- Moved daemon live-event loop ownership further onto the adapter-independent
control.Event/control.NormalizedEventmodel while preserving existing App Server snapshot reconciliation. - Added an experimental local read-only router-agent HTTP API behind
CTR_GO_CONTROL_API_LISTEN, disabled by default and restricted to loopback TCP.
- Repositioned the project from a Telegram-first remote UI to a local Codex Control Plane with Telegram as the first production adapter.
- Added ADR-019, Control Plane wiki docs, v0.5 feature brief, roadmap, research notes, and theory log.
- Added
internal/controlwith adapter-independent runtime/control interfaces for App Server-backed threads, turns, events, approvals, models, ecosystem discovery, diagnostics, and notifications. - Added App Server wrappers for thread fork/name/archive/unarchive/compact/rollback plus skills, hooks, MCP status, app list, config, and plugin skill discovery.
- Added a schema-backed App Server capability map for installed Codex method detection, including future goal API drift handling.
- Moved normalized event and notification severity contracts into the control layer while preserving existing Telegram adapter behavior.
- Added
.DS_Storeignore rules to keep macOS metadata out of future commits.
- Added macOS user-level service installation through
ctr-go service install, including friendly first-run prompts, non-interactive flags, LaunchAgent generation, start/stop/restart/status, login toggle, and uninstall. - Added a macOS menu bar tray app for service control, status, logs/config access, doctor, setup, and start-with-system toggling.
- Added macOS
.pkgpackaging alongside the existing release archives. - Kept daemon secrets in local
config.env; LaunchAgent receives onlyCTR_GO_CONFIGand never stores Telegram tokens in plist environment variables. - Preserved proxy runtime env in private config for LaunchAgent deployments and redacted Telegram bot URLs from fatal stderr output.
- Added ADR-018, service installer docs, tray command tests, LaunchAgent unit coverage, and macOS package dry-run validation.
- Added official GitHub Release binaries for macOS, Linux, and Windows, with SHA-256 checksums.
- Added
ctr-go initto create a private localconfig.envfor first-run setup. - Added config file loading from
~/.codex-tg/config.envorCTR_GO_CONFIG, while preserving explicit environment variables as the highest-priority source. - Kept Telegram bot tokens out of
status,doctor, daemon logs, and init summaries. - Added ADR-017, a distribution brief, release workflow, release packaging script, and CLI/config unit coverage.
- Replaced the operator-specific Russian-language agent instruction in
AGENTS.mdwith language-neutral guidance for future contributors. - Kept the runtime unchanged; this is a documentation hotfix on top of
v0.2.6.
- Added a Plan Mode reset contract: Plan-like Final Cards expose
Turn off Plan, and/stop <thread>arms the same one-shot reset. - The next ordinary Telegram-origin
turn/startafter reset is sent withcollaborationMode.mode = default, then the reset is cleared after a successful start. - Kept
/defaultand/reply --defaultas hidden compatibility fallbacks while removing/defaultfrom the Telegram command menu,/help, README, and user-facing docs. - Hardened
/stopso completed threads with staleactive_turn_idare treated as idle instead of attempting a timed-outturn/interrupt. - Added ADR-016, unit coverage for reset state/callback guards, and the opt-in live E2E
plan_mode_resetcase.
- Added the Telegram notification contract:
New runis configurable,[Plan]and[Final]notify, while live progress, direct responses, menus, callbacks, exports, and errors are sent silently. - Changed Final rendering to send a new
[Final]message and best-effort delete transient live cards, preserving Details routing on the new Final Card. - Fixed tool-only runs so live current tools are not erased by stale polling snapshots and completed tool-only commands remain visible in Details and Tools file.
- Added explicit Default Mode escape hatches through
/defaultand/reply --defaultfor threads that remain in App Server Plan Mode. - Added ADR-015, contract/regression documentation, release validation notes, Telegram transport tests for
disable_notification, and live E2E coverage for notification and tool-only Details behavior.
- Changed
/newchat <prompt>to create a real Codex UI Chat folder underCTR_GO_CODEX_CHATS_ROOTbefore starting the new thread. - Added
/newthread <prompt>as the no-Chat-folder escape hatch for starting without project selection. - Added
CTR_GO_CODEX_CHATS_ROOT, command-menu coverage, unit coverage for prompt slug/collision behavior, and ADR-014 for the new Chat folder contract. - Added an opt-in
newchat_folderlive Telegram E2E case and validated/newchat,/newthread,/context, and generated folder behavior on macOS.
- Fixed the public CI secret-pattern smoke scan by replacing private-looking Windows path fixtures in tests with
C:\Users\you\...examples. - Added
/newchatto the Telegram Bot API command menu registration so the UI command button exposes the existing new Chat flow. - Added unit coverage for the Telegram command menu to keep
/newchatregistered and prevent duplicate command names. - Rebuilt and restarted the macOS LaunchAgent daemon, then verified Telegram
getMyCommandsreadback includesnewchat.
- Fixed a Details binding regression where pressing
Detailson an older completed run could render the latest run andBackcould replace the older Final Card with the newer one. - Bound Details callbacks to their original panel/card using
panel_id, thread, turn, chat/topic, and message-id guards, with stale callbacks failing closed instead of falling back to the current panel. - Restored Details rendering for older turns when App Server raw payloads use the nested
{ "thread": { "turns": [...] } }shape. - Added unit coverage for old/new completed run panels, missing
panel_id, mismatched message ids, and mismatchedTools fileroutes. - Added the checked-in
details_bindinglive Telegram E2E case and validation notes for Details,Tool on,Tools file, andBack.
