ThinkWatch Lite 2026.10.17

Upgrade notes:

• The bundled core is now 0.71.0, with control-plane protocol 47. A remote server must run core 0.71.0; servers on 0.70.x do not connect until they are upgraded.
• Nothing is cleared; the request history, stored payloads and settings carry over.
• Check your custom outbound redaction rules. A rule written before this release was a case-sensitive regular expression; it now looks for its text as written and ignores case. A rule that relies on a regular expression keeps loading and simply stops matching, with nothing reported, so what it used to replace is sent as it is. Open each such rule and choose Regex under Match by, and Match case to keep telling capital letters from small ones.

Outbound redaction:

• Field names in a request are no longer searched, and custom rules leave alone the identifiers a protocol needs exactly as they are: item and call ids, types, roles, tool names and model names. A custom rule whose text appeared inside an id that Codex sends with its history used to replace part of the id; the upstream then rejected that request and every later turn of the conversation. Built-in rules still search those values.
• The private-key rule now looks for the end of a key block only within the same text. A key header without an end in one message no longer joins up with an end line in a later message, which used to replace everything in between with one placeholder.
• A custom redaction rule has Match by: Contains looks for the text exactly as written, so . and * have no special meaning; Regex takes a regular expression. Match case next to it tells capital letters from small ones; it is off by default. The test box tries the chosen settings, and the rule list and the security log detail say how each rule matches.

Downloads

Platform	File
macOS, Apple silicon	ThinkWatch-Lite-2026.10.17-darwin-arm64.dmg
Windows, x64, installer	ThinkWatch-Lite-2026.10.17-windows-x64-setup.exe
Windows, x64, portable	ThinkWatch-Lite-2026.10.17-windows-x64-portable.zip
Windows, ARM64, installer	ThinkWatch-Lite-2026.10.17-windows-arm64-setup.exe
Windows, ARM64, portable	ThinkWatch-Lite-2026.10.17-windows-arm64-portable.zip
Linux, x86_64	ThinkWatch-Lite-2026.10.17-linux-x86_64.AppImage
Linux, aarch64	ThinkWatch-Lite-2026.10.17-linux-aarch64.AppImage

Each file is published with a .sha256 file beside it. latest.json is the manifest for in-app updates, and install.sh is the Linux install script.

On Windows, the portable ZIP runs without installation or administrator rights: extract it to any writable folder and start ThinkWatch Lite.exe. Its settings stay in the data folder beside it, separate from an installed copy, and it updates itself in place.

On macOS, Homebrew installs the same disk image:

brew install --cask thinkwatchproject/tap/thinkwatch-lite

On Linux, the install script downloads the AppImage for the machine's architecture, checks its SHA-256 and installs it as ~/Applications/ThinkWatch-Lite.AppImage:

curl -fsSL https://github.com/ThinkWatchProject/ThinkWatch-Lite/releases/latest/download/install.sh | sh

Both commands install the latest release. First-launch steps for each platform, such as removing the quarantine attribute from a copy downloaded on macOS, are described in the README.

The ThinkWatch Lite page describes each feature, and the documentation covers installing, connecting clients and routing.

Verifying a download

A .sha256 file holds the SHA-256 of the file followed by its name. With both files in the current directory, on macOS:

shasum -a 256 -c ThinkWatch-Lite-2026.10.17-darwin-arm64.dmg.sha256

On Linux:

sha256sum -c ThinkWatch-Lite-2026.10.17-linux-x86_64.AppImage.sha256

On Windows, in PowerShell, the following prints True when the installer matches:

(Get-FileHash .\ThinkWatch-Lite-2026.10.17-windows-x64-setup.exe).Hash -eq (Get-Content .\ThinkWatch-Lite-2026.10.17-windows-x64-setup.exe.sha256).Split()[0]

The Homebrew cask and the Linux install script check the SHA-256 themselves.

What's Changed

• Import links: tests for the links New API and Sub2API generate by @fylorn in #323
• chore: add a contributor license agreement signed by PR comment by @fylorn in #324
• ci: name the CLA job cla by @fylorn in #325
• 2026.10.17: redaction rules match as written or by regex, with a case switch; pin core v0.71.0 by @fylorn in #326

Full Changelog: v2026.10.16...v2026.10.17