main (#1692) (#1696)

Full Changelog: v0.1.8-rc.1...v0.1.8-rc.2

v0.1.8-rc.1

Android

• the Quotas widget now fetches fresh quotas when it updates, and says "Updated 3 h ago" when its numbers are old. (#1687)
• a hold on machine items names only the machine. (#1673)
• no longer opens the starbridge://pair links that CLIs before 0.1.1 printed. (#1668)

iOS

• a hold on machine items names only the machine. (#1673)
• no longer opens the starbridge://pair links that CLIs before 0.1.1 printed. (#1668)

Web

• /privacy names the iPhone and Mac apps, Sign in with Apple and Apple's push service. (#1648)
• a hold on machine items names only the machine. (#1673)

Desktop

• no longer opens the starbridge://pair links that CLIs before 0.1.1 printed. (#1668)

All pull requests (24)

• Desktop: build and publish a signed tip from every change to main (#1692) (#1694)
• Release 0.1.8-rc.1 (#1703)
• Marketplace: plugins from v0.1.7 (#1701)
• Releases: rcs on demand, promoted 4 hours after the rc (#1699)
• pre-commit stages formatted files from the repo root, not from the package folder (#1693) (#1695)
• Android: every merge that touches the app and every rc tag builds to the internal track (#1691)
• Ops page: a Promotion section (#1688) (#1689)
• Privacy: name the iPhone and Mac apps, Sign in with Apple, Apple push (#1640) (#1648)
• Android: the Quotas widget fetches fresh quotas and says when they are old (#1687)
• Desktop: notarize on a push to main only when signing inputs change (#1685)
• CI: install gh on the runner boxes, fix stale comments, time out every job (#1682)
• CI: start the lockfile job and the image scan only when they can act (#1683)
• CI: keep write tokens away from the jobs that run third-party code (#1676) (#1680)
• CI: one matrix job for the CLI on Windows, macOS and Linux ARM64 (#1677) (#1681)
• Protocol, web, Android, iOS: drop the by heads of machines before #794 (#1627) (#1673)
• Prod deploy: retry compose up once Docker finishes removing the old container (#1674) (#1675)
• AGENTS.md: check for the bugs reviews keep finding before review (#1658) (#1672)
• Worktrees: install dependencies when a session starts (#1671)
• Git hooks: format staged files before commit, refuse force-push (#1670)
• CI: record jobs that fail and then pass on a rerun (#1669)
• CodeQL Swift: build ios/StarbridgeProtocol and the widgets by hand (#1650) (#1667)
• Staging deploy: retry compose up once Docker finishes removing the old container (#1663) (#1666)
• Drop the starbridge://pair link of CLIs before 0.1.1 (#1628) (#1668)
• Ops: a private page of the rings, main included, and what happens next (#1633)

Full Changelog: v0.1.7...v0.1.8-rc.1

v0.1.7

Android

• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1592)
• When another device or your agent closes the last question you have open, its sheet closes and the empty inbox comes back. (#1595)
• The sign-out message is clearer. (#1614)
• A pairing link opened before this phone is in your account asks before adding it. (#1506)
• A notification no longer goes missing when it arrives while the app is syncing on a slow network. (#1505)

iOS

• A question's detail and History read as on Android and the web: "Your answer" in the reply field, Done and Snooze beside the session's name, an amber page link, a dark block for a prompt's command, and who answered each question in History. (#1644)
• Runs show as on Android and the web: running ones newest first, finished ones for 30 minutes, an indeterminate bar before the first progress, and no elapsed time on a lost run. Questions posted together keep the agent's order. (#1645)
• links from the agent show as chips with an icon and short text, such as #123 for a pull request. (#1593)
• The sign-out message is clearer. (#1614)
• The app icon shows how many questions and prompts need you. (#1615)
• When another device or your agent closes the last question you have open, its sheet closes and the empty inbox comes back. (#1596)

Web

• A permission prompt's row always offers Allow; when the row can't show the whole input, Allow opens the prompt. (#1646)
• /terms lists its changes with dates. (#1643)
• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1585)
• /privacy lists its changes with dates and names Cloudflare and what Oracle holds. (#1623)
• The sign-out message is clearer. (#1614)
• a Find query that matches no open card no longer closes the open card on a narrow window. (#1606)
• the last open card, settled from elsewhere while open on a narrow screen, returns to the empty inbox. (#1588)
• the tab icon is centred like other sites' icons. (#1564)
• Safari no longer says notifications are blocked right after you allow them. (#1491)
• /privacy says an encrypted copy of the nightly backup is kept at Oracle, in Frankfurt, for 14 days. (#1483)

Desktop

• A notification's reply field reads "Your answer". (#1646)
• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1585)
• The sign-out message says "this Mac" and is clearer. (#1614)
• the Server window opens at the size of its content, with Save and Use starbridge.run in view. (#1616)
• the same. (#1606)
• the Dock icon shows how many cards are waiting for you. (#1604)
• the same, in a narrow window. (#1588)
• the menu bar icon with the amber dot now follows the menu bar's light or dark look, not the theme's. (#1515)

