codr v0.9.0

codr 0.9.0

History controls, safer OpenCode observation, paginated folder search and
contributor fixes for Linux and macOS. This is a bridge-worker update; the
connector pin, wire protocol and storage cohort stay unchanged.

Read history without resuming sync

• /last replays the newest conversation message in the current agent chat.
  /last4 and /last 4 replay the newest four in source order. Counts from
  1 to 100 are supported. Explicit replay includes already delivered text,
  without changing sync, prompting an agent, or consuming automatic delivery keys.
• /recent retains its three-message excerpt per eligible chat. /recent2 and
  /recent 2 select a two-hour activity window; the default stays one hour.
• Catch-up and replay label You/Agent text with the original UTC source date.
  Missing or invalid dates are marked unknown. Date labels do not alter delivery keys.

Safer OpenCode observation

• Optional opencode_service_file selects an authenticated, loopback-only V2
  reader. Failed reads do not start, replace, or signal the shared server and
  cannot fall back to the managed CLI.
• A small durable-log watermark avoids repeated exports of unchanged histories.
  Changed history still uses a bounded full export. Forms and permissions remain
  separately refreshed; failed reads do not clear pending prompts.
• The initial cause of the observed stall remains unproven. A separate OpenCode
  client recovery fix is tested locally but is not part of the Codr binary and
  was not installed by the Codr mitigation rollout.

Current-chat reset and clearer invitations

• /cancel clears cached questions, permission cards and pending menus in the
  current chat. It interrupts only the verified active native agent, without
  discarding history, accepted deliveries or uncertain-operation records.
• Invitations and first welcomes identify the project and explain /help.
  Existing chats do not receive repeated welcome messages.

Filter existing folders without losing pagination

• ls <part> searches selectable folder names by a case-insensitive substring.
  Matching results retain the existing 200-folder pages and persisted numbered
  selection; results are not cut off at the first 200 entries.
• A new search starts at page one. Bare ls clears the filter and refreshes the
  full list. ls next searches for the word next, while bare next changes pages.
• This adapts Juraj Bednar's filtering contribution from
  PR #17, without merging that PR's
  branch or version-preparation changes. Existing root, symlink,
  menu-code, page-selection and launch-confirmation checks remain active.

Fresh Claude sessions and quieter warnings

• A fresh Claude session has empty history until its first transcript is written.
  Chat setup can proceed before the first prompt. Ambiguous transcripts, scan
  errors and invalid session IDs remain errors. Adapted from Juraj Bednar's
  PR #18.
• Repeated bridge log lines print once per ten minutes, with repeat counts on
  the next print. The cache remembers at most 256 lines and evicts its oldest
  entry when necessary so new errors remain visible. Evicted lines can print
  again before ten minutes. Adapted from Juraj Bednar's
  PR #19.
• The optional CLI export fallback retries EOF/incomplete JSON at most three
  times per API shape. Other parse errors and command refusals are not retried
  on that shape. Incomplete-read evidence survives an unsupported fallback.
  This corrects the shared afe4f38 contribution; the non-owning HTTP reader
  remains separate and cannot start or fall back to the managed CLI.
• Updater test fixtures derive a newer release version from the running package.
  Mute/wake tests wait for background reads to complete, including a slow-read
  fixture, without changing delivery semantics or runtime forwarding logic.

macOS service startup

GitHub PR #16, already merged on master,
retries a refused macOS launchd bootstrap once and allows a slow first spawn.
The release retains the original contributor commits and four regression tests.
A known limitation remains: a mixed-service activation check shares the extended
timeout while a job is in its first-spawn state.

Contributors

Contributors to this release are Tom Dwyer
(@tidley) and Juraj Bednar
(@jooray), the original author of the launchd fix
in commit 9cc41f0902b55186c1c37f0897eccecd6240196b through GitHub PR #16.
Juraj also authored the folder-filtering contribution adapted from PR #17,
commit bac75ff2af0eb0ebd68f9e5e52c172adccfdc0bc; its source and tests informed
the local adaptation while preserving the existing pagination.
Juraj's fresh-Claude-session and warning-throttling contributions are adapted
from PR #18 (d0f19b80f1a476076f092893daac213f10be9f59) and PR #19
(0ae3df4173dc915dc5881832665a9c923d3809eb). The bounded CLI export-retry
contribution comes from their shared commit
afe4f38ad99a0431c4bd72b183c35d200092f428, with local corrections and tests.
Credits are based on original authors and the co-author record in the source
range since v0.8.0, including the original PR #16 commits and the adapted
contributions above. The same credits are retained in the ngit mirror.

