pacer 0.12.0

Fixed

• Keep every Accounts column visible in narrow Settings containers with labelled cards, align its desktop columns with the board, and show More actions only for existing sign-in or refresh help. Give Agents and Accounts continuous table header bands and Add agent navigation links full touch targets.

• Keep Add agent steps and forms contained at tablet and phone settings widths. Agents uses five columns with visible More actions controls, moves priority editing into details, and shows labelled cards in narrow containers. Restore Machines board rows and responsive cards, enlarge touch targets, and frame unknown-host errors with a link back to Machines.

• Settings pages expose one page heading. Agent details use a section heading, preserve task-limit edits on Escape, restore focus when closed, and report Takes work failures above the table even after closing details. Add agent focuses and announces newly detected agents after Check again.

Added

• Add a New task composer at #/tasks/new, opened with ⌘N (Ctrl+N elsewhere). Write the request, attach files or mention paths, pick the repository, where it runs, the kind and acceptance checks, optionally send it to a specific agent, and delegate with ⌘↵. A "Will go to" card previews the route with the read-only dispatch.explain op and says so when the connected service doesn't offer it yet. When supported by the connected service, From an issue searches and imports issues as plain text with a visible source note. The routing preview distinguishes queued work from a task with no eligible agent. Below 560px the composer is a full-screen sheet whose rows open their own choice sheets. The draft is kept until the task starts.

• Extend Claude Code's planner delegation guard from the Agent/Task subagent hook to the Bash tool: it now also blocks a shell command that starts a known executor CLI (claude, codex, pi, opencode) with PACER_ROLE=executor or a pacer-managed CLAUDE_CONFIG_DIR/CODEX_HOME, pointing to pacer delegate instead — recognized through env/exec, an export earlier in the same command, and bash -c/sh -c, not just the bare inline form. Same exemptions as the subagent guard (PACER=off, relaxed mode, executor sessions, no eligible alternative executor); a strict-managed executor's own Bash use stays unaffected. This is a best-effort pattern match on the command text, not a shell-level security boundary, and it now runs pacer guard on every Bash call rather than only Agent/Task. See Terminal and servers.

• pacer now ships as a Rust front door, pacer, paired with its TypeScript core, pacer-core. The front door owns the CLI, stdio, loopback HTTP/SSE/WebSocket and the desktop's native listener. Operations and routes it does not handle itself go to the core with the same requests, results, errors, authentication and events, so the API stays the same. Keep both files together: the install script, npm, Homebrew and the desktop app install and update them as a pair. See Distribution.

• When pacer-core is missing or reports a different version, the front door repairs it automatically; pacer self-repair does the same on demand. It downloads the core for its own version from the release, checks its size and SHA-256 against the release manifest, runs a version smoke test and only then replaces the file. A read-only installation directory is left unchanged, and PACER_NO_SELF_REPAIR=1 turns off the automatic repair. The desktop app is never repaired piecemeal: reinstall the complete app instead.

• Desktop can take over a separately installed, compatible pacer service: Use the desktop service switches its login registration to the app's bundled pacer/pacer-core pair after active work finishes. If the new service fails its startup check, the original registration is restored and verified.

• Rust plugin SDK crates on crates.io: pacer-plugin (the SDK) and the generated protocol crates pacer-plugin-protocol, pacer-plugin-decision-protocol and pacer-plugin-agent-session-protocol. The SDK re-exports them all as pacer_plugin::types.

• Record private, bounded OTA request-stage diagnostics in live validation evidence while preserving fixture authorization and HTTP behavior.

• Add the Insights screen and the read operation insights.summary: root tasks handled, subtasks, retries, accepted first try, tokens with coverage, the spread per agent, a daily series, task kinds by agent and the dispatcher's ladder rules and skip reasons, compared with the previous period. Workload counts use distinct roots and child tasks from attempts ended in the period, matching the union of the agent rows. Acceptance and retry counts retain the first-settle cohort. Narrow chart labels no longer collide; Insights table columns, frame and period control follow the board.

• Add the always-on assistant: ask about tasks, dispatch, executors and budgets from anywhere with ⌘J (Ctrl-J elsewhere). It runs on the endpoint account you choose in Settings › Assistant, reads pacer's own data through fixed read tools with secrets and free task text removed, and can only propose actions (retry, stop, answer, pause, resume, a prefilled New task) that run after you press the card's button. New assistant plugin extension point (plugin protocol 1.3.0, bundled pacer-assistant, bundled-only until installed plugins are sandboxed), client protocol additions assistant.* with an ephemeral per-turn stream at /v3/assistant/turns/<id>/stream (the answer arrives as one frame until plugins can stream), an assistant event that carries no text, and pacer ask (outside executor sessions; executors keep their question). New design-system AuroraSheet. The ⌘K ? mode is wired by the command menu through assistantEntry in a follow-up.

