v1.8.1 - Docs drift cleanup

Fixed

• Docs drift audit: corrected a stale claim in ref/claude-connector.md that DCR is off (registration_endpoint has been advertised since the ChatGPT connector work and is live), moved the shipped process-consolidation plan to plan/done/ with its status corrected from "runtime verification pending" to shipped and verified since 1.5.0, added the missing feat/ anchor stamp to docs/feat/tools.md, and synced docs/index.md (2 missing entries added, 1 duplicate removed).

Full Changelog: 1.8.0...1.8.1

v1.8.0 - Ingress picker, standalone packaging, .env support

Added

• 3-tab ingress picker in setup: Tailscale Funnel, your own public origin, or a hosted domain.
• Domain purchase request form for the hosted-domain option.
• Standalone packaged app for macOS Apple Silicon: no Node.js install needed (Windows/Linux coming later).
• Native .env file support for local configuration.
• Automated CI syntax check on every push.

Changed

• Connect confirmation page now shows which app is requesting access.
• The ~/.claude folder grant can no longer be accidentally removed from the panel.

Fixed

• Setup's status badge now reflects the real Tailscale/origin state.
• The passphrase page no longer shows your OS username.

Full Changelog: 1.7.0...1.8.0

v1.7.0 — Cloudflare tunnel ingress option

Added

• Cloudflare tunnel ingress: run npm start -- --tunnel <cred.json> --origin <host> to launch a Cloudflare named tunnel as an alternative public edge for regions where Tailscale Funnel drops requests.
• PUBLIC_ORIGIN bring your own edge: point it at any stable public HTTPS URL you run and the server skips Tailscale entirely.
• macOS media commands open, sips, and ffmpeg are now allowed, so a connected client can open files and handle images locally.

Fixed

• The panel no longer reports a false Tailscale failure when you intentionally run your own tunnel; it names the active ingress and serving URL instead.
• Setup wording no longer points to a "header" or "preferences" field that no app has; it names the custom instructions setting.
• The akidevrule update banner no longer reappears after you have already updated.

Full Changelog: v1.6.0...1.7.0

v1.6.0 - update check, spy-TOC nav, mobile fix

Added

• Update check for both the app and akidevrule on every start, with one-click install/pull buttons and a stale-instruction warning.
• Panel gets a scroll-to-top button and a numbered sidebar that tracks your scroll position.

Changed

• Every copyable value in the panel now uses one consistent click-to-copy style.

Fixed

• Long commands no longer overflow the panel on mobile.
• Default rule file name updated to match the renamed akidevrule core rule.

Full Changelog: v1.5.0...v1.6.0

1.5.0: MCP consolidation 8 to 4, prompt rework

Changed

• Panel §0: Funnel re-sync hint for intermittent connector drops. When the public edge returns 200 but one ingress IP's TLS handshake is slow, §0 prints the funnel off / serve reset / funnel --bg 9999 cycle to run (needs sudo). Evidence: docs/research/claude-ai-oauth-connector.md round 9.
• MCP tool processes consolidated 8 to 4; tool arms unified under one local server (scripts/local-tools-mcp.js; the shell/agy/kiro/search arms are now register(server) modules). Tools renamed to local__*: local__run_cmd, local__agy_run, local__kiro_read, local__find_path, local__search_content. Existing connectors must reconnect. scripts/userdata.js auto-migrates legacy config.
• Paste-in instruction reworked: working.md to plan.md, dynamic plan (skip pure Q&A), tighter MCP-over-sandbox boundary.
• README expanded with use-cases, product positioning, and Grok cloud automation.

Full Changelog: v1.4.0...v1.5.0

1.4.0 — multi-client panel onboarding, connector tabs, per-client settings links

Panel onboarding is rebuilt for multi-client setup: a step-overview header, sections reordered to follow the real flow, and the Connectors section split into shared values + per-client tabs (Claude/Grok/ChatGPT/Gemini). Instructions now deep-links each client's settings page, not only Claude's. Plus a second usage-watch extension for Grok, an install-when-missing prompt line, a locked index.md rule checkbox, and case-insensitive extended-regex search_content.