CLI

• starbridge setup --no-plugin is refused; use --no-agents. (#1637)
• the Claude Code plugin starts one process fewer for each AskUserQuestion question. (#1632)
• an answer reaches a busy Claude Code, Codex or Pi agent at its next tool call, whether or not the question was marked waiting (#1594, landed here). (#1600)
• several answers waiting for one session reach it as one message, one line each, in Claude Code, Codex, Pi, opencode and Antigravity. (#1600)
• withdrawing a question that was already answered now prints the answer instead of losing it, and starbridge answers --all lists answers to questions withdrawn since. (#1582)
• an answer queued in Claude Code is no longer submitted twice, or lost, when two processes resume the same session. (#1563)
• an answer queued in a Claude Code session whose process exits before it runs comes back once when the session is resumed. (#1531)
• starbridge --help lists codex for hook permission, hook settle and hook question. (#1503)
• Uninstall removes the PATH line setup added to your shell's startup file, and deletes settings files it leaves empty. (#1502)
• Refreshing or uninstalling Cursor's setup keeps your own hooks.json entries that run a script from ~/.cursor/starbridge. (#1498)
• a quick question an agent asks with its own question tool reaches your devices titled with the question, not with a question about the card's title. (#1501)
• an answer to a question the agent marked waiting reaches a busy Codex agent at its next tool call, instead of after its turn. (#1489)
• an answer to a question the agent marked waiting reaches a busy Claude Code or Pi agent at its next tool call, instead of after its turn; starbridge waiting prints an answer that already came in. (#1487)

Server

• refuses the CLI before 0.1.1. Run starbridge update on a machine that still has 0.1.0. (#1631)
• SIGNUP_GITHUB_IDS limits who can make an account on a self-hosted server with GitHub sign-in. (#1525)

Docs

• what each harness supports lists batched answers. (#1600)
• answers during a turn, the quiet-devices hold choice, the iPhone app in TestFlight and the status page; stale self-host and CI statements fixed. (#1573)

All pull requests (85)

• Release 0.1.7
• Release 0.1.7-rc.3 (#1665)
• iOS: the question detail, prompts and History say what web and Android say (#1634) (#1644)
• Web: a prompt row's Allow opens the prompt when its input doesn't fit (#1636) (#1646)
• iOS: inbox order by instant, and runs as web and Android show them (#1635) (#1645)
• CI: check the Android and iPhone apps against staging every night (#1621) (#1664)
• CLI: drop setup --no-plugin (#1626) (#1637)
• Plugin: drop the PreToolUse hook on AskUserQuestion (#1625) (#1632)
• Server: refuse CLIs before 0.1.1 (#1624) (#1631)
• android: pull requests restore a Gradle cache saved from main (#1652)
• Terms: dated Changes list and a test, as /privacy has (#1639) (#1643)
• Prune duplicate tests and change detectors in server, web and protocol (#1654) (#1659)
• Prune duplicate and mirrored tests in cli and mod (#1629) (#1647)
• opencode: read a claim's text and age from one open file, so two takeovers never both submit (#1649) (#1653)
• Releases: record what each release published, for a public releases page (#1618) (#1619)
• iOS: link chips with icons and short text, from the shared rule (#1591) (#1593)
• Android: link chips from the shared rule, artifact and file icons (#1590) (#1592)
• CI: run a pull request's e2e parts on GitHub's runners (#1638) (#1641)
• Desktop e2e: the median of five warm tab switches under 100 ms (#1581) (#1622)
• Link chips: one shared rule, Claude artifact and GitHub file icons (#1577) (#1585)
• Privacy: dated Changes list, Cloudflare status page, what Oracle gets (#1620) (#1623)
• Android: the last open card settled elsewhere closes its sheet (#1586) (#1595)
• Sign out says the same on every client, with this Mac in the desktop app (#1614)
• iOS: the app icon badge counts what needs you (#1603) (#1615)
• Android: a build of main names its commit in its versionName (#1610) (#1611)
• Desktop: the Server window opens at the size of its content (#1613) (#1616)
• CI: run the narrow-window e2e (#1609)
• Android: OutageNoticeTest waits for a timer's notice instead of asserting at once (#1601) (#1607)
• Web: Find with no match keeps the open card open (#1606)
• Desktop: the Dock icon shows the number of cards waiting (#1602) (#1604)
• Answers: several pending for one session go as one message (#1597) (#1600)
• iOS: the last open card settled elsewhere closes its sheet (#1587) (#1596)
• Dogfood: main's builds to the owner's devices, against staging (#1578)
• CLI: settle never loses an answer that came first (#1575) (#1582)
• Web: settling the last open card elsewhere returns to the empty list under 1100 px (#1583) (#1588)
• Staging: phones get its pushes through starbridge.run's relay; it relays for nobody (#1540) (#1579)
• Mod: a queued answer's recovery never replays or loses it (#1559) (#1563)
• Release 0.1.7-rc.2 (#1580)
• Scan: ignore sprintf-js's DoS, reachable only from Electron's build-time download (#1554) (#1574)
• Demo server: off prod, now that sb-staging serves it (#1576)
• CLI test: the keyboard answers Codex's picker only once the card's post returned (#1547) (#1569)
• Demo server: sb-staging serves demo.starbridge.run (#1558)
• Docs: review after 0.1.7 (#1573)
• Releases: prod deploys on rc tags; main deploys to staging only (#1539)
• Deploy: apply.sh asks the server whether it would open the database (#1567) (#1568)
• scan.yml: scan the commits prod and staging serve (#1561)
• Web: the tab icon is centred top to bottom (#1562) (#1564)
• Load test: LOAD_FAKE=stack runs the fakes on the stack's network (#1571)
• Spec: infra alerts go to Discord from sb-oracle, not cards (#1565) (#1566)
• Load test: a fleet mode for weeks against a real server, with metrics every 5 minutes and cut long-polls (#1552)
• Hosted: service targets and the status page (#1550)
• Deploy: rehearse migrations on prod's schema at the hosted cap (#1546)
• Server: open a database one additive migration ahead, so a rollback keeps its writes (#1555) (#1556)
• Load test: a JSON result compared with a stored baseline, runnable from CI's images in one capped slice (#1549)
• CI: scan the images with Trivy and the lockfiles with osv-scanner (#1545)
• Deploy: failover runbook to sb-staging, and a first drill (#1533)
• Android: resolve Gradle dependencies through the home mirror where a machine sets it (#1537)
• Deploy: a round trip from sb-oracle right after each prod deploy (#1523)
• CI: a Play dry run from main passes when only the versionCode is too low (#1530) (#1541)
• Server: a sign-up list of GitHub users, for staging (#1525)
• CI: log in to Docker Hub before pulling images (#1534) (#1535)
• Deploy: rollback.sh for the server, and a client rollback checklist (#1521)
• Mod: an answer queued as a prompt survives the session's process exiting (#1517) (#1531)
• Deploy: build the server and web images once in CI, push to ghcr, prod pulls (#1519)
• Desktop: retry only the ...