• Match the tray board with a pinned footer, paused delegation banner, compact task lists, and New task (⌘N) opening the New task composer at #/tasks/new; the planner name stays readable at narrow widths (the pace label truncates first).

• Add the Plugins settings page, host-drawn plugin settings pages, the Extend settings navigation group and the activity-bar Plugins section.

• Switch task execution between Direct and Orca in Settings, the TUI or pacer config; Orca again runs supported agents as supervised workers in Orca terminals with pacer's permission flags. Orca hosts interactive launches (the default launch mode) with the direct interactive launch's command and per-run Claude settings file; headless tasks and strict managed work run directly. Claude terminals use CLAUDE_CODE_SANDBOXED=1 instead of configuration edits, and in Orca worktrees pacer created for the task they keep the source checkout's rejected MCP servers off; pacer removes worktrees left by failed starts and keeps terminals whose worker start is uncertain for later reconciliation. Tasks that allow delegation run directly, because their work grant cannot be placed in a visible Orca terminal command.

• Align Machines and Add agent with the settings boards: machine header cards, guided SSH aliases, native account/location options, reported model choices and a contained live Test task block.

• Align Agents and Accounts with the settings boards: compact tables, factual sign-in details, account spread/fill controls, an executor details editor and a save bar that appears only while needed.

• Restyle the app frame chrome to the design canvas: a 44px title bar with the pacer mark, planner chip and panel-toggle buttons, a 52px activity bar with an active indicator and count badges, and a 28px status bar with per-vendor budget meters, running and queued counts and the terminal shortcut. The Setup and Settings attention dots are now red.

• Let plugins contribute UI as host-rendered data (plugin protocol 1.2.0): contributes.ui declares activity items, panel tabs, a settings page and a status item; the host validates every view document and settings value, and grants cover surface kinds. Adds the plugin.ui.* and plugin.settings.* client ops (additive, v3), the pacer plugin settings and pacer plugin ui list commands, and a strategy-independent plugin settings store. See Plugin UI contributions.

• Add the read-only files.search operation (protocol 3) for the app's command menu Files scope: it searches tracked file paths in registered repositories with git ls-files and returns the repository, repo-relative path, size, matched ranges and the running tasks that changed each file. Results, query length and per-repository listing time and size are capped, executors are refused, and nothing is written; the change is additive. See the design.

• Add the read-only issue.import and issue.search operations for starting a task from a GitHub issue. They read a registered repository's issue through the user's gh login, take the GitHub repository from the checkout's origin remote, return the title, body, labels, URL and state as capped plain text, and are refused for executor sessions. Two error codes are added, unavailable (503) and rate_limited (429); the change is additive. See Import a GitHub issue.

• Add the read-only dispatch.explain operation and pacer route --explain: which executor a request would go to, the ladder step, coded reasons, fallbacks with exclusion reasons, and the planner's cost (unknown until a planner adapter reports tokens). It reuses the dispatcher's decision code, starts, reserves and writes nothing, and the change is additive. See Explain a route.

• Record token usage for each attempt with a measured, partial or unknown coverage label. Codex gets its final tokens used total as a partial, self-reported figure and Claude Code gets measured usage from its `stream...

pacer 0.11.0

Added

• macOS desktop releases include a .dmg for first installs: open it and drag pacer into Applications. It holds the same signed app as the .app.tar.gz update package; release validation checks that the two match.

Changed

• Let a conversation's session UI fill the task workspace between a slim action row and a pinned control footer, and stop calling it a terminal. The footer shows who is driving, Take/Release control, size and the screen reader toggle; files stay with the session. A hidden or collapsed pane no longer resizes the agent's terminal, and Tab no longer traps focus in a watched terminal.

Fixed

• Show Ark CLI authentication failures as unknown subscription status instead of no active subscription, with sign-in and refresh guidance in Settings › Accounts.
• The desktop shows the live service version before loading older service screens and no longer restarts a mismatched service automatically.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.10.0

Added

• A dedicated Settings → Dispatcher page shows the default planner, active decision ladder, model choices, and a read-only task preview. Its editor validates and activates a new named strategy. Routing and project strategy precedence are explained in the UI.

• Managed work dispatch through CLI, API and MCP: any supported executor can request a child task, and Pacer selects an eligible executor, account and model using configurable strategy steps, capability tiers, live capacity and usage evidence. Decisions, reservations, lineage, dependencies, scoped grants and independent reviews are recorded for inspection.