Update and verification

• Linux x86_64/aarch64 and macOS x86_64/aarch64 packages come from the required
  tag workflow for the exact v0.9.0 source, not relabelled build-only artifacts.
• /update requires the signed stable ngit release and verified independent
  Blossom downloads. It replaces only the managed bridge worker after phone
  confirmation. A GitHub-only release is not yet discoverable by that command.
• Accounts, chats, native sessions, accepted deliveries, history and sync settings
  must remain intact. The connector/storage cohort does not change. Installations
  still using MDK 0.13 must follow the existing stopped-backup migration procedure;
  this release does not authorize or perform a storage migration.
• Foreman orchestration, worker-sharing filters, combined runtime and vendored MDK
  dependency changes are not included. The separate OpenCode client recovery patch
  is not part of this binary.

See the release verification and phone update-test guide.

codr v0.8.0

codr 0.8.0

codr 0.8.0 adds confirmed phone-driven worker updates, immediate prepared-media
delivery, ordinary file attachments, and more reliable project setup and
progress completion. These changes follow 0.7.0.

Confirmed updates from your phone

• /update checks stable releases from the pinned maintainer's ngit records and
  downloads checksum-verified bytes from Blossom, without a GitHub fallback.
• A ten-minute, chat-bound confirmation is required before installation. The
  update job replaces only the managed bridge worker, retaining identities,
  chats, queues, accepted deliveries and running native coding sessions.
• Connector, protocol or storage-cohort changes are refused. Failed startup
  restores the previous executable without rewinding routing state. Uncertain
  launches are not automatically retried.

Media delivery without an idle wait

• ZIP archives, documents and other file attachments are downloaded to private
  local files and handed to the agent with their caption, file path and quoted
  original name. They do not require audio transcription. Archives are not
  automatically extracted or executed by the bridge.
• Images download and voice messages transcribe while the agent works. Prepared
  input is handed to the same verified native session without interrupting it or
  waiting for the current task to finish.
• Image preparation stays FIFO, but an older legacy text delivery does not hold
  it up. Outgoing sync-off does not block owner media input. Captions, private
  prepared paths and submission receipts survive worker restarts.
• Image acceptance says Preparing image, rather than implying that a future
  agent task was queued. Blocked native dialogs and changed or unavailable
  sessions still defer delivery safely.

File attachments retain the four-attachment and 25 MiB-per-file limits. Private
copies survive restarts; remote filenames never become destination paths.

Optional Gemini voice transcription

• Paul Eipper (@lkraider) contributed
  scripts/transcribe_gemini.py through ngit for hosts where local transcription
  is too slow or too large. It sends decrypted voice audio to Google's Gemini
  API and returns the transcript through the existing voice-message flow.
• Local Phonon remains the default. Gemini requires an API key file with private
  permissions and an explicit transcribe_command change; setup does not enable
  it, and there is no automatic Google fallback. Google's API terms apply.
• Tests use synthetic audio and mocked HTTP responses. No live Gemini request
  has been verified.

Standalone control chat

• Juraj Bednar (@jooray) contributed an optional
  owner-only codr control chat. Set control_chat = true to create it on worker
  startup. It accepts /new and general commands without an existing agent
  session; ordinary text receives guidance instead of becoming an agent prompt.
• The chat is off by default and uses the existing account. It is excluded from
  session-history checkpoints, session-end detection and automatic renames.
  Uncertain group creation is not retried automatically.

