ThinkWatch Lite 2026.10.0

Upgrade notes:

• The bundled core is now 0.57.1, which speaks control-plane protocol 31. A remote server has to run core 0.57.x too: this version does not connect to 0.56.x, and 2026.9.26 and earlier do not connect to 0.57.x.
• Request history is cleared on the first start, as the request store is rebuilt. Configuration, keys and upstreams are kept.
• Two redaction rules are on by default: Chinese resident ID numbers and bank card numbers. In Observe, the factory mode, they are only recorded; in Enforce they are replaced before a request leaves. Either can be switched off on the Security page.
• Routing rules on input tokens now use the gateway's token-count estimate: one token per CJK character and 1,600 per image or file, with thinking left out. A request with many images can now cross a size threshold it used to stay under.

Searching the whole history:

• The Traffic page used to search only the latest 2,000 requests it had loaded. A search or filter now also runs over every stored request, newest first. The footer says how far back the search has got, and Search further goes back another page.
• The toggle inside the search box also searches content. It covers what each request newly sent (the last user turn, tool results included) and its answer (text and tool calls), for requests whose payloads are still kept.
• Each content match shows an excerpt under the request, with credentials masked.

Upstream check-up:

• Upstreams › Check-up compares each upstream with the others over 24 hours, 7 days, 30 days or a custom range:
  • requests and failure rate;
  • whether the model named in its answers matches the one sent, with the pairs that differ;
  • the input it reports, as a multiple of the local estimate, against other upstreams serving the same model;
  • the share of input read from the prompt cache in follow-up turns, against those upstreams too;
  • median time to first token and generation speed.
• Every figure comes with its sample size. A deviation is marked only when both sides have enough samples:
  • input: a gap of 25% or more, and only on the upstream further from the local estimate;
  • cache: other upstreams read at least 30% from the cache and this one less than half of that.

ID and bank card numbers:

• Outbound redaction now also replaces Chinese resident ID numbers and bank card numbers. A number counts only when its structure and check digit are valid:
  • an ID number needs a region code, a real birth date and a valid check character;
  • a card number needs the prefix and length of UnionPay, Visa, Mastercard, American Express, JCB, Discover or Diners Club, and must pass the Luhn check.
• Placeholders say what was there, such as <<TW_ID_NUMBER_1>>, and the security log shows only the last four characters.

More clients:

• The Clients page now connects Pi, oh-my-pi, Grok Build, Qwen Code and Hermes Agent:
  • Pi and oh-my-pi get a provider of their own with the models the key can use. Their default model stays as it is, and ThinkWatch models are chosen in /model.
  • Grok Build gets one model entry per gateway model, each with its own key, so the xAI session token is never sent to the gateway. One of them becomes the default model. Remote campaigns, which can change the default model, are turned off while it is connected.
  • Qwen Code 0.19.3 or later gets a provider of its own in the OpenAI format, and the change applies after a restart.
  • Hermes Agent: its default profile is pointed at the gateway, and other profiles keep their own configuration.
• DeepSeek Harness counts as installed when only its desktop app is. Models used through a DeepSeek account in the desktop app still go to DeepSeek directly, which the plan now says.
• The MCP page lists the servers of the five new clients without writing to them. Skills in the shared ~/.agents/skills folder appear under a shared folder, and Cursor's hooks are scanned too.
• Codex stopped reading OPENAI_BASE_URL in April 2026, so a shell that still exports it is no longer reported as overriding the connection.

Getting started:

• Until the first request reaches an upstream, the Overview page shows a checklist: add an upstream, connect a client, send a first request.
• Other pages show a hint for the next step where it applies. A hint can be hidden, and Settings › General shows the hidden ones again.

Requests other than POST:

• These now get a 404 from the gateway itself. Hermes Agent sends such GETs when it starts, to tell whether a server is Ollama or LM Studio.
• They used to be sent to an upstream as empty POSTs and recorded as failed requests.

The Features page describes each of these in full.

Downloads

Platform	File
macOS, Apple silicon	ThinkWatch-Lite-2026.10.0-arm64.dmg
Windows, x64	ThinkWatch-Lite-2026.10.0-x64-setup.exe
Windows, ARM64	ThinkWatch-Lite-2026.10.0-arm64-setup.exe
Linux, x86_64	ThinkWatch-Lite-2026.10.0-x86_64.AppImage
Linux, aarch64	ThinkWatch-Lite-2026.10.0-aarch64.AppImage

Each file is published with a .sha256 file beside it. latest.json is the manifest for in-app updates, and install.sh is the Linux install script.

On macOS, Homebrew installs the same disk image:

brew install --cask thinkwatchproject/tap/thinkwatch-lite

On Linux, the install script downloads the AppImage for the machine's architecture, checks its SHA-256 and installs it as ~/Applications/ThinkWatch-Lite.AppImage:

curl -fsSL https://github.com/ThinkWatchProject/ThinkWatch-Lite/releases/latest/download/install.sh | sh

Both commands install the latest release. First-launch steps for each platform, such as removing the quarantine attribute from a copy downloaded on macOS, are described in the README.

Verifying a download

A .sha256 file holds the SHA-256 of the file followed by its name. With both files in the current directory, on macOS:

shasum -a 256 -c ThinkWatch-Lite-2026.10.0-arm64.dmg.sha256

On Linux:

sha256sum -c ThinkWatch-Lite-2026.10.0-x86_64.AppImage.sha256

On Windows, in PowerShell, the following prints True when the installer matches:

(Get-FileHash .\ThinkWatch-Lite-2026.10.0-x64-setup.exe).Hash -eq (Get-Content .\ThinkWatch-Lite-2026.10.0-x64-setup.exe.sha256).Split()[0]

The Homebrew cask and the Linux install script check the SHA-256 themselves.

What's Changed

• README: name the relay threat that tool-call inspection guards against by @fylorn in #259
• README: the ThinkWatch Lite logo at the top by @fylorn in #260
• Guidance: a get-started checklist and next-step hints by @fylorn in #261
• chore(deps): fix the npm advisories; shadcn is a dev dependency by @fylorn in #262
• feat(adopt): connect Pi and oh-my-pi; list the shared skills folder by @fylorn in #263
• Use core v0.57.0: search the whole history, upstream check-up, ID and card redaction by @fylorn in #264
• feat(adopt): connect Grok Build, Qwen Code and Hermes Agent by @fylorn in #265
• chore: 2026.10.0 by @fylorn in #266

Full Changelog: v2026.9.26...v2026.10.0