Added

• Grok Usage Watch in panel §4 (Browser utilities) (scripts/config-page.js): a second recommended Chrome extension beside Claude Token Counter, showing grok.com's rate-limit/usage bar that the site doesn't surface itself. Screenshot public/extension-grok-usage.png. The Claude extension image was renamed claude-tokenizer-chrome-extension.png → public/extension-claude-usage.png (naming now parallels the Grok one); the <img src> was repointed.
• Panel prompt tells the model to install rules when they are missing (scripts/config-page.js buildPrompt): when "load rules" is on but index.md is not present under the rules dir, the generated instruction gains one line asking the user to press Install/update in panel §2 before starting — closing the gap where a web client with no harness @-import silently ran with null rules. Plan: docs/plan/done/improve-instructions-1.3.1.md §1.

Changed

• Panel onboarding restructured — a step overview header + renumbered sections (scripts/config-page.js): a new header shows the required flow as a horizontal stepper (0 Setup · 1 Connectors · 2 Install rules · 3 Instructions · 4 Extension), step 0 marked done and step 4 marked optional, each linking to its section. Sections were reordered to follow that flow: Tailscale becomes 0 · Setup (its two live checks plus clone / npm install / npm start shown done), then 1 Connectors → 2 Install AkiDevRule → 3 Instructions → 4 Browser utilities → 5 Folders → 6 Allowed shell commands. All in-panel cross-references were repointed to the new numbers.
• Connectors (§1) reorganized into common values + client tabs (scripts/config-page.js): the three values every client shares — MCP Name, MCP URL, Passphrase — sit once at the top, and the per-client walkthroughs (Claude / Grok / ChatGPT / Gemini, Claude active by default) moved into a horizontal tab strip, so a user reads only their own client's steps. Claude's two extra credentials (OAuth Client ID / Secret) live in the Claude tab; Gemini's steps reference them from there. Replaces the stacked h3 sub-sections and the collapsed Gemini <details>. A small click handler toggles the active tab/pane.
• Instructions (§3) links to each client's settings, not only Claude's (scripts/config-page.js): the single "Open Settings → General" link (Claude-only) became a row of four deep links — Claude, Grok (?_s=personality), ChatGPT (#settings/Personalization), Gemini (saved-info) — and the copy hint is now client-neutral instead of naming claude.ai.
• index.md rule checkbox is now locked (scripts/config-page.js renderRuleChecks): it sorts first in the §3 rule checklist and renders checked + disabled with a 🔒, so the rule map can't be unchecked by accident (the other three core rules stay optional). Plan: docs/plan/done/improve-instructions-1.3.1.md §1.
• Prompt drops the misleading singular DATA_DIR (scripts/config-page.js buildPrompt): the allowlist is multi-root, so the prompt now says "run_cmd cwd=absolute under an allowed root" and "all local paths use Aki MCP FS only" instead of naming one directory. The dead DATA_DIR client const, its renderPanel param, and the caller arg (scripts/panel.js) were removed. Default 4-rule prompt is 833 chars (< 1500). Plan: docs/plan/done/improve-instructions-1.3.1.md §3.
• search_files stays prompt-banned, not proxied out (docs/plan/done/improve-instructions-1.3.1.md §2): the filter-proxy option was researched and rejected — a stdio passthrough would have to re-own JSON-RPC framing/shutdown and, decisively, it changes the shape of filesystem.args, which filesystemPaths()/setFilesystemPaths() in scripts/panel.js parse by fixed position to build the directory allowlist. MVP is the existing never … search_files line in the paste-in prompt — a soft/UX boundary, since find_path already supersedes the tool. Documented in docs/feat/tools.md.
• search_content is now case-insensitive extended regex by default (scripts/search-mcp.js, grep -rnI → -rniIE): a single query carries every alias joined by | ("funnel|ingress|thay.*funnel" hits EN+VI+synonym in one call, and Funnel matches funnel), so multi-concept hunts stop fanning out into N sequential calls or falling back to run_cmd grep. Measured on this repo: the two load-bearing wins are correctness (funnel case-sensitive found 27 lines and missed 39 Funnel hits → false "not found"; now 66) and fewer round-trips (N concepts → 1 reliable call, versus the old BRE path silently returning junk when \| was forgotten). Not a real win: query time (≈15ms at this tree size) and per-call output size (an OR result is larger, being the union of all aliases) — the context saving is fewer full-history re-sends, not smaller payloads. The tool description now states the -iE contract with an OR-alias example. docs/feat/tools.md gains a 7-step search ladder. No prompt change — buildPrompt uses a static residual, not tool descriptions. Plan (with the measured table): docs/plan/done/smart-search-strategy.md.

