v5.68.1

• Fixed: ending a session now also kills whatever its CLI left running. Killing,
  archiving or destroying a seat used to signal only the session's own process,
  so a command the agent had started underneath it — a test run, a build — kept
  running with nothing left to stop it; two such runs were found an hour later
  using a core each. Quitting the app sweeps every session the same way. Each
  leftover process is targeted individually and killed outright, with no
  grace period.
• Fixed: a finished foreground Bash call no longer stays "live" in the pane. Its
  output file is deleted when the call ends, and Clodex noticed that deletion
  only through a filesystem notification the OS drops when the disk is busy —
  when it went missing the call kept its spinner and its elapsed counter for the
  rest of the session, while a call that finished a moment later finalized
  normally. The row now settles from the next refresh regardless.
• Fixed: a preserved failing-run dump is now written through a staging file
  named for the writing process, in both the shipped clodex-run-tests grant
  and the test-digest.sh one. Two runs finishing at the same moment used to
  stage through one fixed name, so the file published to
  ~/.clodex/test-failures/last.txt could hold one run's lines spliced into
  another's while still carrying a single run's # tree:/# head: header. Each
  publish is now one run's whole output. The published names are unchanged, and
  the second run of a pair still replaces the first's dump.
• Fixed: "Clodex optimized" now turns off the built-in skills that only appear
  after a seat has run its first turn. Optimized mode used to write a snapshot
  of the skills known while the dialog was open, so every skill the CLI
  announced afterwards arrived enabled and you paid a create → first turn → edit
  skills → reload cycle to remove skills that were always going to appear. It
  now stores the denial the way a lean team template already did — "everything
  known at spawn except this keep list" — resolved when the session starts.
  This also corrects 5.68.0's skills curation: that release said both modes
  differ in every category, which was true, but the keep list named six skills
  this box has never seen the CLI offer, while the deny floor named only real
  ones. Optimized now also keeps dataviz and artifact-diagramming (charts and
  inline diagrams are ordinary repo work) and turns off design,
  artifact-design and artifact-capabilities (Artifact-publishing flows),
  alongside the existing review and setup skills. Standard mode is unchanged and
  still writes no skill denial, and your own saved skill defaults — including an
  explicitly empty one — still win over the shipped floor. A skill Clodex has
  never seen on this box still can't be denied before it appears. Creating
  into a sandbox or a peer box still sends that box a plain list rather than the
  deferred shape, so an older Clodex on the far side can't misread it.
• Fixed: the sidebar's web-UI arrow (↗) now works for a peer you reach by plain
  URL. It used to refuse those with "Clodex can only tunnel to a web UI over a
  transport it dials itself" — the refusal fired because there was no tunnel
  to open, which is exactly the case needing none. Clicking it now opens your
  browser straight at that peer's web UI, composed from the peer's own address
  and the port it advertises in its hello, and the button's tooltip shows the
  address it will open. The ssh, SSM, kubectl, GCP IAP and Azure Bastion peers
  still tunnel exactly as before. A peer that reports no web frontend is still
  refused rather than opened at a guessed port, and a peer whose web UI requires
  a token still opens no window — you get the address to open with ?token=…,
  because a fresh tab carries no token and would land on a bare 401.

---

Apple Silicon (arm64) build. Intel (x64) users can build from source (npm install && npx electron-rebuild && npm run dist:mac).

Unsigned (ad-hoc) build: first launch needs right-click → Open, or xattr -cr /Applications/Clodex.app.