Changelog
The watch, getting sharper.
Every release of the beta, in order: what was added, what changed, and what got fixed.
Claude limits stay connected.
Claude limits
- Vigil now renews a signed-in Claude account before its access token expires. Renewal runs five minutes early and retries once after an unexpected authorization failure, so the limits panel no longer needs a Claude prompt followed by repeated manual refreshes.
- Credential rotation is coordinated with Claude Code. Vigil uses the shared cross-process lock, rereads the credential after waiting, and writes a rotated pair only when the original is still current. A stale lock from a crashed process self-recovers after one minute.
Security & privacy
- Claude credentials remain in macOS Keychain. Tokens and credential responses never enter Vigil logs, caches, analytics, or UI payloads.
Downloads should feel like downloads.
Updates
- Update buttons now open the correct DMG immediately. Watchtower no longer puts a technical checksum screen in front of the download, and the Island no longer detours through About. All update buttons use the same official architecture-specific release URL.
Claude stays signed in, and an empty Island stays visible.
Claude limits
- A refreshable Claude login is no longer called expired. Vigil distinguishes access-token expiry from login expiry and explains the required fix: send any prompt in Claude Code to renew access, then Recheck. It asks for
/loginonly when the stored login can no longer refresh. - Vigil only checks that a refresh token exists and has not expired; it never sends, writes, or rotates that token. Claude Code remains the owner of the login.
Island
- Empty notch states stay readable. Waiting, setup guidance, and active-but-silent diagnostics remain visible pills instead of collapsing into a blank camera-width shell.
- Attention text no longer floats beside the notch. Needs-input and error events expand the Island, then leave a taller, status-colored project band behind.
- Silent-agent recovery guidance stays visible. It no longer disappears through the ordinary idle timeout.
Accessibility & privacy
- Screen readers still announce the project name and actual needs-input or error state after the redundant visible message is removed.
- Release artifacts remain anonymously ad-hoc signed with no Apple Developer identity or notarization.
The missing meters are back, and setup no longer waits on the network.
Limits & setup
- Claude and Codex limits load in the menu bar and Watchtower again. A hidden Island can no longer latch native quota polling offline, and a dead IPv6 route falls through to working IPv4 inside the existing request limit.
- Manual recovery stays visible. Watchtower keeps Refresh available before any provider has produced a meter and shows the real refresh result in its header.
- The welcome tour continues immediately. Enabling Limits is saved before its first refresh runs in the background, and an older Accessibility response cannot overwrite a newly granted Active state.
- A failed tray-icon repaint keeps the native text readout. The raster gauge takes over only after macOS accepts the icon.
Network & performance
- Claude and extra-provider quota polling reuse native HTTP connection pools. Renderer network events are refresh hints only and no longer write native connectivity state.
- Quota, update, checksum, registry, and sound-pack requests bound each connection candidate, so an unreachable address cannot consume the whole request before the next one is tried.
Security & privacy
- Release artifacts remain anonymously ad-hoc signed with no Apple Developer ID, Team ID, certificate, personal identity, or notarization.
Changed
- Notifications are now Alerts. Routine starts, progress, and completions stay in Activity; Alerts is reserved for moments that genuinely need attention. Suppressed alerts remain in history, while exact retries and events inside the prompt quiet window do not create noise.
- The approved Island park is now the default. It dissolves cleanly beside the notch and re-emerges without leaving an invisible click-blocking window over the menu bar. Project and achievement banners also keep their correct click destinations.
- The welcome tour is driven by live state. Replaying it preserves existing choices, hook and sound-pack failures remain visible, and login-item/config changes commit together or roll back.
- Website, demo, GitHub, and in-app release notes now share the beta.14 story. Watchtower's defensive note limit was raised so detailed releases such as beta.13 are no longer cut off.
Hooks & agents
- Codex stays visible while a trusted hook is waiting for input. The rollout fallback no longer overwrites hook-authoritative permission or error state, manufactures a prompt transition, or duplicates the first hook-backed event.
- Claude Code and Codex connection health now reflects what each tool can actually run. Vigil honors
CLAUDE_CONFIG_DIRandCODEX_HOME, checks the exact executable script, and distinguishes malformed config, Codex trust and handler state, disabled hook features, and administrator policy. Hook repair remains additive and preserves unrelated configuration. - Hooks now treat missing optional fields as missing on every supported macOS release. The macOS 15
plutilwrote failed key lookups to standard output, which could hide a Claude Stop, omit Codex model metadata, or mistake a blocking Codex question for an auto-resolving one. - Automatic review is no longer reported as a human block. Codex Approve for me and Claude's pre-review permission hook stay quiet; manual approvals and genuinely blocking questions alert. Auto-resolving questions, auth notices, idle events, and ordinary progress remain Activity only.