1.3.0 — trusted script dirs, allowlist chips/rows UI, residual-only prompt

Shell trust gets a second axis and a real editing UI.

Trusted script directories (shell.allowlistDirs) — an executable, or a script run via an interpreter (node/python3/…), under a trusted zone runs without its own allowlist row, so new Aki skills/scripts need no setting.json edit. checkPermission is now name-allow OR dir-allow. Fail-safe: a zone overlapping a filesystem write root is dropped (write+exec = RCE). The panel has an editable list (add / remove / save, live, no hub restart).

Allowlist as chips + rows — any-subcommand commands render as compact chips, restricted commands as rows with a subcommand field and an "any" collapse button. Storage moved to an explicit diff { added, revoked }, fixing a P0 revoke bug where deleting a default did not actually revoke it (it fell back on reload).

Instruction prompt rewritten to residual-only — carries only what the force-loaded akidevrule core can't guarantee (density, force-load line, scope gate + working.md, tool-selection contract, sandbox boundary). Default drops from ~1309 → 959 chars, well under ChatGPT's 1500 cap.

Plus a panel UI/content pass and removal of a dead /messages reverse-proxy route in the gatekeeper.

Full detail: CHANGELOG.md.

1.2.1 — Gemini + Grok connectors fixed, Kiro arm reaches existing installs

Patch release: the Gemini and Grok connectors now work, and the Kiro worker arm actually reaches existing installs.

Fixed

• Gemini connector connects. Two bugs found from live OAuth traces: its redirect goes through Google's OAuth proxy (not a gemini.google.com path), and the shared confidential client was pinned to Claude's callback so every Gemini authorize was rejected. Paste the Client ID/Secret like Claude; works on paid tiers including Pro.
• Grok connector connects. Its real redirect prefix is now allowlisted; Grok self-registers and completes the handshake end to end.
• The Kiro arm now deploys to older installs. It was only added to new setups; existing installs kept booting the original four servers. Startup now merges in any missing server, so Kiro appears on the next npm start.

Changed

• Kiro arm verified against the live kiro-cli 2.16.2 binary (locked to claude-sonnet-4.5).
• Connector renamed to be OS neutral ("Aki MCP Server from local Shell & FileSystem").
• Failed client registrations now log the submitted redirect URI, so a new client can be allowlisted instead of failing silently.
• Gemini carries a caveat: the connection succeeds but it does not reliably drive the tools yet. Claude and Grok are the dependable clients today.

Full detail: CHANGELOG.md.

1.2.0 — Gemini + Grok connectors, Kiro arm, instruction prompt

Two new connectors (Gemini + Grok) and a Kiro CLI worker arm, a paste-in instruction prompt tightened under ChatGPT's 1500-char cap, and the shell read-only guarantee closed for real (issue #2) — bundled with the 1.1.0 audit follow-up (ChatGPT connect fix, XSS fix, SSoT dedup) that was still unreleased.

