Cookrew 0.3.0 — the canvas tidies its own cables, a seat is bought on the site, and a lane per agent

Cookrew 0.3.0 — the canvas tidies its own cables, a seat is bought on the site, and a lane per agent

Seventy-odd commits on dev since 0.2.0. Four things changed what the product is; the rest made it faster and more honest.

The canvas draws its cables as a wiring harness

Every connection on the board used to be its own line, drawn end to end across the whole canvas — 3,112 crossings on the Cookrew Dev board. The canvas now routes cables round the cards on a grid, draws a shared run once as one trunk, and shows a run only when both of its ends are on screen; a cable that leaves the screen becomes a tab on the card's border naming where it goes, newest first, with a fold for the rest. Hovering a card lights its cables and dims everything else. It is the default view, costs nothing per frame, and routes the live board in 41–51 ms.

A cable carries the question and the answer

When one agent asks another, the cable between them lights and a pulse runs along the trunks from the sender to the receiver; the answer runs back the other way, like a signal on a trace. One frame per moment from main, one compositor keyframe per pulse, nothing per frame — the render-count gate reads 2.07 commits a frame with or without it, and nothing is in the tree when nothing is in flight.

Switch workspaces by looking at them — the screen wall

The header's dropdown is gone. One chip opens a wall of your workspaces as pictures; tap one to go there, swipe on the phone. The wall carries NEW, DIRECTORIES, REMOVE and HISTORY for the picked screen. The canvas you leave is photographed on the way out, so the wall always has a picture of it; the one you are standing in has one without a camera.

A seat is bought on cookrew.dev, and the market knows your name

The purchase path the ladder promised finally runs end to end: BUY on a team's page goes to Stripe Checkout and comes back to that page, which opens the line on your new seat by itself; a bought seat admits you on every later session and follows you to any device. The marketplace is a shop with one identity — your username: it opens on YOUR AGENTS — the teams you serve and the seats you hold, one row and one act each, OPEN THE LINE — then what is for sale, free teams say so, priced ones wear their price and BUY, and a stranger is offered the account sheet — never a handle to enrol. Stars act as the account too. The front page puts the instances you can rent on its first screen; the import sheet in the app lists your saved teams and the seats you hold, no address needed. Verified in a real browser against Stripe's test mode and against a real registry.

Lanes — a worktree per agent, and landing is the app's job

Several agents on one canvas used to share one working tree, and one agent's edits rode into another's commit. A card can now open a LANE: a linked worktree on its own branch, cut from the branch the shared tree is on. LAND merges base into the lane, runs the repo's gate (its gate:lane script, else typecheck), and fast-forwards the shared tree — a conflict or a failed gate is a state on the card, never a prompt in the agent's conversation. AUTO-LAND lands four seconds after a turn ends.

Also

• Every card says its agent's model and effort; Claude's and Pi's dials turn from the zoom view, Codex's stay read-only on evidence; the phone has the dials too.
• The board row in another workspace takes you there and opens the card.
• The homepage opens on ten seconds of the real app; every still on the site is retaken in the harness view from the agents' own records; the brand is the icon and seven pixel letters.
• The zone answers the phone's probe (GET /v2/names/<host>), a 401 ends only the token it was about, and the path panel says who refused.
• The version interaction (V pins, V chips) is gone from the rail and the serving surfaces.

The browser card keeps the last picture you saw

Four defects on the browser card's snapshot path, fixed without a byte of new loading: the thumbnail's version was a clock, so an idle page re-sent the same 65 KB frame over the relay every five seconds; the live frame was thrown away on zoom-out; a zoomed relay view read "unavailable" while the card's picture sat in the store; and the desktop photographed every browser on the canvas every tick. The version is now the pixels, the last painted live frame becomes the thumbnail on the way out, the stored picture is the poster, and the sweep captures only what the screen shows.

Performance

• The API's p95/p98 tail was the main-thread gzip of a 750 KB /api/workspace: dynamic bodies are now compressed once per distinct content and cached under their hash, named by a weak ETag, and a poll that names it back is a 304 with no bytes. Measured on the live payload: 0.33 ms per hit against 15–26 ms idle and 183 ms loaded before.
• A workspace switch that leaves an unchanged canvas writes nothing; the switch sends the canvas light first and whole a beat later.
• Transcripts: a block window is answered from the index, state and marks are parsed once per change, an append parses only the appended lines, and rows re-render only when their own facts change.
• Every synchronous shell-out lands in /api/health's loop ledger under its command's name, so a multi-second stall says which herdr or tmux call held the thread.

