v0.21.0

What's Changed

• Codebase review: bug fixes, performance and docs accuracy by @RogerReed in #339
• Forwarding: re-send a session another member or org owns under this owner's id by @RogerReed in #340
• org link: use the device flow automatically on headless machines by @RogerReed in #341
• desktop/README: drop links to gitignored plan files by @RogerReed in #346
• Cloud daily rollup ceiling: notice once a day, pause no later than midnight UTC by @RogerReed in #343
• Runbooks index: Cloud plan-pricing changes by @RogerReed in #344
• Docs: Cloud's Free plan, and a current machine-cap fixture by @RogerReed in #345
• Desktop (Windows): sign with the TraceRoost Azure Artifact Signing profile by @RogerReed in #342
• Signals: agent prompts, three false-positive fixes, plainer names, Opus-class tier bar by @RogerReed in #348
• Desktop (Windows): flag to switch signing off by @RogerReed in #347
• View Alert: open the fired alert instead of the Alerts list by @RogerReed in #351
• Org panel: unlinked, Open TraceRoost Cloud sits under the Link callout by @RogerReed in #349
• Desktop (Windows): winget package (TraceRoost.TraceRoost) by @RogerReed in #352
• Desktop release: no more *-preview names for unsigned macOS and Windows builds by @RogerReed in #356
• Stop re-running unchanged git lookups on every idle poll and forward by @RogerReed in #355
• Show the evidence behind every signal, and highlight it in the waterfall by @RogerReed in #354
• Desktop (macOS): ready to sign and notarize when the Apple membership lands by @RogerReed in #353
• CI: skip the slowest desktop checks on PRs that don't touch desktop/ by @RogerReed in #357
• Weekly OpenTelemetry upstream watch, emailed to the owners by @RogerReed in #358
• OTel watch: look for the state branch by its full ref by @RogerReed in #362
• UX review fixes: dashboard, extension, CLI, desktop, README by @RogerReed in #359
• Dashboard layout: Alerts panel, Filters popover, 11px floor, theme-aware agent colours by @RogerReed in #361
• Agent setup: Remove agent setup, Not now re-asks, background service owns configs by @RogerReed in #360
• Database performance: cheaper writes, bounded tables, 3 s saves by @RogerReed in #363
• Docs: keep core's docs core-only; fake org name in the Org panel test by @RogerReed in #364
• Security review: release-age gate, Dependabot cooldown, triaged findings by @RogerReed in #365
• Signals: plain-language explanations, and two accuracy fixes by @RogerReed in #366
• Signals: one consistent icon tile, severity by fill by @RogerReed in #367
• Docs: bring ARCHITECTURE.md up to date; limit CLOUD_ARCHITECTURE.md to the Cloud interface by @RogerReed in #370
• Pre-launch docs: user-doc fixes, release runbook, Windows signing and withdrawal runbooks by @RogerReed in #369
• Docs: point §11 at pricing.ts instead of repeating the model list by @RogerReed in #372
• Signals: a tool call is identified by its tool and arguments, not its label by @RogerReed in #371
• Pre-launch review: privacy, data-safety and release fixes; Node 22+ by @RogerReed in #368
• Desktop (macOS): teal tile app icon, built by iconutil by @RogerReed in #373
• Advisor: per-repo instruction panels, sort and filter notice, only agents in use; Limit column rename by @RogerReed in #374

Full Changelog: v0.20.0...v0.21.0

Opening the desktop app

These downloads are not code-signed. They are the builds CI tested, byte for byte (TraceRoost-desktop-*-SHA256SUMS), but your OS will warn before opening them:

• macOS (TraceRoost-*-mac-*.dmg): ad-hoc signed, not notarized. Gatekeeper refuses the first open; right-click the app → Open, then Open again (or xattr -d com.apple.quarantine /Applications/TraceRoost.app).
• Windows (TraceRoost-*-win-*.exe installer): not code-signed. SmartScreen shows "Windows protected your PC"; click More info → Run anyway.