octoscode-web v0.11.0

First stable 0.11.0, promoting v0.11.0-rc.3 with the hardening that landed on main since the candidate. Verified against Octos Core v2.0.3 (fca32c4): the pinned Core runtime and UI Protocol contract advance from v2.0.3-rc.13 to v2.0.3, and the released archive's octoscode-web-build.json records that baseline.

• Interrupting a running turn no longer leaves a stale retry path: the steering delivery view carries a staleness guard, and the Retry-queued-delivery dispatch has a regression test.
• Taking over a Session held by another tab returns focus to the composer so keyboard users can continue typing immediately.
• Search input polish with a clearer no-match signal, the match count stays hidden until a query exists, and the case-sensitive toggle persists across reload.
• Commands and search wording is fully translated, including the zh follow-ups for the reworded steer entry and the commands section title.
• Redaction tests now cover the access_token and apikey patterns.

Validation: real-Core integration plus the GLM live gate (real-model turn with tools, reload restore, background turn) ran green against real octos serve v2.0.3; the artifact SHA-256 is cf93cdcc5d7580d19dfcd741845c7e3b1c98710ef3782ed6decaa42129e4b500 with build provenance attestation.

---

cat
/tmp/rel-notes-current.md

octoscode-web v0.11.0-rc.3

What's Changed

• fix(timeline): read data.path for file_attached (top-level field) by @anantheparty in #160
• refactor: consolidate duplicate errorMessage helpers by @anantheparty in #161
• refactor: consolidate 5 duplicate isRecord into shared/guards.ts by @anantheparty in #162
• fix(web): list a workspace's real session history in the sidebar by @ymote in #158
• feat(web): copy the conversation as Markdown from the header by @ymote in #164
• fix(web): show, preview and download files the agent delivers by @ymote in #163
• chore: remove 2 confirmed dead files (v3 audit) by @anantheparty in #165
• fix(security): expand redactSecrets to cover auth_token and api_key by @anantheparty in #166
• fix(timeline): distinguish rate_limited from generic turn failure by @anantheparty in #167
• test: use a neutral workspace path in the live receipt fixture by @ymote in #168
• chore(deps): bump katex from 0.18.7 to 0.18.9 in the production-dependencies group by @dependabot[bot] in #170
• chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in #171
• chore: remove dead CSS v4 — 38 blocks verified 0 references by @anantheparty in #172
• docs: sync ADRs with current sessions, drafts, and Activity by @ymote in #173
• chore: remove dead CSS v5 — 14 fully-dead rules by @anantheparty in #174
• test: cover auth_token and api_key redaction by @anantheparty in #175
• feat(timeline): in-conversation search with CSS Custom Highlights API by @anantheparty in #176
• feat(search): case-sensitivity toggle by @anantheparty in #177
• fix(deps): unify katex to 0.16.47 — CSS and engine now match by @anantheparty in #178
• feat(search): Enter/Shift+Enter navigation + live match count by @anantheparty in #179
• feat(session): cross-tab session ownership via Web Locks by @anantheparty in #180
• perf(search): debounce MutationObserver re-search during streaming by @anantheparty in #181
• chore: fresh-eyes audit v7 follow-ups by @anantheparty in #182
• feat(session): gate dispatch while another tab owns the session lock by @anantheparty in #183
• chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #185
• chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in #184
• perf(settings): preload settings panel chunks during idle by @anantheparty in #186
• Apply the selected OctosCode logo throughout the web app by @ymote in #187
• feat(commands): keyboard shortcuts help overlay (? key) by @anantheparty in #188
• fix(commands): Escape closes the shortcuts help overlay by @anantheparty in #189
• test(policy): enforce single katex resolution in pnpm-lock.yaml by @anantheparty in #190
• chore: dead CSS v6 + audit v8 follow-ups by @anantheparty in #191
• fix(commands): focus trap in the shortcuts help overlay by @anantheparty in #192
• fix(activity): keep the triage filter across panel opens by @anantheparty in #193
• docs(protocol): record the server/shutdown control surface by @anantheparty in #194
• test(search): unit-test the match-collection core by @anantheparty in #195
• feat(search): two-stage Escape — clear first, then close by @anantheparty in #196
• fix(search): reachable on an empty session by @anantheparty in #197
• fix(commands): ⌘K/⌘F work from inside the composer by @anantheparty in #198
• fix(search): render the bar in the session-open branch by @anantheparty in #199
• fix(search): ⌘F swings back to Chat from the Trajectory tab by @anantheparty in #200
• test(search): e2e coverage for the conversation search flow by @anantheparty in #201
• feat(composer): steer by default with Queue and Send now controls by @ymote in #202
• docs(changelog): record steer-by-default under Unreleased by @anantheparty in #203
• docs(changelog): backfill search, tab-lock, and shortcuts-help entries by @anantheparty in #204
• docs(readme): record conversation search and steer-by-default by @anantheparty in #205
• test(e2e): cover steer-by-default composer semantics by @anantheparty in #206
• fix(brand): align PWA and Safari pinned-tab colors with the new logo by @anantheparty in #207
• feat(review): expose workspace changes before the first turn by @ymote in #208
• docs(changelog): record Keep Changes before the first turn by @anantheparty in #209
• feat(commands): composer section in the shortcuts help overlay by @anantheparty in #210
• fix(commands): §8 suppression covers contenteditable=plaintext-only by @anantheparty in #211
• docs(commands): help overlay reflects the two-stage search Escape by @anantheparty in #212
• a11y(search): announce match progress to screen readers by @anantheparty in #213
• fix(commands): chords stay out of modal dialogs + repeat/session guards by @anantheparty in #215
• fix(composer): steerUnknown copy tells the truthful recovery path by @anantheparty in #216
• docs: audit v9 follow-ups — stale banner comment + changelog wording by @anantheparty in #214
• feat(composer): retry control for the steerUnknown latch by @anantheparty in #219
• fix(session): Send-now respects the cross-tab session lock by @anantheparty in #220
• refactor(client): align diff-methods with the sibling grouped pattern by @anantheparty in #221
• fix(composer): audit v10 P1s + retry delivery control + follow-ups by @anantheparty in #222
• fix(composer): report inconclusive steers at settle without upserting acceptance by @anantheparty in #223
• feat(search): remember case-sensitivity across reloads by @anantheparty in #224
• i18n: zh catalog + t() wiring for the new search/lock/help surfaces by @anantheparty in #225
• test(steering): regression for the Retry-queued-delivery dispatch by @anantheparty in #226
• chore(release): v0.11.0-rc.3 by @anantheparty in #227
• chore(release): sync packages/client version to 0.11.0-rc.3 by @anantheparty in #228

