v0.15.0

0.15.0 (2026-08-06)

Features

• api: add PickerKind::Size (a5c9e9c)
• api: local-first connect selection — detect local vs remote (7a6d04c)
• api: shared tunnel protocol — the durable, local/remote contract (d3a00e2)
• app: set the darkrun app icon in the bundle (ships via fastlane) (79db09d)
• app: web push registration — the client half of notify-on-tick (72a5365)
• app: wire the Firebase web config (login now functional) (2af84d6)
• app: wire the Web Push VAPID key — remote push fully configured (9d0750c)
• cli: darkrun statusline --explain says why the line is blank (2b57a6e)
• cli: darkrun login — enable remote access (closes the engine-side loop) (39d99b5)
• cli: darkrun statusline --explain says why the line is blank (#270) (f0238e1)
• cli: engine-data write guard redirects each artifact to its own tool (bf6f206)
• cloud: Firebase-native foundation — Firestore data model, rules, project config (b97cfa4)
• core+mcp: fan the SHA write-guard out to units and briefs (b4fea39)
• core+mcp: SHA optimistic-concurrency guard on artifact writes (knowledge first) (138fb1e)
• deeplinks: add iOS associated-domains entitlement (capability now enabled) (0b4cb23)
• deeplinks: fill the AASA appID + wire associated-domains (macOS) (0df6bc4)
• desktop: auto-detect + drive the installed app from a dev-checkout engine (275cdaf)
• desktop: auto-detect run history as projects + Finder-pick local repos (8e07c6b)
• desktop: auto-surface provider repos with darkrun artifacts (clone-on-open) (a529aeb)
• desktop: auto-surface provider repos with darkrun artifacts (clone-on-open) (#241) (5f84ab9)
• desktop: read a run offline from .darkrun when no engine is connected (5a8a490)
• desktop: read a run offline from .darkrun when no engine is connected (#239) (0683311)
• desktop: readable question prompts — markdown, text-only cards, real mockups (d71321a)
• desktop: request changes offline; a resuming engine picks them up (88a4c4e)
• desktop: request changes offline; a resuming engine picks them up (#240) (eefcb4a)
• desktop: sign in with GitHub/GitLab and pick a permitted repo (authenticated clone) (f51a536)
• desktop: sign in with GitHub/GitLab and pick a permitted repo (authenticated clone) (#223) (dae755d)
• engine+desktop: questions surface on the run + persist across restarts (598d98e)
• engine+desktop: sessions materialize on demand; chrome is not selectable (c3c2395)
• engine: engine-driven run-setup elicitation (factory/mode/size pickers) (905e8ca)
• engine: mode-gate questions + scope interactive sessions per station (e990bd4)
• engine: pull fable from the model selector (Anthropic removed support) (38a4c80)
• engine: spawn the host connector + advertise reachability (fab84f3)
• engine: the desktop surfaces with the work, not at the first gate (299011a)
• gates: await_decision primitive + SessionPayload::resolved() (eadcea7)
• infra: capture Firebase Auth sign-in config as code (79ed568)
• ios: MATCH_NUKE — one-command cert-slot reset (bb82760)
• ios: RC build numbering for TestFlight (increment until release is cut) (d49a487)
• ios: safe-area edge-to-edge (toolbar + drawer) + "Darkrun AI" name (791ceab)
• ios: universal app (iPhone/iPad/Mac) with mobile content mode (0db7104)
• login: relay-token broker carries a browser-minted token to the engine (b7e2082)
• mas: Phase 1 — shared data root for the Mac App Store app group (36b51c5)
• mas: Phase 2 — App Sandbox entitlements + macOS .pkg packaging (2a82f53)
• mcp: fall back to the app.darkrun.ai deep link when no desktop can open (29b7830)
• mcp: live-mirror the run payload after every mutating tool (7542bfe)
• mcp: local OS notification when a run reaches a gate (8c15fdf)
• relay: remote reachability (Wave 2 crit #5) (463654a)
• relay: remote-push spine — FCM fan-out + device registration (d3f15c3)
• relay: self-refreshing relay credential (Wave 2 crit #6) (aea50fd)
• remote: Decide command, direction/picker routing, exactly-once client retry (ae69714)
• sim: protocol-fidelity harness — a dumb agent that must follow rendered prompts (ffe29d5)
• site: 'Open app' link in the header (#185) (8c16e14)
