0.12.29 — The guided tour

Game data is unchanged from 0.12.26 (Homecoming 2026.1.1242, last client re-export 2026-07-07) and the optimizer's model stays at v36, so every certified champion carries the same score. This release is the guided tour, a security hardening, and a better user guide.

A guided tour of the whole app. New here, or never sure what a button does? A compass button in the header opens a chooser: pick one section or take the complete tour (56 steps across 7 sections). The tour walks a drawn example screen, a Brute damage build with every panel filled in, laid out exactly like the real app, so any part of it works at any time and nothing about your own work is ever touched. Every card highlights the control it explains in tour green, clicks that open something (the enhancement picker, the power details, the targets editor, the What-changed window, the Journey, the bug report) actually open it on the example screen, and small controls get annotated drawings. You advance with Next, the arrow keys, or the space bar; stray clicks do nothing; every card offers "Save my spot & exit" and the compass offers to resume right there. Every power card also carries its own ? that jumps straight to the card explained. A fresh install offers the tour once; after that it waits behind the compass and the ? beside each section.

Security: another website can no longer make the app do things. 0.12.28 stopped other sites reading from the app. This closes the other half: a page in another tab could still send the app an instruction your browser would faithfully deliver, such as telling it to close, even though that page never saw a reply. The app now refuses anything that changes something unless the request came from its own page. Nothing about normal use changes, and the tools and Companion Lite that talk to it are unaffected.

The user guide grew. The Hero/Villain section now explains that switching sides also switches which accolades are assumed and recalculates your totals (it was described as pure style, which was wrong), and new "Locking a power" and "Reading the Numbers" sections cover the padlock and how to read the bars.

Both downloads are code-signed (CN=Joel Andrew Chambers). The tour engine is driver.js 1.8.0 (MIT), vendored and credited in CREDITS.md.

0.12.28 - The security release

Five security fixes and one field-reported bug. Nothing about how you use the app changes, and nothing here alters build results: game data is unchanged from 0.12.26 (Homecoming 2026.1.1242) and the optimizer's model stays at v36, so every certified champion carries the same score.

Automated code scanning now runs on this project continuously. The security fixes below came out of its first pass. None of them were being exploited — they were found by looking, not by anyone getting hurt.

Security

Other websites can no longer read your local Hero Companion data. The app runs a small server on your own machine, and it was telling browsers that any website was allowed to talk to it and read the answer. While Hero Companion was open, a page in another tab could have asked it for your game install paths, your account folder names, your saved characters, and your Play Log, or simply told the app to close. It never needed that permission, since the app's page and its data come from the same place. Removed.

Names from outside your machine can no longer inject anything into the app. Text the app did not write itself was not being fully escaped before being put on screen. That includes an imported build's name, an in-game export, and, most importantly, other players' character names picked up by the Play Log, which you do not control. A name containing a double quote could break out and attach itself to the interface. Now escaped properly, everywhere, in one place. Names still display exactly as written, quotes and all.

A search you type can no longer run as code. The "nothing matches" message in the enhancement picker put your search text straight into the page.

The in-game build reader can no longer be walked out of your game folder. It already refused paths outside your accounts folder, but the check compared the path as written rather than where it actually leads, so a shortcut-style link placed inside that folder could point anywhere on your drive and still pass. It now resolves links before deciding.

The app no longer hands internal error details to the page. When something failed, the raw error, including folder paths from your machine, went back to whatever asked. You now get a plain explanation of what went wrong and what to do, and the technical detail stays on your machine.

Fix

Backing out of the "new level 50" wizard takes you back to the start screen. Picking an entry card and then changing your mind used to close the wizard onto an empty builder with no character in it, which looks like the app broke. It now returns you to "How do you want to start?". If you already had a character open, closing still returns you to it.

Verification

Release smoke PASS and gold standard 24 of 24 served, both run against the signed frozen build, with the security fixes confirmed present in the packaged client rather than assumed. Both downloads are code signed as CN=Joel Andrew Chambers.