Full Changelog: v0.11.0-rc.2...v0.11.0-rc.3

octoscode-web v0.11.0-rc.2

What's Changed

• test(timeline): lock the role=log landmark at unit level by @anantheparty in #60
• chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #104
• fix(connection): require auth token before connect by @anantheparty in #115
• feat(timeline): scroll-driven reading progress bar by @anantheparty in #116
• test(client): property-based tests for wire-decoders by @anantheparty in #118
• fix(web): offer a server this browser saw, even at the default origin by @ymote in #113
• fix(web): let pnpm dev connect — make the parked-connect claim StrictMode-safe by @ymote in #119
• feat(composer): persist drafts across tab close by @anantheparty in #122
• feat(web): close every settings pane with an × in the top-right corner by @ymote in #120
• feat(web): render markdown while a reply is still streaming by @ymote in #121
• docs: establish 0.20 maintenance workflow and acceptance ledger by @anantheparty in #126
• fix(web): widen the chat column and soften the composer by @ymote in #125
• fix(web): resolve parity audit gaps in identity and interaction by @anantheparty in #130
• feat(web): stop the Octos server from Settings by @ymote in #129
• web-parity 8: disclose when another client owns the session by @ymote in #112
• docs: separate release outcomes from stale implementation proposals by @anantheparty in #135
• fix: restore unsent input after an explicit turn rejection by @anantheparty in #137
• fix(composer): restore durable drafts for the authenticated user by @anantheparty in #134
• fix(web): let the user continue past a turn the server lost by @ymote in #133
• perf: open primary settings without first-click loading delay by @anantheparty in #132
• feat: retain concurrent sessions and expand the coding workspace by @ymote in #105
• chore: remove dead code identified by external audit by @anantheparty in #140
• chore(deps): bump production deps + regenerate licenses by @anantheparty in #141
• fix(composer): graceful draft eviction instead of permanent save lock by @anantheparty in #142
• feat(app): Cmd/Ctrl+K toggles the command palette by @anantheparty in #147
• chore: remove dead code v2 — 630 dead CSS lines + SettingsView.tsx by @anantheparty in #148
• fix(composer): evict draft durable copies with the cache and un-fixme the 51st-draft e2e by @BH3GEI in #149
• fix(timeline): handle file_attached projection event by @anantheparty in #150
• docs(adr): record the rejected ADR 0016 self-application (#58) by @BH3GEI in #151
• fix: address security + correctness audit findings by @anantheparty in #152
• docs: record the capability-gated Stop server control (#144) by @BH3GEI in #153
• chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #154
• Prepare octoscode-web v0.11.0-rc.1 by @ymote in #155
• Release octoscode-web v0.11.0-rc.2 on Octos RC.13 by @ymote in #156
• Pin Web v0.11.0-rc.2 to Octos RC.13 by @ymote in #157