• site: add 'Open app' link to the header nav (9cfbf4a)
• site: Claude Code's boxed session-start banner on the statusline demo (5963c7c)
• site: render the statusline demo in situ, under Claude Code's prompt box (6c42eab)
• site: social card (Open Graph / Twitter) — the factory-line hero (a3a2781)
• site: the terminal panels follow the site theme (4752490)
• statusline: explorer chips at Spec + dev launcher freshness (170ea16)
• tunnel: host connector — durably bridge the relay to the local engine (4065891)
• tunnel: host connector pushes a remote notification on gate entry (e294a91)
• tunnel: host-side command dedupe (Wave 2 Step 1d) (c6395bf)
• ui: shared Sidebar component (#184) (b0cb04a)
• ui: shared Sidebar component (runs-by-project, actions, identity) (ee7e44b)
• vcs: detect darkrun artifacts on a remote repo without cloning (bc40375)
• vcs: detect darkrun artifacts on a remote repo without cloning (#237) (e0a3148)
• web/app: persistent-login Workspace (sidebar repos+runs, run detail) (3a7c09d)
• web/server: App-backed workspace + run endpoints (persistent Firebase login) (e3d7873)
• web/server: cover org repos via verified org-membership check (e54c65e)
• web/server: Firestore session registry (Wave 2 Step 1b) (44f2db3)
• web/server: Firestore-backed relay-token broker (Wave 2 Step 1a) (5c1da13)
• web/server: Pub/Sub cross-instance frame bus (Wave 2 Step 1c) (f61b54c)
• web: actionable gate + station narrative in the web app (bb6c7a7)
• web: app.darkrun.ai — the Dioxus web client for live remote runs (694e4a4)
• web: client-addressed relay routing — read into a live session on connect (48c1ae5)
• web: Firebase ID-token verifier secures the relay + /darkrun:darkrun-login (23ea0f1)
• web: Firestore-backed device registry — push survives restarts (5411693)
• web: Font Awesome brand icons for sign-in + app iconography (#183) (45ce997)
• web: Font Awesome icons — brand icons for sign-in + app iconography (2ebcbd2)
• web: GitHub + GitLab on one account + combined portfolio (#173) (80ac32a)
• web: Google service-account token source — FCM push goes live (19b60cc)
• web: link GitHub + GitLab to one account + combined portfolio (e07aa38)
• web: persistent-login workspace (repos + runs) via GitHub App backend (#193) (c6c7d7e)
• web: remote-tunnel relay — reverse-WS bridge in darkrun-web (36e512b)
• web: surface per-station phase in the run detail (b92569a)
• web: web app Firebase Auth sign-in — closes the login chain (11abc83)

Bug Fixes

• api,desktop: send the run's mode over the wire and stop nagging dark runs (fbdb9f0)
• api,desktop: send the run's mode over the wire and stop nagging dark runs (#261) (d0eaa58)
• app: defer signInWithRedirect out of the wasm call frame + no-cache assets (#190) (82fe605)
• app: defer signInWithRedirect to a macrotask; no-cache all assets (04c6016)
• app: fire-and-forget sign-in redirect + no-cache shell + messaging authDomain (#189) (9b95c4a)
• app: fire-and-forget the sign-in redirect (stop the hang) (5695a06)
• app: Firebase authDomain = app.darkrun.ai (unhangs sign-in) (6acb2ed)
• app: mount the shared theme — kills the white viewport border (0614437)
• app: render markdown, add offline state, stop dropping payloads (609a64c)
• app: same-origin Firebase authDomain (unhangs GitHub + GitLab sign-in) (#187) (02873d1)
• app: sign in via full-page redirect, not popup (2f91768)
• app: sign in via redirect, not popup (fixes the hang) (#188) (dbaa3d2)
• app: sign-in can't hang forever + friendly auth errors (#186) (0dd57e8)
• app: spawn sign-in from a persistent scope (the actual hang) (#192) (b555379)
• app: spawn sign-in from a persistent scope (the real hang) (67b9c17)
• app: stop sign-in hanging forever; friendly auth errors (47a06b7)
• auth: refresh hosted GitLab tokens via a website broker route (1c03df1)
• ci-dist: close CI/release gaps — cross-target check, blocking clippy/audit, release asset guard, plugin hooks+version, Apple Sentry DSN, Firestore rules deploy (03c6d0e)
• ci: macOS App Store version on branch pushes (was 'main', now Cargo version) (e0245e0)
• ci: macOS App Store version on branch pushes (was 'main') (#197) (f8463c7)
