ModelDeck 0.3.3 — the update that installs itself

The first release delivered through Sparkle: if you're running 0.3.2,
the app offers Update Now (or installs this quietly on relaunch when
"Install updates automatically" is on). Manual updates are history — and
fresh installs still start from a DMG, but a much nicer one (see below).

Added

• Spend rows show dollar amounts: deck spend rows now render the
  provider-stated extra-usage budget — "$245.63 of $500.00" in the row's
  value slot, matching Claude Code's own presentation — whenever the
  refresh payload carries the amounts and states the currency. No new
  provider calls; amounts without a payload-stated currency keep the
  percent-only copy (a currency is never assumed).
• Premium DMG installer window: the flat gray drag-to-Applications art
  is replaced with brand-blue gradient art — tri-color deck-bar band,
  glyph + wordmark header, and a drop zone that no longer collides with
  the Applications label. Verified in light and dark appearance.

Changed

• The deck checkmark now means exactly one thing: it marks the single
  account whose window currently feeds the menu bar percentage — the
  lowest across accounts in the default mode, your pin in pinned mode, or
  the active account in follow-active mode. It no longer indicates
  CLI-active state, which lives in Settings → Accounts. One checkmark
  total, always.
• Reset times drop the timezone suffix: deck rows show bare local
  times ("Resets Sat 4:38 AM") — they were always rendered in your own
  time zone, so the abbreviation was redundant. The full zone-stamped
  timestamp remains in each row's hover tooltip, and the reclaimed width
  lets labels like "Weekly · all models" render without truncation.
• README + screenshots overhaul: install instructions match the
  product (download, drag, done), update-check copy reflects Sparkle,
  privacy wording precisely separates provider credentials (never
  touched) from ModelDeck's own Keychain token (disclosed), and the
  screenshots are real captures of a demo-seeded deck.

Fixed

• Expanded deck cards no longer bold their window labels: expanded
  rows use the same regular-weight font as collapsed rows.

ModelDeck 0.3.2 — one-click in-app updates (last manual install)

The Sparkle debut: this release ships the in-app update machinery, so
0.3.2 itself must still be installed by hand from the DMG — the last
manual install. Releases after 0.3.2 arrive via in-app Update Now.

Added

• Menu bar account picker: Settings → General → Menu bar now offers
  "Show percentage for" — either the original Lowest across all
  accounts (percent appears only below the warning threshold) or one
  pinned account, whose lowest usage window shows in the menu bar
  continuously: neutral label color while healthy, gold at warning,
  red at critical. The pin survives restarts; a pinned account that is
  later removed falls back to lowest-across. Threshold notifications keep
  watching every account regardless of the pin. Two quick paths beyond the
  Settings picker: right-click any deck card to "Pin to Menu Bar" (or
  unpin), and a "Follow Active … Account" mode (per provider) that
  automatically tracks whichever account is currently active.
• One-click in-app updates via Sparkle 2: when a newer version is
  found, both the deck gear dialog and Settings → General now offer
  Update Now — download, EdDSA + Apple-signature verification, atomic
  install, relaunch — with "Release Notes" as the secondary link. A new
  "Install updates automatically" toggle (default ON) downloads found
  updates quietly and installs them on the next relaunch; turn it off and
  nothing installs without an explicit Update Now. The daily check cadence
  and its Settings toggle are unchanged.

Fixed

• Honest copy for unanchored usage windows: a deck card whose window
  has never been anchored by real use said "Resets " with a
  floating, meaningless time. It now says "Resets 7 days after first
  use" until an anchor exists, and a window that rolled over recently
  shows "Week reset just now" / "Week reset at HH:MM" so a
  suddenly-full quota bar comes with its explanation.
• Activation attempts can no longer end silently: clicking the
  Accounts-pane activation radio could appear to do nothing — a stale
  trouble banner from an earlier failure masked the new attempt's outcome.
  Every activation attempt now ends in a visible outcome (banner or
  verified switch), and the radio dims while activation is unavailable
  instead of swallowing clicks.

ModelDeck 0.3.1 — honest states, one-click recovery

Fixed

• Deck cards now say "Sign in needed" instead of a bare stale age when an
  account's stored sign-in is missing or expired (issue #114): the daemon
  had been reporting signin-required per account all along, but the deck
  card only rendered the #89 "Data from N hr ago" line, with the real cause
  buried in a tooltip — on a multi-account deck this read as a silent
  refresh failure. The card now shows an actionable warning in the same
  visual family as the #98 Keychain notice, whose tooltip explains that
  Claude keeps only the ACTIVE account's sign-in fresh (CLI ≥ 2.1.216, issue
  #99) and points at Settings → Accounts to recover.
• Probe failures from the bundled daemon no longer masquerade as a daemon
  crash (issue #114): the SEA binary dispatched the Claude usage probe
  through the daemon entry point, so any probe error was recorded as
  "ModelDeck failed to start: …" in per-account refresh errors. Both launch
  modes now share one probe CLI wrapper and report
  "Claude usage probe failed: …" identically.

