v0.17.4

Changelog

• ce05d6c chore(release): v0.17.4
• 721d30f fix(panes): open overlays focused and close them on a bare Esc or q

v0.17.3

Security hardening for release installation, updates, and daemon control.

• Managed updates now install the exact commit from the signed release statement before running build scripts. Subsequent updates remain available for commits installed by the updater.
• macOS, Linux, and Windows installers refuse to replace the binary unless the release signature verifies or an independently trusted, approved SHA-256 matches. A bad signature still aborts installation.
• Stop and resync never send signals to an unverified PID. Unverified processes can still receive requests through the daemon control channel, but stop timeouts cannot trigger forced termination.
• Build with Go 1.26.9 to include current standard-library security fixes, and update Staticcheck to 2026.1.

Installations without a trusted approved checksum now require working SSHSIG verification through OpenSSH 8.1 or newer. Checksums downloaded alongside a binary are no longer sufficient on their own.

Regression tests, race tests, lint, and build/vet checks for all five release targets passed locally. The host govulncheck scan reported no vulnerabilities.

Full changes: v0.17.2...v0.17.3

v0.17.2

Changelog

• 1738660 chore(release): v0.17.2
• 7fedd39 fix(crush): never type into a dialog of an agent Herdr does not drive
• 8b2ac9e fix(crush): type into panes of agents Herdr does not drive
• f96854c feat(prompt): answer a question's Type something entry with plain text
• 1a184c1 fix(prompt): type into a dialog only after the ✏️ press
• 57f13f8 Merge pull request #46 from alfonsodg/contrib4/opencode-store
• 5f7ec1b Merge pull request #45 from alfonsodg/contrib4/unreadable-notice
• 0000a28 fix(opencode): address the copilot review — one read event, shape-checked rows, docs (#39)
• 1772a12 fix(done): the unreadable notice counts delivered posts once per streak (#42)
• abcfb07 fix(opencode): read the last turn from the store, hardened per review (#39)
• 97f607b harden(done): warn when replies stay unreadable, with expected fallbacks excluded (#42)

v0.17.1

Bug fix: Claude Code pane scrolled after every turn

With Claude Code in full-screen mode ("tui": "fullscreen") or OpenCode
under Herdr 0.9.x, the agent's pane scrolled from the top of the
conversation to the bottom 2–3 times whenever a turn ended. A /screen all
from Telegram on an idle agent caused the same scroll.

Cause. Herdr 0.9.x builds the scrollback of an idle full-screen agent by
scrolling it with the mouse wheel. For a few seconds after each turn, the
plugin read 400 lines of recent output once a second, and it did the same
for /screen all.

Fix. Herdr refuses a recent read of a working full-screen agent with
agent_not_idle. The plugin now remembers that refusal until the agent goes
away and reads only the visible screen of that agent from then on, working
or idle. Herdr has no reason to scroll it any more. Agents with real
scrollback, such as Codex with alternate_screen = "never", keep reading
recent output as before.

Trade-off. The plugin now builds a full-screen agent's /screen all
history only from the snapshots it takes once a second while the agent
works. Output that moves past a whole screen within one second can leave a
gap.

Changelog

• c63b6a3 chore(release): v0.17.1
• 5b567ec fix(capture): stop scrolling full-screen agents after their turn

v0.17.0

Changelog

• 48a4879 chore(release): v0.17.0
• 3eef0b1 Merge branch 'fix/windows-signing-fixtures'
• ae7381b fix(ci): keep signing fixtures byte-exact on Windows checkouts
• 5919dc7 Merge branch 'feature/blocked-agent-text-delivery'
• 8518112 docs: free text to a blocked agent goes through pane.send_text
• 19f97b1 fix(prompt): type free text into a blocked agent's dialog
• 7c81f64 feat(herdr): map agent_blocked and add pane.send_text
• 7221203 Merge branch 'feature/signed-release-verification'
• 28382ed feat(update): trust the owner's release key
• ae60234 docs: signed releases, sign-release tooling and update trust model
• 63e5722 feat(install): verify release signatures in the install scripts and write a receipt
• 2874aa9 feat(update): require a signed release statement and pin the signed commit
• a639c0b feat(update): verify SSHSIG release statements with compiled-in keys
• 188dce7 Merge branch 'feature/audit-follow-up-hardening'
• 1021d39 fix(private): keep last buttons on failed refresh, check quota first
• 606d56e docs: audit follow-up behaviour
• 74ba038 Merge branch 'worktree-agent-a4fde518fea0642c4' into feature/audit-follow-up-hardening
• 696378c fix(private): attachments follow the inbox options and quota, pickers hold recipients too
• b9d4c32 Merge branch 'worktree-agent-a70b555f7547fb891' into feature/audit-follow-up-hardening
• 468e73c fix(readers): cap OpenCode export while writing, tie Muse pids to start time, open without blocking
• b6b719c fix(daemon): quieter and safer logs, byte-capped names, unlocked idle probe, snapshot deadline
• 222c9f9 fix(private): prune refreshed buttons, check grant time on /screen, wait out pending replies

