v0.71.0

New features

• Diagnose setup problems with roborev doctor. It checks configuration, agent availability, hooks, recent failures, and the current repository, then suggests fixes without changing your setup. It also detects invalid .roborev.toml on the default branch. Use --json for structured output.
• Route daemon jobs to cheaper agents as recorded daily spending rises. Enable [budget] in global configuration and set a daily limit and estimated agent costs. Routing is off by default. The limit is soft, so reviews keep running after spending reaches it.
• Protect daemon access with an optional shared auth_key. Generate it with openssl rand -hex 32, add it to global configuration, and restart the daemon. CLI commands, hooks, and the terminal UI send the key automatically. Browser access requires login unless a separate browser token is configured. TCP connections still use plaintext HTTP.
• Remove linked worktrees while committed reviews are running by enabling isolate_reviews = true globally or per repository. Reviews run in temporary daemon-owned checkouts and see only committed files. Queued jobs and retries still require the registered repository path.
• Control the reasoning used to combine multiple agents' reviews with synthesis_reasoning in review panel configuration. This setting works independently of roborev fix, including for named panels used in CI.

Improvements

• Navigate the terminal UI with Ctrl-P and Ctrl-N for up and down, u and d for a visible page, and g or gg and G for top and bottom. Release notes move to U. In logs, g pauses following and G resumes it.
• Reduce duplicate embedding requests across synced machines. Daemons reuse review embeddings, the numeric representations used for semantic search, when both [search.embeddings] and [sync] are configured. No new setting is required.
• Select a caller-managed daemon with --server. Commands start the local daemon when needed, but an unavailable explicit server returns an error without changing the local daemon. For roborev log, replace --db with --server.
• Anonymous telemetry records web, terminal UI, and direct CLI use, plus install age when available. Usage reporting respects existing opt-out settings and counts each interface at most once per UTC day. Hooks, MCP commands, and bundled skill commands do not report opens.

Bug fixes

• Codex structured reviews accept valid final JSON answers even when Codex writes a note beforehand. These reviews no longer trigger unnecessary retries or fallback to a backup agent.
• Native Windows Codex reviews select the elevated sandbox when ignore_review_user_config = true, avoiding shell commands rejected as "blocked by policy". Explicit Windows sandbox settings take precedence, and command execution still requires confirmation.
• Windows paths through NTFS directory junctions work for agent file access and snapshot validation. Agent writes through junctions that lead outside the repository are rejected, as are junctions used as snapshot_dir inside the repository.
• Semantic search works with embedding servers that reject zero dimensions when none are configured. Configuration errors leave reviews pending for indexing instead of skipping them, while inputs rejected for length or content policy are skipped.
• CI review health stays unhealthy until a failed review produces usable output and posts it. Failures survive restarts. Queueing another attempt no longer reports recovery, and skip labels clear failures only after publishing the skipped status.
• CI health no longer stays unhealthy indefinitely when a review target is an ordinary GitHub issue. Cleanup removes stale review records only after confirming that the target is not a pull request.
• Reviews from linked worktrees show the repository name instead of the checkout folder name. Existing names that match checkout folders are corrected, including for removed checkouts; other custom names remain intact.