0.12.27 - Targets you set, and honest advice when they fall short

Both fixes in this release came from reports in the forum thread, and both were the tool being wrong rather than anyone using it wrong.

When a goal is out of reach, you now get told what would close it

Ask for a defense or resistance number the build cannot reach and the tool used to tell you the number it reached and then stop. Now it names the actual unpicked powers on your character that supply that stat and roughly what each would add, for example "adding Stealth (about 7 percent base, more once slotted) and re-solving would close part of the gap". When nothing is left that supplies it, it says so plainly instead of going quiet.

That advice already existed, but it only ever appeared if you had opened the "Customize build targets" editor first. State the same goal through the wizard and you got a bare refusal with no suggestions. Two more faults were behind it: the Concealment pool was looked up under a name the game does not use, so Stealth could never be suggested, and a character with no unpicked candidates returned nothing at all rather than the honest "this ask may be unreachable on this pairing".

It suggests, you decide. It will not pick powers for you.

One deliberate limit: this only fires for goals you set. The defense and resistance numbers behind a Content and Role choice are internal aiming points for the optimizer, not promises, so the tool will not offer to close a gap you never asked about.

"Reset to imported build" no longer throws away your targets silently

That button restores the build exactly as it came in, which also clears custom build targets and your front/back line and travel answers. It did that without a word, so solving afterwards quietly went back to the preset targets for your Content and Role, which reads as the tool overriding you.

Reset still resets. It now tells you what it is about to clear and lets you back out, and if you go ahead it says what was cleared and where to set it again. If you had nothing set, it does not prompt.

Under the hood

The first bug survived a full release because the code caught its own error and discarded it silently. Twenty three more places were doing the same thing. They all still recover exactly as before, they just say what happened now.

Data currency

Game data unchanged from 0.12.26 (Homecoming 2026.1.1242) and the optimizer's model stays at v36, so every certified champion carries the same score it did last release.

Verification

Release smoke PASS and gold standard 24 of 24 served, both run against the signed frozen build. Both downloads are code signed as CN=Joel Andrew Chambers.

Hero Companion 0.12.26 — Full power icons and in-app bug reports

Mostly a fix-and-polish release, with two things worth calling out.

New

• Report a bug without a GitHub account. The bug button opens a short in-app form that sends straight to the developer, with your version, model, game data and character attached automatically (and an option to include your full build). No account, no email app needed.
• Power icons filled in. Over a thousand more powers now show their real in-game icon (Bio Armor, Psionic Armor, Staff Fighting, Dual Pistols, Marine Affinity, Seismic Blast, Storm Blast and many more), read straight from the game client.

Also

• Removed the old "Power colors (.powerCust)" export, a leftover from a shelved idea.
• Credits now name the game client as the data source, with Mids Reborn credited as the foundation the tool was built on.

Fixes

• The Leveling Journey no longer covers a brand-new level-50 build, its header reads cleanly on any width, and it shows the character you are actually on.
• The Play Log no longer lists the same account twice.
• Incarnate powers show their real icon on the tray.
• Clearer "load another character" button.

Both downloads are code-signed (CN=Joel Andrew Chambers). Free and noncommercial, forever.

v0.12.25 — The Journey grows up

The Leveling Journey went from a road with placeholder labels to a full 1-50 field guide.

• Every zone shows its game picture — the comic-panel splash plate with the zone name on it (38 zones, from the game client).
• Where every badge is, in plain English — location + a written direction ("on top of the casino, 120 yards due east of Meteor Do") + coordinates, 350+ badges, with a VidiotMaps pointer. Badge data via n15g's public-domain content database.
• When each Task Force / Strike Force / trial opens — "available at N" on all 50.
• Master & iTrial challenge badges — each run's Master badge and the exact sub-badges it needs.
• A readiness check per neighborhood — read against your level with the game's own con system: "go now" or "come back at 27".
• Every zone that fits your level, computed from the full 47-zone table, not just the route.
• Where to level, level by level — zones and story arcs in order, from Gulbasaur's Good/Mean Missions guides, with XP-pause tips.
• See any side — Hero / Vigilante / Rogue / Villain / Flashback preview that never touches your build.
• Bigger, clearer, and the current level glows gold.