Added

• Gemini and Grok connectors ride the existing OAuth 2.1 + RFC 7591 DCR path: isAllowedRedirect now allowlists Grok and Gemini-Enterprise callbacks beside Claude and ChatGPT, with a panel walkthrough for each. Redirect prefixes are provisional (flagged in code with a live-connect discovery step); the OAuth round-trip on each is unverified until a real connect. Consumer gemini.google.com may not support custom MCP connectors — targets Gemini Enterprise/Business.
• Kiro CLI arm (scripts/kiro-mcp.js): two separate MCP tools, kiro_read (--trust-tools=fs_read) and kiro_write (--trust-tools=fs_read,fs_write), so a connector can approve write independently of read. Model hard-locked to claude-sonnet-4.5. Requires kiro-cli on PATH; unverified at runtime (binary not installed here) — fails loud on a missing binary, never fabricates output.
• Paste-in instruction prompt now carries a mandatory per-task workflow line: investigate and confirm scope before editing, then keep/update $HOME/.aki/mcpsv/task/<id>/working.md so a later session resumes.

Changed

• Instruction prompt compacted under ChatGPT's 1500-char cap (rules-dir path emitted once, dense rewrite, live char counter). Default (4 rules) ≈ 1309 chars.
• agy tool: effort enum restricted to low|medium|high to match the installed CLI; valid model ids documented.
• SSoT dedup (from the 1.1.0 audit follow-up): shared scripts/http.js, scripts/mcp-tool.js, scripts/html.js.

Fixed

• Reflected XSS on the /authorize confirmation page — hidden-field values are now HTML-escaped.

Security

• Shell read-only guarantee closed (#2): find and sort removed from the default allowlist — their own flags escape read-only (find -delete/-exec, sort -o) and execFile is no defense. find_path/search_content cover the read-only lookup. Reverses 1.1.0's "accepted tradeoff" framing.

Unverified (runtime, user-triggered): the Gemini/Grok OAuth round-trip and the Kiro tools (binary absent) — see CHANGELOG and the plan docs under docs/plan/.

1.1.0 — Windows support and ChatGPT custom connector

Now works on Windows, and connects from ChatGPT as well as Claude.

Windows support and the ChatGPT custom connector come from PR #1 by capybara (okdev888), rebuilt onto the OS-agnostic architecture of docs/plan/unify-windows-linux.md — see docs/plan/merge-pr1-windows-chatgpt.md for what was adopted as-is and what was reshaped.

Added

• ChatGPT custom connector on the same Funnel URL (contributed): RFC 7591 POST /register (dynamic client registration), public-client token auth (none), and allowlisted https://chatgpt.com/connector/oauth/… redirects. Registered clients persist in ~/.aki/mcpsv/oauth-dcr-clients.json. Panel section 2 documents Claude and ChatGPT side by side. Claude's pre-issued Client ID/Secret path is unchanged.
• scripts/agy-mcp.js: dedicated MCP server for the agy CLI (wired into mcp-hub.config.json), replacing the generic shell route that shell-tokenized the whole command and could mis-split a multi-word -p prompt. Here prompt/mode/model/effort/outputFormat are separate execFile args, so no quoting step can get them wrong. Defaults to read-only mode plan and the fast wide-context discovery model; other modes must be opted into via setting.json agy.allowedModes, and cwd is enforced under an allowed root through the shared resolveUnderRoot.
• scripts/open-browser.js: small cross-platform "open default browser" helper (open / cmd start / xdg-open by process.platform), replacing the macOS-only execFileSync('open', ...) call in start.js — no new npm dependency added.
• scripts/log.js: shared timestamped logger. Gatekeeper request lines now carry an ISO timestamp + duration; oauth.js and streamable-bridge.js log each OAuth step, session open/close (with reason), stale-session 404s, and request timeouts — so a failed connect points at its exact cause instead of going silent.

