v0.10.0-rc.9

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• Retained quota for a provider login recorded without an email (a generic
  default identity) now survives failed refreshes. The account-scoped cache
  lookup reads the plain provider file where those snapshots are written, so
  an expired-token state shows stale bars and reset times instead of a blank
  card. Exact identity matching keeps a legacy specific-account snapshot from
  being relabeled as generic, and one generic label never answers for another.
• Provider failure copy no longer displaces an expired-login message with the
  generic reconnect line, and a gRPC resource-exhausted throttle is labeled
  rate limited instead of provider slow.
• OAuth grant files are flushed to disk before their atomic rename, so an
  operating-system crash during a token refresh cannot truncate a grant whose
  rotated refresh token the provider has already invalidated.
• A fixed-port OAuth login now fails closed when another local process already
  holds the IPv6 loopback port, instead of silently continuing IPv4-only and
  letting that process receive the authorization redirect. PKCE already kept
  the code unredeemable; the login no longer hangs, and hosts without IPv6
  loopback still sign in over IPv4.
• The source-setup portable desktop fallback now says when no published
  release matches the checkout version instead of a raw HTTP 404 exception on
  Windows or a silent skip on macOS and Linux, and states that the installed
  desktop app is unchanged with the two truthful next steps.
• A Grok read denied because the CLI's stored token is already past its
  recorded expiry now reports an expired login with the repair steps (use Grok
  once, or quotabot login grok) instead of a bare gRPC status, so an idle
  machine shows what to do rather than an unexplained code. The exact provider
  status is kept in the message, denials for a token that should still be
  valid keep their raw status, and throttling and provider errors are never
  reclassified. The desktop Connect action now appears for this proven expiry.
• The scheduled install smoke no longer fails when the target release predates
  tools/verify-doctor.ps1. The workflow fetches its own commit's verifier
  before the Windows doctor checks, so smoking the latest stable release keeps
  the fail-closed verification instead of erroring on a missing script.
• Desktop provider cards keep retained quota bars and reset times above a
  failed-refresh warning, so a temporary Grok or Claude metadata failure cannot
  visually replace known quota. Compact provenance now labels whole-account
  scope explicitly instead of reading like the error affects the whole account.

v0.10.0-rc.10

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• Plain loopback HTTP reads now replace email-shaped account labels with stable
  keyed pseudonyms. A caller with the existing owner-only bearer token still
  receives exact account identities, and the bundled LiteLLM router supplies
  that token on recommendation reads so exact account dispatch keeps working.
• Local HTTP and MCP request bodies now have a 15-second read deadline. MCP
  rejects missing bearer credentials before body processing and force-closes a
  stalled unauthorized sender after flushing the HTTP 401 response.
• MCP Streamable HTTP now limits active sessions to 64, including concurrent
  initialization attempts, and returns HTTP 503 when capacity is full. Its
  public constructor now rejects non-loopback hosts and invalid body-timeout or
  session-limit configuration instead of relying only on CLI validation.
• A bare Grok HTTP 403 keeps its provider diagnostic instead of incorrectly
  claiming that reconnect is available. Antigravity keeps its provider-specific
  reconnect path.
• Desktop startup height now reserves an inline Connect row only when the
  provider is actually connectable through the current native host. The first
  frame and rendered cards share one predicate, preventing an empty row on
  unsupported hosts.