v0.1.7-rc.3

Android

• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1592)
• When another device or your agent closes the last question you have open, its sheet closes and the empty inbox comes back. (#1595)
• The sign-out message is clearer. (#1614)

iOS

• A question's detail and History read as on Android and the web: "Your answer" in the reply field, Done and Snooze beside the session's name, an amber page link, a dark block for a prompt's command, and who answered each question in History. (#1644)
• Runs show as on Android and the web: running ones newest first, finished ones for 30 minutes, an indeterminate bar before the first progress, and no elapsed time on a lost run. Questions posted together keep the agent's order. (#1645)
• links from the agent show as chips with an icon and short text, such as #123 for a pull request. (#1593)
• The sign-out message is clearer. (#1614)
• The app icon shows how many questions and prompts need you. (#1615)
• When another device or your agent closes the last question you have open, its sheet closes and the empty inbox comes back. (#1596)

Web

• A permission prompt's row always offers Allow; when the row can't show the whole input, Allow opens the prompt. (#1646)
• /terms lists its changes with dates. (#1643)
• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1585)
• /privacy lists its changes with dates and names Cloudflare and what Oracle holds. (#1623)
• The sign-out message is clearer. (#1614)
• a Find query that matches no open card no longer closes the open card on a narrow window. (#1606)
• the last open card, settled from elsewhere while open on a narrow screen, returns to the empty inbox. (#1588)

Desktop

• A notification's reply field reads "Your answer". (#1646)
• a Claude artifact link shows a window icon, and a GitHub file link shows a file icon and the file's name. (#1585)
• The sign-out message says "this Mac" and is clearer. (#1614)
• the Server window opens at the size of its content, with Save and Use starbridge.run in view. (#1616)
• the same. (#1606)
• the Dock icon shows how many cards are waiting for you. (#1604)
• the same, in a narrow window. (#1588)

CLI

• starbridge setup --no-plugin is refused; use --no-agents. (#1637)
• the Claude Code plugin starts one process fewer for each AskUserQuestion question. (#1632)
• an answer reaches a busy Claude Code, Codex or Pi agent at its next tool call, whether or not the question was marked waiting (#1594, landed here). (#1600)
• several answers waiting for one session reach it as one message, one line each, in Claude Code, Codex, Pi, opencode and Antigravity. (#1600)
• withdrawing a question that was already answered now prints the answer instead of losing it, and starbridge answers --all lists answers to questions withdrawn since. (#1582)
• an answer queued in Claude Code is no longer submitted twice, or lost, when two processes resume the same session. (#1563)