• ci: ship macOS release candidates to TestFlight via pilot (e9545dd)
• ci: ship macOS release candidates to TestFlight via pilot (#252) (eebdd38)
• clear all code-scanning alerts (clippy + CodeQL) (a82d211)
• cli: add migrate subcommand, CSPRNG login nonce, document codex harness (e52a4c9)
• cli: the engine roots at the project, not the worktree it booted in (ec17657)
• cli: the engine roots at the project, not the worktree it booted in (#268) (a197a83)
• cli: the statusline reads the project's state, not a worktree's stale copy (eec5f59)
• cli: the statusline reads the project's state, not a worktree's stale copy (#266) (e3f83fb)
• close from-scratch gap-report findings (gate surfacing, review markdown, evidence gates, web app, site, infra) (#216) (8bcbf63)
• cloud: correct the Firebase model — session registry, NOT a state mirror (52b2fbe)
• core: require every declared Pass beat to settle before a unit completes (96e3ef6)
• core: require every declared Pass beat to settle before a unit completes (#259) (532d3df)
• core: route the annotation leaf through the containment backstop too (af3867e)
• core: StateStore resolves to the project by construction (b8c2f43)
• core: StateStore resolves to the project by construction (#269) (55a7b87)
• desktop,cli: keep the station rail whole, open past stations, resolve the statusline absolutely (7afde25)
• desktop,cli: whole station rail, navigable past stations, a status line that resolves (#257) (8eef6df)
• desktop: a stale dev launch bundle execs the fresher build (042f83b)
• desktop: close review-surface gap-report findings (c231e1a)
• desktop: close the operator-surface gaps (markdown browsing, replies, proof at the gate, archive) (8ee5e6c)
• desktop: drag the window by the toolbar (wry ignores -webkit-app-region) (f96b771)
• desktop: key sidebar run lists by project slug, not display name (14ec652)
• desktop: let the welcome/projects surface fill the main pane (920c2e0)
• desktop: match the drift-chip run by (slug, port), not project name (347d0fa)
• desktop: one checkpoint decision surface; stack cramped text artifacts (81816bc)
• desktop: one checkpoint decision surface; stack cramped text artifacts (#245) (f25c812)
• desktop: resolve repo identity in the sandbox; show version + build (1c265dd)
• desktop: resolve repo identity in the sandbox; show version + build (#244) (a9a4fb0)
• desktop: show the git repo at the top level, worktrees as subnavs (d669618)
• desktop: show the git repo at the top level, worktrees as subnavs (#243) (ac9d6e2)
• desktop: stop auto-listing every local repo that ran an engine (f605aa7)
• desktop: stop auto-listing every local repo that ran an engine (#236) (75a203d)
• desktop: surface the engine's refusal reason instead of a bare HTTP code (9527a92)
• desktop: surface the engine's refusal reason instead of a bare HTTP code (#253) (897a025)
• desktop: the engine's worktree pool is not a checkout to read state from (311df71)
• desktop: the engine's worktree pool is not a checkout to read state from (#267) (7a5f46f)
• desktop: the review pane opens on what is waiting, and says why (9d9c3f6)
• desktop: the review pane opens on what is waiting, and says why (#264) (50871a4)
• desktop: welcome/projects surface fills the main pane (#166) (c1f7bda)
• engine: answering an interactive session dismisses it + surfaces the next (5828727)
• engine: close engine-minor gap findings (mode-picker copy, await/pure-read docs) (8983893)
• engine: close evidence + correctness holes at the checkpoint gates (da2fbf4)
• engine: close gap-report engine findings (guarantees, atomicity, review data) (558e681)
• engine: close the B+D audit residuals (UserGate-at-Spec, drift re-orient cascade + over-broad trigger) (ca674f9)
• engine: hold at operator gates + durably record desktop decisions (05ffe57)
• engine: land station work onto run-main (the manufactured code never reached the base branch) (#219) (22b7270)
• engine: land station work onto run-main (worktree_is_dirty ignored .darkrun-only dirt) (f2506c7)
• engine: let non-dark runs reach Reflect+Checkpoint; gate checkpoint_decide to a real hold (d80b18a)