More reliable project setup

• Juraj's command shortcuts accept unambiguous prefixes such as /n, /st
  and /sy. The control chat also accepts bare command words. Ambiguous
  prefixes do not guess, and shortcuts never rewrite prepared voice/file input
  or previously accepted deliveries. /u is ambiguous between /unmute and
  /update; use /un or /up instead.
• At the folder step, ls lists selectable folders under launch_root for
  numbered selection. Listing and launch validation do not follow root,
  ancestor or entry symlinks. Existing one-line workspace names list and
  pick remain valid.
• Reply confirm, yes or y to a current launch preview, or type its
  repository folder name. Expiry, cancellation, replay protection and workspace
  revalidation remain active.
• Fresh panes can finish shell startup before agent.start succeeds. Only an
  explicit pre-input agent_pane_busy refusal retries, every 250 ms for up to
  15 seconds. Other errors and uncertain outcomes do not retry.
• Confirm /new using the repository folder name, not the destination workspace
  label. For parent/repo.v2 inside workspace Main, type repo.v2. The preview
  still shows the workspace separately and rechecks destination renames.
• Keep ten-minute expiry, restart-safe confirmations and 0 cancellation. A
  repository folder named 0 uses explicit /new confirm instead.
• Accept OpenCode's explicit default variant when the selected model omitted
  a variant. Previously, a successfully created session could be marked
  uncertain before its tab or agent started. In-place model changes use the same
  corrected check. Provider, model, explicit variant, session and folder checks
  remain strict; old uncertain launches still require inspection.

Custom text replies to OpenCode questions

• For a supported OpenCode V2 question that allows a custom answer, type the
  answer directly, such as v6.6.6, or use /answer TEXT. Exact listed numbers
  and labels still select an option. Combined text such as 1 v6.6.6 is sent
  literally as a custom answer, not interpreted as two separate actions.
• Custom replies use the authenticated, request-bound form API. The bridge
  rechecks the native session, current form and question code before sending,
  and persists submission intent first. No model prompt or terminal keystrokes
  carry the custom text; uncertain replies are not automatically repeated.
• Changed questions require the current card's code. Custom text is limited to
  4000 UTF-8 bytes and complete owner text messages; prepared media is not
  automatically treated as a custom answer. Legacy questions, forms without
  custom answers, multi-select and multi-question dialogs retain terminal-only
  custom entry.

One progress bubble, completed in place

• Follow-ups, media acceptance and blocked-to-working transitions do not append
  extra standalone working notices. The active editable bubble carries status
  and checklist updates, then becomes done; final answers remain separate.
• Failed completion edits keep their known targets and retry without blocking
  final replies. Mute/resume and restart retain both the target and completion
  evidence, including a final recorded before runtime reports idle.
• Early idle alone does not finish progress. A lost initial acknowledgement with
  no known message target is retained for inspection instead of replaying a send
  that could create a duplicate; local status reports unresolved_progress.
• New chats say Connected to <chat name>. followed by
  Type /help from anywhere to view commands. The obsolete bracketed terminal
  title and longer Pat introduction are removed from the welcome.

Reliable handoff and retained chats

• Juraj's repeated-message attribution matches identical confirmed phone
  receipts to fresh transcript echoes by count. Unmatched extra input remains
  ambiguous and still mutes forwarding.
• Delivered blocked notices do not repeat after mute/wake. Cancelled notices
  that never reached a confirmed send can announce on wake. Muted polling does
  not consume their announcement, and editable progress keeps its known target.
• An unexpected new native session on a terminal with a retained chat pauses
  the new connection before creating another group. The original chat, history
  and accepted deliveries remain intact. Local confirm-session-change checks
  the current terminal and native identity before approving a separate chat.
  Returning to the original native session reconnects its existing chat.
• README guidance covers the control chat and White Noise intelligent folders.
  Existing screenshots remain unchanged.

The bridge guard does not patch OpenCode itself. The separately installed local
OpenCode session-recovery build is not part of codr's release assets.

