FlupCode flupcode-v4.0.0

FlupCode 4.0: runs you can trust, cost you can read

FlupCode 4.0 makes a run say what really happened, shows what it cost, and puts the browser and remote access under one policy. The engine is still OpenCode 2.0.18.

What's new

• Runs you can trust.
  • Stop really stops the agent, and a failed model call fails the task.
  • Every task and run carries a verdict: Verified, Not verified, Needs your input or Failed.
  • A failed run resumes from the task where it broke.
  • Checkpoints carry the conversation, a summary and the cost, and a run can be forked from any of them.
• Cost you can read.
  • One usage ledger is behind every figure, so the home card and the Cost screen agree.
  • Budgets stop a run at the step that crosses them. Near a budget, a run goes one task at a time, can wait for you, or switches to the policy's fallback model.
  • The Cost screen shows the quota OpenRouter and DeepSeek report.
• A browser under one policy.
  • Every browser action asks per site: once, this session or always. Payment, banking and sign-in sites are refused.
  • The agent can use FlupCode's own browser, your Chrome or Edge through the FlupCode Bridge extension (loaded unpacked for now), or a Preview of your dev server in the desktop app.
  • A verify task can compare the page with its last capture.
• FlupCode without the desktop window.
  • flupcode serve hosts the harness, and a web tab pairs with a code.
  • A paired phone has a Runs view where it can approve a gate and stop a run.
  • The desktop app restarts its engine and harness server, keeps their logs and offers Copy Diagnostics.
• Routines that keep time: time zones, cron, missed runs, retries, and a notice after three failures.
• One interface: one navigation, one run card, one attention mark, accessible dialogs, context chips in the composer, and artifacts with versions.

What can break

• FlupCode's plugins no longer load in an OpenCode you start yourself. They load only in engines FlupCode starts, and the copies in ~/.config/opencode/plugins/ are removed on the next start.
• A run task that needs approval mid-turn now holds its run at "Needs approval" until somebody answers. unattended: deny fails it within seconds instead.
• A run with a budget slows to one task at a time once 80% is spent. Turn it off with nearBudget: { serial: false }.
• A task whose model call failed now ends failed. Routines that showed success this way will start failing visibly.
• Memories FlupCode extracts are not used until you approve them in the Memory panel.
• Restoring a checkpoint also takes back the conversation it was taken in. The plan says so first.
• Deleting a run also removes its checkpoints and evidence; deleting a document forgets all its versions.
• Navigation moved: "Customize" is "Settings", Agents live in Settings › Agents, and the Cost screen is at /cost. Old links redirect.
• For scripts and config:
  • adaptive.jev.*, allowJev and TYPESAFE_API_KEY are aliases for one release. Use adaptive.providers.<id>.*, allowModel and FLUPCODE_TYPESAFE_API_KEY.
  • Removed: /harness/browser/* low-level routes, GET /harness/adaptive/metrics/sessions, and fromCheckpoint on workflow runs.
  • In an external task's command, {{item}} and inputs are passed as one quoted word each.

Updating

• The desktop app updates itself. On first start it migrates its database (a copy is taken first) and fills the usage ledger from your existing sessions.
• The flupcode binary is attached to this release. flupcode serve needs flupcode-harness-<platform> beside it.
• Builds are not signed:
  • macOS: use Open Anyway in System Settings → Privacy & Security, or run xattr -dr com.apple.quarantine /Applications/FlupCode.app.
  • Windows: choose More info → Run anyway.

Full notes: docs/RELEASE-4.0-DRAFT.md.