• engine: narrow the UserGate-at-Spec hold to the early-stamp race only (6ecc9ee)
• engine: raising a question/direction/picker gate launches the desktop (e5586ef)
• engine: require evidence (or an explicit override) at the human Prove gate (d1e3f1d)
• engine: unify feedback ids, wire annotation-close, retire sessions on reset, re-orient on drift close (4c7401d)
• engine: unwedge non-dark runs (Reflect+Checkpoint), gate checkpoint_decide, unify feedback ids, wire annotation-close, retire sessions on reset, safe drift re-orient (#221) (ec5c83b)
• gate hold + sandbox registry + dev-bundle seal + 3 gap-close bundles (discovery, operator surface, platform edges, vcs extraction) (#218) (17e69c0)
• gates+desktop: hold at every operator gate; sandbox-proof the registry; seal the dev bundle (aeee7a0)
• gate: surface gates to a running app via deep link + engine-follow (40a08c6)
• git: normalize the common dir before deriving the project root (028d2e3)
• git: satisfy clippy 1.97 question_mark in the remote_status fixture parser (dbbad70)
• git: satisfy clippy 1.97 question_mark in the remote_status fixture parser (b9b5cc9)
• http: surface a refused gate decision (no false success); read agent-attached proof from disk (479edf9)
• http: surface refused gate decisions (no false success) + read agent-attached proof from disk (#222) (7074e37)
• http: the Mine predicate checks the run's STABLE branch (ab8eb8f)
• infra: resolve relay. dial + deploy GitHub App creds (2deaf6f)
• ios: bootstrap actually sets the secrets (kill the unbound-var abort) (dba244a)
• ios: bootstrap drops the stale Gemfile.lock (bundler 1.17.2 vs Ruby 3.4) (df2affa)
• ios: bootstrap prefers a modern Ruby; drop Appfile placeholders (9102bc5)
• ios: bootstrap survives LibreSSL — use real OpenSSL for match (5f04f92)
• ios: build for device (not simulator) + compile the app-icon asset catalog (038e441)
• ios: build from the dx .app, not a phantom Xcode project (055a9f5)
• ios: build with a released (non-beta) Xcode + inject DT* Info.plist keys (6d64c3e)
• ios: declare ITSAppUsesNonExemptEncryption=false to stop the export prompt (a9651ce)
• ios: disable webpage zoom in the mobile viewport (app feel) (e1b3e3e)
• ios: don't apply the desktop window size on mobile (the real layout fix) (5b770de)
• ios: find the match profile in Xcode 26's install location (d9a211c)
• ios: force device-width viewport so the mobile drawer layout fires (e45a1d0)
• ios: full-bleed app icon (stop iOS double-masking the rounded tile) (#234) (44e8395)
• ios: make the App Store release lane idempotent (no build-number collision) (b339b95)
• ios: make the App Store release lane idempotent (no build-number collision) (#205) (5bf5240)
• ios: own the mobile index with a clean viewport (drawer + safe area) (40537a5)
• ios: pass App Store binary validation (Info.plist, symlinks, iOS 26 SDK) (5a7aa28)
• ios: pin IPHONEOS_DEPLOYMENT_TARGET=15.0 for the device build (05deaf2)
• ios: pin platform: ios so the upload doesn't prompt in CI (74d6c4a)
• ios: setup_ci so codesign doesn't hang on a keychain prompt (8df8501)
• ios: upload_to_testflight option is app_platform, not platform (94cf0d5)
• ios: use a full-bleed app icon so iOS stops double-masking it (5512d65)
• local: auto-detect installed desktop app + hold/record checkpoint gates (#206) (161bcd4)
• low-severity UX residuals (drift-chip slug collision + escalated count, visible archive errors, non-macOS window guard) (#224) (da670a9)
• mas: add network.server (boot) + name bundle 'Darkrun AI.app' (be9ddf4)
• mas: don't let identity lookup trip pipefail + dump identities (28d96bf)
• mas: find installer identity under basic policy, not codesigning (0781cfb)
• mas: generate_apple_certs:false for the installer cert (dd9e641)
• mas: inject application-identifier entitlement (ITMS-90886) (#164) (0fc15c3)
• mas: inject application-identifier entitlement to fix ITMS-90886 (d13894d)
• mas: macOS app boot crash (network.server) + name 'Darkrun AI' (#165) (9d0d4a3)
• mas: target macOS 12.0 so the arm64-only build passes validation (ee64717)
• mas: unblock Mac App Store .pkg signing + upload (#163) (f8e8383)