Fixes

Pi's effort was unreadable on sessions bigger than the window and it now records both dials; Codex agents kept their tag through a long turn; a block window arrives in the number the drawer is laid out in and skips rows the chain reports missing; the mini tile stacks model over effort so the effort survives; the wall is tappable on every platform; the header keeps its own layer; a door nobody is serving reads OFFLINE, not SIGNED OUT.

Known

• The Windows CI leg stays red on POSIX-assumption tests (#80); the Windows build is a preview.
• The watch companion is in progress on feat/watch and is not in this release.

0.2.0 — Identity v3: one identity, from the sign-in door to the served door

Your account is now the only thing that speaks for you — on a second Mac, at a served door, and on your own Wi-Fi.

What you can do that you could not

• Use your account on a second Mac. Sign in with your username and password, or take an eight-character code from a device you already hold. The old build could only offer to claim a new name, and told you your own username belonged to somebody else.
• Buy a seat once. A seat bought on the web admits the desktop with no second payment, because the desktop now identifies as your account at a listed door instead of a key it minted for itself. The marketplace no longer enrols browsers at all.
• Answer everything in one place. A device asking to join, a phone asking for your Mac's Wi-Fi, and a guest asking for a seat all arrive in the same queue, answerable from any device you hold. Approving a join asks for the number shown on the asking machine.
• Revoke and mean it. Revoking a device ends its access at the account, at every door, and on the Wi-Fi of every Mac — not just in a list.
• Stop losing your doors on the thirtieth day. The session renews on the device key. The password becomes a threshold for the acts that need one: changing it, removing a factor, revoking another device, minting a join code, taking over a door.

Also in here

Leaving an account on one Mac without touching the canvas. Device names you can tell apart. Doors that follow an account claimed after startup. A lock screen that says who is waiting.

What the reviews caught

A branch review blocked this release with one CRITICAL and eight HIGH findings, all fixed before it shipped. The CRITICAL: a step-up threshold the asking session could cross by approving its own request. Also fixed — two ways a revoked device kept access, an event feed a stranger could flush, an APPROVE button that was dead and deleted your own pending sign-in after three taps, and two hardcoded production addresses that made isolated testing impossible.

A pass on the real interface found the approval request was invisible on a first run: the poll was started once at launch, before there was an account to poll for.

Verification

8386 tests, none failing. Typecheck clean. The end-to-end script runs against a real registry with two accounts standing in for two Macs.

Known

Four product decisions ship without a ruling and are named in PR #88. The Windows build remains a preview: agents do not survive a restart there, by design, because the terminal multiplexer it needs does not exist on Windows.

Cookrew 0.1.4 — the glove is the mark, the phone pastes with a thumb, and herdr upgrades under a running fleet

What this is

10 commits since v0.1.3, 36 files, +991/-432. A small window with three things in it: the glove became the mark, the phone pastes with a thumb, and herdr can be upgraded under a running fleet without losing it.

The glove is the logo

A cartoon glove makes the C and wears the glasses for the OO, with KREW set in Fredoka outlines. It moves together across the site brand, the SEO card, the app icon and both PNG lockups — one mark, everywhere, instead of a hand on the site and a chip in the app.

The phone pastes with a thumb

A long press on the live pane pastes, and the paste key moved into the arrow row where a thumb already is; the copy button and the header pair are gone. The press listens on pointer events, because a touch released over a live pane never delivers a mouse event — which is why the first cut of it did nothing at all.

The path sheet now says what it actually measured, and offers to race again instead of leaving a dead panel on screen.

herdr 0.9.0 — protocol 22, upgraded live

herdr update --handoff carries a running fleet across the version boundary, and two things about 0.9.0 had to be answered for that to be true:

• Subscriptions stopped replaying retained history. The status feed used to list panes and then subscribe, so a pane that changed in between was a change nobody heard about — it would sit on its old state until the next transition. It now seeds pane labels, subscribes, and only then takes the snapshot that seeds status. Each pane is still announced exactly once, because the boot timer treats the first announcement as the agent becoming reachable.
• A replaced server keeps the panes and forgets their names. herdr persists pane layout, not the metadata a source reported against it, and Cookrew only re-reported that metadata for terminals it attaches. A live handoff turned 33 named panes into 5: every agent still running, and every tool that resolves an agent by title answering "pane not found". Boot now re-asserts the card binding for every terminal in every workspace, over one shared pane listing.

Rehearsed on a 56-pane fleet: all 56 panes survived the handoff, both sides on protocol 22, and 56/56 wear their card again after the restart.

