v0.1.33

First independently owned release

T4 Code v0.1.33 is the first release published from
wolfiesch/omperator. Its Android package uses the
project's new net.t4code.app signing key, and its macOS packages use Michael Schoenberger's pinned
Developer ID certificate and notarization credentials. GitHub Releases is the authoritative
download surface, and the protected release workflow publishes the same immutable release manifest
and checksums to t4code.net.

Electron and React are the product authority

T4 Code has standardized on the Electron desktop shell and canonical React renderer. The abandoned
Flutter migration, its duplicate platform targets, and its CI and release plumbing have been
removed. macOS is the primary desktop target, Linux remains supported, and React/Capacitor Android
plus the responsive Tailnet browser/PWA remain compatibility clients for paired hosts.

The standardization preserves T4's standalone host, typed wire, OMP authority boundary, current
session and transcript behavior, native Browser workspace, terminal, files, review, secure
credentials, and signed update path. The public demo now builds from the same React client shipped
inside Electron, eliminating a second product implementation.

A session rail built for large libraries

T4 Code v0.1.33 makes a large session library easier to navigate. The rail now supports text search, activity filters, newest/oldest sorting, grouped and flat layouts, collapsible project folders, and saved display preferences. Those controls follow the Codex desktop organization model while keeping OMP as the source of truth.

Project menus can create a session in that folder, reveal the folder in the system file manager, collapse the group, or hide it from the rail. Hidden projects are not deleted and can be restored from the filter menu. The reveal action is deliberately narrow: the host accepts only project paths already present in its session catalog.

Faster transcripts and easier context sharing

Opening a large session paints its newest saved transcript entries before older history finishes loading. The composer can insert bounded file references from the active workspace, and the session menu can export a transcript without exposing hidden host state. Session activity labels now follow authoritative runtime events, so a settled session no longer appears busy because of stale client-side timing.

Workspace polish and stable empty panes

The workspace shell, transcript, home pane, composer, and supporting panes now share a clearer and denser visual hierarchy. Empty activity, agent, file, review, and terminal panes keep their normal header and close control visible, so an empty result never traps the user in a pane without navigation.

More reliable macOS upgrades

When a bundled OMP upgrade temporarily fails to stop the existing macOS service, T4 Code now retries the stop-and-replace sequence. This avoids leaving the installed backend half-updated during normal desktop upgrades while preserving the existing signed-runtime checks.

The bundled backend now also recovers from an inactive Unix socket when the crashed owner's process ID still appears alive, and after a restart that renumbers the disk identifiers recorded in the leftover ownership files. Previously such a reboot could leave the backend permanently unable to reclaim its own socket, so the app opened with an empty session list. Recovery still confirms the endpoint is unreachable more than once and revalidates every ownership file before reclaiming it, while leaving a responsive backend untouched.

T4 now owns the host service

T4 Code now packages its own standalone t4-host executable instead of running the network host inside OMP. The desktop replaces the old service definition directly and automatically repairs a stopped default service when the local connection falls back to reconnecting. The service label and local socket stay stable, so ordinary local clients and administrative commands keep using the same connection point.

OMP remains the authority for session files, locks, agent execution, credentials, and takeover decisions. The smaller omp bridge --stdio command exposes only the versioned authority operations T4 needs. T4 validates the exact t4-omp-authority/1 bridge before accepting an OMP installation and rejects older appserver-only runtimes.

Native Browser workspace

The desktop app now includes a built-in Browser workspace that is distinct from the existing host-backed Browser Preview workspace. Its tabs expose stable native surface state for navigation and rendering. New tabs use the credential-isolated isolated-session profile. Authenticated profiles are never selected automatically: each use requires the exact user-selected profile with explicit opt-in.

Native Browser automation is bounded to its surface contract. Touch input is currently unsupported and returns a capability error. The desktop closes native Browser surfaces and releases their supporting controllers when the renderer reloads, the window closes, or the app stops.

Host Browser Preview workspace

Session-linked Host Browser Previews continue to open in their dedicated workspace. The client projects bounded, sanitized preview state from the host, maps pointer and keyboard input through explicit permission gates, and uses leases so two clients cannot silently control the same preview at once. Preview activity records origins and paths without storing query strings, page pixels, credentials, or backend error text.

Runtime provenance

T4 Code v0.1.33 vendors app-wire 0.7.0 from integration commit 796bb7dc, source tree 0c195a01ba0bb98fbf4d4863aee59bf23a6e81b7. The frozen package remains compatibility evidence; T4 owns the active omp-app/1 wire schema.