Full Changelog: v0.10.0...v0.11.0-rc.2

octoscode-web v0.10.0

What's Changed

• chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #5
• chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #4
• chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #6
• chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #7
• chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot[bot] in #8
• chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #9
• fix(deploy): repeat security headers inside header-declaring locations by @anantheparty in #10
• perf(web): vendor chunk split and on-demand shiki grammars by @anantheparty in #19
• docs: add README screenshots (light and dark coding session) by @anantheparty in #24
• fix(a11y): batch 1 — tree semantics, focus visibility, live log, contrast by @anantheparty in #25
• feat(web): taste batch 1 — skeletons, press feedback, stagger, numeric mono by @anantheparty in #26
• feat(web): recovery banner severity and shared RefreshIcon by @anantheparty in #27
• feat(a11y): tree keyboard navigation via aria-activedescendant by @anantheparty in #28
• fix(session): drop recovery-buffered replays already covered by hydrate by @anantheparty in #29
• fix(session): treat hydrate session mismatch during recovery as fatal by @anantheparty in #30
• feat(web): picker skeleton rows and dark-mode bubble elevation by @anantheparty in #31
• fix(timeline): sweep stale streaming tails when a turn completes by @anantheparty in #33
• refactor(web): migrate inline SVGs to the shared Icon set by @anantheparty in #34
• fix(connection): guide token refresh on handshake failures by @anantheparty in #35
• test(e2e): visual regression baselines over the deterministic fixture by @anantheparty in #36
• feat(web): spacing scale tokens and first migration batch by @anantheparty in #37
• refactor(settings): use shared PlusIcon in ModelManagementSection by @anantheparty in #38
• test(e2e): pending-question restore repro + fixture fidelity gap by @anantheparty in #40
• style(web): normalize off-grid spacing literals to the scale (batch A) by @anantheparty in #44
• fix(fixture): session-scoped pending interactions so hydrate restores them by @anantheparty in #45
• perf(timeline): memo entry boundaries and content-visibility by @anantheparty in #46
• feat(settings): copy-diagnostics action in General settings by @anantheparty in #47
• fix(a11y): first ArrowDown activates the first tree item; regression test by @anantheparty in #48
• feat(settings): wire the runtime diagnostics ring into the snapshot by @anantheparty in #49
• fix(a11y): focusable main for the skip link; keyboard-path e2e by @anantheparty in #50
• feat(app): session deep links via ?s= by @anantheparty in #51
• test(e2e): long-animation-frame budget gate for the streaming phase by @anantheparty in #52
• feat(timeline): follow contract — stick-to-bottom, detach, jump-latest by @anantheparty in #59
• feat(composer): auto-grow input via field-sizing where supported by @anantheparty in #61
• feat(timeline): collapsible reasoning blocks and tool cards by @anantheparty in #71
• style(timeline): outdent speaker names past the body indent by @anantheparty in #72
• feat(timeline): motion layer for collapsible blocks by @anantheparty in #73
• feat(composer): deep-thinking indicator for the send→first-delta gap by @anantheparty in #74
• fix(timeline): prevent heading clip from content-visibility containment by @anantheparty in #75
• fix(session): surface lost background handoffs, start timeouts, and recovery causes by @BH3GEI in #70
• fix(composer): widen thinking-indicator visibility window by @anantheparty in #76
• fix(timeline): settle segmented reasoning entries on turn_terminal by @anantheparty in #77
• docs: full audit handoff by @anantheparty in #80
• docs: handoff update with streaming audit findings by @anantheparty in #85
• fix: make workspace interaction and session recovery reliable by @anantheparty in #87
• fix: remove redundant assistant reply label by @anantheparty in #88
• feat(theme): manual light/dark/system toggle in the sidebar by @anantheparty in #89
• fix(theme): complete token coverage for manual light/dark override by @anantheparty in #91
• polish: 0.10 release polish — line width, copy, placeholder cleanup by @anantheparty in #90
• docs: briefing update by @anantheparty in #92
• fix(ui): Settings loading placeholder sized to match actual dialog by @anantheparty in #93
• fix: close Codex 0.10 history, protocol and interface audit gaps by @anantheparty in #94
• docs: record final Codex 0.10 acceptance and deployment evidence by @anantheparty in #95
• fix: complete self-hosted workflows and recovery safeguards by @anantheparty in #96
• test: remove redundant coverage and constrain future test growth by @anantheparty in #97
• refactor: remove obsolete code and low-value tests by @anantheparty in #98
• fix: reduce interaction stalls and stabilize session navigation by @anantheparty in #99
• release: v0.10.0 by @anantheparty in #100
• fix(ci): add --repo to gh release commands in publish job by @anantheparty in #101
• fix: honor session selections while navigation is pending by @anantheparty in #102

