Clio Coder 0.6.6

Clio Coder 0.6.6 rebuilds telemetry as one system: one telemetry namespace, one event registry and hub, and journals per process, session and run under <stateDir>/telemetry/ (#434). Every record names the acting agent, every journal is hash-chained, and a sealed scope directory is a self-contained bundle that clio-coder telemetry verify can check on another machine. clio-coder telemetry share prepares a redacted archive with a content-free, structural or research profile, and telemetry import verifies it into a separate namespace. Every TUI, CLI, ACP and desktop app usage figure comes from the same read model, with measured, estimated and unknown values kept distinct. Sealed run records replace receipt files, and journaled assessments replace the evidence directory. A hosted prompt cache stays warm while a turn waits on its tools (#423), a session cost ceiling stop reaches ACP clients and the desktop app with the raise that clears it (#424), and clio-coder fleet land lands the task branches a run kept. @path references inline only text Clio can bound (#438), workers refresh a rejected OAuth token (#427), gateway memory targets no longer derive a relevance engine (#429), and the ACP registry's auth check passes (#418). The desktop app opens on a desk of every project's sessions, explains usage from the number itself and shows session timelines and run replay. The Pi SDK moves to 1.4.0, and Clio names itself to providers and on its own sign-in pages.

Upgrade notes

• Telemetry now lives only under <stateDir>/telemetry/: process/<processId>/, sessions/<sessionId>/ and runs/<runId>/ each hold journal.jsonl, rotated journal segments and their own objects/. Closing a scope writes its seal and bundle.json; resuming a session continues its chain and withdraws the bundle manifest until the next close. Session ledgers remain the conversation, and their embedded provider usage is no longer an accounting source.
• The first boot on an existing home runs a one-time cleanup that deletes trace.sqlite and its WAL and SHM files, usage/ (including out-of-turn.jsonl), receipts/, the old evidence directory and evidence-index.json, audit/, route-history.json, route-decisions/, memory step and observation-event logs, systemone/, startup/ and telemetry/research/. It also deletes old session call journals, objects, prompt manifests and context snapshots, old run event journals, and the usage field in each session's meta.json. Session conversations, memory state and run recordings remain. Copy any old telemetry you need before launching 0.6.6; the cleanup deletes it rather than importing it. Symlinks are left alone, and cleanup errors do not fail boot.
• There are no readers for retired telemetry formats, receipt versions, plain-line run journals or legacy ledger accounting. A session or run without a current journal reads as not measured. clio-coder telemetry import-legacy and telemetry rebuild are removed, and the session selector no longer shows spend from meta.json. Route history is a fold over run journals, with no route-history file or version migration.
• clio-coder trace is removed, including trace inspect, sql and prune. Read a session with clio-coder telemetry inspect <session-id>, a run with telemetry inspect --run <run-id>, and a live run with clio-coder fleet view <run-id> --follow. trace code-steps <rootId> [--json] moves to clio-coder fleet code-steps <rootId> [--json]. CLIO_CODER_TRACE_RETENTION_DAYS and CLIO_CODER_TRACE_MAX_BYTES are removed; CLIO_CODER_TRACE_BOOT still prints boot timing.
• clio-coder telemetry export and import-bundle are replaced by telemetry share and telemetry import <archive>. Select scopes with --session, --run, --repo, --since and --until, and choose --profile content-free|structural|research; --out names the archive and --dry-run previews it. The old --structural and --research export flags are gone. Sharing writes a local tar.gz and uploads nothing. Imported scopes live under telemetry/imported/<installId>/telemetry/; read them with --imported <installId> on telemetry read commands, separately from local totals.
• clio-coder telemetry verify <scope-dir|archive> [--json] verifies all covered journal segments, objects and seals. fleet verify, /view verify, evidence inspection and desktop run checks now verify the run scope. Receipt files, tombstones, the receipt integrity coverage map and telemetry prune --receipts are removed. clio-coder evidence build and evidence inventory are removed; evidence list and evidence inspect <runId> --json read the journaled assessment by run id.
• clio-coder fleet inspect is removed. Use fleet status --json [--all] for the run board and telemetry inspect --run <runId> --json for one run. Headless run --agent --json ends with a {"type":"result","result":...} frame carrying the run result instead of a receipt frame. Consumers of fleet, run and evidence output must use settled run facts and seal verdicts in place of saved receipt documents and paths.