Changed

• OAuth metadata advertises registration_endpoint and token_endpoint_auth_methods_supported: ["none","client_secret_post"] (contributed). The token endpoint now authenticates the client per its registered method and binds each authorization code and refresh token to the client it was issued to.
• agy-mcp.js, search-mcp.js, shell-mcp.js: each MCP server and tool now advertises a human-readable title ("Antigravity CLI", "File Index" / "Find Path" / "Search Content", "Shell" / "Run Command"), so the connector UI lists them by name instead of by bare protocol id.
• Windows/Linux unification (docs/plan/unify-windows-linux.md): package.json start script no longer relies on bash-only ${VAR:-default} syntax; scripts/panel.js folder picker (osascript, macOS-only) replaced with a manual "+ Add folder…" text input; validatePaths now uses path.isAbsolute instead of a hardcoded leading-/ check, so Windows drive-letter paths pass; scripts/config-page.js's CLAUDE_DIR build now uses path.join instead of manual / string concatenation; scripts/search-mcp.js's path-depth sort in walk/findPath now splits on path.sep instead of /.
• streamable-bridge.js: per-request response timeout raised 30s → 10 min (MCP_REQUEST_TIMEOUT_MS) so long shell runs aren't cut off. (The 5-minute idle auto-close and the per-client session model it belonged to are gone entirely — see the single-session rewrite under Fixed.)

Removed

• scripts/chrome.js and its 4 panel routes/UI (Chrome tab connect/restart/list/eval via CDP): macOS-only (pgrep, osascript) and already broken since Chrome 136 regardless of OS. The manual "paste this into the browser console" widen-chat-pane snippet is kept, folded into the Utilities section, since it never depended on Chrome automation.

Fixed

• streamable-bridge.js: the mass "client disconnected from MCP HUB" log is fixed at the root (docs/plan/bridge-session-churn.md, Option B). Measurement (docs/research/claude-ai-mcp-session-reinit.md) showed claude.ai re-sends initialize with no Mcp-Session-Id every ~10s — 17 hub sessions in 4 minutes for 3 conversations — so the old per-client model spawned a throwaway hub session each time, producing thousands of connect/disconnect pairs. The bridge now holds one internal hub session for the whole process: every external client multiplexes onto it via JSON-RPC id remapping, and each initialize is answered locally from the cached hub result. The hub now logs one connect at boot and one disconnect at shutdown regardless of re-initialize frequency. Removed the per-client sessions Map, the MCP_MAX_SESSIONS cap, LRU eviction, and the diagnostic churn counters that scoped this fix — all compensating machinery the corrected shape no longer needs.
• start.js / tailscale.js: npm start now auto-starts Tailscale when it is stopped. tailscale status --json returns valid JSON even while the backend is Stopped, so funnelStatus previously reported the daemon as healthy and never brought it up — the public Funnel URL then closed every connection (ERR_CONNECTION_CLOSED). funnelStatus now reads BackendState, and start.js runs tailscale up before enabling the Funnel. A NeedsLogin state still requires manual login (surfaced in the log).
• Windows (contributed): npm start no longer dies on spawn npx ENOENT — the hub is resolved with require.resolve('mcp-hub/dist/cli.js') and run through process.execPath, and every child inherits an explicit HOME/USERPROFILE so the ${HOME} placeholders in mcp-hub.config.json expand. Child processes spawn with windowsHide: true, spawn failures are reported instead of dying silently, path containment compares case-insensitively, and the panel's rule installer looks for bash.exe with a Git-for-Windows hint when it is missing.
• shell-mcp.js: the backslash is no longer treated as a dangerous character on any platform. execFile never invokes a shell, so it is an inert literal everywhere while being a legitimate path separator on Windows — one branchless rule rather than a per-OS one.
• Default shell allowlist widened with read-only commands: sort, uniq, cut, diff, basename, dirname, realpath, which, date everywhere, plus where, findstr, tasklist, hostname on Windows. sed/awk/xargs/perl/python/env are deliberately excluded — each can write files or execute an arbitrary program.

---

Upgrading: pull and restart npm start — the gatekeeper has to re-advertise registration_endpoint before ChatGPT can self-register. Existing Claude connectors keep working untouched, no re-authorize needed.