Server

• refuses the CLI before 0.1.1. Run starbridge update on a machine that still has 0.1.0. (#1631)

Docs

• what each harness supports lists batched answers. (#1600)

All pull requests (36)

• Release 0.1.7-rc.3 (#1665)
• iOS: the question detail, prompts and History say what web and Android say (#1634) (#1644)
• Web: a prompt row's Allow opens the prompt when its input doesn't fit (#1636) (#1646)
• iOS: inbox order by instant, and runs as web and Android show them (#1635) (#1645)
• CI: check the Android and iPhone apps against staging every night (#1621) (#1664)
• CLI: drop setup --no-plugin (#1626) (#1637)
• Plugin: drop the PreToolUse hook on AskUserQuestion (#1625) (#1632)
• Server: refuse CLIs before 0.1.1 (#1624) (#1631)
• android: pull requests restore a Gradle cache saved from main (#1652)
• Terms: dated Changes list and a test, as /privacy has (#1639) (#1643)
• Prune duplicate tests and change detectors in server, web and protocol (#1654) (#1659)
• Prune duplicate and mirrored tests in cli and mod (#1629) (#1647)
• opencode: read a claim's text and age from one open file, so two takeovers never both submit (#1649) (#1653)
• Releases: record what each release published, for a public releases page (#1618) (#1619)
• iOS: link chips with icons and short text, from the shared rule (#1591) (#1593)
• Android: link chips from the shared rule, artifact and file icons (#1590) (#1592)
• CI: run a pull request's e2e parts on GitHub's runners (#1638) (#1641)
• Desktop e2e: the median of five warm tab switches under 100 ms (#1581) (#1622)
• Link chips: one shared rule, Claude artifact and GitHub file icons (#1577) (#1585)
• Privacy: dated Changes list, Cloudflare status page, what Oracle gets (#1620) (#1623)
• Android: the last open card settled elsewhere closes its sheet (#1586) (#1595)
• Sign out says the same on every client, with this Mac in the desktop app (#1614)
• iOS: the app icon badge counts what needs you (#1603) (#1615)
• Android: a build of main names its commit in its versionName (#1610) (#1611)
• Desktop: the Server window opens at the size of its content (#1613) (#1616)
• CI: run the narrow-window e2e (#1609)
• Android: OutageNoticeTest waits for a timer's notice instead of asserting at once (#1601) (#1607)
• Web: Find with no match keeps the open card open (#1606)
• Desktop: the Dock icon shows the number of cards waiting (#1602) (#1604)
• Answers: several pending for one session go as one message (#1597) (#1600)
• iOS: the last open card settled elsewhere closes its sheet (#1587) (#1596)
• Dogfood: main's builds to the owner's devices, against staging (#1578)
• CLI: settle never loses an answer that came first (#1575) (#1582)
• Web: settling the last open card elsewhere returns to the empty list under 1100 px (#1583) (#1588)
• Staging: phones get its pushes through starbridge.run's relay; it relays for nobody (#1540) (#1579)
• Mod: a queued answer's recovery never replays or loses it (#1559) (#1563)

Full Changelog: v0.1.7-rc.2...v0.1.7-rc.3

v0.1.7-rc.2

Web

• the tab icon is centred like other sites' icons. (#1564)

Desktop

• the menu bar icon with the amber dot now follows the menu bar's light or dark look, not the theme's. (#1515)

CLI

• an answer queued in a Claude Code session whose process exits before it runs comes back once when the session is resumed. (#1531)

Server

• SIGNUP_GITHUB_IDS limits who can make an account on a self-hosted server with GitHub sign-in. (#1525)

Docs

• answers during a turn, the quiet-devices hold choice, the iPhone app in TestFlight and the status page; stale self-host and CI statements fixed. (#1573)

All pull requests (31)