• telemetry.mode (default standard, applies at the next turn) controls capture. Standard admits accountability and operational events with content-free or structural payloads. research adds the records selected by telemetry.research.content (default false), deltas (true), providerHeaders (true), systemOneDataset (true) and busTrace (false). Content also needs clio-coder telemetry consent for the workspace, stored in the state directory, and research capture has a 256 MiB cap per session. Project and local settings can lower capture but cannot raise it above user settings.
• systemOne.record is removed. System One dataset capture requires research mode, telemetry.research.systemOneDataset, content capture and workspace consent. CLIO_CODER_BUS_TRACE, CLIO_CODER_MEMORY_TRACE and CLIO_CODER_OBSERVATION_TRACE are removed with their file and stderr aliases. Memory, observation and bus research records use the telemetry journals and capture policy.
• chat.cacheKeepalive (default true, applies without a restart) controls hosted prompt cache refreshes. Each refresh is a paid request, journaled under the prewarm agent role (#423). safety.limits.sessionCostUsd now applies live, so raising it releases a request already parked at the ceiling (#424).
• clio-coder telemetry prune remains a dry run unless --apply. Its defaults are 90 days or 1 GiB for standard telemetry and 30 days or 4 GiB for research content, adjustable with --days, --max-gib, --research-days and --research-max-gib. Run pruning accounts for complete scopes, including objects and manifests. Live or locked scopes, fork parents a kept child reads and referenced runs are held. Nothing is pruned automatically.
• The exit card's tokens and cost cover the whole session on every branch, read from the read model, with this visit's call count beside the turns; in 0.6.5 they covered the current visit. Cost wording is shared across surfaces: $0.42, ~$0.42 est, $0.42 +? for partly unpriced spend, $0.00 local and not measured. Sub-cent amounts keep up to eight decimals, and partial token totals read as lower bounds. Claude Code and Claude Agent SDK cost reports are estimates because they use client-side price tables. Scripts parsing CLI, /export or ACP display text must account for the new wording.
• clio-coder usage report --json emits the read model's report DTO for the selected repository and time window. The earlier fact rows, including tokens, all-recorded-tokens, model-usage, session-cache, worker-tokens, worker-model-usage and worker-audience-usage, are gone. Token and cost fields across telemetry, fleet and GUI contracts use facts and quantities with coverage and server-rendered displays; missing measurements no longer imply zero.
• ACP _clio-coder/usage/read v1, its types and capability advertisement are removed. Clients use _clio-coder/telemetry/session, calls, cost, cache, timeline, run, runs, quota, health, why_stopped and explain, advertised under _meta["clio-coder/telemetry"] version 1 and requiring authentication. Quantities carry facts, displays and explanation references; _clio-coder/telemetry/update coalesces invalidations to at most 10 per second. usage_update and prompt usage carry read-model quantities, and first-token timing refers to the first main-agent response. Terminal fleet frames and replay read the sealed run DTO. Evidence assessment notices identify runId instead of evidenceId.
• ACP _clio-coder/context/ledger adds expectedColdReasons, backend prefill timings and uncachedPrefillTokens. A cost ceiling stop arrives under clio-coder/notice and clio-coder/budget metadata, advertised in initialize and replayed on session/load, with the setting and raise that clear it (#424).
• Desktop HTTP telemetry routes serve session and run DTOs, costs, calls, cache, timelines, stop reasons and explanations. GET /api/traces/status and run /phases, /gates, /processes, /events and /live routes are removed, along with their trace-table types and the trace list's source filter. Fleet and trace rows carry read-model telemetry, settled run facts and seal verdicts instead of copied trace totals or receipt files. GET /api/sessions/:id/usage now contains telemetry and telemetryQuota; LiveUsage and turn usage use quantities with server displays. Evidence views and notifications use run ids. Rebuild API clients against the new contracts.
• Desktop GET /api/sessions/overview and GET and POST /api/workspaces/:id/machines are new; removal of a machine uses that POST. Session telemetry gains autonomy and budget state, problems can carry replacement model selections, and telemetry.updated names topics to re-read. Mutations may send X-Clio-Epoch; a request from an earlier server epoch is refused as a conflict.
• System One no longer derives a relevance engine from context.memory when the memory target is a litellm or openrouter target, a gateway, or a cloud or subscription runtime, even at a private address. Declare one under systemOne.engines to keep it (#429).
• The Azure OpenAI Responses API family is removed. No built-in runtime used it, a worker spec declaring azure-openai-responses fails validation, and the engine registers no adapter for it.

