Changelog

✨ New: CSV / TSV previews

Open a local .csv or .tsv from a console bubble and it now renders in the built-in file-viewer, the same route .md / .json / .pdf / images already take. The table view gained the two things a spreadsheet actually needs:

• Filter — substring match across all columns, or scope it to one column via the toolbar dropdown.
• Click-to-sort — asc → desc → off, numbers compared numerically and empty cells sunk to the bottom. Row numbers stay in file order through both filter and sort.

A table / raw toggle sits in the toolbar. One implementation (window.CockpitCsv, wrapping the Explorer's table view) now backs the console, the chat modal, and the Explorer pane alike.

✨ New: Favorite sessions, on the tab

The tab bar's pushpin becomes a star. Click it to add or remove a session from your favorites list — filled gold means favorited, outlined means not. The star lives on the top-right of the tab's number chip (far left of the tab); a tab with no session yet shows none.

The Favorite Sessions panel now renders each row from the same parts as the recent-sessions list above it: status dot, engine mark, relative time, live title, last-message preview, current-project highlight, and the full hover card (path + branch + first/last message). A session favorited long ago that has aged out of the recent record degrades gracefully to just its project and title.

One word for the feature everywhere now — 收藏 / favorite — in both languages, replacing the old mix of "常用 / Pinned / star / 收藏".

🐛 Fix: Terminal pipe commands lost your PATH

Pipe (non-pty) console commands spawned a login shell with no PATH, so tools installed via an rc-file PATH edit — Android platform-tools, ~/.local/bin, ~/.cargo/bin, nvm/pyenv shims — vanished. adb … said command not found in a pipe bubble while the identical command ran fine in a pty one. Both branches now inherit the server PATH, and a user-supplied PATH still wins.

🌐 Site: faster landing page

The homepage hero was a 544 KB lazy-loaded PNG with no dimensions — it drove mobile LCP to 5.1s and desktop CLS to 0.153. It's now a 92 KB WebP served eager and preloaded through next/image, with the box reserved up front. Two accessibility nits went with it.

mobile   Lighthouse 0.81 → 0.97   LCP 5.1s → 2.6s
desktop  Lighthouse 0.91 → 1.00   CLS 0.153 → 0

✨ New: ask about a block's dependencies without making the model re-derive them

The code-map block header already offered explain. Asking "what does this depend on" next to it made the model walk the call graph again — the same graph Cockpit had already resolved and was drawing as two columns of pins on either side of the block.

The new dependencies button sends those pins along with the prompt. Project-internal edges (cross-file, self, method) are listed one by one; external symbols are rolled up per package, since a single block routinely carries a dozen npm imports that would otherwise bury the edges you actually care about. The button stays hidden when a block has no pins at all — asking about the dependencies of something with three empty lists just wastes a turn.

🐛 Fix: file links pointing outside the project open where you are reading

Clicking a file link in an AI reply whose target lives outside the tab's cwd was a dead click. Any absolute path not under cwd had its leading / stripped and was reinterpreted as cwd-relative, so /Users/x/other/report.md sent the Explorer looking for <cwd>/Users/x/other/report.md and it rendered "File not found". The click was consumed either way, so there was no fallback.

Such a file cannot appear in the Explorer tree at all — the tree is hard-rooted at cwd and the server refuses to resolve outside it. So the link now opens the same preview modal a tool-call doc chip does, in place, over the conversation you were reading. Links inside cwd still go to the Explorer tree, line-number jump included; anything the preview stack can't render (it covers markdown and images) gets a toast instead of silently swallowing the click.

.html is deliberately still excluded: previewing a local page runs it with full shell access, which is not a privilege an AI reply's link should hand out on one click.

The cwd comparison also stopped being a bare string compare — trailing slashes, the macOS /private prefix, and cwd spelled as a symlink or worktree alias now resolve correctly.

📦 Misc

• New GLM chats default to 5.3, new Kimi chats to k3.
• The code-map header's "Code" button was a hardcoded English literal; it now follows the interface language.

✨ New: watch an update happen instead of guessing

Updating used to be a spinner on a popover button that disappeared the moment the popover closed, followed by minutes of silence while the server was gone, and then two separate cards each offering a reload.

Progress now lives in its own card in the top-right corner. It survives closing the popover, switching panels, and the server being absent mid-restart — the updater publishes live state on a loopback port, and Cockpit falls back to a local timer if that port isn't there. When an update fails you get the rollback plus a copyable fix command and the log path, instead of a toast that's gone in three seconds. The old "server restarted" banner is folded into the same card, so exactly one surface ever offers you a reload.

The card also renders once now. Every project pane is an iframe of Cockpit itself, so the parent and each open project used to mount their own copy — all drawing at the same corner, stacked, and disagreeing about what to say, because only the parent was actually running the update.

