v0.7.0

Volute CVC v0.7.0

Volute CVC v0.7.0 adds a Claude Code harness: sessions of Anthropic's Claude Code agent are recorded from the transcript it writes, through its own lifecycle hooks, with no cooperation needed from the model, and the response that runs git commit is linked to the commit it created. The release also hardens the local store for parallel worktree sessions, closes two gaps in the consent gate, and smooths the first-run path across the CLI, the MCP server, and the VS Code extension.

CVC keeps explicitly available AI-assisted development context alongside Git history. It records only information exposed or supplied by its integrations; it neither retrieves hidden chain-of-thought nor promises a verbatim record of a black-box model's internal reasoning.

Full Changelog

Highlights

Claude Code harness

• cvc harness install claude-code writes PostToolUse, Stop, and SessionEnd hook entries, carrying the absolute path of the running cvc, into the checkout's .claude/settings.local.json, and keeps that machine-specific file out of Git through info/exclude. The install is per checkout; each linked worktree needs its own. cvc harness uninstall claude-code removes exactly those entries. (#31)
• cvc ingest claude-code records each completed assistant response of a session transcript as one private thought: the prompt or tool results it reacted to become the prompt, exposed thinking becomes model_cot, text becomes the response, and tool calls become tool executions carrying the status of their results. Paths the session read or edited inside the worktree become file context, subject to .thoughtignore. Ingestion is incremental from a per-session byte cursor and idempotent through deterministic interaction ids, so a hook run never duplicates a thought or disturbs a link it already earned. The hook form reads Claude Code's stdin payload, prints nothing, and never returns the blocking exit status; the explicit form takes --transcript <path> for a finished session or one recorded before the hooks existed.
• Commit links from transcript evidence. The response that runs git commit reaches the store only after the post-commit hook has run, so the time-window linker could never reach it. Ingest now reads the commit the session's own git command created, verifies it against the repository, and links that response and the reasoning before it to the commit, segmented so each commit claims only the reasoning since the previous one. The commit is identified from the command's recorded output: git's own summary line, a hash at the start of a line as git log --oneline prints, a full hash, or the line the post-commit hook itself prints, which now names the commit, so a quiet git commit -q links too. A hash that does not resolve, or whose time contradicts the transcript, links nothing. (#70, #102)
• Subagent transcripts stored beside the session are ingested in the same pass, each as its own conversation named <session>:agent-<id> and titled from Claude Code's metadata for the agent. (#71)
• Conversations carry Claude Code's session title, the one you set or the one it generates, with the first prompt standing in until either exists. (#101)
• Tolerant of unfamiliar content blocks. Claude Code adds content block types within a major version; one such block used to fail an entire session. A block type the parser does not know is now kept as a bracketed placeholder naming the type, never its content, and counted in the ingest summary. Entries outside the conversation chain, such as the request caches Claude Code 2.1.300 writes, are skipped whatever they carry. A transcript of another major version, or a chained entry of an unknown shape, is still refused whole. (#84, #110)
• The harness is a passive channel: like the VS Code watcher, it records nothing until the repository-local capture acknowledgement exists, and captures are attributed to the worktree the hook ran in, so parallel checkouts cannot claim each other's thoughts. Scrubbing, .thoughtignore, per-conversation sharing, and per-destination consent apply unchanged.

Reliability under parallel sessions

• The MCP server no longer loses its own thoughts. cvc-mcp inspected the database file outside SQLite, which on Unix released the process's WAL lock; the next CLI command or Git hook then checkpointed and removed the write-ahead log under the running server, and every later commit_thought landed in a file only that server could see. The server now derives its binding identity without opening the file, and the store treats a vanished write-ahead log as a failed write instead of a silent success. (#60)
• Writers wait instead of failing. Every writing transaction begins immediately, so SQLite's busy handler always applies, and a writer waits up to 2 s for a competitor before giving up, up from 250 ms. "CVC Hook Warning: Failed to link artifacts: database is locked" no longer appears in normal parallel-worktree operation; hooks remain advisory and still fail closed past that patience. (#40)
• Exact squash relinking works across linked worktrees. Range evidence gains a v2 identity hashed from the canonical common Git directory, so a range observed from two worktrees of one repository is one record, not two conflicting ones; existing duplicated v1 records are unified. Ranges that genuinely disagree still refuse to relink. (#39)
• A linked worktree whose administrative directory holds a broken gitdir marker without a commondir is refused rather than treated as a standalone repository. (#42)

Consent gate

• Typed acknowledgements come from the terminal, not from stdin. On Unix the challenge opens the controlling terminal directly, discards pending input immediately before the prompt is shown, and reads one byte at a time, so a pasted runbook or type-ahead cannot answer a challenge before it is displayed. (#22)
• cvc share --push honours an existing auto-push grant for the destination instead of demanding a second I PUBLISH challenge for a decision already made; without that grant the challenge follows as before. (#24)