Verification

The macOS and Ubuntu test legs are green and both release builds pass. The Windows unit-test leg fails on POSIX-only assertions (path separators, 0600 modes, fsync), and the perf gates fail on the same team paste shape gate and headless-Chrome profile-cleanup race as v0.1.3 — the render-count gate itself passes locally with numbers matching the previous release.

Cookrew 0.1.3 — an account owns the Mac, the phone reaches it on cookrew.dev, and the app got a performance program

What this is

628 commits since v0.1.2, 910 files, +138524/-23838. Four things happened in this window: an account now owns a Mac and its phones (identity v2), the phone reaches the Mac without leaving cookrew.dev (reach v2.1), the app got a performance program with gates that run every night and every hour, and the checkpoint rail reads one stream instead of four copies of the conversation.

Identity v2 — accounts, devices, and the sign-in ladder

An account is a handle plus a password, with TOTP, passkeys, device approvals and recovery codes behind it; a phone is a device on the account, admitted by a pairing key the Mac prints; the owner's canvas is served to that account alone through a private relay session on cookrew.dev (/relay/@user/desktop/<id>/ answers 401 to anyone else, 403 not_this_device to a wrong device, no-store always). Door seats, settlement and caller avatars ride on the same identity. Six phases, each landed as registry half plus app half, followed by three QA rounds (named 401 sentences, password change verifying the current one, enrolled passkeys listed, ended sessions prompting for the password, QR sweep across every version and level). Legacy handles migrate by setting a password; the env override is retired.

Reach v2.1 — the phone finds the Mac

One pairing token in the URL fragment, pairing on the phone, no jump off cookrew.dev. The Mac serves under its own DNS name at d.cookrew.dev with an ACME-issued certificate and SNI, and the phone switches its data plane live to whichever path answered — relay, or the Mac directly on the same Wi-Fi, which the path sheet on an iPhone now offers. The Mac publishes only its real interfaces, the hello probe retries without the local-network hint, and a failed LAN probe says why.

One stream

The transcript, the checkpoint rail and the marks ledger read one lineage-wide stream (phases T1 to T5): a shared persisted cursor, rewind as an appended mark, anomaly classes, index paging, the five old routes kept as adapters, and the second copy of the conversation retired. A card binds to the process in its pane and never to a background job's session; the gate reports a card that alternates between two sessions; a checkpoint can no longer fall off the end of a card's history.

Performance — measured, gated, and fixed

A perf suite (npm run test:perf) with structural gates that no fast machine can fake, a nightly CI workflow, and an hourly live eval on the owner's machine (npm run perf:eval, storage, memory, p95/p98 latency, event-loop delay from GET /api/health). Then seven lanes against what it found, every one adversarially reviewed before merge:

	before	after
Main-process stall behind the beachball (board probe forking herdr on the main thread every 3 s)	2 to 4 s per no-work request	1 to 6 ms; zero synchronous children per pass
Board polling	every 3 s forever once anything was detached	runs only while a board is open; 0.5 listings/min busy, 0 closed
EventLog.query at the live log size	p50 66.5 ms, every rotated file re-parsed	p50 5.7 ms, one read on a warm query
Note render cache	51.5 MB retained at 64 KB notes, count-bounded	3.8 MB, byte-bounded, 40 MiB worst case
Canvas pan, 27 cards × 60 frames	every card re-rendered every frame (1,464 wrapper renders)	zero card renders; a rename renders one card
Served-callers IPC listeners	one per card (114)	one for the canvas
Team session sidecars	1.0 GB never swept	swept by open set and grace; served sandboxes likewise
Sous title retries under load	one timeout every 2 s, forever	a circuit breaker, one log line per opening
Remote canvas boot over the relay	80 requests, 8 third-party, first card 1.2 s	16 requests, 0 third-party, first card 0.34 s (#77)

Sous by voice

Hold ⌘ on the Mac and speak; Xiaoai reaches the same intent core through voice-gateway; Typeless-style dictation. Sous switches, asks, creates, connects, renames and goes back, in Chinese or English.

The site, the Board, the phone

The homepage is the three pages in one, with HOME, the market and the account in the header and the features index sizing its frames; /start in two steps. The Board opens on the loaded workspace and shows every agent's latest checkpoint. On the phone: a tapped card opens again, the rail's row actions are reachable with one finger, the terminal stays alive across a reaped connection, the bottom row waits for your thumb to leave. The amber lockup is the brand: the site moves, the app holds still.

Served crews

The first selected agent terminal leads an exported team; an orch is required to serve; doors are dialled after the account is known at boot; the phone announces itself at every pairing.

