Claude++ 0.3.3

Claude++ 0.3.3

Claude++ 0.3.3 restores LocalSessions file-reference and workspace lookup when a Claude Desktop update changes its
IPC channel identifier. The Runtime discovers the three channels from the installed host preload at startup instead
of using a fixed identifier, and reports a diagnostic if they cannot be identified unambiguously.

Pair this release with Unity Links Claude 0.1.4 to open file references rendered by current Claude versions,
including line and column locations and line ranges. Transcript recovery keeps the original file URL when two
same-name references with line ranges point to different paths. Claude++ continues to resolve the channels in Main
and expose only the existing permission-gated session API to Tweaks; Renderer sandbox boundaries and startup behavior
remain unchanged.

The Windows package is claude-plusplus-0.3.3-win-x64.zip. Download it from the
kpkhxlgy0/claude-plusplus releases page, extract it, and
run install.ps1. Run bin\claudeplusplus.cmd doctor after installation to verify the managed app.

Claude++ 0.3.2

Claude++ 0.3.2

Claude++ 0.3.2 fixes Config's Download Update action for installations built from source and makes updater startup
observable and retryable. Portable Windows installations continue to use the Node.js runtime shipped in the release;
source installations use only the exact Node.js executable recorded by their installer.

Highlights

• Source installs can start Stable and Prerelease updates without a bundled toolchain\node.exe when their recorded
  Node.js executable still exists and reports version 24 or newer.
• Download Update immediately changes to Starting Update…, blocks duplicate clicks, then reports checking,
  download, verification, extraction, Custom build, installation, and terminal state while the page remains open.
• Downloads expose the actual streamed byte count. When the response supplies a valid total size, Settings displays a
  progress bar and percentage; otherwise it displays bytes received without inventing a percentage.
• Updater state records the detached process ID, rejects asynchronous process-creation failures, and turns abandoned
  checking state into a retryable failure instead of leaving Settings locked indefinitely.

Runtime selection and recovery

The packaged Windows release remains bundled-runtime first and does not search the system PATH. A source install
records the absolute Node.js executable used by install.ps1, including during same-version maintenance. Runtime uses
that path only when no bundled Node.js exists, the file is still present, and node --version reports Node.js 24 or
newer. Stable and Prerelease updates then download and verify the official portable package and do not require npm;
the Custom source channel still requires both Node.js 24+ and npm.

Source installations created before this fix do not yet contain the recorded runtime path. After updating the source
checkout, run install.ps1 once to backfill it. If Node.js was moved, replaced, or removed, run the installer again
with the intended Node.js 24+ executable before retrying from Settings.

The child updater writes its own PID throughout every active progress update. Only that live process, or the short
process-launch grace period before its PID is recorded, keeps the action in progress. A six-hour hard limit also
prevents stale state from remaining active indefinitely. Config refreshes an active update every 500 ms while its page
remains mounted, stops polling when the page is disposed or a terminal state arrives, and automatically restores the
download action with Up to date, Updated, or failure details.

The downloader reads Content-Length only when it is a valid positive integer and counts the bytes actually streamed
to disk. State writes are throttled during large downloads and forced at completion. Unknown, zero, or malformed total
sizes never produce a percentage. A failed launch writes terminal failure state before the Config invocation rejects,
so both the current page and a later reopen can explain what happened.

Safety boundaries

• Official packages still use the release archive's SHA-256 checksum before replacing the installed source root.
• Source fallback accepts only the installer-recorded absolute executable path and verifies its major version; it does
  not execute an arbitrary node.exe found on PATH.
• Automatic metadata checks remain advisory. They do not start an update; Download Update is a separate explicit
  action.
• Claude++ continues to modify only its managed Claude mirror. The official Claude executable and app.asar remain
  unchanged.

Install or update

The Windows release package is named claude-plusplus-0.3.2-win-x64.zip. After the GitHub Release is published,
download it from the
kpkhxlgy0/claude-plusplus releases page, extract it, and
run:

.\install.ps1

For a source checkout, update the checkout with Git, ensure Node.js 24+ and npm are available, and run:

pwsh -File .\install.ps1

After installation, verify the managed app with:

bin\claudeplusplus.cmd doctor

Claude++ 0.3.1

Claude++ 0.3.1

Claude++ 0.3.1 adds visible, review-only update indicators for Claude++ and installed Tweaks while preserving the
existing explicit-install boundary. Advisory metadata checks remain best-effort, validity-aware, and isolated from
release downloads, executable changes, and automatic installation.