The verified OMP 17.0.5 runtime is built from commit ca2902bc and tagged t4code-17.0.5-appserver-15. It provides the bounded authority bridge used by T4's standalone host and no longer exposes the old public appserver launchers. It pages snapshot-consistent session inventories across bounded frames, marks over-limit inventories partial, and allows lifecycle actions only when a lock is missing or provably stale. It also keeps session-list metadata sparse before bridge encoding, publishes xd:// mounts atomically with their transport tools, and preserves bounded newest-first transcript paging, stale-owner recovery, privacy-safe local project reveal, lazy session indexing, cross-session attention and transcript search, and the negotiated browser-preview command surface. Unsupported optional capabilities remain hidden when the host does not advertise them.

The integration is based on the official upstream v17.0.5 tag, commit 9fd6e971. Official upstream OMP v17.0.5 has no appserver command and cannot host T4 Code.

Packages

The Android APK is signed and supports Android 7.0 or later. Linux packages target x86_64. macOS packages target Apple Silicon and are signed and notarized. Verify downloads with SHA256SUMS.txt.

What's Changed

• [codex] establish GitHub operations baseline by @wolfiesch in #1
• fix: scope required owner review by @wolfiesch in #2
• fix: limit Dependabot to security updates by @wolfiesch in #10
• fix: remove owner review deadlock by @wolfiesch in #15
• [codex] operator: port executable CRD lifecycle by @wolfiesch in #11
• [codex] operator: reconcile dependency changes safely by @wolfiesch in #13
• [codex] feat: add executable T4 API v1 contract and SDK by @wolfiesch in #12
• chore: own the OMP supply chain by @wolfiesch in #14
• fix: stabilize installed Mac OMP sessions by @wolfiesch in #19
• fix: consume lossless OMP RPC v2 transport by @wolfiesch in #22
• fix: harden installed OMP dogfood flows by @wolfiesch in #21
• fix: unblock OMP profile and partial inventory startup by @wolfiesch in #23
• fix: support deployment-only AWS credentials by @wolfiesch in #25
• fix: polish installed Mac runtime feedback by @wolfiesch in #26
• fix: hydrate session controls after attachment by @wolfiesch in #27
• fix: preserve observer-only session attachments by @wolfiesch in #28
• feat: fork a read-only session into an owned copy by @wolfiesch in #29
• Fix transcript paging and terminal error copy, add host command tracing and disposable session seeding by @wolfiesch in #30
• release: move release authority to this repository by @wolfiesch in #32
• feat(tooling): add repeatable local dogfood workflows by @wolfiesch in #31
• Fix the site deployment broken by a third-party import running before install by @wolfiesch in #33
• ci: cut pull-request feedback from ~8 minutes to ~3 by @wolfiesch in #35
• test(maintainer): split the deployment suite into parallel domain files by @wolfiesch in #36
• refactor: separate collaboration boundaries by @wolfiesch in #37
• chore(deps): bump ws from 8.18.3 to 8.21.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #18
• chore(deps-go): bump the go_modules group across 1 directory with 3 updates by @dependabot[bot] in #16
• fix(desktop): use the mock keychain in the development sandbox by @wolfiesch in #39
• chore: ignore the whole artifacts output directory by @wolfiesch in #40
• ci: run the required suite for merge groups by @wolfiesch in #42
• release: let the Android identity declare a key with no published history by @wolfiesch in #43
• fix(desktop): keep a sandboxed desktop off the developer's own host by @wolfiesch in #45
• feat(desktop): allow selecting the official OMP authority by @wolfiesch in #46
• ci: split the core job and stop verify waiting on deferred gates by @wolfiesch in #48
• feat(host): add T4-owned pseudo-terminal authority for official OMP mode by @wolfiesch in #47
• release: take ownership of the application identity by @wolfiesch in #49
• fix(desktop): connect the local host by its public socket link by @wolfiesch in #38
• fix(host-service): harden transcript scanner for large records up to 10 MiB by @wolfiesch in #50
• fix(host): undo a failed fork, say why, and offer a folder when a copy has nowhere to run by @wolfiesch in #52
• ci: select merge-run legs from a proven baseline by @wolfiesch in #51
• fix(desktop): raise doctor probe deadlines above measured cold-start times by @wolfiesch in #53
• fix(remote): bound process timeout and stdio cleanup by @wolfiesch in #54
• fix(host-service): reclaim an appserver socket after a reboot by @wolfiesch in #55
• fix(desktop): bound native service commands by @wolfiesch in #56
• chore(deps): patch release advisories by @wolfiesch in #57
• chore(release): rotate signing identities by @wolfiesch in #58
• release: prepare T4 Code v0.1.33 by @wolfiesch in #59
• docs(release): enable owned site publication by @wolfiesch in #60

New Contributors

• @dependabot[bot] made their first contribution in #18

Full Changelog: https://github.com/wolfiesch/omperator/commits/v0.1.33