- Preserved the live
Current tool:display for Telegram-origin turns when durable polling temporarily reports an older completed tool from the same turn. - Added a live E2E regression case that exercises two long-running progress-printing commands and fails if
[Tool]reverts to an older completed command while the newer tool is still running. - Split Codex UI
Documents/Codexchats into a dedicatedChatsnavigation area under/projects, with recency sorting, pagination,/newchat <prompt>, and configurable preview/page limits. - Improved
/projectsreadability: project buttons now useN. Project name, Chat buttons useChat N. Thread name, and visible internalkey:rows were replaced withlast thread:. - Updated contract, regression, validation, quickstart, and Telegram UX docs for the Projects/Chats navigation and v0.2.1 live validation.
- Added a normalized App Server live event layer for
item/*,turn/*,thread/status/changed, and legacycodex/event/*notifications. - Restored honest current-command visibility for Telegram-origin turns:
[Tool]now showsCurrent tool:from live App Server events during execution, then returns toLast completed tool:after completion. - Preserved v0.1.3 safety for foreign GUI/CLI observer panels: they still show only completed tool/output state from durable
thread/read. - Hardened App Server client lifecycle with per-process generations so stale stdout/stderr, responses, server requests, and notifications from a closed session cannot affect the next session.
- Preserved Telegram-origin live current tool state when a same-turn
thread/readsnapshot omits in-progress tool details, while still allowing completed/final snapshots to reconcile durable state. - Upgraded live Telegram E2E harness with selectable cases,
sleep20_timingcurrent-tool acceptance, and a multi-tool current/completed transition scenario. - Added docs, ADR/regression-map updates, validation notes, and public release notes for the v0.2.0 live event refactor.
- Added project-first thread creation from Telegram:
/projectsopens cached workspaces by normalizedcwd, project menus exposeNew thread, and the next message starts a new App Server thread in that project. - Added
/new <project-key-or-number> <prompt>as a direct new-thread shortcut for cached projects. - Bound the chat/topic to the newly created thread after success, seeded the Telegram-origin snapshot, and started hot polling for the first turn.
- Preserved created thread recovery when the first
turn/startfails, while refusing to start a turn ifthread/startdoes not return a thread id. - Scoped Plan answer buttons to the current turn so stale
user_inputchoices from an older turn cannot appear under a newer[commentary]card. - Made synthetic Plan fallback neutral (
Input required.) instead of reusing stale thread preview text from a previous turn. - Added docs, regression map entries, unit coverage, and live Telegram readback validation for the new project-thread flow and Plan fallback behavior.
- Made the Telegram live trio honest about App Server visibility:
[commentary]owns whole-run timing,[Tool]shows the last completed tool, and[Output]shows the last completed tool output. - Added
Run active for: ...while a run is active andRun duration: ...on the terminal[Final]card. - Removed running-tool preservation from compact snapshots so missing App Server tool state cannot be rendered as an authoritative current command.
- Hardened late live-tool handling so older turn/tool updates cannot overwrite newer completed state.
- Retired session-tail overlay from live UI paths; session JSONL remains only for explicit exports/full-log flows.
- Added public-safe Telegram live E2E coverage for sequential commands,
sleep 20, and a multi-command math run that verifies last-completed tool/output updates and run timing. - Filtered internal/ephemeral App Server threads from public thread lists.
- Updated ADR/testing notes for the correctness-over-current-command-visibility contract.
- Added bounded daemon diagnostics for Telegram-originated turn lifecycle, app-server calls, session repair, transport failures, and first terminal status of Telegram-originated turns.
- Normalized App Server snapshots that contain a
final_answerbut still reportinProgress, clearing stale active-turn state before Telegram routing. - Treated
no active turn to steeras stale active-turn evidence so Telegram input can start a new turn instead of returning a false parallel-turn warning. - Prevented global observer sync from recreating duplicate
New runpanels for Telegram-originated turns already represented by a Telegram input panel. - Added
Get thread idto live summary and Final Card actions so operators can copy full thread/turn ids without SQLite or logs. - Sanitized Telegram-visible rendering so missing App Server command/status/request fields never appear as literal
"<nil>", with unit coverage and a local live nil-guard E2E path documented. - Serialized App Server session lifecycle repair/startup so stale old live loops cannot clear newer sessions or create duplicate live subscriptions.
- Gated transient Telegram-origin empty
interruptedsnapshots so Telegram does not collapse into a false terminal card before App Server catch-up. - Changed observer chronology so
New runis an orientation card without run status. - Kept run status only on live
[commentary]and terminal[Final]cards. - Stopped
[User]cards from showing or updating run status after the prompt is delivered. - Made terminal catch-up collapse directly into
[Final]when final text is available, while preserving the existing guard against historical observer fan-out. - Kept completed commentary/tool/output history in Details instead of the final card body.
- Added Telegram-originated Plan Mode starts through
/plan,/plan_mode, and/reply --plan, using App ServercollaborationMode: plan. - Added
/settings,/model, and/effortTelegram button menus for Telegram-started collaboration-mode model settings, with choice buttons removed after a selection. - Guarded active-thread replies so Telegram does not start a parallel turn when an active turn cannot be steered.
- Added
ctr-go version. - Verified the macOS daemon path on macOS 26.3.1 arm64 with Go 1.26.2, LaunchAgent startup, build, and Telegram readback/status check.