---

What's Changed

• docs: audit of October 2026 and new roadmap by @rldona in #476
• fix(server): stop a run by interrupting every live task session by @rldona in #477
• fix(server): fail a task when its engine turn failed by @rldona in #478
• fix(harness): one session-cost calculation and one money format by @rldona in #479
• fix(server): quote plan steps and inputs in external task commands by @rldona in #480
• fix(server): a failed routine start stays failed, and every due routine fires by @rldona in #481
• fix(harness): terminal on the OpenCode 2 PTY, through the adapter by @rldona in #482
• docs: status documents match the October 2026 audit by @rldona in #483
• docs: decide to attach to the engine's opencode.browser protocol by @rldona in #484
• fix(remote): memory injects only approved memories, scopes its tool, refuses credentials by @rldona in #485
• fix(server): confine file and artifact reads to known project roots by @rldona in #486
• fix(desktop): open-path allowlist, renderer CSP, single instance by @rldona in #487
• fix(server): web action runs need a server-issued, single-use approval by @rldona in #488
• fix(server): keep harness secrets from children and argv, scope the plugins' bearer by @rldona in #489
• fix(server): a resumed run hands on its notes and trees by @rldona in #490
• fix(server): find checkpoints by id and collect their refs with the run by @rldona in #491
• fix(harness): one slash-command registry for the palette and the composer by @rldona in #492
• fix(harness): surface resource failures in Changes, Usage and Adaptive by @rldona in #493
• feat(server): a run names the workflow, version and inputs it executed by @rldona in #494
• fix(server): deleting a run has a defined effect on everything under it by @rldona in #495
• feat(server): add the usage ledger and its ingest route by @rldona in #496
• feat(server): attribute usage to runs, tasks, workflows and purposes by @rldona in #497
• feat(remote): send every billable engine event to the usage ledger by @rldona in #499
• feat(server): reconcile the usage ledger from engine transcripts by @rldona in #498
• refactor(harness): retire the 1.x compatibility layer and police raw engine routes by @rldona in #500
• feat(server): usage summary API with group-by and cost basis by @rldona in #501
• feat(server): a verdict on every task and run (RP-06) by @rldona in #502
• feat(server): one browser policy decides every browser action by @rldona in #503
• feat(harness): Cost & Usage Center on the usage ledger by @rldona in #505
• feat(harness): one attention scale across sessions, runs and routines by @rldona in #504
• feat(harness): run card that reads as one thing by @rldona in #506
• feat(harness): presets for the user's own browser, under FlupCode's approvals by @rldona in #507
• fix(release): release only what CI tested, for the architecture it claims by @rldona in #508
• feat(harness): resume a run from a task by @rldona in #509
• feat: artifact lineage and versions by @rldona in #511
• feat(desktop): supervise the engine and the harness, keep logs, copy diagnostics by @rldona in #510
• docs: put UX-00 in wave 7 by @rldona in #514
• feat(server): unattended mode for task sessions and a fail-closed agent floor by @rldona in #513
• feat(harness): dependable routines with zones, missed runs, retries and a failure notice by @rldona in #512
• feat(cli): flupcode serve hosts the harness, and a web app tab pairs with it by @rldona in #515
• test(harness): drop the CSP spec's routes before the page closes by @rldona in #516
• refactor(server): a BrowserDriver interface, with the recipe runner as its first driver by @rldona in #517
• refactor(server): prune the adaptive layer to what has a consumer by @rldona in #518
• fix(remote): keep engine plugins in FlupCode's own folder by @rldona in #519
• feat(server): budgets stop runs at the step that crosses them by @rldona in #520
• refactor(harness): split app.tsx into feature stores, routes and lazy screens by @rldona in #521
• feat(harness): home dashboard on engine stats and the usage ledger by @rldona in #522
• feat(remote): carry /harness/* over the remote tunnel (HE-02) by @rldona in #523
• feat(server): provider quota adapters with typed windows and stored samples by @rldona in #524
• feat(server): the agent's browser over the engine's attach protocol by @rldona in #525
• feat(server): provider-neutral adaptive settings and keys by @rldona in #526
• feat(harness): one Modal for every dialog, and motion tokens by @rldona in #527
• fix(harness): keep a dialog's focus through a re-render, and read the composer's boxes at once by @rldona in #532
• feat(harness): one navigation model by @rldona in #528
• refactor(server): a decision kind is one module; providers declare capabilities by @rldona in #529
• feat(harness): FlupCode Bridge extension for the user's own browser by @rldona in #530
• feat(desktop): embedded preview of the project's dev server by @rldona in #531
• feat(harness): an identity brief of FlupCode's own (UX-06) by @rldona in #533
• fix(harness): keep palette rows through a refresh, and wait for what the flaky tests read by @rldona in #537
• feat(server): budget- and quota-aware model routing (PI-04) by @rldona in #534
• fix(harness): runs on the phone once the tunnel is up, and the browser tools gone before detach says so by @rldona in #539
• feat(server): visual verify task compares the preview with its last capture by @rldona in #538
• feat(harness): one context-chip model for the composer by @rldona in #536
• feat(server): budgets that decide: one task at a time, a gate and routed notes near a budget (CL-2) by @rldona in #540
• feat(server): semantic checkpoints with conversation, summary, cost and fork by @rldona in #535
• docs: draft release notes for 4.0 by @rldona in #541
• chore: bump version to 4.0.0 by @rldona in #542

Full Changelog: flupcode-v3.0.1...flupcode-v4.0.0