Both assets code-signed (CN=Joel Andrew Chambers). Free and noncommercial, forever.

Thanks to Gulbasaur (missions guides) and n15g (coh-content-db).

Hero Companion 0.12.24

Hero Companion 0.12.24

• The Leveling Journey. Your whole 1–50 as a road you scroll like a map — every level a stop with its power pick, new enhancement slots, and milestones; click a card for what that level buys you. Security-level badges sit at 10/20/30/40/50 with the game's own descriptions, and a "Zones & badges" drawer holds the full exploration-badge catalog straight from the game's files, find-hints included. The 🗺️ Journey button in the header is its on/off switch (✕ and Esc work too). Zone display names, level ranges, and task force suggestions are labeled as coming (they need server-side game data, in progress) — nothing on the road is a guess.
• A 1–50 character's Journey starts ON. Build or resume a leveling character and the road opens itself the first time, introducing what it's for, how to toggle it, and how to turn on the game's chat log — with the full 2-minute setup steps right there. Then it's your call: close it once (or press "Got it") and it never opens itself again.
• The wizard never asks a question twice. The archetype recommender now owns no questions of its own — it reads your Role / Mostly-in / You-fight-from answers and lives right below them. Asking it with Role unanswered flags the question instead of quietly assuming damage.
• Farm advice works for the real farm choices again. Eight pieces of server-side farm guidance were still listening for the retired "Fire Farm" key; all of them now recognize the AFK and Active farm choices (and the old name, for older saved characters).
• Your archetype's hidden mechanics are now in the math AND on the screen (model v36). Fury, Domination, Defiance, Vigilance, Scourge, Containment and the other built-in meters are credited with stated steady-state assumptions, and the new Inherent Mechanics panel shows every credited meter with its assumption written next to it. Champions re-certified under the new math.
• Live game-log connections are now a named list, not a bare number. Each connection shows its file path and last-activity time; stale logs expire out on a stated timeout.
• Optional: start Hero Companion automatically when you sign in to Windows. Asked once on first run of the installed app — never turned on silently — changeable any time from the tray menu, quiet at login (no browser tab until you click), removed completely on uninstall.

Both artifacts are code-signed (publisher: Joel Andrew Chambers).

Data currency: game data current to the client re-export of 2026-07-15 (Homecoming live); no game patch has shipped since.

Hero Companion 0.12.23

Signed release: both files carry a Microsoft-verified signature (publisher "Joel Andrew Chambers").

Endurance is now real physics (model v35)

The old scoring gave an endurance-broken build 45 to 72 percent credit no matter how fast the blue bar emptied. Now the model plays the fight out: full output until the bar drains, then only what recovery can pay for, measured against each fight's actual length. Sustainable builds are never penalized. Scores and warnings use your BARE recovery, with any incarnate assumption stated in plain text instead of assumed silently. Endurance procs (Performance Shifter, Panacea) are credited at their measured average from real game logs, 40 previously-dropped +Max Endurance set bonuses now count, travel toggle drain is always shown, and Cardiac gets recommended when your ledger actually needs it.

Every champion re-verified under the corrected math

All 24 certified reference builds were re-converged and gated: 13 were genuinely beaten by better builds under the new model (including every Peacebringer and Warshade form) and were replaced; 11 defended their seats. Each verdict came from a fresh, canonical comparison with the run's search health checked, so no result rides on a broken run.

The Build Assistant knows whether you are creating or retooling

With an imported or resumed build on screen the panel reads "Improve this build", shows the build's existing identity instead of re-asking setup questions, and every button names its consequence.