Telemetry

• One event registry drives live delivery and journal capture with subject.past_participle names. Events cover calls, tools and final safety decisions, approvals, run admission and routing, gates and code steps, config and context changes, memory and observations, hooks and Library operations, worker middleware, lifecycle, boot, health and account quota. Each envelope carries the acting agent's role and instance, separate from the journal owner. A fork opens its own session scope and references its parent (#434).
• Every model call records its start and settlement, including main turns, workers, compaction, memory, System One, prewarm and keepalive, /btw, handoff, helpers and the safety judge. Settlement keeps disposition, stop reason, per-field facts, pricing source, admission and provider timings, first token, transport and cache evidence. Sessionless calls belong to the process journal. A call never sent counts no spend; interrupted streams keep reported lower bounds or explicit estimates, and a call settled before a crash still counts without a conversation-ledger message.
• A finished run persists run.settled, its result object, evidence.assessed and a terminal seal. The assessment keeps trust, findings, gate verdicts and failure attribution; later authenticated review-gate records are composed with the sealed assessment. Seals cover the journal and objects, and readers report verified, unsealed or failed integrity instead of accepting a second copy of the run's facts.
• The read model folds facts once for the footer, /usage, /context, /health, turn summaries, exit card, dispatch board, CLI reports, ACP and desktop app. Quantities retain measured subtotals when some calls are unknown, show measured zeros and expose the records and fold rule behind their explanations. /usage includes harness overhead and working-set recall cost; /loop and job cards read the turns their jobs ran (#422).
• telemetry inspect, calls, cost, cache, timeline, why-stopped and explain serve session or run data, with JSON DTOs and stable explanation references. Session spend covers its own branches and referenced worker runs; lineage is shown separately. Timelines include decisions, gates and memory activity. why-stopped names budget holds, their release and limited account windows. telemetry doctor reports capture, consent, journal health and seal state.
• /health reads process health samples, writer pressure, gaps, transport, quota, route breakers and System One breakers. Health and quota are journaled once per process. Shared-account quota consumption between readings is an estimate because other devices can spend from the same window; account credits, refresh failures and shared subscription identity remain visible. Lost journal records raise a bounded warning pointing at /health.
• Share profiles re-apply secret redaction and project records and structural objects through allowlists. Below research, free prose is withheld and private identities and paths are anonymized; the structural profile adds projected manifests, and research content requires the capture consent recorded for its scope. Each filtered scope is resealed over the archive's actual contents. Verification and import enforce the declared profile and scope integrity, and import refuses overwrites and symlink escapes.
• Research capture stores redacted prompt and request content in scope-local objects. Provider headers are allowlisted, delta capture keeps inter-delta timing histograms, and prefix and health samples record structural cache and timing detail. Accountability capture continues past the research cap, and gaps distinguish policy filtering from lost records. telemetry consent [--workspace <dir>] [--revoke | --list] manages content consent; revocation applies to subsequent capture and leaves already captured content on disk.
• /context uses the newest main call's cache evidence. Missing cache counts stay unknown, partial backend reuse is worded as partial, and llama.cpp timing-only cache reports use backend timings. The footer, thinking marker and transcript summary use journaled reasoning, with an estimate marker when needed. The board and fleet views use the run's first generated token and coverage-aware token and cost displays, and unknown context draws no zero meter.
• A Ctrl+D during a finished turn's persistence tail waits up to two seconds for settlement before exiting when no other work remains. A plan-close reminder held in a context of at least 128K tokens is delivered only on a continuation or a follow-up such as continue within five minutes in the same session (#431).