• mas: upload .pkg binary only, skip first-version metadata upload (071b8d4)
• mcp: a run that cannot get its own branch refuses to start (d18484d)
• mcp: engine state commits land in the darkrun/ branch space or nowhere (48e8e1b)
• mcp: engine state commits land in the darkrun/ branch space or nowhere (#260) (a2a8acc)
• mcp: the engine's own state never counts as the operator's dirty work (4b11496)
• mcp: the engine's own state never counts as the operator's dirty work (#265) (780e877)
• mcp: unbreak the Windows release build (notify.rs E0282) (1106f18)
• merge: unify frontmatter rendering + never-drop guarantee + drop vulnerable quick-xml (c4dc2cd)
• picker UX (chrome, stale selection, auto-close) + same-commit checkout (a085a7d)
• platform: legacy-tree discovery, warm-app deep link, per-run presence, TestFlight idempotency (067805a)
• prompts: drop the dead darkrun_checkpoint_choose reference (ad3c911)
• release+site: unblock the release pipeline, per-route canonicals, honest statusline + verify/bench (9dc7c8b)
• review: render markdown artifacts + make the artifact the primary pane (52a193c)
• review: render markdown artifacts as a document + widen the artifact pane (#194) (9508ccd)
• review: render markdown for all review artifacts, not raw source (14b9331)
• security+release: reject path-traversal slugs + escape OAuth callback; unblock release, per-route canonicals, honest statusline/verify/bench (#220) (340c0f6)
• security: reject path-traversal slugs at the route + store; escape the OAuth callback (e5656aa)
• signing: force-regenerate App Store profiles in the certs lanes (cd86b22)
• signing: installer cert has no profile — skip_provisioning_profiles (macos) (9536371)
• site: clay banner box, sized to the panel (50fb85d)
• site: correct license, privacy, changelog, and dark-mode copy (23982ad)
• site: make /preview and /review showcases deliver their pitch (2236db8)
• site: preview question sample sets run_slug (68f3edf)
• site: serve /assets/* (OG image, favicon, screenshots) (48cf7a6)
• site: statusline stepper dots use the shared accent pill; drop the redundant slideshow slide (eea29bd)
• statusline+relay: keep review chips live at the UserGate; point remote access at a host that exists (0e7263f)
• statusline: read on light terminals — bold default-fg for slug and passed pips (73be50f)
• telemetry: authoritative opt-out + unit-testable init decision (7e5c205)
• the low-severity UX residuals from the bundle audits (3f43e9a)
• ui: move CSS doc comment onto its const (empty-line-after-doc lint) (82d135c)
• ui: saturate the tab count pill at 99+ (8f5588a)
• vcs-git: bridge stored OAuth token into push/fetch; paginate + refresh; safe self-hosted GitLab (34865cb)
• vcs: refresh GitLab OAuth token before hosting/PR requests (b1f0edc)
• web-server: close server security + correctness gaps (0a43f55)
• web: app wordmark + tab title match the website (#174) (fe98d89)
• web: app wordmark matches the website's interactive look (#175) (a4faedb)
• web: correct app wordmark + tab title (match the website) (2526cea)
• web: CORS on /api/repos for the cross-origin dashboard (#176) (77e42f2)
• web: CORS on /api/repos so the dashboard can call it cross-origin (d447e69)
• web: dashboard default + both providers + narrower GitLab scope (#182) (cb19524)
• web: default to the dashboard, show both providers, narrow GitLab scope (3e7e1c3)
• web: Dioxus.toml [web.resource] needs a dev subtable so dx build works (5a0944f)
• web: match the website's interactive wordmark in the app (e5bd8a3)
• web: multi-identity merge, redirect-failure surfacing, run/interactive wiring (675f248)
• web: paginate portfolio + run discovery so >100 items aren't dropped (6bfcab2)
• web: pin dark theme so the wordmark shows on app.darkrun.ai (#180) (19e3caf)
• web: pin data-theme=dark so the wordmark renders on the dark app (fdb26e5)
• web: select rust_crypto backend for jsonwebtoken 10 (4ef9cdb)
• web: serve robots.txt + sitemap + feeds (run the SEO generator in the image) (03da11f)
• web: serve robots.txt + sitemap + feeds (run the SEO generator in the image) (#203) (5acc680)