v0.5.7

Nothing to do before you upgrade. Not a grading method change: every trend continues.

• Dismiss a fix the team won't do. A fix card has a Dismiss button that asks for the reason. Over MCP and the API, it's mark_fix with state: dismissed and the reason as the note, with no link. A dismissed fix leaves quick wins, the dashboard and the open counts; it shows under the new dismissed status filter. A later fix for the same page stays dismissed, and nothing is measured for it, because nothing shipped.
• The analyst hears why. Each new fix list is built with the 20 newest dismissals from every set and their reasons. The analyst is told not to propose them again, or any fix that rests on a premise a reason says is wrong.
• Undo. Withdrawing a dismissal reopens its fix. A dismissal can only be withdrawn, and merged work must be withdrawn before its fix is dismissed.

Trends. Unchanged. The analyst prompt isn't part of a run's method, and the grader is unchanged. Fix lists built from this release on take dismissals into account.

No schema change: fix_attempts.state gains the value dismissed, and a dismissal stores no link.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.7 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.7

v0.5.6

Nothing to do before you upgrade. A grading method change for runs with a claude-code or codex answerer: they start a new trend from this release. Runs that use only API answerers are unaffected.

• Codex's search track searches the live web. codex 0.163 drops --search when it comes before exec, so Codex search answers searched a cache rather than the live web (its requests said external_web_access: false). Codex is now called with web_search="live" after exec, as the search policy intends.
• Codex's recall track has no web search. Recall is defined as having no tools, but Codex still offered its model a cached web search, and only the prompt asked it not to use it. Codex is now called with web_search="disabled" on recall, so recall measures what the model already believes, as the other answerers' recall does.
• A run's method covers how CLI answerers are called. A run records the arguments it gives claude-code and codex on each track, and run.Method includes them. A change in how a CLI is called now starts a new trend line instead of mixing with older runs. For the same reason, a queued run asked with older arguments doesn't resume, and re-grading skips it ("asked differently").
• Codex answers make only the calls they need. Plugins, ChatGPT apps and analytics are off for every Codex call. Before, each answer fetched the plugin catalog, listed apps and posted analytics events over the account's login.
• Claude Code telemetry is off. Every claude call (answers, and grading and analysis through claude-code) gets CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1, which a value in Cheap Seats' own environment can't override. WebSearch and WebFetch are unaffected.

Trends. Codex runs start a new method from this release: the first two changes change what a Codex answer can do, so earlier Codex results aren't comparable with new ones, and re-grading can't repair them. claude-code runs also start a new method once, because their arguments are recorded for the first time; how they're asked doesn't change. Runs with only API answerers keep their method. The grader is unchanged.

No schema change: a run's snapshot gains cli_args, and runs stored before it keep their method.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.6 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.6

v0.5.5

Nothing to do before you upgrade. Re-import recent access logs afterwards to backfill visits.

• AI crawlers counts people's page visits. cheapseats crawl import used to read the browser lines in your access logs and throw them away. It now counts them as visits, so the crawlers page shows AI referrals of N visits: a denominator for the referral count without setting up analytics. A visit is a browser user agent with none of the words tools and bots send, requesting a page (not an asset, feed or download), and not a redirect. It's a guess from the user agent alone, so a bot dressed as a browser counts. Visits appear on /crawlers, in crawl report, in the import summary, in /api/crawlers and in get_crawlers. They never appear in the by-crawler table and don't change crawled or cited flags. Unique visitors, sessions and traffic sources are out of scope; use an analytics tool for those.
• Re-importing backfills visits only. Earlier releases never recorded browser lines, so importing the same logs again adds their visits without counting any crawler fetch or referral twice. Data imported before this release shows no visits until you do.
• A shorter import window. An import now counts log lines from the last 120 days (down from 400) and keeps their deduplication hashes as long, since visits add one hash per page view. Daily crawler, referral and visit counts are still kept for 400 days; nothing already counted is deleted.
• Example prompts and init leave out closed comparisons between two other products: the brand's absence from them is expected, not a visibility gap. Questions asking for alternatives stay.

Public read-only copies: visit counts are your traffic. If you publish a copy of your database, delete them first: DELETE FROM crawl_daily WHERE class = 'visit'.