Prompt cache

• While a turn waits on its own tools, above all an attached dispatch, Clio replays the turn's last request at 90% of the route's cache lifetime when the refresh is expected to save at least $0.05, with a capped output. It runs on routes with a known cache lifetime, including Anthropic, OpenAI Responses and Codex, for up to two hours behind an attached dispatch and one hour behind any other tool. It stands down while a permission ask or ask_user waits on you, between turns, on a runtime change and when a refresh would reach the session cost ceiling. Anthropic requests with budget thinking are skipped (#423).
• A cache break the host cannot otherwise name is attributed to idle expiry once the gap since the previous call reached the route's lifetime, or to a transport reset after a full frame followed a delta or a transport recovery. A target or model change, a rewrite of the replayed instructions after compaction, a tool-choice change and a Codex socket reset are now recorded as expected cold reasons. On Codex a /thinking change is no longer a candidate break cause, because the effort change travels as a configuration update and keeps the prefix (#423).
• The footer warns of a pending prompt recompile only when the compiled system prompt actually changed, so the second turn of a new session no longer reads reuse uncertain, and the pre-send reuse estimate clears once the call it describes settles (#423).

Budget

• A session cost ceiling stop reaches ACP clients with the same notice the TUI prints, live while the prompt waits and again when the session is loaded. The desktop app shows it in a banner above the transcript with the spend against the ceiling, a Raise ceiling to $X button and a link to the setting, and clears it once model text, reasoning or a tool call arrives (#424).
• The raise a ceiling stop names is rounded up at four decimals, so typing it clears the stop, and the stop names its spend as estimated or partly unpriced when it was.
• Each /btw, /draft and /handoff attempt, a retry included, is admitted against the session cost ceiling inside its own call instead of once per round, and one whose session changed while it was held is refused (#424).
• fleet run's preflight and the fleet preview word the remaining session budget with the spend's provenance, as an estimate or as at most when part of the spend is unpriced.

Dispatch and fleet

• clio-coder fleet land lists the task branches finished runs kept, previews one with its commits, changes, destination and conflicts without changing anything, and with --yes lands it on the branch it was dispatched from, then removes its branch, worktree and claim unless --keep. --squash lands one commit and --plan <id> refuses a landing that drifted from its preview. A conflict is refused before the checkout changes, and the only step that touches the checkout is a fast-forward. Task branches record their base and source branch in Git config, and a withheld or rejected merge names clio-coder fleet land <branch> instead of git merge.
• When the orchestrator leaves a worker's stdout unread past its drain bound after a clean exit, the run now ends with exit 1 and its run result reports tool telemetry coverage partial, instead of a clean exit or a truncated frame blamed on the worker. That gap and a worker's own undrained stdout retry on the same route without charging its breaker (#425).
• A worker refreshes an OAuth token the server rejects and retries the round once, as main turns and side calls already did; a failed refresh names the target and the login command (#427).
• run --agent names @file attachments inside the workspace by their relative path, so they no longer fail admission with legacy_scope_path_absolute.
• clio-coder agents validate [--json] checks project and user agent recipes, project and user skills and the fleet profiles, rosters and bindings in .clio-coder/settings.local.yaml in one pass, prints each problem as one file: field: message line and exits 1 when any exist. doctor gains a harness row for each file with problems, and a write or edit that lands a recipe under .clio-coder/agents/ appends that recipe's issues.