v0.10.0-rc.6

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• quotabot logout now stays disconnected for Claude, Codex, Grok, and
  Antigravity even when their host applications remain signed in. A safe
  provider-wide marker blocks host and quotabot credentials for every account
  without changing host state, and only a successful explicit quotabot login
  clears it. Any exact marker-path entry fails closed, and marker mutation
  never follows a link.
• First-run readiness now keeps the best account for each provider and never
  calls stale, drifted, suspect, or expired quota live. The source installers
  apply the same conservative readiness rule, and macOS/Linux setup once again
  receives and renders the CLI snapshot it was meant to summarize.
• MCP Streamable HTTP startup now rejects repeated or conflicting bearer-token
  sources instead of silently choosing one by argument precedence.
• Reset countdowns below one hour now use useful minute labels instead of 0h.
• Explicit CLI-only source setup no longer downloads or installs the desktop
  app, or opens an interactive dashboard. Automatic desktop-toolchain failures
  can still use the verified portable desktop fallback during a normal full
  setup.
• MCP provider and account selectors now use one bounded exact-identity
  validator across quota, routing, model, availability, and reservation tools.
  Blank, control-bearing, and oversized identities fail before quota
  collection, cache reads, or lease access instead of silently widening or
  truncating a request.
• Lease idempotency keys now require an exact 8 to 120 character ASCII key at
  every MCP, local HTTP, in-memory, and file-backed boundary. Distinct long
  keys can no longer alias after truncation.
• Cache-only decide_now responses now derive snapshot timestamps and ages
  from the providers remaining after profile, account, and exclusion filters,
  so their provenance describes the actual routing evidence.
• Named desktop profiles now retain their exact current provider and account
  selections when every known option is selected, hidden accounts can be
  restored after a sibling account leaves, and ambiguous multi-account
  analytics no longer reuse legacy provider-only history.
• Portable desktop fallback installs now consume the selected release on every
  run and use the same rollback-protected activation as source-built payloads,
  so exact updates and rollbacks cannot silently reopen an older app.
• Windows, macOS, and Linux uninstall now stop only processes launched from
  quotabot install roots, remove guarded CLI and desktop generation stores,
  preserve config unless purge is requested, and fail visibly if payloads
  remain. The Windows install smoke also rejects any nonzero doctor exit
  before parsing its JSON.
• CLI value options and singleton local HTTP /suggest query parameters now
  reject repeated values before quota collection. HTTP snake-case and
  kebab-case aliases are treated as the same option, so conflicting aliases
  cannot silently select the last value. Repeatable exclude and
  cost_penalty collections retain all distinct values, while duplicate cost
  keys are rejected after provider normalization.
• A valid manual quota with the exact same provider and specific account as one
  built-in subscription is now retained as explicit supplemental provenance on
  the built-in row instead of creating a competing route, analytics identity,
  or desktop card. Measured windows, status, availability, routing, and
  analytics remain authoritative; ambiguous, local-runtime, placeholder, and
  non-exact identities stay separate for verification and account selection.
• Desktop reset reminders now arrive 15 minutes before reset, reconcile stale
  or privacy-obsolete owned requests without touching unrelated notifications,
  serialize disablement with in-flight scheduling, and use a bounded durable
  ledger to prevent the same reset from being delivered twice.
• "Skip for now" in first-run setup now defers the walkthrough only for the
  current process instead of permanently marking setup complete.

Documentation

• Ordered the remaining 0.10.x work so field-discovered correctness,
  quality-of-life refinement, and native validation finish before platform
  signing activation, and added the complete Windows and macOS publisher
  enrollment and rehearsal checklist without changing the project's Apache 2.0
  license.
• Aligned the README, roadmap, documentation index, setup, usage, architecture,
  data-source, provider cross-check, schema, product-strategy, and desktop
  distribution guidance with the rc.6 behavior and release order.

v0.10.0-rc.5

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• Claude usage throttling and other non-authentication HTTP failures no longer
  claim that a locally known-expired Claude Code login caused the response.
  HTTP 401 keeps the login recovery guidance, while HTTP 429 retains its exact
  status, throttled pipe health, and bounded retry metadata.

v0.10.0-rc.4

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Changed

• Updated the optional LiteLLM proxy integration to 1.92.2 with aiohttp
  3.14.3 and cryptography 50.0.0. Updated the TypeScript MCP client examples
  to SDK 1.30.0 with patched fast-uri, Hono, and ip-address versions,
  removing the known vulnerable transitives from both reproducible locks. The
  Python MCP example guide now pins the current maintained v1 release while
  identifying v2 as the stable breaking line.
• Replaced the exportable-PFX Windows release contract with a protected
  release-signing environment, short-lived GitHub OIDC authentication, and
  the pinned Azure Artifact Signing action. The signer receives an exact
  full-tree-validated file catalog, SHA-256 file and RFC 3161 timestamp digests,
  and no private-key material. Credential-free build and publication jobs
  exchange immutable candidates with the isolated signing jobs, so dependency
  resolution, compilation, packaging, attestation, and upload cannot obtain the
  Azure signing identity.
• Windows signature verification now binds platform trust to the Artifact
  Signing Public Trust marker and the owner's durable subscriber identity EKU,
  while recording but not pinning the service's daily rotating leaf subject and
  thumbprint. Exact downloaded draft assets are reverified before publication.
• Added explicit release signing modes and a mandatory release-note disclosure.
  The transition unsigned mode preserves checksums and provenance without
  claiming platform identity; signed mode fails closed without the protected
  Azure profile configuration. Published v0.9.9 artifacts remain unsigned.