Highlights

• When a newer Claude++ release is available, Settings shows an Update review action beside the CLAUDE++ heading.
  The action opens the
  current GitHub release, or the official
  kpkhxlgy0/claude-plusplus releases page when release
  metadata has no URL.
• The reviewed Tweak Store now warms before its page is opened and shows a numeric badge for installed versions that
  differ from their approved Store manifest versions.
• Every installed Tweak whose entry exists is checked, including disabled and runtime-incompatible rows. A
  missing-entry diagnostic row starts no request and receives cached data only when repository and installed version
  match.

Product and Store triggers are intentionally separate. Product metadata begins on a visually eligible CLAUDE++
navigation-group mount or remount; a hidden mount defers it until that mount first becomes visually visible. Store
metadata begins on a visual false-to-true Settings transition. With an initially visible shell, navigation is attached
first and both requests begin before injector setup returns; navigation waits for neither.

Stable and Prerelease product checks use the official kpkhxlgy0/claude-plusplus repository and Claude++'s existing
release-list selection. Custom uses its saved repository. These notes record exactly five approved differences from
the inspected Codex++ v1.0.0 behavior:

1. Advisory persistence is validity-aware and best-effort. Automatic product/Tweak checks preserve present malformed,
   non-object, or unreadable config instead of Codex++'s invalid-state fallback that can replace it, and a cache-write
   failure does not block Renderer Tweaks; valid state continues to use atomic replacement.
2. Where Codex++ can duplicate simultaneous requests, overlapping checks for the same absolute config path, manifest
   id, repository, and installed version share one process-local in-flight promise, which is removed after settlement.
3. Stable and Prerelease remain on the official Claude++ repository and both retain the release-list endpoint and
   local selection rules; only Custom uses its saved repository. Codex++ instead uses the saved repository for every
   channel and /releases/latest for Stable.
4. Instead of persisting a request-start snapshot as Codex++ can, each advisory completion re-reads and merges the
   latest valid config at commit time, preserving distinct product/Tweak slots and intervening valid in-process
   changes. Same-id, different-identity Tweak checks still target one slot and retain last-completion behavior; the
   merge guarantee is process-local.
5. Config's explicit Check Now uses the same validity-aware writer as automatic checks, rather than the ordinary
   explicit-config mutation contract, and publishes through the same controller-owned product state.

No other Codex++ behavior difference is introduced by this indicator work.

Timing and cache behavior

Installed-Tweak checks start after installed discovery and before the catalog response. Entry-present checks run in
parallel but are awaited, so an expired or unavailable persistent cache can delay initial Renderer Tweak startup or
Renderer hot reconstruction by the slowest GitHub request, bounded at roughly 8 seconds. During hot reconstruction,
the previous Renderer lifecycle and Settings registrations have already been cleared. A completed current-batch result
still reaches the current catalog response when persistence is refused or fails.

A Tweak's persistent result is reused only when manifest id slot, repository, and installed version match and the
result is younger than 24 hours. Its in-flight identity additionally includes the absolute config path. Single-flight
sharing lasts only for overlapping calls in one Runtime process; the promise is removed after settlement. Invalid,
unreadable, or unwritable config can therefore cause a later sequential call or another process to request metadata
again.

Parallel completions merge at commit time for distinct product and Tweak slots. Same-id, different-identity Tweak
checks and overlapping automatic/forced product checks retain completion-order, one-slot last-completion behavior;
there is no latest-request-wins arbitration. Automatic Store warm and forced Refresh can also overlap and retain the
Renderer cache's last-completion behavior.

The Store cache has no 24-hour TTL. It survives closing and reopening Settings in the same Renderer and is invalidated
only by manual Refresh, successful Store installation, or Renderer restart. A successful installation clears the
cache before the existing delayed forced refresh.

Safety boundaries

Automatic checks download JSON metadata only. They never download a release archive or executable, install a product
or Tweak update, enable Watcher, or change automatic-refresh or other Settings state. Indicators are review links;
installation remains a separate explicit action. Watcher and automatic refresh remain off by default.

Present malformed JSON, non-object JSON, and unreadable config are not replaced merely to cache advisory metadata.
Unwritable valid config contains the write failure, and the completed result remains available to the current caller.
This promise applies to advisory cache writes, including forced Check Now; explicit enablement, channel, Safe Mode,
Watcher, and other configuration mutations retain their existing contracts.

Two Codex++-aligned success-only fire-and-forget boundaries are deliberate:

• The product Update click invokes only the GitHub external-open path and has no local rejection handler. Automatic
  product-check IPC does catch rejection and hides the action.
• Automatic Store warm attaches only a success continuation and has no local rejection handler. An explicit Store-page
  render catches load failure, clears the badge, and renders its error and Refresh state. The shared in-flight Store
  promise is still cleared after settlement so a later transition or page open can retry.