No schema change: crawl_daily.class gains the value visit. Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.5 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.5

v0.5.4

A small release. Nothing to do before you upgrade.

• Rankings charts are clearer when a trend restarts. A change in how answers are asked or graded is dated under the chart, and its marker names any set change on the same day too. The caption and each day's hover say how many measured days contribute to the rolling average, so a 7-day window with one measured day no longer reads like a week of evidence. A stretch with only one measured day keeps its point and 95% interval.
• Example prompts match what they measure. In the bundled example config and the review skill, a question that asks for an explanation is informational, and closed comparisons between other products have their own set instead of counting as discovery. cheapseats init generates the "downsides" question as informational. The plan output says a moved prompt keeps its id and its stored runs keep their original set.
• Shorter docs and a clearer setup path. The README and guides are tightened and corrected. Setup now splits into subscription CLIs (Go and logged-in claude/codex) or Docker with API keys, no Go needed.

Statistics, stored data and grading are unchanged. Not a grading method change. Trends carry on and no regrade follows. Your own prompt sets are untouched; changing a prompt's intent or wording in your config restarts comparisons for that prompt, as before.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.4 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.4

v0.5.3

A small release. Nothing to do before you upgrade.

• Formulas in the run report are typeset. The per-answer position weight behind Weighted, the opportunity gap score and the outreach ranking render as real equations (native MathML, selectable, no scripts or downloads) instead of inline prose. A long equation scrolls in its own row on a narrow screen, and you can reach and scroll it with the keyboard.
• Clearer wording beside them. Brand presence is defined as the share of citing answers that name you, and the outreach ranking says it counts distinct competitors.

Calculations, stored data and grading are unchanged. Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.3 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.3

v0.5.2

A small release. Nothing to do before you upgrade.

• Shorter, plainer explanations across the dashboard. Each page's help now leads with how to read it or what to do next, and says each piece of chart guidance once. Denominators, intervals and method limits stay next to the numbers they qualify. Some claims are now worded more carefully: a retrieved page wasn't necessarily read, Jev's agreement rate doesn't measure grader drift, a diagnostic label suggests a cause rather than proving it, and audit reads aren't always free.
• Bars in the run report. Opportunities show each gap score as a bar scaled to the largest gap. The neutral retrieval baseline pairs its bar with the assistants' on one prompt-count scale, so you can compare where a neutral index ranks a page against where the assistants found it. The bars are decorative; the table cells still carry every value.

Calculations, stored data and grading are unchanged. Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.2 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.2

v0.5.1

A small release. Nothing to do before you upgrade.

• The dashboard opens in the light theme. It used to follow the system's theme. The header toggle still offers every theme, now cycling light, dark, system, and remembers a pick in the browser. A light or dark pick made before carries over; to keep following the system, pick system once.
• SQLite driver 1.61.0 (modernc.org/sqlite, from 1.60.1). Databases are unchanged: same schema, no migration.

Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.1 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.1

v0.5.0

A security release. A full review of the app, its deploy scripts and its CI found gaps in how Cheap Seats trusts requests, files, providers and its own build; this release closes them. Four changes may need something from you before you upgrade.

Before you upgrade

A Helm ingress needs TLS. A release with ingress.enabled: true and no ingress.tls now fails to install or upgrade, because the sign-in cookie carries the access token. Set ingress.tls, or ingress.externalTLS: true when TLS ends in front of the Ingress. The chart also refuses a literal key or token in extraEnv; use valueFrom.secretKeyRef or existingSecret.

Config limits. [budget] concurrency must be 1 to 64 (unset still means 4), and an answerer's samples and [tiers.plg] max_samples at most 20 a track. A config above these refuses to start, so run cheapseats check on it first.

.env can't redirect requests or change sign-in. A .env in the working directory no longer sets *_BASE_URL, proxy or CA settings, CHEAPSEATS_CLI_ENV, CHEAPSEATS_AUTH_HEADER, CHEAPSEATS_ALLOWED_EMAILS, or variables that load code at startup; each is ignored with a warning. Export them in the real environment instead. CHEAPSEATS_TOKENS still loads from .env.

Startup checks its auth settings. serve refuses to start when CHEAPSEATS_TOKENS is set but holds no token, or CHEAPSEATS_AUTH_HEADER is blank, and runs without sign-in only on exactly localhost or a loopback address.