First-run polish

• cvc --version and cvc --help print to stdout and exit 0; cvc-mcp reports its real version to MCP clients. (#85)
• The stubbed cvc component and cvc auth subcommands, which simulated success, are removed along with the HTTP client and keyring dependencies they pulled in. (#86)
• VS Code: Volute: Check Setup refreshes the CLI path and starts the language server after a mid-session CLI install, so the prompted first-run flow no longer needs a window reload, and a CLI task that cannot start says so instead of silently doing nothing. (#41)
• cvc harness install claude-code tells you that hooks apply to new Claude Code sessions and how to verify capture; the README carries an ordered Claude Code quick start; the @volute_cvc/cvc-mcp npm package has a README. (#91)
• Release engineering: the Marketplace publish step is convergent, so a rerun after a gallery timeout publishes only the missing platform targets. (#69)

Included components

• cvc-core — Rust library for local storage, Git integration, policy enforcement, linking, sync data structures, and the Claude Code transcript adapter.
• cvc-cli — the cvc command-line interface, including cvc harness and cvc ingest.
• cvc-mcp — MCP server for explicitly submitted interaction records and local history access.
• cvc-lsp — language server used by editor integrations.
• cvc-plugin — VS Code extension for the supported local VS Code chat-session workflow.
• cvc-reviewer — client-side React reviewer for GitHub-hosted CVC data.
• @volute_cvc/cvc-mcp — npm launcher for released CVC binaries (cvc-mcp and cvc).

Install

GitHub release assets

Once the full release workflow completes, download an archive and SHA256SUMS.txt from the v0.7.0 GitHub release. Verify the archive against that manifest before extracting it, then put cvc (or cvc.exe) on PATH. Each archive includes cvc, cvc-mcp, and cvc-lsp.

Platform	Archive
Linux x86-64	cvc-x86_64-unknown-linux-gnu.tar.gz
macOS x86-64	cvc-x86_64-apple-darwin.tar.gz
macOS ARM64	cvc-aarch64-apple-darwin.tar.gz
Windows x86-64	cvc-x86_64-pc-windows-msvc.zip

Expected additional release assets are LICENSE, THIRD-PARTY-NOTICES.md, install.sh, and install.ps1. Each native archive and VSIX also includes the mechanically generated third-party notice file. The standalone installer assets default to v0.7.0, select the matching supported archive, and verify its checksum; set CVC_RELEASE_VERSION to an explicit valid release tag to override that version. Review a script before running it.

From any Git working tree, get started with:

cvc init
cvc status
cvc conversations

Capture Claude Code sessions

With cvc installed, from the checkout you work in:

1. cvc init — create the local cache and the advisory Git hooks.
2. cvc privacy acknowledge-capture — the one-time local capture acknowledgement, an interactive typed challenge; passive capture stays off until it is granted.
3. cvc harness install claude-code — write the capture hooks into this checkout's .claude/settings.local.json.
4. Start a new Claude Code session; a session already running does not pick up the hooks.
5. Work as usual, then cvc conversations to see the captured sessions and cvc log for detail.

VS Code Marketplace

After the full release workflow completes, Volute CVC (volute.cvc) is expected to be available from the VS Code Marketplace. The extension supports VS Code ^1.91.0 and uses the platform-specific bundled language server. On a machine without the CLI it prompts to install it; after installing, run Volute: Check Setup.

npm MCP launcher

After the full release workflow completes, the @volute_cvc/cvc-mcp launcher is expected to be available from npm:

npm install --global @volute_cvc/cvc-mcp@0.7.0

It provides cvc-mcp and cvc, downloads the matching release binary on first use, and verifies it against the release checksum manifest. Configure cvc-mcp in your MCP client as documented in the MCP setup guide.

Upgrade notes

• One automatic database migration. The first time a v0.7.0 component opens a repository's store, the interactions table is rebuilt once inside a single transaction to admit the new claude_code capture source (capture-source-claude-code/v1), rows copied verbatim, and the harness_ingest_cursors table is created. The widened constraint is a superset of the old one, so v0.5.x and v0.6.0 binaries keep working on a migrated store; upgrade the CLI, language server, and MCP server on a machine together all the same, since they share it.
• Restart running MCP servers. The fix for #60 is in the cvc-mcp binary. An MCP host keeps its server process alive for the session, so after installing v0.7.0 restart the host or the session; a v0.5.0 or v0.6.0 server that is still running keeps the defect.
• No wire-format change. Sync output remains byte-compatible v5. Range evidence records written by v0.7.0 use the new v2 identity; v1 records stay readable and verifiable and are never silently rewritten.
• Consent semantics are unchanged: the same challenges, the same per-destination boundaries, the same inert bare cvc push without a standing auto-push grant. The capture acknowledgement now also gates the Claude Code harness.
• Removed: cvc component and cvc auth, which had no real behaviour. Installation remains the release archives, the installer scripts, and the npm launcher; there is no authentication feature in the open-source CLI.
• Scripts that relied on cvc --version writing to stderr with exit status 1 must expect stdout and exit status 0.
• Claude Code hooks are installed per checkout and are picked up by new sessions only.