• Release 0.1.7-rc.2 (#1580)
• Scan: ignore sprintf-js's DoS, reachable only from Electron's build-time download (#1554) (#1574)
• Demo server: off prod, now that sb-staging serves it (#1576)
• CLI test: the keyboard answers Codex's picker only once the card's post returned (#1547) (#1569)
• Demo server: sb-staging serves demo.starbridge.run (#1558)
• Docs: review after 0.1.7 (#1573)
• Releases: prod deploys on rc tags; main deploys to staging only (#1539)
• Deploy: apply.sh asks the server whether it would open the database (#1567) (#1568)
• scan.yml: scan the commits prod and staging serve (#1561)
• Web: the tab icon is centred top to bottom (#1562) (#1564)
• Load test: LOAD_FAKE=stack runs the fakes on the stack's network (#1571)
• Spec: infra alerts go to Discord from sb-oracle, not cards (#1565) (#1566)
• Load test: a fleet mode for weeks against a real server, with metrics every 5 minutes and cut long-polls (#1552)
• Hosted: service targets and the status page (#1550)
• Deploy: rehearse migrations on prod's schema at the hosted cap (#1546)
• Server: open a database one additive migration ahead, so a rollback keeps its writes (#1555) (#1556)
• Load test: a JSON result compared with a stored baseline, runnable from CI's images in one capped slice (#1549)
• CI: scan the images with Trivy and the lockfiles with osv-scanner (#1545)
• Deploy: failover runbook to sb-staging, and a first drill (#1533)
• Android: resolve Gradle dependencies through the home mirror where a machine sets it (#1537)
• Deploy: a round trip from sb-oracle right after each prod deploy (#1523)
• CI: a Play dry run from main passes when only the versionCode is too low (#1530) (#1541)
• Server: a sign-up list of GitHub users, for staging (#1525)
• CI: log in to Docker Hub before pulling images (#1534) (#1535)
• Deploy: rollback.sh for the server, and a client rollback checklist (#1521)
• Mod: an answer queued as a prompt survives the session's process exiting (#1517) (#1531)
• Deploy: build the server and web images once in CI, push to ghcr, prod pulls (#1519)
• Desktop: retry only the staple step after notarization (#1512) (#1513)
• Desktop: the amber menu bar icon's arch follows the menu bar's appearance (#1514) (#1515)
• Marketplace: plugins from v0.1.6 (#1510)
• CLI test: wait for the waiting mark instead of a fixed sleep (#1508) (#1509)

Full Changelog: v0.1.7-rc.1...v0.1.7-rc.2

v0.1.7-rc.1

Android

• A pairing link opened before this phone is in your account asks before adding it. (#1506)
• A notification no longer goes missing when it arrives while the app is syncing on a slow network. (#1505)

Web

• Safari no longer says notifications are blocked right after you allow them. (#1491)
• /privacy says an encrypted copy of the nightly backup is kept at Oracle, in Frankfurt, for 14 days. (#1483)

CLI

• starbridge --help lists codex for hook permission, hook settle and hook question. (#1503)
• Uninstall removes the PATH line setup added to your shell's startup file, and deletes settings files it leaves empty. (#1502)
• Refreshing or uninstalling Cursor's setup keeps your own hooks.json entries that run a script from ~/.cursor/starbridge. (#1498)
• a quick question an agent asks with its own question tool reaches your devices titled with the question, not with a question about the card's title. (#1501)
• an answer to a question the agent marked waiting reaches a busy Codex agent at its next tool call, instead of after its turn. (#1489)
• an answer to a question the agent marked waiting reaches a busy Claude Code or Pi agent at its next tool call, instead of after its turn; starbridge waiting prints an answer that already came in. (#1487)

All pull requests (17)

• Release 0.1.7-rc.1 (#1511)
• Android: pairing links ask before acting (#1506)
• Android: a push that waits for the store lock is handled once it frees, not dropped (#1497) (#1505)
• CLI help: hook permission, settle and question list codex for --agent (#1496) (#1503)
• Web: store writes settle when their transaction aborts (#1495) (#1504)
• Uninstall: remove the PATH line setup added, and files it leaves empty (#1502)
• Android: re-record the sign-in screenshots for #1477's mark (#1507)
• Cursor setup: Starbridge's hook entries are known by their exact commands (#1493) (#1498)
• Rule: an ask-tool question ends with the question itself (#1499) (#1501)
• Skill eval: #1063's four void Claude Code rows, rerun (#1500)
• Skill eval: #1487's answer-delivery wording, and a mid-task situation (#1488) (#1492)
• Web: never say notifications are blocked on Notification.permission alone (#1404) (#1491)
• CI: run the CLI suite on Linux ARM64 (#1481) (#1490)
• Codex: an answer marked waiting reaches the agent at its next tool call (#1486) (#1489)
• Answers during a turn: a question marked waiting reaches the agent at its next tool call (#1484) (#1487)
• deploy: encrypted offsite copy of each nightly backup (#1482) (#1483)
• Release: sign TestFlight builds with one stored distribution certificate (#1479) (#1480)

Full Changelog: v0.1.6...v0.1.7-rc.1

v0.1.6

Android

• In the Quotas widget's picker, tapping a ticked quota now unticks that quota, not the other one. (#1476)
• The app icon, themed icon included, sits centred. (#1477)
• the app starts faster when it has kept many questions with images. (#1475)
• the app starts faster on a long history and no longer downloads the images of answered questions until you open one. (#1467)
• the app sends half the requests when it opens. (#1470)
• Sign in with Apple under Other ways to sign in. (#1443)
• Answering from a notification closes it at once; it comes back only if the answer is refused. (#1448)
• New app icon: an arch from your machine to your phone. (#1414)
• the update screen says your answers are kept and sent once the app is updated. (#1424)
• the colours option is called Material You again. (#1413)
• an answer refused while the server was limiting requests now goes out on its own once the limit ends, without a pull to refresh. (#1391)
• a presence beat's 429 no longer holds every call. (#1389)
• the empty inbox's install command is your server's. (#1386)
• after approving a machine by its typed code, Add a device shows the check code to compare in the terminal. (#1385)
• when your lock screen hides sensitive notification content, a question's buttons ask you to unlock the phone before they answer. (#1376)
• a new account's inbox scans a machine's QR code in one tap. (#1371)
• a snoozed question no longer comes back early when its first push arrives late. (#1323)
• Devices says when each machine last updated its CLI, and to which release. (#1272)