✨ New: every bash call a previewed page makes, on the record

Previewing a local .html runs it, with full shell access, and until now that happened with no trace anywhere. The injected SDK records every bash() the page issues and shows them in a floating panel — time, cwd, duration, exit code, whether it was backgrounded or killed.

It is deliberately not opt-in: a page that could switch the log off would simply switch it off. Instead the button stays hidden until the page's first bash call, so plain notes and reports get no extra chrome, and the button appearing is itself the signal that this page ran something. The log is in-memory and per-page — localStorage is writable by the page being audited — and nothing is exposed on window.cockpit, since this is the host reporting on the page, not a feature the page drives.

The log button and the theme button now share one draggable dock instead of covering each other in the same corner.

✨ New: code-review findings say whether your change caused them

A review report answered "what is broken" but not "which of these did I just cause", so the first thing asked after every report was a follow-up sorting the findings. Each finding now carries that itself: introduced, activated, or pre-existing, in a column in the summary table, an Origin line in the detail, and a tally at the end.

The test is a revert counterfactual, not whether the offending line sits inside the diff — the findings most worth flagging are half-landed changes, where a contract, enum, mirror table or bilingual string was updated on one side and the other was left behind, and the line that misbehaves isn't in the diff at all. Origin is orthogonal to severity: a pre-existing defect that your change routes live traffic through is still as bad as it is.

🐛 Fix: Codex sub-agent bubbles are back on 0.147

Codex 0.147 stopped announcing sub-agents in exec --experimental-json — spawn_agent produces no thread item, and the one event that still arrives carries empty agent state. A running multi-agent turn therefore rendered only its Bash calls: a review that spawned two agents showed 2 tool calls out of 8.

The live engine now reads the same sources the resume path already used — the rollout's spawn_agent lines, plus the sub-agent's own message for the report. Verified end to end against the real 0.147 binary, with the older collab_tool_call path kept for earlier versions.

🐛 Fix: three endpoints that had been failing silently

Each of these had the client and the server declaring the same request fields separately, and drifting:

• Right-click → copy file 400'd every time and toasted 复制失败.
• Console bubble titles never survived a reload.
• The scheduled-task unread badge never cleared.

All three now have contract files both sides import, which turns this class of bug into a compile error rather than a silent 400. The scheduled-task route also stops answering 200 to a typo'd action and no longer reports bad arguments as "task not found".

🐛 Fix: images in history render as images

Clicking an image in the history tab showed garbage — the commit-detail and branch-compare panes ran every file through the text differ, and a PNG decoded as UTF-8 is mojibake rendered line by line. Both panes now short-circuit on image paths and render the actual before/after images as of those revisions (one image when the file was added or deleted), matching how the status pane already behaved.

🐛 Fix: floating surfaces stop turning see-through

The session-complete toast used a translucent hover tint as its background, so hovering it made the sidebar menu underneath bleed straight through — and since hover cancels the auto-dismiss, the broken state stuck around. Sweeping for the same mistake turned up four more: the Jupyter cell toolbar (which referenced a token that doesn't exist, so it had no background at all), the sticky blame gutter, and the sticky group headers in search results and references.

📦 Misc

• A finished session's summary shows two lines instead of one — a single line cut off at about 20 CJK characters, usually too early to tell which task just finished.
• The close-all button stays visible with a single tab open, where it still does something useful: swap the tab for a blank New Chat.
• The HTML app preview title shows the file's path.
• Sol's default reasoning effort is now medium.

🌐 Site: homepage hero reshot

The hero still showed chrome that v1.0.263 removed — a brand-coloured border on the user bubble, the teal focus ring on the composer. Same view, same dimensions, reshot on the current build.

✨ New: a theme layer that works in both modes

Light mode had been styled in dark mode. Enough of it was written and reviewed against a near-black page that the light theme was carrying a long tail of invisible borders, dead fills and text below AA — this release rebuilds the token layer underneath it rather than patching the symptoms.

Surfaces and fills are now two separate scales. Surfaces are solid and are the only things with elevation: the app ground, a panel, a floating overlay. Fills are alpha and carry none: a chip, a toolbar strip, a selected row, composited onto whichever surface they land on. Previously six roles — background, card, popover, muted, secondary, accent — all drew from four slate steps, and they collided: in dark, a toolbar was exactly the colour of the card beneath it, and a dropdown was byte-identical to the panel it opened over.

Light mode gets depth the only way a white base can carry it — borders and shadows. That meant tokens the system didn't have: a 4-step alpha line ramp, a 3-step elevation scale much lighter than Tailwind's stock shadows (built on 0.1 alpha black, they read as a dirty halo on white), interactive tints that compose inside cards instead of overwriting them, and a per-theme scrim, since a backdrop needs far less black over a white page than over a dark one.

