ThinkWatch Lite 2026.10.34

Upgrade notes:

• The bundled core is now 0.86.0 and the control-plane protocol goes from 55 to 57. A remote server must run core 0.86.0 to stay connected.
• The request history and the security log are cleared on first start (the request store's format changed). The usage history behind the overview's past-year view, settings and upstreams carry over.
• Many more redaction rules are on by default. In the default Monitor mode they only record; with the protection On they replace what they find.

Secrets & privacy:

• Built-in redaction rules grow from 30 to 120. The keys saved in ThinkWatch (upstream keys, gateway keys, proxy passwords, sync credentials) are recognised by value, whatever their format, so keys without a recognisable shape are covered too.
• About 60 more kinds of API keys and tokens, including xAI, Groq, OpenRouter, Hugging Face, DeepSeek-style sk- keys, Zhipu, Baidu Qianfan, Alibaba Cloud and Tencent Cloud.
• Credentials are also found by where they appear: Authorization and API-key headers, curl -u style passwords, token parameters in URLs, bot webhooks (Feishu, DingTalk, WeCom, Slack, Discord, Teams) and assignments like DB_PASSWORD=... in pasted config files. Only the value is replaced.
• Wallet seed phrases and private keys, passport machine-readable zones and IBANs are recognised by their checksums. Foreign IDs, phone numbers in more forms, addresses, coordinates, licence plates, device identifiers and field-name rules (name, address, birth date, account, health) are available and off by default.
• Rule names and descriptions come from the core in Chinese and English. Rules are grouped by what they protect; groups start collapsed and their heads show how many rules are on and how many matches the last 7 days had.
• A value that is wrongly matched can be listed as an exception, from the security log or by pasting it, without turning its rule off. Exceptions are listed under the rule table and can be removed; only a hash of the value is kept.
• A hit on a saved key shows where the key is saved (for example the upstream's name), never the value.

Traffic:

• A session's duration rounds before it picks its unit: 59.6 seconds reads "1 min" instead of "60 s". Thanks to @RaphaelFakhri (#382).

Overview:

• A cost that is both a lower bound and partly estimated is marked only as a lower bound, with one sign instead of two; how much was estimated is still in the hover.

Speed:

• Redaction scans with a two-phase engine and no longer rescans conversation history that has not changed, so the added rules cost little.

Downloads

Platform	File
macOS, Apple silicon	ThinkWatch-Lite-2026.10.34-darwin-arm64.dmg
Windows, x64, installer	ThinkWatch-Lite-2026.10.34-windows-x64-setup.exe
Windows, x64, portable	ThinkWatch-Lite-2026.10.34-windows-x64-portable.zip
Windows, ARM64, installer	ThinkWatch-Lite-2026.10.34-windows-arm64-setup.exe
Windows, ARM64, portable	ThinkWatch-Lite-2026.10.34-windows-arm64-portable.zip
Linux, x86_64	ThinkWatch-Lite-2026.10.34-linux-x86_64.AppImage
Linux, aarch64	ThinkWatch-Lite-2026.10.34-linux-aarch64.AppImage

Each file is published with a .sha256 file beside it. latest.json is the manifest for in-app updates, and install.sh is the Linux install script.

On Windows, the portable ZIP runs without installation or administrator rights: extract it to any writable folder and start ThinkWatch Lite.exe. Its settings stay in the data folder beside it, separate from an installed copy, and it updates itself in place.

On macOS, Homebrew installs the same disk image:

brew install --cask thinkwatchproject/tap/thinkwatch-lite

On Linux, the install script downloads the AppImage for the machine's architecture, checks its SHA-256 and installs it as ~/Applications/ThinkWatch-Lite.AppImage:

curl -fsSL https://github.com/ThinkWatchProject/ThinkWatch-Lite/releases/latest/download/install.sh | sh

Both commands install the latest release. First-launch steps for each platform, such as removing the quarantine attribute from a copy downloaded on macOS, are described in the README.

The ThinkWatch Lite page describes each feature, and the documentation covers installing, connecting clients and routing.

Verifying a download

A .sha256 file holds the SHA-256 of the file followed by its name. With both files in the current directory, on macOS:

shasum -a 256 -c ThinkWatch-Lite-2026.10.34-darwin-arm64.dmg.sha256

On Linux:

sha256sum -c ThinkWatch-Lite-2026.10.34-linux-x86_64.AppImage.sha256

On Windows, in PowerShell, the following prints True when the installer matches:

(Get-FileHash .\ThinkWatch-Lite-2026.10.34-windows-x64-setup.exe).Hash -eq (Get-Content .\ThinkWatch-Lite-2026.10.34-windows-x64-setup.exe.sha256).Split()[0]

The Homebrew cask and the Linux install script check the SHA-256 themselves.

What's Changed

• Cost: write just "≥" when an amount is both a lower bound and partly estimated by @fylorn in #387
• Expanded redaction rules: core 0.85.0 by @fylorn in #388
• Security: collapsed rule groups with 7-day counts, redaction exceptions; pin core v0.86.0 by @fylorn in #389
• Traffic: a session's duration rounds before it picks its unit by @RaphaelFakhri in #382
• chore: 2026.10.34 by @fylorn in #390

New Contributors

• @RaphaelFakhri made their first contribution in #382

Full Changelog: v2026.10.33...v2026.10.34