iOS

• The app icon sits centred. (#1477)
• joining on an account with a long history no longer downloads the images of answered questions; a question's images load when you open it. (#1468)
• Sign in with Apple, beside GitHub. (#1441)
• Answering from a notification closes it at once; it comes back only if the answer is refused. (#1448)
• a permission prompt whose input has emoji gets Allow on its card exactly when the web and Android give it. (#1431)

Web

• The install icon sits centred. (#1477)
• Sign in with Apple under Other ways to sign in. (#1442)
• open questions show within about a second of opening the page, before History. (#1461)
• the inbox opens faster after a reload. (#1456)
• switching to the Inbox with History open is faster on a long history. (#1462)
• the inbox opens faster on an account with a long history. (#1457)
• Under 1100 px, J and K move between cards, and with a mouse answering opens the next card instead of the list. (#1433)
• New app and tab icon: an arch from your machine to your phone. (#1414)
• the recovery key screen says to keep the key in a password manager or on paper. (#1424)
• on an iPhone Home Screen app, every question notifies again; before, notifications stopped after a few answered questions until the app was reopened. (#1369)
• the landing page lists the Android, iPhone and Mac apps first, then the install command. (#1379)
• a browser signing in to an account with a long history no longer downloads the images of every answered question; a question's images load when you open it. (#1388)
• the empty inbox's Homebrew and npm commands run starbridge setup, and its Add a device opens on the code field. (#1386)
• the pairing result's check code line is shorter. (#1385)
• the inbox opens in about a second on an account with a long history; the browser keeps what it read and fetches only what is new. History shows the last 7 days, older questions under "Show older". (#1383)
• a new account's inbox links to Add a device, to pair its first machine. (#1371)
• a few page reloads within a minute no longer make a settings change fail with "too many requests". (#1373)
• on an iPhone, the Inbox no longer offers to turn on notifications that are already on. (#1364)
• a snoozed question no longer comes back early when its first push arrives late. (#1319)
• Devices says when each machine last updated its CLI, and to which release. (#1272)

Desktop

• The app icon sits centred. (#1477)
• Sign in with Apple under Other ways to sign in. (#1442)
• a click on the menu bar icon opens Starbridge; Open at login is now in Settings → App, and the icon lines up with the system icons. (#1453)
• Answering from a notification closes it at once; "Answer not sent" still shows if it fails. (#1448)
• Update installs the newest release even when an older one was already downloaded. (#1445)
• In a narrow window, J and K move between cards, and answering opens the next card instead of the list. (#1433)
• Updates show at the foot of the window's sidebar ("Update available", "Restart to update"). Release candidates and automatic downloads moved to Settings → Updates, out of the menu bar. (#1403)
• New app and menu bar icon: an arch from your machine to your phone. (#1414)

CLI

• answers start their Claude Code turn right away instead of up to 25 s later. (#1460)
• when Claude desktop runs a session on another machine with copies of Starbridge's plugins that have no hooks, ask and status say so, since answers then come back only through wait. (#1434)
• starbridge update also moves the Pi extension to the new version. (#1418)
• a CLI installed with install.sh or install.ps1 now installs each new release by itself, while no question, permission prompt or run is in flight; starbridge config updates off turns that off. (#1272)

Server

• Apple's web sign-in for the page and the apps. (#1442)
• Sign in with Apple for the iPhone app; deleting an account also revokes its Apple sign-in. (#1440)
• account deletions are limited to 3 an hour per address. (#1348)
• a snooze's push says whether it is the question's return. (#1319)

Docs

• cli/CONTRACT.md gives every line starbridge settle --session and --all print. (#1347)
• the CLI page describes automatic updates. (#1272)

All pull requests (77)