Providers and models

• Pi 1.4.0 moves pi-ai, pi-agent-core and pi-tui together. Every request carries a clio-coder/<version> (<platform> <release>; <arch>) User-Agent and Clio Coder attribution, so OpenRouter, NVIDIA NIM and OpenCode no longer attribute it to pi, while Anthropic subscription OAuth keeps its Claude Code headers. A Codex body keeps its previous shape, so cached continuations survive the upgrade. On OpenAI-compatible runtimes a tool call whose arguments are not valid JSON fails with the parse error instead of an empty-arguments fault. Prompt templates keep a quoted empty argument's position, and ${ARGUMENTS:-default} falls back when there is no argument or a single empty one.
• Logins identify as clio-coder: OpenAI's authorize URL carries originator=clio-coder, the loopback page shows the Clio mark, Anthropic's browser sign-in runs in Clio, and the openai-codex runtime sends a clio-coder originator and User-Agent. A target's own auth.headers still win.
• The OpenAI Codex quota row reads Clio's own openai-codex login, without a refresh and in a relocated home too, instead of the Codex CLI's auth.json, which showed another program's account. A separate Codex CLI row reads that file under the interop rules.
• A compaction summary's output cap divides the summary room by one minus the reasoning share recently seen on that route, at most 0.9, up to the model's output limit, and a reasoning route with no observation yet gets the whole limit, so the summary is no longer cut off before the checkpoint is saved. The fixed 8,192-token ceiling is gone on every route.
• A successful catalog or embedding probe reads at most 16 MiB of its body and fails with response body exceeds the 16 MiB probe limit past it.
• Bare clio-coder auth status lists each configured target that keeps its own credential, such as a litellm key stored as target:litellm, under its runtime.
• A System One breaker probe that is cancelled, or whose preflight spends its deadline, returns the breaker to half-open instead of leaving it refusing calls as breaker-open until the probe deadline.

Attachments

• An @path reference reads only the first 4 KiB to classify a file. A zip, tar or gzip archive renders as read would list it, bounded at 32 KiB with the call that continues it; a binary file is named with its size and how to inspect it instead of refusing the submit; a text file over 256 KiB, a notebook included, is named and pointed at read with an offset and limit. Smaller text, non-UTF-8 text and notebooks still inline whole, and a PDF keeps its bounded extraction (#438).
• When poppler is missing, the PDF message names brew install poppler on macOS, scoop install poppler on Windows and poppler-utils elsewhere, and doctor gains a pdf attachments row that checks pdftotext and pdfinfo (#438).
• SIGINT while a headless run reads an @path inside its prompt stops the extraction, prints that nothing was sent and exits 130, as it already did for file arguments (#438).

Updates

• Homebrew and winget installs now show the update notice with brew upgrade clio-coder or winget upgrade --id IOWarp.ClioCoder --exact, and never install an update themselves. A source checkout at a release version is told when a newer release exists, and the notice points at clio-coder upgrade for the git steps (#436).

Tools and safety

• Bash output masks the exact values of credentials in the environment a command inherits and of keys Clio resolved, as [redacted:known], in progress cards, model context, offloads and the operator shell record. Values shorter than 8 characters are not masked, and neither are run_script output and live !cmd progress.

ACP

• Clio offers its clio-login terminal method to clients that announce terminal auth through clientCapabilities._meta["terminal-auth"] as well as clientCapabilities.auth.terminal, so the ACP registry's auth check passes, and the registry icon is the Clio mark (#418).

