DevMate 4.0.5

• Your own browser, through an extension for Chrome and Edge. DevMate could already drive a browser of its own; now your client reaches the one you use: bookmarks (tree, search, create, rename, move, remove), tabs and windows (list, open, go to, bring to front, reload, close, move, group), history (search, delete), downloads (list, start), recently closed tabs (list, bring back), the reading list, the most visited sites, and a tab's page (its text, a picture of what it shows or of the whole page). It debugs a page like DevTools: the console and uncaught errors, the network requests and one of them in full, the page as its elements with a number to act on each, one element in detail, what the page stores, click, type, press, choose, hover, scroll, run a script, answer a dialog, reload, and emulation of a screen, a color scheme or being offline; Chrome shows its own bar on a tab while it is debugged. They are capabilities of the engine chrome, used through capability_list, capability_query and capability_call without a project. The extension is also an entry like the editors: its panel says how things stand and what to do about it, starts DevMate, opens the workbench, copies the address a client needs, counts what waits for you and lists what DevMate did in the browser. It has two switches: Let DevMate use this browser (off: every request is refused and the client is told you paused it) and Start DevMate with the browser (off until you turn it on). It is loaded once, from a folder in DevMate's instance directory that stays where it is: every start of the runtime makes that folder, and the program the browser starts, the DevMate that runs, and the extension loads itself again when its files changed, so an update through any entry needs nothing done in the browser (Developer mode stays on). devmate chrome install registers DevMate with Chrome and Edge for your account (no administrator) and puts the extension into that folder, devmate chrome and the doctor say whether a browser is connected, devmate chrome uninstall takes it away. The browser starts DevMate's own small program for this one extension (native messaging): nothing listens for it and no public connection is needed.
• OpenAI's tunnel without a second program: devmate connect openai-tunnel --tunnel-id <id> is all it takes. DevMate speaks the tunnel's published protocol itself: this computer only reaches out to api.openai.com, nothing is installed or downloaded, up to 32 calls are served at once (maxConcurrentRequests), progress is passed on while a call runs, and the tunnel id in ChatGPT never changes. The doctor says whether OpenAI accepts the key and how many calls have arrived. A refusal is repeated in OpenAI's words with what to do about it: the key, the tunnel id, the tunnel's organization (--organization <id>), or an update when the protocol version is no longer taken. A tunnel that is connected but not offered in ChatGPT is said to be a matter of the OpenAI account, with the place where OpenAI explains it. OpenAI's own tunnel-client is used instead where --executable names it.
• A relay of your own: devmate relay setup user@host [--domain <name>] makes a public Linux server you control the way in. It installs Caddy there over your SSH key login, forwards one path nobody can guess to this computer through an OpenSSH remote forward, and by default answers only the addresses ChatGPT and Claude connect from and this computer. The address stays, answers stream, and nothing of a third party is in between. Reached by the server's address instead of a name, it needs Caddy 2.10: where the system's package is older or missing, the setup takes Caddy from Caddy's own package repository, and a Caddy that was there before is left alone, with the commands that would replace it. A relay has no sign-in (it forwards one path only), and setting both is refused. devmate relay remove user@host takes it off again.
• What the runtime itself asks of the outside (OpenAI's tunnel service, the check of its public route, a signing-in client's metadata document, external MCP servers) goes through the proxy the computer is set to use: the HTTPS_PROXY, HTTP_PROXY and NO_PROXY variables, or on Windows the system proxy of the account, followed within a minute when it is switched. devmate doctor says which proxy is in force and names a setting it cannot use.
• A model is shown its tools under the names it knows: ChatGPT and Codex get read, apply_patch, exec_command and write_stdin; Claude gets read, write, edit and bash (called powershell where commands run in PowerShell, so that the name never promises another shell); other clients get DevMate's own names. The client is recognised by what it says it is, or chosen with ?tools= in the MCP address, and devmate doctor says what the last client called itself, which list it was shown and why; every tool stays callable whatever list was shown. Everything that only reads, the capability tools and taking a change back are on every list; making a folder, moving and deleting are operations behind operations_call, which a patch or a command does as well.
• workspace_patch changes several files with one patch, all of it or none: the *** Begin Patch envelope Codex writes (update, add, delete, move) or a unified diff as git diff prints it (renames and quoted names included). A hunk is found by its text, so stale line numbers, differing indentation and typographic quotes do not stop it; one that fits nowhere is refused with the line where it stops matching, and one that fits in two places is refused instead of guessed. Should a write fail halfway, what was already written is taken back. Each file stays restorable and the whole patch is taken back with one workspace_restore.
• show_changes says what is uncommitted in a Git project, whoever changed it: per file what happened and how many lines came and went. Marked as reviewed, the next look shows only what changed since, and nothing when nothing did.
• A delegated agent can work in a copy of the project. agents_delegate with isolate:true starts the agent in a Git worktree of the last commit. The project does not change until its work is read (agents.proposal) and applied (agents.apply: all of it as uncommitted changes, or none of it when the project changed in the same places meanwhile) or discarded (agents.discard). Applied work is in the history, so it can be taken back like any other change; a link it brought is applied and named as the one thing that is not. The copy is kept beside DevMate's instance directory, never inside it.
• One call takes back a stretch of work. workspace_restore with since (the number of a workspace_history entry, shown there as #N) takes back every change DevMate's file tools made after that entry, newest first. A file something else changed in the meantime is left alone and listed, and taking back can itself be taken back.
• DevMate has one owner and no other accounts. Member accounts are gone, with their roles and their per-project grants: a sign-in that was issued to a member is refused, and every agent, command and job is the owner's. OAuth sign-in on a public address proves that the client is the owner's; the check DevMate makes of its own public route is the only other caller, and it is told which runtime answers and nothing else.
• A command runs without a terminal: nothing waits in a pager or at a prompt and no colour codes are written (NO_COLOR, TERM=dumb, PAGER, GIT_PAGER, GH_PAGER, GIT_TERMINAL_PROMPT), unless the owner's own environment says otherwise.
• The doctor says when this computer has no public address of its own and which routes work then, and what Windows PowerShell 5.1 costs with every command.
• runtime.metrics says for every operation how often it was called, by whom, how long half of the calls and nineteen in twenty took, and which errors it returned, and lists the newest failures.
• devmate doctor --report prints one text for a bug report: the checks, how the operations went, the newest failures and the last log lines, with credentials, private paths, account names and addresses taken out.
• A call that names no project while several are shared says in its answer which project it was answered from.
• What a connected client is told about the connection (connection_status with full access) never repeats the key a quick tunnel address ends in.
• A long-running capability is started with operations_call {operation:"job.start", …} and read with operations_query {operation:"job.read", …}.
• What every tool tells a client about itself (read-only, destructive, reaching outside) is part of the recorded public surface, so such a hint cannot change by accident.