Contributors and prior work

The new 0.8.0 changes were implemented by Tom Dwyer
(@tidley), Paul Eipper
(@lkraider), who contributed the optional Gemini
transcriber through ngit, and Juraj Bednar
(@jooray), who contributed the standalone control
chat, command shortcuts, folder listing, confirmation replies, safe launch
retries, input attribution, blocked-notice deduplication and README guidance
through GitHub PRs #7 and
#8–#15.
Tom added the session-replacement safeguard and the review-driven integration
regressions and fixes. Original contributor commits are preserved.
This release also builds on the 0.7.0
contributions of Paul Eipper (@lkraider)
through ngit and Juraj Bednar (@jooray) through
GitHub. Their original contributions and credit remain in the
0.7.0 release notes; those
earlier contributions are not presented as newly authored 0.8.0 changes.

Verification and release limits

Local verification covers the Rust and Python suites, strict clippy, and
independent read-only reviews, including the attachment and custom-answer fixes.
No real self-update has been exercised; updater scheduling and rollback tests use
fixtures. Local verification does not substitute for the required four-platform
release checks.

Existing 0.7.0 binaries cannot be relabelled as 0.8.0. A public 0.8.0 release must
be built from its reviewed, versioned source and pass the platform and connector
gates. The connector remains in the existing MDK 0.14 cohort; this release does
not authorize storage migration. Published notes and credits must be identical
on GitHub and the verified ngit/Blossom mirror.

codr v0.7.0

codr 0.7.0

Phone-driven coding

• Phone text goes directly to the mapped agent while it is working, without interrupting the current task. Backend-native input handling still applies. Existing accepted deliveries are kept; uncertain submissions are not replayed automatically.
• /cancel interrupts the current task in this chat. It never deletes history, stops a worker, or cancels accepted future deliveries. /clear-queue is retired.
• /sync auto, /sync on, and /sync off select a persistent global sync mode. Help displays that mode. /unmute clears a forced mode and restores automatic sync.
• /recent replaces the previous catch-up /sync: retrieve the newest three text messages from conversations active in the past hour, without unmuting or repeating confirmed/pending messages.
• Control replies wait for a timestamp after the phone input, avoiding same-second ordering ties and allowing modest clock differences. This does not delay native agent input.

Projects, agents and models

• Four-step /new menus select an existing or new herdr workspace, folder, installed agent, and model. Numeric replies and 0 cancellation keep phone input short. The final preview requires the displayed workspace name before creating anything.
• Expired project menus clear after one notice, so later phone messages reach the normal agent route. The message that triggered expiry is not automatically replayed. Uncertain actions still require local inspection.
• /agent starts a separate session and chat, retaining the old history and accepted work. Fresh chats identify the agent inside the workspace parentheses.
• Model menus offer the default or provider categories, then each provider's full model list. Variants are separate. OpenCode discovery uses the authenticated V2 API; Codex lists its cached models; Claude Code offers documented aliases. Discovery does not guarantee backend account entitlement.
• Pat is the default public display name for newly created bridge identities. Existing identities and custom names stay unchanged.

Images and optional desktop access

• Explicitly embedded local images in completed agent replies use encrypted attachments, not public uploads. Incoming images retain captions and private prepared paths across worker restarts. In this release, incoming media still uses idle-gated delivery; only ordinary phone text has the new immediate-delivery behavior.
• The separate portr desktop app can use an optional, same-user codr endpoint over SSH. It is disabled by default; setup offers an opt-in. Codr does not install SSH, a VPN, or the desktop application.

Platforms and upgrades

• Keep stable OpenCode executable paths across Homebrew upgrades. Setup can repair a missing versioned path after validating the replacement, while Claude-only and Codex-only installations do not require OpenCode.
• Read Claude transcripts above 128 MiB and parse only appended complete records. A bounded 32-entry cache avoids reparsing the full transcript on each poll. Cache eviction and load-sensitive bridge waits have regression coverage.

The release workflow builds Linux and macOS for x86-64 and ARM64, with a dedicated connector pinned to MDK 0.14.0. Publication requires all platform checks and connector tests to pass; a local Linux test run does not verify macOS.

MDK 0.13 users: before first opening storage with MDK 0.14, stop both services and make a private, device-local backup of the complete connector home, database sidecars, media, configuration, and secret-store credentials. Obtain explicit approval before migration. MDK 0.14 rekeys and upgrades storage; downgrading the executable does not make that storage compatible with 0.13. Setup does not automatically cross that cohort boundary. See installation and upgrade and connector provenance.