ModelDeck 0.3.0 — one-DMG install

Fixed

• Your refresh interval now always wins over active CLI sessions (issue
  #90, Tim's design call): pause-while-active used to clamp scheduled
  refresh to every 30 minutes whenever any claude/codex process ran —
  silently overriding the configured interval exactly when usage was
  burning. The cap now applies ONLY until you have ever explicitly chosen a
  refresh interval (a new persisted autoRefreshIntervalCustomized flag,
  set permanently the first time a settings write changes the interval or
  the Settings pane asserts a selection — a "Keep N min" affordance in the
  Refresh section confirms your current value explicitly, since a picker
  cannot re-fire on the already-selected row). While the cap applies, the
  scheduler runs max(configured, 30 min) — it slows fast cadences but
  never polls faster than you configured — and the deck footer shows an
  honest "Auto-refresh slowed" indicator whose tooltip explains it,
  /api/state reports the effective cadence
  (scheduler.effectiveRefreshIntervalSeconds + effectiveRefreshReason,
  derived from the same function the scheduler runs), and stale markers key
  on the effective interval so slowed refresh is never mislabeled as stale
  data. Migration note: existing installs start with the flag unset, so
  the cap still applies once — pick any interval in Settings, or click
  "Keep" next to your current one, and it is lifted permanently; the new
  indicator makes this discoverable.
• CRITICAL — per-profile sign-in on Claude Code ≥ 2.1.216 (issue #99):
  current Claude Code keys Keychain credential storage off the resolved
  ~/.claude, ignoring CLAUDE_CONFIG_DIR/CLAUDE_SECURESTORAGE_CONFIG_DIR,
  so the old env-scoped login guidance silently overwrote the ACTIVE
  profile's credentials. The daemon now version-detects the installed CLI and
  drives sign-ins through activation on affected versions (activate target →
  plain claude /login → verify → restore prior active); both app sign-in
  flows (add-account step 2/3 and the roster's "Sign in again") follow the
  daemon's spec. Post-login verification now has teeth: the verify endpoint
  compares the read-back identity against the intended account and refuses
  the sign-in on mismatch (identityMismatch in the response, surfaced
  loudly in the app) instead of recording the wrong login. GET /api/tools
  additionally reports credentialScoping ("config-dir" / "resolved-home")
  for the installed Claude CLI.

Added

• Per-account staleness surfacing (issue #89): deck cards whose newest
  snapshot is older than ~2x the effective refresh interval now carry a
  visible warning-tinted "Data from N hr ago" line with a tooltip naming the
  account's last refresh error; the daemon propagates per-account refresh
  failures into /api/state (lastRefreshError: {message, at}); an
  expired-stored-OAuth failure flips that account's health chip to "Sign in
  again" even though the credential presence probe still sees the (expired)
  credentials; the popover footer now reads "Oldest data N min ago", keyed
  on the account whose data is oldest, so one silently failing account can
  no longer hide behind fresh siblings.
• DMG installer art (issue #69): the release DMG now opens as a proper
  drag-to-Applications installer — deck-glyph brand mark, arrow, dashed
  drop-zone ring on a committed background (design/dmg/), window sized and
  icons pinned via a vendored Finder .DS_Store
  (scripts/generate-dmg-background.swift,
  scripts/generate-dmg-ds-store.sh). Volume name is now the fixed
  "ModelDeck" (version stays in the DMG filename).

Changed

• Retired the legacy public/ web dashboard and its static-file routes. The
  daemon is now API-only, and the native macOS menu-bar app is the sole
  graphical interface; old dashboard paths return JSON 404 responses.
• Retired the Mac mini staging deployment from the supported architecture;
  the local laptop daemon now serves the native app.
• README rewritten for the public mirror (issue #86): release-first install
  (latest release DMG from Releases, daemon via launch agent), hero local-first/
  no-telemetry callout, feature list matching the current app,
  build-from-source demoted to Development, modeldeck.ai linked.

ModelDeck 0.2.1 — real Claude identity switching + launch polish

First packaged release of the ModelDeck menu bar app.

Highlights

• Real per-account Claude identity switching: activation scopes Claude Code's Keychain credential storage per profile, so switching accounts actually switches who new sessions run as. One-time per-profile login ceremony documented in docs/CLAUDE_IDENTITY.md. ModelDeck never reads, copies, or stores credentials.
• Honest activation verification: the solid check appears only when the active profile's real login matches the account record; mismatch/unverified states get an amber marker with guidance, plus a Complete Activation affordance.
• Menu bar polish: right-click the icon for Check for App Updates / Quit; intentional cold-launch placeholder; optional daily update check (notification only — never installs).
• Fixed: a long-latent settings echo loop that could re-render the deck continuously (idle CPU 20-50%) whenever the popover's stored sort diverged from the daemon's. Root-caused with regression tests; idle CPU is now 0%.

Install

1. Install the daemon: scripts/install-launch-agent.sh (see docs/RELEASE.md — the DMG ships the menu bar app only).
2. Open the DMG, drag ModelDeck to Applications, launch.

Signed, notarized, and stapled (app and DMG).

🤖 Generated with Claude Code