What's Changed

• DevMate 4.0.5: your own browser, OpenAI's tunnel built in, one owner by @Kukutx in #119

Full Changelog: 4.0.4...4.0.5

DevMate 4.0.4

• The address of a quick tunnel ends in a key, new with every start: https://<name>.trycloudflare.com/mcp/<key>. Only the whole address opens anything; the host name alone, which anyone watching DNS can see, answers "not found". devmate doctor prints the address without the key. After updating, give your client the new address from devmate mcp-url.
• Through a quick tunnel DevMate answers in plain JSON, for clients of both protocol generations and without progress messages: Cloudflare does not carry event streams through quick tunnels. npm run smoke:quick-tunnel checks this against a real tunnel.
• One call waits at most 50 seconds (shell_run, process_read, agents_delegate, agents_result) and one text result stays under 140,000 characters, which fits the limits of ChatGPT and Claude. Longer work keeps running and is asked about again; a result that would be larger says where it was cut and how to ask for less. A page of workspace_read or of a diff holds 120,000 characters, a page of command output 128 KiB, a page of bytes 96 KiB.
• VS Code says when a route from the cloud was checked end to end under a new address, with the address one click away, and when a route stays broken; the status bar tells connecting, reconnecting and a failed check apart. Copying the address of a quick tunnel that has none yet no longer hands out the local one (also devmate mcp-url and Obsidian).
• The README says which ChatGPT and Claude plans let a connector you add change things and which only read, with the sources.
• npm run check fails when a file names an earlier version of DevMate or an option that was taken out.

What's Changed

• 4.0.4: a quick tunnel that answers in plain JSON under a keyed address, and calls that fit client limits by @Kukutx in #117

Full Changelog: 4.0.3...4.0.4

DevMate 4.0.3

• The documents, this changelog and the list of plugin versions describe the product as it is now. What is not done yet and what could not be verified is in docs/STATUS.md.
• A connector program is looked for as an ordinary file at its path.

What's Changed

• DevMate 4.0.3: the repository describes the product as it is by @Kukutx in #116

Full Changelog: 4.0.2...4.0.3

DevMate 4.0.2

• Connected in a minute, with no account: devmate connect quick, or the first choice in DevMate: Configure Connection, starts a Cloudflare quick tunnel. Nothing is registered anywhere; DevMate runs cloudflared, takes the address it is given, checks that it reaches this runtime, and devmate mcp-url prints it. The address changes whenever the tunnel starts again and has no sign-in; the doctor says so.
• The check of a quick tunnel waits until public DNS knows the new address, and a computer whose own DNS has not caught up yet is told apart from a route that does not work.
• Obsidian: Configure connection sets up the quick tunnel, and Copy one-time sign-in code serves clients that sign in.
• How the coding agents are run (sessions at once, time limits, whether they get the owner's MCP servers and API keys) is changed while DevMate runs: providers.configure, by the owner or, with full access, by their client. The refusals that name a limit say how to raise it.
• The file tools read and list through links that stay inside the project, and read files that have a second name: a node_modules built from links is readable. Nothing is changed through a link.