MDK 0.14 installations keep their existing configuration, account identity and chat mappings. Apply worker updates only after other work is idle. Do not clear pending deliveries to upgrade.

GitHub is the primary release host. ngit and Blossom mirror the exact published source and asset bytes, subject to signer approval and download verification. A failed or pending mirror is reported separately, not treated as a completed publication.

Contributors

• Paul Eipper (@lkraider) contributed the large Claude transcript reader, incremental parsing, cache/eviction tests and load-tolerant bridge test waits through ngit. His original commits and authorship are preserved: reader, cache tests, wait budgets and remaining timing tests.
• Juraj Bednar (@jooray) contributed the Homebrew/OpenCode executable-path fix in GitHub PR #6.
• Tom Dwyer (@tidley) implemented the phone controls, project/model setup and media features, integrated contributions, and handled follow-up fixes, documentation and release work.

Release scope

This release is built from f45578611629069f0ef9cd50b59e4994e07d018b and provides Linux and macOS builds for x86-64 and ARM64. Source refs are mirrored to ngit; the release-asset mirror is not yet verified complete.

The later /update feature, immediate prepared-media delivery, repository-name confirmation, canonical-default OpenCode launch fix, shortened welcome, and progress-completion fixes are not in these assets. They are being prepared for 0.8.0. Installing 0.7.0 does not install those local follow-up changes.

Known issues being addressed for 0.8.0: OpenCode may return an explicit default model variant that 0.7.0 treats as an unconfirmed launch, leaving the created folder/session for inspection without starting its tab or agent. Progress notices can also remain at working... after completion. Do not blindly retry uncertain launches or clear account data as a workaround.

Full source comparison: v0.6.2 to v0.7.0

codr v0.6.2 — Linux preview

codr 0.6.2 — Linux preview

This is an opt-in development prerelease from dev/linux, for Linux x86-64
and ARM64 only. The stable, cross-platform release remains v0.6.0.

Changes since 0.6.1

• /sync sends each eligible conversation's latest completed assistant reply
  to its own White Noise chat. It uses one shared cutoff: one hour before the
  last confirmed new message sent across all linked chats, not one hour before
  the command. The reference survives restarts and can be recovered from retained
  MDK history. With no confirmed send history, it falls back to the past hour.
• /help lists shortcuts in the requesting White Noise chat. Both commands
  are owner-only, work while muted, leave mute settings unchanged, and never
  prompt agents. Replies are durable and protected against command replay.
• Muting no longer blocks invitations or automatic chat-name and description
  updates. Introductions use bracketed lowercase labels such as [oc].
• The dedicated connector is built from pinned MDK 0.14.0 source, with the
  existing founding-admin and media-recovery extensions.

Upgrade warning: one-way MDK storage migration

MDK 0.14 rekeys account databases and changes storage on first open. Downgrade
to MDK 0.13 is unsupported. Do not roll back only the executable or restore stale
MLS state into a running account.

Before upgrading an existing installation:

1. Stop the bridge and dedicated connector services.
2. Make a private, device-local backup of the complete connector home and its
   secret-store credentials. Keep credentials out of chat, logs, and repositories.
3. Install this version and run Setup only when you accept the migration.

herdr plugin install tidley/codr --ref v0.6.2
herdr plugin action invoke local.white-noise.setup

Setup preserves the configured owner, existing account, group mappings, and
consumed-message history. It selects the release-matched connector without
creating a replacement identity. Use the version tag, not the moving branch.
macOS users should stay on v0.6.0.

Build provenance

The Linux preview workflow runs Rust tests, formatting, Clippy, and Python tests,
then builds static musl bridge binaries and dedicated connectors on native
x86-64 and ARM64 runners. The connector source pin is MDK 0.14.0 commit
3fb4b4759ac676b0c21c4c3527074866c9fa4c89; the published patch is
patches/mdk-codr.patch. Connector archives include CODR-CONNECTOR.json and
the upstream license. Each archive has a SHA-256 sidecar.