The web app

• No page can be framed, or load an image from another site, so a hostile page can't trick a click onto Run now or Share, and analyst Markdown shows an image as its alt text.
• Requests have limits: a minute to send a request, two to start the next on an idle connection, 1 MiB per body (4 KiB for /login). A proxy in front needs a read timeout over ten minutes, for MCP's wait_for_run.
• The sign-in cookie is Secure behind a proxy that terminates TLS (CHEAPSEATS_PUBLIC_URL https, or X-Forwarded-Proto: https).
• A form from a CHEAPSEATS_HOSTS name is accepted only from its exact origin, scheme and port included.
• Opening the prompt review no longer marks it reviewed; a Mark reviewed button does.
• The CSV export marks every column that starts like a formula, not only the model's words.

Outbound calls and limits

• Provider replies are read up to a cap (32 MB for the models and Exa, 4 MB for TypeSafe), and a claude or codex call that writes past 32 MB is stopped.
• A citation check fetches at most 100 pages, under one process-wide fetch limit.
• Fetches refuse every address IANA lists as not globally reachable, including the documentation ranges and IPv6 site-local.
• Crawl counts pool 4xx responses into one /(errors) row per host, day and bot, ignore future-dated log lines, cap one import at 1M requests and age out after 400 days. A 5xx stays on its page.

Files and deploys

• The database, its backups and snapshots are readable only by the user Cheap Seats runs as; an existing database is tightened at start.
• exe.dev: the CLI user can't connect to Cheap Seats' port (an nftables rule the deploy installs and checks), and the deploy refuses a config with committed symlinks.
• cheapseats init writes a .gitignore for .env; migrate-config rewrites only plain files; probe prints results without control characters; fix prompts tell the coding agent that the pages it reads are data, not instructions.

The build

Release images build with Go 1.27.3, which fixes standard-library vulnerabilities, from base images pinned by digest. Every workflow action is pinned to a commit, and a release tag must be plain vX.Y.Z.

Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.5.0 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.5.0

v0.4.7

Tables keep host names whole. A table cell showing a host, hash or id could break between any two letters, so the browser shrank those columns until hosts read one or two letters per line. On the run page the Opportunities table also packed its competitor list into a numeric cell that never wraps, which collapsed its Kind, Page type and share columns. Host names and ids now stay whole and a phone scrolls the table instead; only cells showing a whole URL may break. Opportunities lists the competitors named in a column of their own and the most cited hosts one per line. Checked on a copy of real data across every page at desktop and phone widths.

The prompt review shows each flag's prompt. The Jev table printed the review's internal data where each flagged prompt's id belonged.

Not a grading method change. Trends carry on and no regrade follows.

Image: ghcr.io/cheapseatsdev/cheapseats:0.4.7 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.4.7

v0.4.6

Each objection says which pages taught it. The run page's objections table, and the top praise and objections in the sentiment section, gain a "pages behind it" column: the pages the answers raising it cited, each marked owned (your own site) or earned (a third party), with how many answers raised it from memory alone. An objection your own pricing page taught is a different fix from one a comparison site taught, and the fix list now names that page so the analyst can aim at it. GET /api/runs/{id} and MCP get_run carry the same pages. It reads what runs already store, so earlier runs show it too.

A submitted fix shows whether its page now says the claim. For a fix with an attempt whose target is on one of your sites, the fix card reads "On the page now": landed, not landed with the missing terms, or could not read it. It is evidence under "Done when", fetched at most once a day through the citation check's reader, and counts toward no outcome.

Sources show the cited pages that flipped. A run's citation check is compared with the set's previous one, and a page that started or stopped naming you, or a competitor, gets a chip in a new "Cited pages that changed" table. get_run carries it as cited_page_changes.

Not a grading method change. Trends carry on and no regrade follows.

Also in this release: the neutral-retrieval table's shared host rows are named for the first configured domain or site, instead of whichever page was counted first; an /idea-review skill for contributors reviews proposed features against the code.

Image: ghcr.io/cheapseatsdev/cheapseats:0.4.6 · Chart: oci://ghcr.io/cheapseatsdev/charts/cheapseats --version 0.4.6