DevMate 4.0.1

• The VS Code extension is listed as "DevMate Agent": the Marketplace does not accept the display name "DevMate", which another extension holds. This is the first version of DevMate 4 on the Marketplace.
• The build no longer fails when a package feed has an outage while installing ripgrep: the step tries again and checks that the tool is there.

DevMate 4.0.0

• One local runtime per instance directory with a single SQLite state store, an explicit operation registry, and identical access through MCP, the CLI, the localhost workbench and the ChatGPT/Claude MCP App.
• Direct tool surface for the connected model: line-paged reads, glob find, ripgrep search, exact-replacement workspace_edit, write/mkdir/move/delete with restorable per-file history, read-only Git status/diff/log/show/blame/branches, and shell_run with real shell semantics (PowerShell on Windows), full owner environment, disk-spooled output paged by cursor, long-running processes, stdin and whole-tree stop.
• Tool results send bulk text once as plain content; tool hints distinguish read-only, ordinary writes, destructive and open-world operations; the server delivers working instructions including the registered projects.
• Connections through routes you own: official OpenAI Secure MCP Tunnel, a managed Cloudflare named tunnel on your own domain, any external HTTPS reverse proxy, or OpenSSH reverse forwarding. Public traffic enters through a separate ingress port that serves only MCP and OAuth; the control port refuses proxied requests. connection.verify proves the public route with a real MCP round trip.
• One-call delegation to locally installed coding agents (agents_delegate / agents_result) on top of the Codex, Claude, Gemini and Grok adapters, with native approvals surfaced in the workbench.
• Editor awareness: the VS Code window publishes its active file, selection, open files and language diagnostics, so editor_diagnostics shows compiler, type and lint errors without a build; project_overview returns Git state, the project's agent instructions, scripts and layout in one call.
• Find and search are driven by ripgrep, honour .gitignore and have no tree-size limit. In VS Code nothing has to be installed for this: when PATH has no rg, the runtime uses the copy the editor ships, and remembers it for use without an editor.
• Guided setup: DevMate: Configure Connection, Copy MCP URL, Copy One-Time Sign-In Code and Doctor in VS Code; devmate doctor on the command line. Connection credentials are stored in the private instance directory instead of environment variables.
• The event journal, idempotency receipts and restorable file versions are pruned after retentionDays (default 30).
• The model carries a short list of tool definitions; every other operation is reachable through operations_call without spending context.
• Official MCP TypeScript SDK 2.3 for the 2026-07-28 protocol, also serving clients on the 2025 revisions, and the MCP Apps standard for the workbench.
• One runtime per instance, guaranteed by the operating system: any number of VS Code windows, Obsidian and the CLI can start it at the same moment and all join the same process. A record left by a crash never blocks a start. Editors with devMate.autoStart bring a crashed runtime back; an explicit stop is respected.
• The CLI is a complete entry on its own, with no editor required: start, stop, restart, serve, status, doctor (also when nothing is running), logs, project add|list|remove, connect, secret set (read from standard input), mcp-url, login-code, ui --open, and every operation by name.
• Folder sharing in VS Code is explicit and adjustable: by default a trusted folder is shared read and write and the window says so once; Change Folder Sharing makes any folder read only or takes it out, and devMate.shareFolders changes the default (readWrite, readOnly, ask, never). A status bar item shows the runtime state, and editors with built-in MCP support discover the local endpoint automatically.
• devmate mcp serves MCP over standard input and output for clients that start their servers as a program, starting the runtime when needed and surviving its restart.
• Deleting a large file keeps a restorable copy (up to 256 MiB); larger ones need an explicit force. project_overview points out folders that carry their own instruction file.
• Command lines are displayed and recorded without the credentials written inline in them. Every text input has an upper bound.
• The operations are defined by area under runtime/operations/; runtime/service.mjs is the registry that authorizes every call. npm run lint checks for mistakes.
• What is shared, and how far, is decided at the owner's computer (editor, devmate project add, local workbench). A client connected through MCP cannot share a folder, widen read-only access, lift the protection of credential files, change how a capability engine is set up, or answer an agent's approval or question; a workbench embedded in a chat app is such a client too. It can always narrow. A folder taken out stays out, also through the folder above it or inside it. There is no tool for sharing a folder: the model is told to ask the owner.