No macOS assets are included, and this release is not marked latest. Stable
master and the existing published release assets remain unchanged.

codr v0.6.1 — Linux preview

codr 0.6.1 — Linux preview

This is an opt-in prerelease from dev/linux, for Linux x86-64 and ARM64 only.
The latest stable, cross-platform release remains v0.6.0.

Changes

• Editable working... progress keeps the current to-do list while a final reply
  is still being saved. Completed replies are separate messages, not edits to
  the progress bubble.
• Completed progress preserves checklists from both the old and new working labels.
• Pending OpenCode V2 questions are read from live session forms, restoring
  supported phone-side decision cards. Existing visible-terminal checks remain.
• Send unmute or /unmute by itself in any linked White Noise chat to resume
  forwarding for all chats without prompting or answering an agent.

Install or upgrade

herdr plugin install tidley/codr --ref v0.6.1
herdr plugin action invoke local.white-noise.setup

Use the version tag, not the moving development branch. Setup preserves the
configured owner, connector account, group mappings, and consumed-message history.
It selects the version-matched connector path without creating a replacement identity.

macOS users should stay on v0.6.0; this preview declares Linux-only support.

Build provenance

The workflow runs the Rust tests, formatting, Clippy, and Python tests on Linux,
then builds static musl bridge binaries on native x86-64 and ARM64 runners.
It does not run macOS jobs or rebuild unchanged MDK source.

The dedicated connector executable and license are reused byte-for-byte from
v0.6.0. Reuse requires the published archive checksum and its repository,
source revision, upstream version, and patch checksum to match connector.toml
and patches/mdk-codr.patch. A mismatch fails the preview and requires a rebuild.
CODR-CONNECTOR.json records the original package version and source-archive
checksum, as well as the new package version. Each published archive has a SHA-256
sidecar. No macOS assets are included, and this release is not marked latest.

For another preview, dispatch Build and release on the development branch
with linux_preview=true and source_ref set to the exact reviewed commit.
The workflow creates the prerelease tag with its GitHub Actions token so the
normal all-platform tag workflow is not triggered.

codr v0.6.0

Automatic desk/phone handoff

codr now switches forwarding automatically across every mapped chat:

• A new local prompt in OpenCode, Codex, or Claude Code mutes all groups.
• A new authorized owner message from White Noise resumes forwarding globally after a history checkpoint.
• Durable native message IDs and prompt fingerprints distinguish phone echoes from local input, including across bridge restarts.
• Ambiguous or unconfirmed input mutes conservatively. Incomplete native messages pause outgoing delivery until attribution is possible.
• Manual At desk / Away controls remain available. Startup no longer opens a control popup.

Automatic handoff is enabled by default, including on upgrade. Set auto_forwarding = false in the bridge configuration to disable local-prompt detection and keep manual controls with phone wake.

Detection follows the three-second polling interval plus transcript read time. It cannot recall output already submitted to MDK and is not an instantaneous privacy boundary. Phone prompts are not queued behind busy or blocked agents; wait for idle and resend. Supported decision answers use their separate route.

Other changes

• Linux x86_64 and ARM64, plus macOS Apple silicon and Intel release packages.
• New groups grant founding admin rights to the configured phone owner and bridge. Other members still cannot prompt the agent.
• Group names include the workspace and follow HERDR label changes without overwriting manual renames.
• OpenCode 1.x and 2.x exports, with automatic CLI recovery when the configured database history format becomes incompatible.
• Read-only check-readers validation, also run by setup before service or identity changes.
• Release-matched dedicated MDK connectors with founding-admin and media-history recovery extensions. Shared wn-agent installations are not replaced.
• Fixed Linux x86_64 musl bridge startup by retaining Rust's default linker.

Install or upgrade

herdr plugin install tidley/codr --ref v0.6.0
herdr plugin action invoke local.white-noise.setup

Use setup to select the matching connector. Existing identity, group mappings, and configuration are preserved. Existing groups retain their admin policy.

Remote HERDR clients use local key bindings by default. Configure the forwarding shortcut on the client, or reconnect with herdr --remote <host> --remote-keybindings server. No server restart is needed.