• Release 0.1.6
• Release 0.1.6-rc.4 (#1478)
• Android: a tap in the Quotas widget picker unticks the row tapped (#1465) (#1476)
• The mark's box sits at the centre of the icon (#1466) (#1477)
• Android: each image in a file of its own, not inside state.bin (#1471) (#1475)
• Release 0.1.6-rc.3 (#1474)
• Web, iOS: a fetched image opens against the kept question's refs, from the same machine (#1472) (#1473)
• Android: an answered question's images download when its sheet shows them (#1464) (#1467)
• Android: one sync at launch, and no chain replay when the directory is unchanged (#1469) (#1470)
• Android: Sign in with Apple behind Other ways to sign in (#1411) (#1443)
• Web and desktop: Sign in with Apple behind Other ways to sign in (#1411) (#1442)
• iOS: an answered question's images download when its detail shows them (#1463) (#1468)
• Web: a load shows the open questions before it opens the answered ones (#1458) (#1461)
• Web: one read of the directory per page load and poll round (#1454) (#1456)
• Web: History lays out its rows 50 at a time (#1459) (#1462)
• Web: the prompts' settled notices read from the kept inbox's cursor (#1455) (#1457)
• Mod: hold no long call while an answer waits for its turn (#1446) (#1460)
• Desktop: the menu bar icon opens the app; its options move to Settings; center the icon (#1453)
• iOS: Sign in with Apple (#1411) (#1441)
• Release notes: iOS is a product (#1451) (#1452)
• Notifications: an answer from a notification closes it at the tap (#1447) (#1448)
• Desktop: Update installs the newest release (#1444) (#1445)
• Server: Sign in with Apple for the iPhone app (#1411) (#1440)
• Release 0.1.6-rc.2 (#1439)
• iOS: build and test on the Mac mini through one script with a cache and a lock (#1438)
• Web, Android and iOS tests read rules.json (#1431)
• Protocol: rules.json, the rules every client applies on its own (#1430)
• CLI: ask and status name the hookless plugin copies Claude desktop runs a session with (#1428) (#1434)
• Play: a workflow updates the listing's icon and feature graphic through the API (#1436) (#1437)
• Web: J, K and the next card after an answer under 1100 px (#1433)
• Desktop: updates in the window, not the menu bar (#1403)
• New mark: an arch from machine to phone (#1366) (#1414)
• Parity copy: Android's update screen and the web's recovery key screen follow the other clients (#1424)
• CI: a client PR says what it means for the other clients (#1426)
• AGENTS.md: a change to one client's behaviour checks the others (#1421) (#1425)
• Release: sign the TestFlight build through the App Store Connect REST API (#1419) (#1420)
• CLI: refresh moves the Pi package to the new release (#1418)
• Release: archive the iPhone app unsigned; the API key signs only the export (#1415) (#1416)
• Release: check the App Store Connect key before the TestFlight archive (#1409) (#1410)
• Android: the colours option is called Material You again (#1412) (#1413)
• Spec: notifications close on Safari when the page reads the inbox (#1406) (#1408)
• Spec: the apps send a presence beat during a rate-limit hold (#1405) (#1407)
• iOS: end GitHub sign-in on the https callback, with apple-app-site-association (#1115) (#1402)
• Release: upload the iPhone app to TestFlight (#1397) (#1399)
• Android: the hold test sets the hold with another call's 429 (#1400) (#1401)
• Release 0.1.6-rc.1 (#1396)
• Web Push: every push to Safari shows a notification (#1363) (#1369)
• iOS: the empty inbox of an account with no machine says how to add one (#1395)
• iOS: a question's lock-screen buttons follow Show Previews (#1394)
• iOS: an answer the server could not take is sent again on its own (#1393)
• Android: an answer refused during a rate-limit hold is sent once the hold ends (#1390) (#1391)
• Android and iOS: a presence beat's 429 no longer holds every call (#1389)
• Landing: apps first, then the install command (#1232) (#1379)
• Web: a History question's images download when shown (#1382) (#1388)
• Server: list answered decisions without their images on request (#1382) (#1387)
• Empty inbox: every in...

v0.1.6-rc.4

Android

• In the Quotas widget's picker, tapping a ticked quota now unticks that quota, not the other one. (#1476)
• The app icon, themed icon included, sits centred. (#1477)
• the app starts faster when it has kept many questions with images. (#1475)

iOS

• The app icon sits centred. (#1477)

Web

• The install icon sits centred. (#1477)

Desktop

• The app icon sits centred. (#1477)

All pull requests (4)

• Release 0.1.6-rc.4 (#1478)
• Android: a tap in the Quotas widget picker unticks the row tapped (#1465) (#1476)
• The mark's box sits at the centre of the icon (#1466) (#1477)
• Android: each image in a file of its own, not inside state.bin (#1471) (#1475)

Full Changelog: v0.1.6-rc.3...v0.1.6-rc.4

v0.1.6-rc.3

Android

• the app starts faster on a long history and no longer downloads the images of answered questions until you open one. (#1467)
• the app sends half the requests when it opens. (#1470)
• Sign in with Apple under Other ways to sign in. (#1443)
• Answering from a notification closes it at once; it comes back only if the answer is refused. (#1448)

iOS

• joining on an account with a long history no longer downloads the images of answered questions; a question's images load when you open it. (#1468)
• Sign in with Apple, beside GitHub. (#1441)
• Answering from a notification closes it at once; it comes back only if the answer is refused. (#1448)

Web

• Sign in with Apple under Other ways to sign in. (#1442)
• open questions show within about a second of opening the page, before History. (#1461)
• the inbox opens faster after a reload. (#1456)
• switching to the Inbox with History open is faster on a long history. (#1462)
• the inbox opens faster on an account with a long history. (#1457)