Privacy and sharing

CVC is local-first, not local-only. Captures live under the repository's common Git directory in cvc/ and are private by default; linked worktrees share that private store. Remote publication is a separate, explicit action behind per-destination consent and an interactive challenge. Privacy.md's "How your data moves" section describes the full lifecycle in plain language, and now covers transcript ingestion.

A Claude Code transcript contains everything the session saw: prompts, tool output, and file contents the agent read. CVC applies its scrubbing, .thoughtignore path rules, and bounded rendering of tool output on the way in, but review a conversation with cvc conversations and cvc log before sharing it. Built-in scrubbing and .thoughtignore are defense in depth, not a guarantee. Once published to Git, content may remain in objects, clones, forks, reflogs, caches, and backups. Rotate an exposed credential first; local deletion and tombstones are suppression mechanisms, not guaranteed physical erasure.

Release security and hardening

• Release tags must exactly match the Rust, VS Code extension, and npm package versions before publishing, and are SSH-signed by the dedicated release identity documented in RELEASING.md (fingerprint published there for pin-verification).
• Release archives include a SHA-256 manifest; the installer and npm launcher verify the selected archive and reject unsafe redirects or archive members.
• The workflow pins its GitHub Actions by full immutable Git object SHA, uses scoped job permissions, and publishes GitHub build provenance attestations for workflow assets: gh attestation verify <asset> --repo meirka8/volute.
• npm publishing is configured to use npm trusted publishing.
• The CLI no longer links an HTTP client or an OS keyring library; the third-party notice inventory shrank accordingly.

The same-release SHA-256 checksums are corruption/integrity checks, not independent signatures. Download only from this repository and review installers before running them.

Known limitations

• Linux ARM64 is not released. The installers and npm launcher support the same platform matrix and reject unsupported platforms before downloading an asset.
• The Claude Code transcript format is internal to Claude Code and may change between its releases. The parser is pinned to transcript major version 2 and verified against recorded fixtures of 2.1.219, 2.1.260, 2.1.289, and 2.1.300 sessions; another major version is refused whole, and an unfamiliar content block becomes a counted placeholder. Ingest reports the transcript version it refused.
• A worktree created by Claude Code's worktree option starts without the harness. The hook entries live in each checkout's .claude/settings.local.json, and the "worktree" option in the Claude desktop app (or the EnterWorktree tool) creates a fresh checkout without it, so a session started there is not captured. Run cvc harness install claude-code inside that worktree and start the session again; automatic propagation through the post-checkout hook is tracked in #113. Cowork sessions, which run inside the desktop app's sandbox VM, are not supported.
• The Claude Code harness is verified on Linux and macOS only. Windows binaries are released and the hook installer writes a Windows-quoted command, but hook execution on Windows has not been exercised; treat the Claude Code path as untested there until a run is documented (#97).
• Advisory Git hooks call a bare cvc. If ~/.cvc/bin is not on the PATH Git's hook environment sees, post-commit time-window linking fails silently (#92). The Claude Code in-session commit links use an absolute path and are unaffected.
• Thoughts recorded through the MCP server link only as temporal, because commit_thought carries no file context (#23).
• Transcript-derived commit links are recorded with the generated grade; a distinct provenance grade for transcript evidence is a follow-up. Subagent conversations carry no recorded edge to the response that spawned them.
• cvc privacy status before cvc init reports a misleading .thoughtignore error instead of pointing at cvc init (#93).
• Sharing is explicit and per-conversation, by design. The VS Code extension's Share command still asks for a conversation id by text input.
• Hosted Reviewer requires deployment configuration. The default Reviewer mode is local PAT mode.

Trademarks and affiliation

Claude and Claude Code are trademarks of Anthropic. GitHub, Copilot, and Visual Studio Code are trademarks of their respective owners. Volute is not affiliated with, sponsored by, or endorsed by Anthropic, GitHub, GitHub Copilot, or Visual Studio Code.

Learn more and contribute

• README
• CLI reference
• Privacy reference
• Security policy
• Contributing guide