Install or update

The Windows release package is named claude-plusplus-0.3.1-win-x64.zip. After the separate GitHub Release is
published, download it from the
kpkhxlgy0/claude-plusplus releases page, extract it, and
run:

.\install.ps1

Run the same installer over an existing Claude++ installation to update it.

Claude++ 0.3.0

Claude++ 0.3.0

Claude++ 0.3.0 adds a first-class Windows workflow for building local Tweaks and strengthens recovery when a managed
Claude Desktop mirror is stale, damaged, or left without trustworthy installer state. The official WindowsApps
package remains read-only, and automatic Watcher repair remains explicitly opt-in.

Highlights

• Scaffold, validate, link, and watch local Tweaks with built-in CLI commands.
• Validate manifests through the Claude++ SDK and require a contained, regular-file entry point without executing
  Tweak source.
• Establish original and patched managed-ASAR provenance, rebuild untrusted mirrors from the official package, and
  roll back failed pre-commit mirror refreshes.
• Control and inspect Safe Mode from the CLI, including omission of Claude++ Renderer preload/CSP hooks at cold
  start.
• Diagnose ASAR drift and incomplete recovery state through status and doctor.

Tweak authoring

The Windows package now provides:

bin\claudeplusplus.cmd create-tweak <target> --scope both
bin\claudeplusplus.cmd validate-tweak <target>
bin\claudeplusplus.cmd dev <target>

create-tweak generates exactly manifest.json, index.js, package.json, and README.md. Its CommonJS templates
are runnable for renderer, main, or both scope and request only the permissions they use. The scaffold does not
depend on an unpublished npm package.

validate-tweak uses the public SDK validator, then resolves an explicit manifest main or the fallback order
index.js, index.cjs, and index.mjs. The entry must be a regular file whose canonical path remains inside the
project; absolute, drive-relative, traversal, directory, and link-escape entries are rejected. Validation does not
execute the Tweak.

dev validates the project and creates a contained Windows Junction under
%APPDATA%\claude-plusplus\tweaks. It watches by default, revalidates after a 100 ms debounce, and atomically refreshes
the root reload marker after successful validation. Use --no-watch to create or confirm the Junction and exit, or
--replace to replace a different, fully rechecked Junction. Real files or directories and broken or malformed links
are refused. The Junction remains after the command exits.

The source validator supplements, but does not replace, Runtime file watching. A direct Junction event can reload
independently of the validation marker, so an invalid edit can still cause the current Tweak to stop and fail
rediscovery; Claude++ does not promise one coalesced reload event or keep the old Tweak active in that case.

Start with the Tweak authoring guide. The package includes the SDK declarations and the full
guide set; the SDK is not published to the public npm registry.

Recovery and diagnostics

Safe Mode now supports:

bin\claudeplusplus.cmd safe-mode --on
bin\claudeplusplus.cmd safe-mode --off
bin\claudeplusplus.cmd safe-mode --status

Main Tweaks reload immediately after a Safe Mode change. Restart Claude Desktop to fully apply the corresponding
Renderer preload and CSP state. A cold start in Safe Mode skips Renderer preload/CSP registration. Mutating commands
refuse to replace unreadable, malformed, or non-object configuration, while --status remains read-only.

Successful managed installs now record SHA-256 provenance for the original and patched ASAR raw headers. A mirror is
reused only when its package identity and recorded patched hash agree. Legacy, missing, invalid, drifted, unreadable,
or package-mismatched mirrors are rebuilt from the official package before becoming a trusted baseline. If Runtime,
fuse, Loader, hash, or state persistence fails before the replacement is committed, installation restores the prior
working mirror and leaves the prior state in place. A later backup-cleanup error keeps the already-committed
replacement and state instead of rolling them back.

Schema-1 state remains readable for compatibility, but it does not prove ASAR provenance. doctor reports that
condition and recommends repair; the next successful install or repair rebuilds the managed mirror and records
schema-2 provenance. status and doctor also distinguish patched, original, drifted, unreadable, and legacy ASAR
states.

Uninstall now cleans Claude++'s fixed managed-mirror root even when state is missing or malformed and reports locked
residual paths as warnings. Normal uninstall preserves Tweaks and their data; use uninstall --purge only when those
user files should also be removed.