Desktop

• Sign in with Apple under Other ways to sign in. (#1442)
• a click on the menu bar icon opens Starbridge; Open at login is now in Settings → App, and the icon lines up with the system icons. (#1453)
• Answering from a notification closes it at once; "Answer not sent" still shows if it fails. (#1448)
• Update installs the newest release even when an older one was already downloaded. (#1445)

CLI

• answers start their Claude Code turn right away instead of up to 25 s later. (#1460)

Server

• Apple's web sign-in for the page and the apps. (#1442)
• Sign in with Apple for the iPhone app; deleting an account also revokes its Apple sign-in. (#1440)

All pull requests (18)

• Release 0.1.6-rc.3 (#1474)
• Web, iOS: a fetched image opens against the kept question's refs, from the same machine (#1472) (#1473)
• Android: an answered question's images download when its sheet shows them (#1464) (#1467)
• Android: one sync at launch, and no chain replay when the directory is unchanged (#1469) (#1470)
• Android: Sign in with Apple behind Other ways to sign in (#1411) (#1443)
• Web and desktop: Sign in with Apple behind Other ways to sign in (#1411) (#1442)
• iOS: an answered question's images download when its detail shows them (#1463) (#1468)
• Web: a load shows the open questions before it opens the answered ones (#1458) (#1461)
• Web: one read of the directory per page load and poll round (#1454) (#1456)
• Web: History lays out its rows 50 at a time (#1459) (#1462)
• Web: the prompts' settled notices read from the kept inbox's cursor (#1455) (#1457)
• Mod: hold no long call while an answer waits for its turn (#1446) (#1460)
• Desktop: the menu bar icon opens the app; its options move to Settings; center the icon (#1453)
• iOS: Sign in with Apple (#1411) (#1441)
• Release notes: iOS is a product (#1451) (#1452)
• Notifications: an answer from a notification closes it at the tap (#1447) (#1448)
• Desktop: Update installs the newest release (#1444) (#1445)
• Server: Sign in with Apple for the iPhone app (#1411) (#1440)

Full Changelog: v0.1.6-rc.2...v0.1.6-rc.3

v0.1.6-rc.2

Android

• New app icon: an arch from your machine to your phone. (#1414)
• the update screen says your answers are kept and sent once the app is updated. (#1424)
• the colours option is called Material You again. (#1413)

Web

• Under 1100 px, J and K move between cards, and with a mouse answering opens the next card instead of the list. (#1433)
• New app and tab icon: an arch from your machine to your phone. (#1414)
• the recovery key screen says to keep the key in a password manager or on paper. (#1424)

Desktop

• In a narrow window, J and K move between cards, and answering opens the next card instead of the list. (#1433)
• Updates show at the foot of the window's sidebar ("Update available", "Restart to update"). Release candidates and automatic downloads moved to Settings → Updates, out of the menu bar. (#1403)
• New app and menu bar icon: an arch from your machine to your phone. (#1414)

CLI

• when Claude desktop runs a session on another machine with copies of Starbridge's plugins that have no hooks, ask and status say so, since answers then come back only through wait. (#1434)
• starbridge update also moves the Pi extension to the new version. (#1418)

All pull requests (22)

• Release 0.1.6-rc.2 (#1439)
• iOS: build and test on the Mac mini through one script with a cache and a lock (#1438)
• Web, Android and iOS tests read rules.json (#1431)
• Protocol: rules.json, the rules every client applies on its own (#1430)
• CLI: ask and status name the hookless plugin copies Claude desktop runs a session with (#1428) (#1434)
• Play: a workflow updates the listing's icon and feature graphic through the API (#1436) (#1437)
• Web: J, K and the next card after an answer under 1100 px (#1433)
• Desktop: updates in the window, not the menu bar (#1403)
• New mark: an arch from machine to phone (#1366) (#1414)
• Parity copy: Android's update screen and the web's recovery key screen follow the other clients (#1424)
• CI: a client PR says what it means for the other clients (#1426)
• AGENTS.md: a change to one client's behaviour checks the others (#1421) (#1425)
• Release: sign the TestFlight build through the App Store Connect REST API (#1419) (#1420)
• CLI: refresh moves the Pi package to the new release (#1418)
• Release: archive the iPhone app unsigned; the API key signs only the export (#1415) (#1416)
• Release: check the App Store Connect key before the TestFlight archive (#1409) (#1410)
• Android: the colours option is called Material You again (#1412) (#1413)
• Spec: notifications close on Safari when the page reads the inbox (#1406) (#1408)
• Spec: the apps send a presence beat during a rate-limit hold (#1405) (#1407)
• iOS: end GitHub sign-in on the https callback, with apple-app-site-association (#1115) (#1402)
• Release: upload the iPhone app to TestFlight (#1397) (#1399)
• Android: the hold test sets the hold with another call's 429 (#1400) (#1401)

Full Changelog: v0.1.6-rc.1...v0.1.6-rc.2