Known at release

• The Windows CI leg has 29 failures (POSIX mode bits, paths), issue #80; Windows artifacts remain windows-preview.
• The registry (cookrew.dev) is deployed separately from this tag; the relay header change in #77 needs that deploy to take effect.
• Issue #64: the boot storage sweep reads 1 GB of session sidecars for attachment citations. Issue #78: a CLI note write from a terminal whose workspace is not focused prints OK and does not persist.

Cookrew v0.1.2

Served crews take real money — a crew you publish can now be paid for and talked to by a stranger, on either rail. Both moved real funds in testing, not fixtures: x402 settled 7.5 USDC to the author's own payTo across three Base Sepolia transfers, and Stripe reached payment_status: paid with automatic_tax: complete. Callers pay the author directly — Cookrew never holds the money and takes nothing. The Stripe rail follows Stripe's own implementation plan for this business: a pinned API version, an idempotency key on every session, the AI-service tax code, and address plus tax-ID collection so a cross-border B2B sale can take reverse charge.

A served crew answers — an orch is now required before a crew can serve, closing the door that let a crew with no orch take a caller's prompt at a bare shell. Four delivery bugs went with it: a served agent that dies now says so instead of failing silently, a served harness finds its binary however the app was launched, detaching a mirror no longer kills the agent it mirrors, and a served ask waits on the backend that actually runs it.

The phone stops dying — zooming into a terminal on a heavy workspace was killing the companion. It was creating one WebGL context per pan, not one per session: every card clears the detail threshold on a phone stage, so panning flipped the overlay and churned contexts until iOS killed the web process. With per-workspace memory budgets, layer shedding while an overlay owns the stage, incremental live transcripts and single-parse SSE, the heaviest workspace now stays under budget.

Security — the owner's home directory no longer leaves the machine in a published preset: only registered workdirs were masked before, so a home path in a note, a card name, or a command travelled under a signed "placeholders" claim. The team's own name is now scanned like any other author-written field. A served sandbox is blind to every other service and to the owner's credential stores, and Cookrew refuses to boot from inside a terminal it is itself hosting.

Known gaps — a grant that cannot work refuses after the caller pays rather than at serve time; budgets are silent until exhausted.

Artifacts — macOS dmg/zip (arm64), Windows portable + NSIS installer (preview: persistence needs herdr there), auto-update manifests.

Cookrew v0.1.1

Canvas clipboard — cards are a clipboard selection: pick cards on the canvas or board (click again to cancel), then copy, cut, save, and paste them across workspaces from the selection bar. A moved or cut agent arrives with its conversation — the session is carried to the new card before it boots, never restarted as a stranger. A paste lands as one state mutation with one summary event, not a flood of per-card ones.

Card edit menu — right-click or long-press any card to rename it, save its role from a checkpoint, fork a new agent from a checkpoint, or move it to a different workdir.

herdr card binding — when herdr hosts the panes, Cookrew's names show in herdr's own chrome: the pane wears the card's title and role, the workspace wears the active Cookrew workspace's name, with identity tokens on both. Display-only; tmux hosting is unchanged.

Latency events — the event log records how long things took, not just that they happened: turn completion reports the agent's wait, workspace switches time the full PTY handoff, and a shared percentile helper (p50/p95/p98) keeps board and renderer in agreement.

Also in this release — native directory picker for new workspaces; a workspace switch lands on the new canvas instead of empty space; phones that lose the desktop find their way back; browser cards get their screenshots on mobile again; cards under a live spinner no longer flash a bare ❯.

Artifacts — macOS dmg/zip (arm64), Windows portable + NSIS installer (preview: persistence needs herdr there), auto-update manifests.

Cookrew v0.1.0

First release.

Terminal hosting — agents run behind a multiplexer seam with declared capabilities. herdr hosts where installed (transparent pane attach, agents survive app restarts, dead agents auto-recover with their conversation context via --resume); tmux is the first-class fallback (COOKREW_MULTIPLEXER=tmux); switching hosts migrates agents instead of duplicating them. On Windows — where tmux does not exist — herdr provides persistence for the first time.

Agent protocol — cookrew ask waits on the agent's actual lifecycle state instead of inferring "done" from silence; push-based status feeds the turn tracker.

Turn & checkpoint pipeline — checkpoint identity from the harness session file; replay frames let mid-session viewers (including phones) scroll live panes; wheel-based checkpoint jumps.

Mobile — Tailscale support, re-auth UX for expired tokens, persistent pairing.

Artifacts — macOS dmg/zip (arm64), Windows portable + NSIS installer (marked preview: without herdr installed, agents do not survive app quit), auto-update manifests.

Known gaps are documented in #52: herdr's server durability is supervised rather than assumed, and copy-mode search under herdr is replaced by the renderer-side path.