New Contributors

• @dependabot[bot] made their first contribution in #5
• @anantheparty made their first contribution in #10
• @BH3GEI made their first contribution in #70

Full Changelog: v0.1.0-rc.2...v0.10.0

octoscode-web v0.1.0-rc.2

Changelog

v0.1.0-rc.2 — 2026-08-26

• Record both the generated protocol source pin and checksummed released Core
  runtime baseline in the deployed build manifest.
• Mark release-candidate tags as GitHub prereleases and ship security/changelog
  metadata with the static archive.
• Make settled Markdown links, syntax tokens, and task-list controls pass the
  deterministic light-theme WCAG 2/2.1 A/AA gate.

v0.1.0-rc.1 — 2026-08-26

First release candidate of the standalone Octoscode browser client.

• Durable UI Protocol hydrate, cursor replay, dedupe, reconnect, and gap repair.
• Octoscode-compatible prompt queue, interrupt, launch, approval, question, and
  canonical coding-session semantics.
• Safe Markdown/code transcript, server-owned permissions and diff review,
  plans, tasks, paged output/artifacts, context/cost/model status, and bounded
  cross-session activity.
• Session navigation with per-session drafts and capability-gated Core forward
  methods.
• Browser-first solo profile/provider onboarding with transient credentials,
  provider test-before-save, partial-failure recovery, and a TUI fallback.
• DSH-derived visual language with the MIT notice preserved.
• Strict protocol decoders, generated Core vocabulary, pinned checksummed real
  Core integration, Chromium/WCAG gates, hardened deployment reference, and
  versioned static release artifacts.

octoscode-web v0.1.0-rc.1

Changelog

v0.1.0-rc.1 — 2026-08-26

First release candidate of the standalone Octoscode browser client.

• Durable UI Protocol hydrate, cursor replay, dedupe, reconnect, and gap repair.
• Octoscode-compatible prompt queue, interrupt, launch, approval, question, and
  canonical coding-session semantics.
• Safe Markdown/code transcript, server-owned permissions and diff review,
  plans, tasks, paged output/artifacts, context/cost/model status, and bounded
  cross-session activity.
• Session navigation with per-session drafts and capability-gated Core forward
  methods.
• Browser-first solo profile/provider onboarding with transient credentials,
  provider test-before-save, partial-failure recovery, and a TUI fallback.
• DSH-derived visual language with the MIT notice preserved.
• Strict protocol decoders, generated Core vocabulary, pinned checksummed real
  Core integration, Chromium/WCAG gates, hardened deployment reference, and
  versioned static release artifacts.