• Two permission profiles, chosen by the owner at their computer (devmate access, DevMate: Change Permission Profile, Permissions… in Obsidian). Guarded is the default. Full access is for driving everything from a chat client: the owner's connected client may share folders, widen access, read credential files, set up engines, answer agents and run the doctor, and what an agent the owner delegated to asks permission for is granted automatically and recorded. It applies at once, and members keep exactly their grants. The devmate command line run through a connected client's shell is answered as that client.
• capability_query and operations_query run what only reads, so clients that ask before every change do not ask for a status or a list. An answer to an agent's question can be plain text.
• VS Code starts the runtime with the editor by default (devMate.autoStart); Obsidian can do the same with Start the runtime with Obsidian. Both bring a crashed runtime back and leave one you stopped alone.
• With several editor windows open, read-only tools follow the window in use rather than the one that reported last; a call that names a workflow or an agent has named its project.
• With several projects a change must name its project; read-only tools may follow the editor. workspace_edit keeps CRLF line endings, text in UTF-16 or the computer's own encoding can be read, text files up to 32 MiB are read in pages, and listings, blame, log and search say what they left out or cut.
• The command line installs on its own from devmate-cli-<version>.tgz, with no dependencies. devmate mcp never sends a call twice that may already have started.
• Linux and macOS: commands run in bash, stopping a command ends its whole process group, a runtime started from a desktop icon finds the usual tool directories, a Git older than 2.41 is named instead of failing every Git tool, and the instance lock survives two simultaneous starts after a crash. Verified on Ubuntu 24.04 with the full test suite and end-to-end checks; macOS has not been run yet.
• Finding files checks each folder once per call instead of once per file, which more than halves a find over a few thousand files. A path that runs through a file is reported as not_directory on every system, and replacing a file on Windows rides out the moment a scanner still holds it.
• VS Code starts the runtime automatically only when the editor comes up or the workspace becomes trusted; a runtime its user stopped stays stopped.
• The stored state carries a format number and the release that wrote it, so an older release refuses newer state with a clear message; state files are written atomically, and a damaged identity, record or credential file no longer blocks a start.
• Obsidian: sharing a vault asks for read and write, read only or not now, and can be changed or stopped later; stop and restart ask first; the packaged plugin no longer depends on dynamic imports or the browser's fetch.
• VS Code: no separate ripgrep install (the editor's own copy is used when PATH has none), settings take effect without reloading, a window with several shared folders is told about approvals in all of them, and sharing changed elsewhere shows at once.
• The localhost workbench is entered through a single-use link; the owner token is never given to a browser. The session belongs to its browser tab and travels in a request header: there is no cookie that other local web services would receive.
• OAuth sign-in accepts the public client metadata of ChatGPT, Claude, Claude Code, Codex and VS Code, issues refresh tokens, and no longer applies to clients on the owner's own computer.
• A connector that cannot start is reported instead of hidden, the public route is re-verified periodically, cloudflared readiness comes from its own endpoint, connectors orphaned by a crash are cleaned up, and a stored credential applies with connection.restart.
• A cancelled or timed-out tool call only stops waiting; the command or agent task it started continues and stays reachable. Tool calls report progress to clients that ask for it.
• A tag X.Y.Z on main verifies that commit, builds once and publishes that build: a GitHub release (VS Code extension, the Obsidian plugin as an archive and as the three files Obsidian downloads, the command line package, checksums, build provenance) and the VS Code Marketplace version. Open VSX and npm are prepared and stay off until switched on. One command states a new version in every file; npm run check fails when they disagree.
• The extension is tested in a real VS Code on every change: two editors and a third window start together and must share one runtime. It needs VS Code 1.101 or newer. Command and setting texts are available in English and Simplified Chinese, and the Marketplace page has its changelog.
• A request as large as the file tools accept fits through MCP, also through devmate mcp, where a refused or failed request no longer affects the others in flight. What tools say about other tools uses the names a model can call; ...

DevMate 3.8.9

What's Changed

• docs: add Obsidian README screenshot by @Kukutx in #98
• docs: refresh VS Code overview screenshot by @Kukutx in #99
• Release DevMate 3.8.9 by @Kukutx in #100

Full Changelog: 3.8.8...3.8.9

DevMate 3.8.8

What's Changed

• Release 3.8.8: safe Gateway port repair and stale bridge cleanup by @Kukutx in #97

Full Changelog: 3.8.7...3.8.8

DevMate 3.8.7

What's Changed

• Release 3.8.7: harden shared desktop runtime stability by @Kukutx in #96

Full Changelog: 3.8.6...3.8.7

DevMate 3.8.6

What's Changed

• Release 3.8.6: stabilize shared desktop Gateway port by @Kukutx in #95

Full Changelog: 3.8.5...3.8.6