Values are solved so each fill composites onto the exact step it used to be — pixel-for-pixel in most cases. Existing screens keep their weight and gain the compositing fix.

🐛 Fix: the surfaces that never asked the theme

Several surfaces painted themselves from a single hardcoded dark-tuned value that no theme switch ever reached.

The terminal was the worst of them: its xterm palette was one dark set, and background: 'transparent' resolved to solid #000 — invisible against a dark bubble, a black brick over a light one. It now carries a palette per theme. The Neo4j graph canvas assumed a dark ground outright, with edge labels at ~2.8:1 on white and node rings that vanished. Chart grids, the console drag ghost and the hour heatmap's empty bars were all handing a bare HSL triple to canvas or to a style prop, which is a silent no-op rather than an error.

The ANSI palette's four "light overrides" had never applied at all — the selector matched in both themes — and the other 28 colours had no light handling. Light is now the base. The JSON preview no longer renders github-dark keys at ~1.8:1 on a white pane, and tooltips are no longer a white box on a white page held together by a border.

🐛 Fix: chat messages stop stacking surfaces

An assistant turn carries markdown, code blocks and a tool-call list, and each wanted a surface of its own. Nested, and now compositing, they compounded — a code block inside an expanded tool row bottomed out at 2.06:1 against the page it was meant to sit quietly on. The nesting is gone: tool-call rows are divider-separated list items rather than a stack of rounded boxes, and only code blocks keep a fill. Both sides of the conversation now wear one skin; the user bubble is marked by alignment and its flipped corner, not by a brand-coloured border that read as "selected".

Twenty-four cards, toolbars and sub-headers also drop a fill that was doing nothing — the border beside it had been doing all the separating.

🐛 Fix: session badges and Windows tool-call attribution

Recent-session rows said the same thing three times: a status dot, the word 运行中/完成, and an untinted number badge. The word is gone and the badge carries running/unread state, since that is where the eye lands when scanning the right edge.

On Windows, snapshot toolFiles paths were stored with backslashes and compared against git's /-separated diff paths. The sets never intersected, so every file in an Edit/Write snapshot was marked an external change and tool-call attribution broke entirely.

✨ New: background control and in-place updates

Cockpit can now keep running after you close the terminal, with first-class lifecycle commands:

cockpit start
cockpit status
cockpit restart
cockpit stop

Run cockpit update — or click the version pill in the sidebar — to install the latest release and restart in place. Failed installs roll back automatically, and open tabs now detect when a new build is ready and offer to reload.

✨ New: experimental native Windows support

Cockpit now runs directly on Windows, using Git Bash when available and PowerShell as a fallback. Process management, terminal startup, updates, and restarts have all been adapted for Windows rather than routing terminals through WSL.

🐛 Fix: sessions and previews

Session numbers now carry their running and unread state directly, and the project sidebar lists the active sessions you can jump to. Recent-session search is easier to find, engine pickers use calmer neutral styling, and image previews now include a Copy image action.

Fresh installs also have a clear Open Project path, project lists remain scrollable, Claude histories resolve correctly for paths containing spaces or underscores, and noisy git-status logging no longer buries useful diagnostics.

🌐 Site: a simpler way in

The opencockpit.dev homepage is now shorter and more direct: one install command, one product view, and a compact explanation of the Agent / Explorer / Console workflow.

🐛 Fix: Codex sub-agent drill-in

codex 0.147 rewrote its multi-agent wire format, and Cockpit's Task bubble was still reading the old one. Drilling into a sub-agent came back with "no sub-agent messages found" every time, even though the sub-agent's transcript had been on disk the whole time.

Cockpit now binds a sub-agent to the call that spawned it through the new event line, and understands both layouts, so rollouts recorded by either codex version still open. A sub-agent's report lands back on the parent's Task bubble as it arrives, and the bubble is labelled with the sub-agent's task name — 0.147 encrypts the spawn prompt, so the old label was a wall of ciphertext. Two agents spawned in the same turn no longer bind to each other's call either.

🐛 Fix: Codex tool calls, screenshots, and token counts

An audit of 148 local codex rollouts (0.94 through 0.147) against Cockpit's transcript parser turned up four gaps, three of which had been live for months.

Screenshots no longer flood the transcript. view_image returns an image rather than text, so its entire base64 data: URL was being inlined into the bubble as literal text — 586 KB for one screenshot, over 5 MB across a single session, carried through the API response, React state, and the DOM. It now renders as a Read call with the file path in the header. Resumed Codex sessions report tokens again as well: usage was read from a line no codex version actually writes, so context and token counts came back empty after every resume, and they now come from codex's own token-count events.

Tool calls Cockpit hasn't been taught yet are visible instead of dropped. tool_search has been written since 0.141 and rendered as nothing at all; any Codex tool call carrying a call id now gets a bubble under its raw name — plain, but never silent. Forking follows the same rules, so branching a session around one of those calls no longer cuts at the wrong turn.