Safety and compatibility boundaries

• Claude++ continues to copy the official app into its version-keyed managed mirror and never modifies WindowsApps,
  the installed MSIX, the registry, or Claude MCP configuration.
• Watcher tasks are still optional. Normal install and repair do not enable them; run
  bin\claudeplusplus.cmd watcher enable explicitly. Without Watcher, a Claude Desktop update may require a manual
  repair.
• The local dev workflow is Windows-only and uses Junctions. Its containment and replacement checks protect normal
  trusted local development; they are not a security boundary against a hostile process running as the same user.
• Main Tweaks are trusted local Node.js code. Manifest permissions lease Claude++ APIs rather than forming an OS
  sandbox. Renderer Tweaks do not receive Node.js require.
• Existing private Desktop integrations remain locked to their documented version, hash, and module-shape records and
  fail closed outside them. This release does not add external MCP configuration writes or terminal Claude Code MCP
  support.

Install or update

Download claude-plusplus-0.3.0-win-x64.zip, extract it, and run:

.\install.ps1

Run the same installer over an existing Claude++ installation to update it. Normal maintenance preserves
configuration, Tweaks and their data, Safe Mode, Watcher enabled state, and old managed mirrors. The first successful
maintenance operation from legacy schema-1 state may rebuild the current managed mirror to establish trusted
provenance. Remove non-current mirrors only when requested with install --cleanup-all-old.

After installation, verify the managed app with:

bin\claudeplusplus.cmd doctor

Claude++ 0.2.9

Claude++ 0.2.9

Claude++ 0.2.9 restores Claude Code UUID targeting for the Session Title Tweak on Claude Desktop app version
1.32885.1, corresponding to Windows MSIX version 1.32885.1.0.

Fixed

Claude Desktop's DDK session manager keeps cliSessionId on each raw sessions Map record, but its public
getSession(...) result is formatted for events and omits that field. Runtime 0.2.8 was bound to the correct CCD
manager, yet attempted to correlate a Claude Code UUID through those public snapshots, so a displayed UUID could not
resolve to the manager's local_* key.

Runtime 0.2.9 uses the raw Map only to correlate an explicit Claude Code UUID with a Desktop key. Resolution remains
fail closed:

• an exact Desktop manager key wins before UUID correlation;
• the caller-bound lookup and cross-session fallback read raw cliSessionId aliases;
• multiple raw records with the same alias are rejected;
• a unique mapped key must still resolve through getSession(...) before the normal title update runs.

The update continues to use Desktop's normal persistence path and verifies the written title by exact read-back.

Tweak compatibility

Claude Session Title 0.1.2 requires Runtime
0.2.9 because this release supplies the raw-record UUID correlation used by the Tweak. Its MCP tool still requires
exactly two arguments, session_id and title.

This capability covers Claude Desktop sessions only. Claude++ injects the in-process MCP server without writing
Claude MCP or settings configuration; it does not add the tool to terminal-launched Claude Code.

Install

Download claude-plusplus-0.2.9-win-x64.zip, extract it, and run:

.\install.ps1

Install or update to Claude Session Title 0.1.2, then restart Claude Desktop after installing the Runtime.

Claude++ 0.2.5

Claude++ 0.2.5

Claude++ 0.2.5 adds a narrowly scoped Claude Code settings capability for Main-capable Tweaks that must manage an explicitly declared settings path.

Added

• claude-code-settings permission for Main-capable Tweaks.
• Declarative claudeCodeSettings.paths allowlists in manifest.json.
• Lease-scoped api.claudeCodeSettings read, write, and remove operations.
• Whole-file revision tokens and atomic sibling-file replacement for guarded settings mutations.

Safety

• Every operation must exactly match a manifest-declared dotted path; prefix access is not granted.
• Malformed JSON, non-object roots, unsafe path segments, poison object keys, incompatible intermediate values, and stale revisions fail without replacing the settings file.
• Unrelated settings are preserved semantically during read-modify-write operations.
• Retained settings API references reject calls after their Main Tweak lease is disposed.
• Revision checks provide optimistic conflict detection. Node's standard filesystem APIs do not provide cross-process compare-and-swap, so an arbitrary external writer can still race the final atomic rename interval.

Scope

Claude Code Desktop and terminal Claude Code share user settings by default. A Tweak using this capability must describe that shared scope accurately; this release does not create a Desktop-only settings layer.

Install

Download claude-plusplus-0.2.5-win-x64.zip, extract it, and run:

.\install.ps1

Existing installations can run the same installer for routine maintenance. Claude++ preserves configuration, Tweak Junctions, Tweak data, Safe Mode, enabled flags, and old managed mirrors.

Claude++ 0.2.4

Claude++ 0.2.4

Claude++ 0.2.4 adds a generic, permission-gated startup-environment capability for Tweaks that must configure values
before Claude's original Main entry loads.