Fixed

• Made fresh-download verification, exact asset audit, and publication use
  explicit always() conditions with exact-success requirements for every
  direct prerequisite. GitHub's implicit status condition propagated the
  intentionally skipped unsigned signer through successful Windows packaging,
  so the v0.10.0-rc.3 workflow skipped verification after uploading 12 draft
  assets. The incomplete draft and partial assets were removed; its immutable
  tag and workflow logs remain.
• Checked out the tagged source before extracting curated release notes from
  CHANGELOG.md. The v0.10.0-rc.2 release quality gate passed, but draft
  creation correctly stopped before any asset build because the release job had
  no workspace checkout. Its immutable tag has no GitHub release.
• Added the two fully pinned Azure signing action repositories to the GitHub
  Actions allowlist. GitHub validates every referenced action before evaluating
  job conditions, so the missing allowlist entries prevented even an unsigned
  release workflow from starting. The rejected v0.10.0-rc.1 tag remains
  immutable and has no GitHub release.
• Cursor 3.x now passively detects a recognized current local plan only when its
  bounded membership owner matches the subject of the existing Cursor access
  token. The plan remains unroutable diagnostic evidence because Cursor does
  not persist current Cursor Models and Other Models quota balances in the
  supported local state, and credentials and owner identifiers are never
  exposed.
• quotabot login claude now sends a 32-byte, 43-character OAuth state value
  accepted by Anthropic's authorize POST and encodes the scope separator as an
  unambiguous %20. The prior 22-character state could show a valid-looking
  consent page and then fail with "Invalid request format" after authorization.
• Logout now removes every exact account grant slot, including malformed and
  legacy records that cannot be discovered by their embedded account marker,
  without following symbolic links or touching similarly prefixed files.
• OAuth login now rejects successful HTTP responses that omit a nonempty access
  token. Background refresh remains fail-soft and preserves the stored grant
  when Google, xAI, Anthropic, or OpenAI returns an unusable token response.
• Healthy subscriptions with a known reset time now keep the fail-soft
  passthrough fallback instead of also telling callers to wait for the selected
  provider. Only an unavailable subscription can produce a wait-for-reset
  fallback in CLI, MCP, HTTP, receipt, and desktop output.
• Cache-only routing now skips an individual snapshot whose metadata or contents
  cannot be read and continues loading healthy sibling providers, rather than
  silently stopping at the first filesystem error.
• Windows source setup and the new one-command contributor gate now share the
  space-safe Dart invocation for collector and Flutter native-asset commands,
  including Flutter installs located under a user profile containing spaces.
• Windows release signing now passes the RFC 3161 timestamp URL before the
  SHA-256 timestamp digest option, as required by SignTool, and refuses to sign
  when any file in the candidate tree differs from its unsigned inventory.
• Tagged Windows release jobs now download the exact draft CLI and desktop
  archives, re-inventory and independently verify every embedded signature,
  and retain bounded verification receipts before publication can continue.
• quotabot login claude now uses Anthropic's current platform OAuth callback
  and token hosts (platform.claude.com). The retired
  console.anthropic.com generation rejected the public Claude Code client
  with "Invalid request format", so an idle machine could not mint a
  refreshable usage-metadata grant.
• quotabot login claude now POSTs the token exchange as JSON, matching
  Claude Code's current platform.claude.com/v1/oauth/token contract.
  Form-urlencoded bodies on that host can fail with no grant written. A
  rejected exchange now prints the HTTP status and Anthropic's bounded error
  text instead of a generic "token exchange failed".
• Linux desktop release verify now downloads, checksums, and attests the
  draft archive before installing GTK and xvfb. CI and release share a
  time-bounded apt helper, and the verify job budget is 45 minutes, so a
  stalled hosted Ubuntu mirror fails that step instead of cancelling the
  whole job.

Documentation

• Recorded the immutable v0.9.9 14-asset lock and three-OS install smoke,
  including upgrade from v0.9.8.

v0.9.9

What's Changed

• Polish release cleanup and project front door by @blisspixel in #52
• Verify source setup before desktop restart by @blisspixel in #53
• Prepare v0.9.9 release by @blisspixel in #70

Full Changelog: v0.9.8...v0.9.9

v0.9.8

What's Changed

• Prepare v0.9.8 release by @blisspixel in #51

Full Changelog: v0.9.7...v0.9.8

v0.9.7

What's Changed

• Harden local runtime truth and calibration evidence by @blisspixel in #46

Full Changelog: v0.9.6...v0.9.7

v0.9.6

What's Changed

• Add quota stretch routing and prepare v0.9.6 by @blisspixel in #45

Full Changelog: v0.9.5...v0.9.6

v0.9.5

What's Changed

• Synchronize docs after v0.9.4 and define quota stretch by @blisspixel in #43
• Prepare v0.9.5 callback diagnostics by @blisspixel in #44

Full Changelog: v0.9.4...v0.9.5