Desktop app

• A figure the read model words opens its explanation from the number itself: the value, its coverage, the fold rule, and the calls, attempts, runs and records it came from. Trace run totals, a call's tokens and cost in the waterfall and the replay, the session overview's spend, the usage pane's totals and model rows, the usage page's window figures and the timeline's details carry it, and Escape or a press outside closes it (#434).
• A task's Timeline view, under Resources, lists every call, turn, tool, setting, budget and quota record its journal holds, newest first, in the server's words, with an entry-kind filter, stage bars on calls and each call's cache break billed from the session's cache report (#434).
• Trace history lists run journals newest first with the task, agent, route and status, and a run without a journal reads not journaled. A trace run page replays its journal's calls, run feed, worker process and settlement with play, pause, speed, entry search, an entry-kind filter and Home and End keys, draws each call attempt's recorded stages, and follows a live run by re-reading its journal every 2 seconds; it runs no commands (#434).
• A trace run page's Tokens and spend panel shows the run's input, output, cache, reasoning and total tokens, cost and model calls from its journal, then the same spend by the model each call settled on. Fleet and trace run rows read tokens, cost and model calls from the run journal too (#434).
• A run's checks come from the read model's seal-checked assessment and settled facts. Loading the full run record refreshes the integrity verdict beside it, so a changed or missing object cannot leave an earlier verified label on the panel (#434).
• The usage page ranks models by calls, tokens or cost with a per-model accounting panel that splits each model's spend into the sessions' own calls and the worker runs, shows each model's call share, and adds an Observed prefill work table per session. The conversation memory panel shows prompt cache evidence (#434).
• Every spend figure, quota share and context legend is the server's own wording, usage views refresh when the agent reports new telemetry, and a missing count reads not recorded instead of 0. Evidence lists and pages show tokens, as a lower bound when calls or runs are unmeasured, and cost (#434).
• A window whose bundle was built for another Clio Coder version than the server's says so and offers Reload this window; it never reloads on its own. A bundle built before 0.6.6 carries no version and gets no notice.
• The Sessions page is a desk across every project, with counts for Needs you, Working, Ready to continue and active workers, search, a project filter and a Show more button. It replaces the Workspaces page at the same address.
• A Machines page registers an SSH machine with its host, user, port, worker capacity and labels, removes one after confirmation, and checks its readiness for the project picked on the page only when you ask; opening the page contacts no host. A project's task list gains sorting, the filters All work, Open sessions, Needs you and Saved history, and a link to the project's machines.
• The start page turns its starter prompts into cards, shows the project folder, connection and approvals before you start, and keeps the first task you typed in that browser tab through a workspace or connection failure, with Retry original request. The sidebar's New task opens the start page even with no workspace open, its search icon becomes a labelled Search action that opens the command palette, and a new Explore dialog groups every page with keyword search; the Library link moved into it.
• The composer's Actions dialog lists slash commands as plain-language cards whose forms keep their values and leave the message draft alone. An attachment can be previewed before sending, a note under the composer says what will happen to the message, and a picked PDF is refused with a pointer to type @ and its path instead of "not UTF-8 text" (#438).
• Task details lead with changes, files and tasks, with model, context, usage and branches under More details. Stop turn and Close session work the same from the conversation, the desk and the menu, Close asks for confirmation, and a status notice follows the outcome across pages.
• A long conversation opens on its latest 24 turns with a button for earlier ones and returns to your reading position within the same window. Find in conversation searches requests and replies, long requests fold behind Read full request, branch history gains search and a filter, and a failed handoff keeps its edited draft.
• Settings tabs are renamed Model settings, Effective values and Sources & timing, Sources & timing gains search, and a setting saved elsewhere while you edit shows its saved value beside your draft. Connections group credentials and removal under one disclosure, and routing becomes tabs with Cached models. Toolchain, Skills and Other coding agents gain filters, Evidence gains search and a verdict filter, Evidence, Fleet and Traces gain sorting, and Help is organized into guides.
• A repeated identical background error shows once with its count, the autonomy indicator follows mode changes made through runtime commands, and a parked session that wakes keeps its own model and thinking choices instead of the app's cached ones. A refused turn names its reason, the model picker offers the replacements a refusing connection reports and points at Manage saved connections when the agent reports no connection selector, and model and thinking controls stay available without a configured target.
• A command sent before a server restart is refused instead of applied, the usage panel no longer shows figures from a previous runtime or branch, opening a detail while a reply streams keeps its place, and a failed saved-history read gives its reason and Try again instead of "No tasks yet". The task details body scrolls from the keyboard, and focus now lands on the branch history heading after Continue.

Dependencies

• With Pi 1.4.0, marked-cjk-friendly 0.1.2 is bundled for pi-tui's CJK-aware Markdown emphasis, and its MIT notice ships in the package and NOTICE.