- Concurrent sessions no longer erase each other. Attention is tracked per provider, session, and subagent, so one agent continuing or completing cannot clear a blocked sibling. Only a causal answer or that exact agent ending resolves its Needs input state.
- Codex Desktop chats without a real rollout no longer become project pills. Vigil also refuses to deep-link a Codex thread when there is no verified rollout target.
Alerts, limits & setup
- Quota warnings and resets are provider- and window-specific again. Session and Weekly warnings no longer collapse; 50/25/10/5/0% thresholds persist without replaying, scheduled heads-ups and countdowns wait for fresh readings, early resets are detected, and five-hour refills reconcile correctly beside Weekly.
- Quota refreshes survive real laptop behavior. Sleep, wake, offline transitions, in-flight requests, stale caches, and overlapping refreshes are generation-safe. Manual refresh reports complete, partial, unavailable, or failed providers honestly, and OpenRouter support is restored.
- The Accessibility step changes to Active when macOS grants access. The tour checks live state, briefly polls after Allow, and explains how to remove a stale entry and re-add the current app when an anonymous ad-hoc update changes its code identity.
- Menu-bar placement no longer runs Shy's side-dodge on notchless displays. The slim bar still reveals on hover, while Shy remains available for ordinary floating pills. The provider health dot and attention ring are smaller and better separated from the logo and quota text.
- Lifecycle and persistence failures stop looking successful. Relaunch, Reset, login items, hooks, settings, stats, history, alerts, sound packs, projects, exports, and update notices now confirm durable success or show the actual recoverable error.
Performance
- The Island's display link, hover sampling, geometry observers, Watchtower timers, and animations now exist only while their surface is visible; window fitting is lifecycle-driven instead of continuously polled.
- Config, rollout tails, hooks, events, stats, alerts, icons, sound packs, and provider quotas reuse coherent metadata-validated snapshots. Exact-session imports and unchanged-input detection avoid repeated parsing, full history walks, base64 payloads, and renderer work.
- Hidden/fixed placement, history import, extra-quota, and Shy workers park on condition variables. Native producers call Rust handlers directly, and Watchtower rerenders only sections whose fingerprint changed.
- The dependency graph is smaller, with no new frontend framework, async runtime, database, or watcher added.
Security & privacy
- Release builds are anonymously ad-hoc signed only. Local and CI builds clear Apple credentials, keep hardened runtime and required entitlements, and reject any shipping app containing a signing authority or Team ID. No personal Developer ID is imported and no DMG is notarized.
- The loopback server now fails closed when its token, file permissions, bind, or published port is unsafe. Renderer IPC is surface-scoped and bounded, and file/archive paths reject traversal or symlink escape.
- Corrupt stores are quarantined instead of treated as empty, critical writes are atomic or transactional, and remote sound packs validate hosts, redirects, integrity, and archive containment before an atomic replacement.
- Locked
event-listeneris on the RustSec-patched 5.4.2 release; CI fails on future unsound advisories, except the documented non-shipping Linux/GTK branch.
The Island
- The capsule no longer drifts sideways as it tucks back into the notch. Closing the panel ended with the bar sliding left and its left edge then creeping back right, which read as the shape hunting for its parking spot. Its left edge now does not move at all — only the right edge sweeps in, which is what “shrinking into the notch” should look like. Measured across one close: the left edge changed direction four times before, and zero times after.
- The panel closes in order. Its contents fade, then its height collapses, then the capsule narrows into the housing. Previously height and width moved together, because the panel’s height was derived from its width and could not be sequenced.
- The slim project band stopped disappearing partway through the collapse. It faded to nothing for about a seventh of a second — sometimes; where it landed depended on frame timing, which is why it looked intermittent. It now dips and comes back, never below 42%.
- On displays without a notch, the capsule fits its contents. It carried 20pt of dead black on the left and 15 on the right, and none above or below — the pill inside was actually a point taller than the capsule around it. Now an even 3pt frame on all four sides, with the corner radius matched to what it wraps. The slim bar takes the same frame and is shorter to suit it.
- Moving between a notched and a non-notched display no longer leaves a small dark tab floating under the menu bar for a second before it corrects itself. Coming back from the built-in display, the bar also returns to the menu bar instead of hanging underneath it.
- Project pills grow on hover instead of jumping. Their width snapped to the new size on the first frame while only their height animated, so they read as being swapped rather than opening.
- The status dot on a project pill is drawn whole, and the concave corners where the capsule meets the top of the screen stay drawn while the panel is open — they used to vanish the moment the pills grew back to full size.
- The launch pill sits at the top of the strip on displays without a notch. It was offset down to clear a camera that is not there.
- An alert arriving while the bar is parked beside the notch can no longer be lost. A second alert during the tuck-in erased the first, so a project needing your input could go unannounced. They now queue.