• Replaceable decision engines and observation adapters, with bounded provider refresh and reviewed-outcome learning. The Tasks UI and TUI show dispatched work, its tree, timeline, model evidence and review actions. Ordinary interactive sessions and legacy delegation retain their existing routes.

• Managed work can retry or answer in the same task and worktree with revision checks, stable request IDs, cumulative attempt limits and prior review evidence. Work views distinguish execution, dependency, capacity and child waiting, and group shared account usage without counting overlapping parent and child readings twice.

• Refresh usage for idle accounts every 15 minutes while the service runs, or on demand with pacer limits refresh [account], the v3 API, and the app Usage popover. Codex queries its read-only app-server rate limits; provider adapters retain historical readings when refresh fails.

• Discoverable v3 CLI operations through pacer api list, describe and call, with filtered metadata, JSON schemas and bounded JSON file/stdin input. The Pacer skill teaches on-demand discovery for product controls.

• Scriptable authenticated session I/O, attachment upload/list/download/removal, and targeted acknowledged page/native controls for appearance, navigation, windows and tray actions.

Fixed

• Release a finished conversation's runner ownership so a failed session can resume once its terminal has stopped. Explain disk-full failures and provide an attach command when a terminal viewer cannot open.

• Use the preferred terminal selected in This machine for session viewers and other local terminal actions, while preserving existing terminal.app preferences.

• Round the tray panel corners and overlay its More menu without growing the panel.

• Reopening a running Pacer task from the Tasks list now takes control of an unheld live terminal, including interactive conversations, while preserving explicit takeover when another viewer holds it.

• Keep legacy connected Claude settings usable after unrelated settings edits when pacer's hooks are intact; show the recorded failure reason on a failed interactive session.

• Honor protocol v3 for in-process clients and retain executor role restrictions when generic CLI calls use a planner-owned service. Explicit service selection never retries refused calls locally.

• Complete native interactive adapters for Claude Code, Codex and OpenCode: detect CLI capabilities instead of pinning an exact version, retain native conversation identity for resume, honor named accounts and OpenCode models, and report native session activity. Explicit conversations can select the planner account while retaining execution guardrails.

• Align Tasks and Start work with Overview's full-width page gutters and bordered sections. Keep task metadata and actions in stable desktop columns, show complete titles when space permits, and retain full-title tooltips when long titles clip.

• Remove compounded spacing in app sections, cards, settings and embedded page headers; keep task disclosures evenly spaced and compact while preserving touch targets. Add shared spacing ownership checks and browser geometry regressions.

Changed

• Settings → Dispatcher now contains saved global profiles and executor eligibility, including repository overrides. Former Routing and Strategies links redirect there.

• Open tasks in a split workspace with a task navigator and a larger session pane. Keep task details compact, make each list row one navigation target, and use the main Tasks route for returning to the list.

• Add a read-only ui:ready preflight for PR evidence and make skipped local evidence checks explicit; centralize the agent readiness procedure in the UI rules.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.9.0

Fixed

• Select the ArkCLI quota reader for OpenCode’s coding-plan provider during setup and recover existing Ark Coding Plan quota accounts that have no usage source configured.

• Use one keyboard-accessible, searchable dropdown style across Start work, delegation, Settings and retry/review, with aligned Start work fields and a styled native attachment trigger. Missing repository/workspace choices now block starting a session.

Changed

• Use macOS native title-bar controls and rounded window corners; keep the compact header fixed while content scrolls.
• Show usage and screen shortcuts in a persistent desktop status bar, and keep Overview cards sized to their own content.
• Open account-level quota windows, reset times, and reading freshness from the desktop status bar.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.8.1

Fixed

• Refresh each executed account's available usage source after a task completes, so Codex session logs and supported provider commands can update the recorded ending usage without waiting for their normal cache interval.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.8.0

Fixed

• Preserve embedded agent TUI fonts, cell layout and ANSI colors under the app's strict security policy; prevent automation color suppression from flattening native interactive sessions. Session end/resume reads the current revision rather than retaining stale progress state, and resume does not replay the initial prompt or attachments.
• Restore a compact left navigation rail and unify the desktop page header with custom window controls, removing duplicate titlebar rows while preserving touch navigation.
• Finish executor setup with OK to clear the wizard and return to Executors, or Add another executor to start fresh at agent selection.
• Task details use the short name and persistent Summary/Session tabs, with quiet back navigation and remembered task-list scroll position.
• Align desktop buttons, dropdowns and inputs with the compact Delegate control, tighten task-page spacing, and preserve touch targets, multiline fields and compact tray controls.
• Show native desktop update connection failures in Settings instead of silently presenting manual installation as the normal update path.
• Start work agents with unattended permission settings across headless, interactive, resumed and strategy-planning sessions. Codex worktrees and reporting hooks no longer stop at trust prompts; Antigravity and OpenCode interactive launches use their supported prompt and configuration interfaces. Orca-selected work falls back to direct execution because its worker API cannot enforce permission bypass.
• Refuse automatic release tags after a missing or failed dry run, or when the merge differs from the tested PR head. Prebuild Rust test fixtures during release verification and update the desktop navigation assertion.