Added

• startup-environment permission for Main-capable Tweaks.
• Declarative startupEnvironment.keys ownership in manifest.json.
• Versioned per-Tweak snapshots under %APPDATA%\claude-plusplus\startup-environment.
• Lease-scoped api.startupEnvironment status, atomic save, and baseline-safe relaunch operations.

Safety

• The early bridge parses only validated manifests and declarative snapshots; it never executes Tweak JavaScript.
• Safe Mode, global Tweak disablement, malformed or partial snapshots, missing Tweak sources, incompatible runtimes, and
  key ownership conflicts apply no affected override.
• Snapshot groups apply atomically, and retained API references reject calls after their Main Tweak lease is disposed.
• A Tweak-requested relaunch restores each incoming value before scheduling the replacement process.
• Claude++ does not write Windows user/system environment variables, the registry, Claude settings, or server-side
  compaction configuration.

Install

Download claude-plusplus-0.2.4-win-x64.zip, extract it, and run:

.\install.ps1

Existing installations can run the same installer for routine maintenance. Claude++ preserves configuration, Tweak
Junctions, Tweak data, Safe Mode, enabled flags, and old managed mirrors.

Use bin\claudeplusplus.cmd doctor after installation to verify the managed app, Runtime, Loader, Settings, config,
Store, optional Watcher, and integrity state.

Claude++ 0.2.3

Claude++ 0.2.3

Claude++ 0.2.3 lets permission-gated workflow Tweaks recover the original local file destination behind a
Claude-native code reference while keeping transcript contents out of the public Tweak API.

Added

• claude.sessions.resolveReference(sessionId, entryId, label, occurrence, visibleCount) resolves the selected local
  file: destination from one Claude turn only when transcript and visible occurrence counts agree.
• The resolver validates the response identity, visible label, destination filename, and local URL scheme before
  returning a destination.

Fixed

• Unity Links can preserve Markdown #L<line>C<column> fragments when Claude renders only a filename button.
• Ambiguous, remote, malformed, or missing references continue through the existing native-resolution fallback.

Install

Download claude-plusplus-0.2.3-win-x64.zip, extract it, and run:

.\install.ps1

Existing installations can run the same installer for routine maintenance. Claude++ preserves configuration, Tweak
Junctions, Tweak data, Safe Mode, enabled flags, and old managed mirrors.

Use bin\claudeplusplus.cmd doctor after installation to verify the managed app, Runtime, Loader, Settings, config,
Store, optional Watcher, and integrity state.

Claude++ 0.2.2

Claude++ 0.2.2

Claude++ 0.2.2 restores Renderer Tweak compatibility with current Claude Desktop and adds a narrowly scoped,
permission-gated Claude Sessions adapter for workflow Tweaks.

Added

• Renderer Tweaks may declare claude-sessions to resolve a file through the selected Claude Code session.
• The same permission may read only the session's absolute worktreePath or cwd for bounded workspace-relative
  lookup.

Fixed

• Claude++ now composes its CSP compatibility transform with Claude's own response-header listener instead of
  replacing it.
• Renderer Tweak evaluation is enabled only for managed top-level app: documents and remains disabled in Safe Mode.
• Disposed Renderer Tweak leases revoke retained Claude Sessions method references.
• Current Claude header callbacks can complete a request only once, and unsupported filtered registrations fail
  closed without weakening CSP.

Install

Download claude-plusplus-0.2.2-win-x64.zip, extract it, and run:

.\install.ps1

Existing installations can run the same installer for routine maintenance. Claude++ preserves configuration, Tweak
Junctions, Tweak data, Safe Mode, enabled flags, and old managed mirrors.

Use bin\claudeplusplus.cmd doctor after installation to verify the managed app, Runtime, Loader, Settings, config,
Store, optional Watcher, and integrity state.

Claude++ 0.2.1

Claude++ 0.2.1

Claude++ 0.2.1 fixes Main Tweak hot reload when a Tweak is installed through a Windows Junction or directory
symlink.

Fixed

• Module-cache cleanup now follows both installed paths and canonical filesystem paths.
• Linked Tweak source changes are evaluated on reload instead of reusing stale Main-process code.
• IPC handlers owned by a reloaded Tweak are registered from the current source after the old lease is disposed.

Install

Download claude-plusplus-0.2.1-win-x64.zip, extract it, and run:

.\install.ps1

Existing installations can run the same installer for routine maintenance. Claude++ preserves configuration, Tweak
Junctions, Tweak data, Safe Mode, enabled flags, and old managed mirrors.

Use bin\claudeplusplus.cmd doctor after installation to verify the managed app, Runtime, Loader, Settings, config,
Store, optional Watcher, and integrity state.