Your IO sets: visible padlocks instead of a vague checkbox

"Preserve my IO sets" now shows a padlock on every power you hand-slotted. A locked power's slotting is never altered by any solve, byte for byte (tested every release). Unlock individual powers to let a re-solve improve them. The checkbox and the padlocks can never disagree.

Custom targets shape the power picks, not just the slotting

Ask an Invulnerability Tanker for 45 percent defense and the proposal now includes Tough Hide, with an honest note about what it gave up to serve your ask. Anything not fully reachable is reported with numbers and a concrete suggestion, never silently traded. Your typed-in targets also outrank every internal heuristic in the optimizer: declared asks are promises.

Smaller honesty fixes

One targets control instead of two look-alike buttons, with your asks summarized on it. Hand edits to individual IOs update totals instantly, with a visible pulse. The targets editor states what clearing a field means: you drop the demand, not the stat.

Full details in CHANGELOG.md. Verify your download: both files are digitally signed; right-click, Properties, Digital Signatures should show "Joel Andrew Chambers".

Hero Companion 0.12.22

Hero Companion 0.12.22

• This is the first digitally signed Hero Companion release. The installer
  and app now carry a Microsoft-verified signature ("Joel Andrew Chambers"), so
  Windows shows a named publisher instead of an "unknown publisher" warning.
  Every release from here on ships signed. (SmartScreen's "not commonly
  downloaded" prompt is reputation-based and fades as downloads accrue — that
  part takes time, not more paperwork.)
• The engine now values a Mastermind's pet buffs (model v34). A Mastermind's
  main damage is its pets, and the buffs it casts on them — Supremacy (+25%),
  Accelerate Metabolism-class ally buffs, Temporal Selection (single-target, on
  your biggest pet), Beast Mastery's Pack Mentality (assuming 8 of 10 stacks
  with pets engaged, stated on the build) — now raise pet damage in every score
  and label. Caster-only buffs (like the Musculature Alpha) correctly do not.
  A new "Pet damage buffs" section on the offense panel shows exactly which
  buffs applied, at what strength and uptime. Stated simplification: pets are
  modeled as always hitting; pet accuracy is a named next step. Two champions
  genuinely improved under the corrected math and were re-certified (the
  Radiation/Sonic and Radiation/Radiation Defenders); every other certified
  build re-verified with its score updated. Making the search fully exploit
  the new term is the named next engineering item.
• Every power, powerset, and epic pool now uses the game's current names.
  The client's own files are the authority — 74 power names and 4 pool names
  that had drifted (the old "Field Mastery" is the game's "Energy Mastery",
  "Breath of Fire" is "Fiery Breath", and so on) now match what you see in
  game. A standing check keeps them matched. The suspected "phantom epic pool"
  turned out to be a real Mastermind ancillary wearing its stale name — every
  epic offered to every archetype was verified against the game's own
  eligibility rules (zero leaks; a standing check now pins that too).
• No more silent dead pages. If the app's local server isn't running (or a
  page action fails), the page now says so plainly with a Reload button instead
  of buttons that silently do nothing — the field report that found this also
  added an interaction test to every release so it can't ship again. Uncaught
  page errors surface the same visible banner, and older saved characters that
  a newer version can't fully read load safely with an honest note instead of
  deadening the page.
• Imported builds with empty slots say so. An import now flags "in
  progress" powers ("4 empty slots: Dark Consumption") so an unfinished
  character never reads as a finished plan.
• Honest slotting labels. "Full set" now means the set is actually
  complete. A partial set mixed with procs reads "Frankenslot"; a clean
  partial set (plus universal globals like Luck of the Gambler) reads
  "Partial set". The globals list also learned knockback protection (Karma,
  Blessing of the Zephyr), slow resistance (Winter's Gift), and the Theft of
  Essence +endurance proc.
• The content picker's farm section is now two honest choices — AFK Fire
  Farm (passive) and Active Fire Farm. The old generic "Fire Farm" is retired;
  saved builds that used it get a prompt to pick the one that matches how they
  play (never silently remapped).
• Four more dead-air fixes from release-night testing. The build button now
  names the exact field you're missing and highlights it in red instead of
  repeating gray text; the Solve button does the same when Content isn't picked,
  and honestly says "no changes" when your slotting already meets the goal. The
  biggest one: Solve's "are you sure about this role?" question was being asked
  in a hidden panel on every installed copy — Solve would silently wait forever
  for an answer you couldn't see. It now asks where you can see it. And the
  import file dialog no longer strands you on an empty page if you cancel it.
  A set's own proc piece now counts toward its "Full set" label (a 6-piece
  Javelin Volley is a full set, not a mix).
• Data currency: game-client data re-exported 2026-07-15; current through the
  game's July 7 patch.