Added

• Interactive start screen with agent/account selection, isolated worktrees, private file and screenshot uploads, and persistent native agent terminals. Conversations retain their selected executor, survive completed turns and window closure, and support explicit end/resume where the agent reports an identity.

• Diagnostics groups setup issues by integration and account, with reviewed repair actions, inline progress and errors, automatic rechecks, and collapsed passed checks and technical details. The live harness can validate the fixed Codex repair in its isolated UI fixture.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.7.1

Fixed

• Allow cold Rust fixture compilation during release verification and check the current desktop titlebar in responsive shell tests. This unblocks publishing the companion-aware bridge updater.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.6.2

• Normalize absent compiled desktop signer pins and validate production macOS signing in enabled release dry runs before tagging.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.6.1

• Fix Linux desktop release compilation, secure temporary macOS signing keychain permissions before importing release credentials, and create missing parent directories for the release feed dry run.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.

pacer 0.5.0

Added

• One-click releases: Prepare release picks the next version from commit titles, opens the release PR, dry-runs it and auto-merges it; Release tag then tags and publishes. Release PRs that change only version strings no longer need a UI evidence manifest.
• Settings Diagnostics runs doctor checks with repair guidance, distinguishes configured integrations from fixture-tested handlers and unverified Claude invocation, and flags disabled or incomplete Claude hooks.

Changed

• pacer dashboard is redesigned on the shared design system: Home, Review, Sessions, Settings and Setup screens mirror the app, statuses are glyph plus label, colors follow the design tokens for dark and light terminals, destructive actions confirm, and --plain and --once print screen-reader-friendly or single frames. The dashboard now reads and writes only through the API.

Fixed

• Linux arm64 gets an AppImage again. AppImages now bundle the CLI untouched: linuxdeploy's patchelf step corrupted Bun-compiled binaries, so they are repacked after bundling and the bundled CLI is checked before release (#217).
• The interactive account and endpoint setup checks each answer as it is entered and asks again instead of aborting: kind, name, key storage, usage, weekly token budget (with a budget-specific message) and quota source. A blank quota source selects arkcli instead of saving an empty value, with a warning when arkcli is not on PATH. Endpoint setup now asks where to keep the key on add as well as edit (Keychain on macOS and a file elsewhere by default). Endpoint save errors show their full reason instead of only the first line, and migration notices no longer print array indexes.
• Account sign-in state now has one source, the local login indicator plus recorded authentication failures, shared by account list, routing, the Executors and Accounts screens, attention and runner.check. account list reports signedIn: true/false for native accounts instead of always null; a signed-out executor shows as Unavailable with its reason instead of Ready; the Accounts screen shows endpoint state (Ready, Not tested, Not working, Key missing) for endpoints and offers Fix sign-in only for signed-out native accounts.
• runner.check no longer fails a signed-in Claude or Codex account that has no usage reading yet: Signed in uses the sign-in state rather than usage, and Usage readable is skipped with the reason, so the test task runs.
• pacer route without --repo uses the project policy of the registered repository in the current directory, as pacer delegate does, instead of always showing global routing.
• pacer project strategy set --executors '' explains that pacer project strategy remove restores the global strategy, instead of reporting an unknown option.
• When an explicitly requested executor cannot run and another one does, the task records executorFallback (executor_fallback in summaries) with the requested executor and the reason, and tasks, tasks <id> and delegate --wait show it. Fallback behavior is unchanged.
• The Executors settings no longer claim that an executor failing its check is skipped until it passes; a failed check marks it Failing and raises attention, and routing keeps using it unless it is unavailable for another reason (as before). Disable it to skip it.
• An endpoint executor that has never passed its test task reads Not tested in the Executors screen, Overview and tray instead of Ready, matching its account (routing still uses it, as before; the executor summary adds untested: true). Add executor offers Sign in only for a signed-out native account, each Fix sign-in disclosure names its account for screen readers, and an executor row no longer repeats its reason under Last check.
• The accounts guide gives the real default folder for pacer-managed accounts, ~/.<kind>-<name>, instead of ~/.pacer/accounts/<name>.

The app is not yet signed. On first open, Control-click pacer in Applications and choose Open.