✨ New: Claude and Codex model controls

Claude and Codex tabs now have a model picker in the chat header, with the controls each engine actually supports. Claude exposes model, effort, context window, fast mode, and thinking where available; Codex exposes the GPT-5.6 Sol / Terra / Luna models and their supported reasoning levels. Choices are kept with the project tab instead of resetting whenever you move around Cockpit.

✨ New: built-in DevKit and better HTML apps

The HTML Apps panel now includes DevKit, a built-in toolbox for Base64, URLs, JSON, hashes, JWTs, timestamps, and UUIDs. Built-in apps appear as first-class cards without being written into your personal html.json, so they keep working across upgrades and install locations.

HTML apps can also open in a separate browser window directly from the Apps panel, preview toolbar, or file browser. The preview itself gets a clearer title bar, app icon, and backdrop.

✨ New: clearer sessions and live output

Streaming replies now show a live, CJK-aware output count, so long-running answers visibly keep moving. Session panels also share consistent numbered navigation markers, making keyboard destinations easier to identify across recent, project, and global session views.

🐛 Fix: API-key engines and Codex 5.6 transcripts

DeepSeek, GLM, and Kimi now consistently run through Cockpit's Built-in Agent; the old per-tab SDK / built-in switch is gone. Their live model pickers and balance or quota checks remain available, while stale SDK sessions are no longer mixed into the active session list.

Codex GPT-5.6 tool calls now render correctly in both live and resumed transcripts. Cockpit recognizes commands and patches routed through the new exec-script format, preserves their output, and keeps forks aligned with the right tool call.

✨ New: Codex session forking

Codex chats now get the same fork controls as the other engines. Use the fork action on a message to branch a Codex session from that point, either with the conversation prefix or just the selected turn, without manually recreating the prompt in a new tab.

✨ New: HTML app dock

HTML app previews now minimize into the sidebar Apps dock. Open an app from the HTML Apps modal, minimize it, and click its dock icon later to restore the same running preview. The modal still offers Open in Console bubble when you want the app to live in Console instead.

🐛 Fix: chat scroll

Chat now stays pinned to the bottom more reliably while live output is reconciled with on-disk history. This covers the annoying case where a finished run swapped temporary stream bubbles for canonical messages but left the viewport a little above the newest reply.

📦 Misc: /cr review output

The built-in /cr review prompt now asks for a short findings table first, then detailed evidence underneath. Reports should be easier to scan without losing the static or dynamic proof that backs each finding.

🐛 Fix: Console shells

The console's interactive shell button now opens your preferred available shell instead of hard-coding zsh. On macOS/Linux it tries zsh, then bash, then sh; on Windows it uses WSL when available. Rerunning that shell bubble keeps the same behavior, and the bubble title updates to the actual shell that started.

🐛 Fix: Browser and HTML apps

Browser tabs now suppress the native context menu consistently, so Cockpit's own context-menu behavior doesn't get interrupted inside the workspace.

HTML app tooltips and Chinese copy also got a cleanup pass, including the docs and prompt text around local HTML apps.

🐛 Fix: PDF previews

PDF previews now ship a matching pdf.js worker version, avoiding worker/API version mismatch failures when opening PDFs through the built-in file viewer.

✨ New: Codex tool activity

Codex turns now show the work that used to happen off-screen: sub-agents, MCP tool calls, web search, and plan updates all render as normal cockpit tool bubbles instead of leaving a long silent gap.

Open a Codex tab, run a task that spawns agents or searches the web, and you can watch each step in the chat. Sub-agent bubbles also drill into their transcript through the existing task viewer, so a refresh no longer changes the shape of the conversation.

✨ New: HTML apps in the sidebar

The HTML apps launcher moved into the sidebar, where it is easier to reach from the workspace instead of competing with the main chat surface.

🐛 Fix: Codex history and file diffs

Codex resume is more reliable: no-history recovery turns are validated, session state is updated more carefully, and history loading has been tightened up. FileDiff entries for Codex tool calls now survive refresh because snapshots are keyed by Codex's persistent call id instead of the live stream's temporary item id.

🐛 Fix: Explorer links and diff text

File links in AI replies now open in the Explorer, matching the rest of cockpit's file-navigation flow. The diff viewer also shows full text correctly instead of truncating content in the expanded view.

🐛 Fix: Installed app IME

On macOS, right-clicking inside the installed cockpit PWA could break IME composition for the whole window. Cockpit now suppresses the native context menu only in installed app mode, while normal browser tabs and cockpit's own React menus keep working as before.

📚 Docs: Release checks

The release process now runs a clean-clone npm ci --dry-run before the version bump, catching lockfile corruption before a tag is pushed.