Hero Companion 0.12.21

Hero Companion 0.12.21 — the accolade release, and every power card explains itself.

Accolades, done the way the game does them. Below your powers and IO sets is the full accolade list with a search box. Checking one moves your real numbers; a press-and-hold preview shows what all of them together would do without committing anything. Each row's ⓘ shows the game's own description, and most explain how to earn it. New level-50 builds assume the standard accolades and say so on the build — untick any you don't have and the totals follow. And it follows the game's own alignment rule: every accolade is hero-side, villain-side, or neither (read straight from the game data), and your character is one alignment — so the other side's accolades are greyed out as unavailable, exactly as in game. Switch sides with the alignment button and the panel flips. Accolades that aren't side-locked stack normally.

Every power card now says what's in its numbers. Open a power's ⓘ and, where a global buff actually reaches that power's damage (an Alpha like Musculature, a Hybrid, or both), a named line states the amount folded in — and where the game's damage cap holds it below the raw buff, the card shows the effective value, not the raw one. Build-wide bonuses like accolades that don't change a single power's numbers are pointed to Build Vitals instead of faked onto the card. Untick the incarnate preview and the line and the numbers drop together.

The numbers say what's assumed. A line above Build Vitals states exactly which assumptions are folded in, with named contribution lines beneath the stats they touch. Incarnate choices our math doesn't price yet are marked "not yet modeled." While you're leveling a character, the tool now warns when you preview endgame content you haven't earned — incarnates unlock at level 50, Epic pools at level 35 (Patron pools also need their arc) — without blocking the preview.

The AFK fire-farm champion's label was corrected upward. The June 23 patch made Temperature Protection's +MaxHP and +Regeneration enhanceable and our data predated it; re-synced, the same shipped Spines/Fiery Aura build certifies at +4x8, sustaining 42.5 HP/s. Thanks to Maelwys. A new structural check now diffs effect existence against the client so this class of staleness can't hide again, and certificates now state exactly what they prove.

Values are read from the game client. If something looks wrong, say so — this thread has made the tool better release after release.

Companion Lite 0.1.18

Companion Lite 0.1.18 — a real, signed Windows installer.

A proper installer. Companion Lite now installs like a normal Windows app —
a Start Menu entry, a clean uninstall, no admin prompt — instead of a loose exe.
Under the hood it moved from a single packed file to a folder layout, which
starts faster and stops tripping antivirus "packer" heuristics.

Signed with a verified publisher. The installer and the app are code-signed,
so Windows shows Joel Andrew Chambers as the publisher instead of an
"unknown publisher" warning.

A note on first download: Windows SmartScreen may still say the file "isn't
commonly downloaded." That is reputation-based, not a signing problem — a brand
new file has no download history yet, and it clears on its own as more people
install the signed app. The signature is what makes that reputation stick to us
rather than resetting every build.

Auto-start is your choice. On first run it asks, once, whether to start with
Windows — never silently on — and you can change it any time from the tray menu.
Uninstalling removes it cleanly.

Values and capture behavior are unchanged from 0.1.17.