The assets include bridge and dedicated connector archives for all four platforms, with SHA-256 checksums. Linux connectors require glibc 2.35 or newer. macOS service setup requires a logged-in launchd session.

Installation and upgrades · Controls, recovery, and limits · Full changelog

codr v0.5.0

Added

• Image attachments with captions and private local files for the mapped agent.
• Local Phonon-2 voice transcription, submitted directly as an agent prompt.
• A quoted transcript beneath transcribed, edited into the original transcribing bubble when MDK supports edits.
• Optional incremental, read-only OpenCode SQLite reads through opencode_db. Unchanged sessions fetch no message or part bodies.
• Background transcript reads, with up to four readers and one outstanding read per session.

Changed

• Chat names use [cd] session. Descriptions contain workspace and agent details.
• Status notices use blockquotes. Task lists appear below the status without a Tasks heading.
• README screenshots cover images, voice, decisions, and shared chats with owner-only agent control.

Fixed

• Pending and prepared media survive restarts and temporary HERDR outages without duplicate prompt submission.
• Deferred media in one session does not block preparation for other chats.
• Transcript reads preserve session identity and forwarding-mode checks. Exiting sessions get a fresh final read.
• Transcription notice delivery retries independently of agent submission, including lost send or edit responses.

Compatibility

• Same-bubble transcripts and editable progress require edit_responses = true and an MDK build with edit_message support.
• Offline media recovery needs MDK's opt-in include_media download references. These extensions are not in published MDK 0.13.0 binaries.
• Incremental database reads were verified against OpenCode 1.19.3's v1 projections and durable event log. The CLI reader remains available when opencode_db is unset.

Documentation update

• Roadmap and completed work
• Group administration, owner-only prompts, and rename behaviour

codr v0.4.0

Decision replies from White Noise

• Reply with a numbered option or exact label to answer a pending OpenCode single-choice question. The reply goes to the question UI, even when the agent is blocked, instead of becoming a new chat prompt.
• Question cards show the question and choices without unrelated terminal/tool output.
• The bridge verifies the session, pending request, and visible choice list before sending a number shortcut. Wide OpenCode sidebars and joined Unicode emoji are handled.
• Replaced questions use a short question code. Duplicate messages and uncertain submissions do not repeat a selection.
• Custom text, multi-select/multi-question dialogs, permission approvals, and other agent backends still need the terminal. HERDR 0.9.1's identity check and terminal input are not atomic.

Progress and forwarding controls

• Optional editable working/checklist messages with separate durable final replies.
• Structured task lists from OpenCode, Codex, and Claude Code.
• Persistent global At desk/Away forwarding, with all sessions waking on a new message from the configured phone.
• Muted history is checkpointed rather than replayed. Resume checkpoints use up to four concurrent readers.
• A forwarding popup, direct toggle action, shortcut configuration, and automatic popup on a fresh HERDR server start.

Documentation and verification

• README screenshots show the real Android app receiving progress, decision cards, a phone selection, and final replies through the real bridge and MDK transport. A synthetic HERDR/OpenCode fixture supplies the agent data in a dedicated demo profile; the captures do not verify a live OpenCode dialog end to end.
• Regression coverage includes stale/replaced questions, permission UI mismatch, duplicate delivery, restart recovery, and unknown shortcut results.

Install

herdr plugin install tidley/codr --ref v0.4.0
herdr plugin action invoke local.white-noise.setup

Existing installations retain their configuration, identity, and group mappings. Restart only the codr worker after a safe binary upgrade.

The installer retains MDK wn-agent 0.13.0. Decision cards, ordinary status messages, mute controls, and final replies work with it. Editable progress is optional and requires a separately installed MDK build with edit_message support; leave edit_responses disabled with the published MDK 0.13.0 binaries.

Release assets contain checksum-verified Linux x86_64 and aarch64 musl binaries. This release updates the desktop bridge, not the White Noise Android APK.

codr v0.3.2

Full Changelog: v0.3.1...v0.3.2

codr v0.3.1

Full Changelog: v0.3.0...v0.3.1