v0.16.0

Changelog

• 2d8181c chore(release): v0.16.0
• 5ad97ed docs: /model opens OpenCode's picker too
• d2016c3 test: cover the audit fixes' neighbouring paths
• 60643cf fix(private): forwarded commands wait for an idle agent
• 5c9949f fix(daemon): a private reachability update never ends the run
• 0c6d78e fix(private): a dialog button answers only its own question
• 50e5875 fix(git): never enter a submodule to diff it
• 721120b fix(forward): /models only on OpenCode
• bf04483 fix(forward): hold back an attachment behind a kept picker
• 391d086 fix(done): a pending reply survives the pane being seen during the wait
• 0c9c03a docs: private sharing acceptance passed
• e45d970 docs: OpenCode /models picker
• 6c57550 feat(forward): OpenCode /models as a forwarded command
• 7ccbca0 docs(done-posts): a reply written a moment before the recorded turn start still counts (#18)
• 1463ed3 fix(done): forgive a reply written a moment before the recorded turn start (#18)
• b911a57 docs: Muse reply reader
• 131ba1e feat(outbound): Muse answers in done posts and /screen
• cd9acc5 feat(transcript): read Muse replies tied to the pane's process
• 02a9ac9 fix(test): Windows bus path and two racy waits
• 2f1a397 docs: dashboard quota lines
• 3b18887 feat(dashboard): quota lines in the General dashboard and /status
• 4e7331e feat(usage): Claude status line tap and Codex rate limit reader
• ffe56d2 refactor(transcript): decode pi messages by entry type alone
• 9939e9e docs: Pi reply reader
• da5b61b feat(outbound): Pi answers in done posts and /screen
• 49a5c5b feat(transcript): read Pi replies from the session file Herdr reports
• 32b8a4c docs: quiet mode on Linux
• 07141c0 feat(system): Linux input idle source via Mutter and xprintidle
• bfe6ebe docs: Antigravity reply reader
• ea49f8b feat(outbound): Antigravity answers in done posts and /screen
• befd937 feat(transcript): read Antigravity replies from the conversation transcript
• f555d8e docs: pickers on non-Claude agents
• 358fe7f feat(forward): hold back the message after a kept picker
• 23bedc1 fix(forward): keep non-Claude pickers open and say so
• 99496d0 docs: OpenCode export file and pending done posts
• c59a288 fix(outbound): wait for a finished OpenCode turn before the done post
• 3ee0ca0 fix(opencode): read the export through a private file and report unfinished turns

v0.15.0

Changelog

• debb7af chore(release): v0.15.0
• 8474fa1 docs: poll timing and starting without a network
• 63207c3 feat(daemon): keep trying Telegram at startup instead of exiting
• 2796313 fix(telegram): hold the long poll well inside the HTTP deadline

v0.14.1

Changelog

• e9b2df2 chore(release): v0.14.1
• 85b25fa fix(install): literal paths for the temp download files too
• 6908b45 docs: dashboard cap, quiet platforms, new agent kinds
• 3be0ed1 fix(cli): drop the unimplemented event subcommand
• d290634 fix(quiet): /away says so when the platform has no idle source
• 32b7988 fix(install): take the Windows checkout path literally
• de92e73 fix(new): accept the qwen, letta and muse agent kinds

v0.14.0

Changelog

• 3042e3a chore(release): v0.14.0
• e5e7cc0 fix(capture): stop retrying a busy recent read every second
• e046821 feat(options): Formatted becomes the default done post
• ea09cfd docs(readme): present sharing an agent with another Telegram user
• 1c88c22 ci: drop Dependabot; action pins are updated by hand
• 2eb03cc chore(deps): bump actions/setup-go from 5.6.0 to 7.0.0
• 774cd1c chore(deps): bump actions/checkout from 4.4.0 to 7.0.1
• dec600f chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3 (#15)

v0.13.0

Added

• Private sharing. An agent can be shared with another Telegram user through a private topic, read-only or with control. Grants can be suspended, revoked and expire, and they are rechecked on every action.
• Codex replies. Done posts, the summary line, the Reply / Formatted modes and a bare /screen on an idle or done Codex now show the final answer of the last turn instead of the terminal tail. A running, interrupted or rolled-back turn, or a rollout whose newest file cannot be established, falls back to the screen. (#13, fixes #12)

Security

This release follows a full security review of the plugin. Highlights:

• Redaction: secrets are masked in HTML-escaped screens and pager messages, in Markdown-decorated keys (**API_KEY**:, table rows) and when the terminal wraps them across lines. The bot token is always masked, even with redaction turned off. Prefixed key names, JSON keys, URL credentials, topic names and toasts are covered too.
• Private sharing: after a pane's session changes, closes or exits, a guest can no longer reach it before the next agent snapshot. A revoked grant never comes back after a failed save. Strangers have their own ingress budget and a per-minute cap on first contacts, and a full contact directory no longer stalls Telegram polling.
• /git: the repository's hooks, fsmonitor, pager, external diff, textconv and filter drivers are never run, and submodules are not entered.
• Setup: only the Telegram account that opened the one-time link can choose the group, and promotions by anyone else, or from before setup started, are ignored.
• Updates: the new binary's checksum is verified before anything runs it. The installers check the approved checksum, release assets and redirects are limited to GitHub, and prereleases are never offered.
• Local state: the state and config directories are created 0700, and looser permissions on existing files and directories are tightened at start. The logs pane escapes control and bidi characters. The pid file never signals a process that merely reuses the daemon's pid.
• Bounds: Herdr socket reply lines and received files have size caps.
• Supply chain: CI and release workflows pin every action to a commit SHA and GoReleaser to an exact version, and Dependabot proposes updates.

Validation

• Passed make lint (gofmt, vet, staticcheck, import layering, five-target build) and go test -race ./...; CI is green on Linux, macOS and Windows.
• govulncheck reports no known vulnerabilities, and fuzzing found no failures in redaction and the Markdown renderer.
• scripts/verify-install.sh 0.13.0 all installed and ran the release on every target.

Thanks to @AndresDiagoM for the Codex reader.

Full changelog: v0.12.3...v0.13.0