- An achievement notification is no longer cut in half. The window fits itself to the pill it draws and the notification was not counted, so it appeared whole and was then sliced through the middle for the rest of its four seconds — taking half its click target with it, and clicking it is the only way to reach the badge.
Fixed
- ChatGPT Projects no longer appear on the bar as unreadable pills. The desktop app runs Codex inside its own workspace folder per project, and Vigil named the pill after that folder — a 32-character id. Those workspaces are now ignored, like Codex’s other generated folders.
- “Hide from the bar → for the rest of the day” hid for 24 hours. Chosen at 5pm it kept a project hidden until 5pm the next day. It now lasts until midnight, as it says.
- Hiding a project survives a restart. Every duration, including the “when time is up” setting that promises to wait out the full period, was forgotten when Vigil quit. Deadlines are stored, so a restart resumes the countdown rather than starting it again.
- With no agents running, the bar no longer stretches across the menu bar. It reserved room for the camera housing on top of the “Waiting for agents” text — 361pt of black with the camera sitting in the middle of it. With nothing to show beside the housing it now rests below the strip as an ordinary pill, and the first project to appear moves it up into the notch.
- Hovering the bar and leaving again immediately puts it back beside the notch. Leaving during the first fraction of a second left it centred ON the notch instead of next to it, which hid one of the project bands behind the camera until something else moved it back.
- The project bands are brighter, and the one that wants you is brightest. They were all close to invisible against the capsule — blue worst — and “needs input” had no glow at all, only a taller band, so the most urgent state was the dimmest thing on the bar.
- A damaged Claude settings file no longer reports as working. If
settings.jsoncould not be read or parsed, Vigil treated the setup as healthy and neither repaired it nor mentioned it, while no events reached the app at all. It now shows as not connected, so the repair is offered.
Privacy
- The Codex hook no longer passes your prompt as a command-line argument. With “Show the latest line” turned on, the text was handed to
curlin a way that any process on your Mac could read while the request was in flight — the one path that setting exists to protect. It now travels in the request body, as Vigil’s other hooks already did. Nothing changes with the setting off, which is the default: no prompt text is lifted at all. - Vigil’s binary no longer contains the path it was built from. 427 references to the build machine’s home folder were embedded by the compiler; they are now stripped.
Fixed
- Screenshotting a window behind the Island works again. Cmd-Shift-4 then Space picks the topmost window under the pointer, and the Island’s window is far larger than the pill it draws — it is sized for the expanded panel, so a collapsed pill left an invisible 920×900 pane over the top third of the screen. Vigil already shrank the window to fit the pill; it just stopped re-checking after certain moments, and could stay full-height for the rest of the session. Measured: a long-running window sat at 920×900 before this and holds 920×73 after.
- A native menu opened from the Island marks it “busy” so it does not resize under you. If that mark was ever left set, nothing could clear it, and the Island stayed full-height and hover-stuck until the app restarted. A mark older than a minute is now treated as stale.
Fixed
- macOS now says “Vigil” when it asks about starting at login. The prompt, and the Login Items list in System Settings, read vigil-tauri — the name of the executable inside the app rather than the app itself. macOS shows that name because Vigil is not signed with a Developer ID, so there is no registered developer name to show in its place. The executable is now called Vigil, so the prompt is too.
- Your existing “start at login” setting survives the rename: Vigil treats a login item pointing somewhere it is not as stale and repairs it on the next launch.
Privacy
- Vigil does not read what you or your agent wrote. It never needed to - the usage and cost numbers come from the token counts your session files already record beside the text. One feature did read prose: the latest line, shown on a project row so you could tell what an agent was working on. It is now off by default, under a switch in Settings → Data & history. With it off nothing reads message text - not Vigil, and not the hook scripts it installs into your agent sessions, which now check the setting before lifting a single character out of a payload.
- Nothing you or your agent wrote is written to disk, with the switch on or off. That text now lives only in memory, only while it is on screen. The tradeoff, plainly: even with the feature on, older rows come back blank after a restart.
- Upgrading clears what earlier versions saved. Those were Vigil’s copies - your agents keep their own session transcripts, which Vigil neither writes nor deletes.
- What Vigil keeps, so you can judge it: timestamps, project paths, token counts, model names, session ids, and identifiers for the terminal an agent runs in - on your Mac. Project paths are the identifying part, and a per-project monitor cannot work without them.
- What leaves your Mac: your provider’s own usage API every few minutes using the session your CLI already uses, a periodic GitHub version check, and the sound-pack registry when you browse packs. No Vigil server, no account, no telemetry.
Fixed
- The Stats range bar pins to the top again. Today/7/30/90 stuck a topbar’s height too low, with the page scrolling visibly through the gap above it. It now sits flush, and the strip behind it fades out instead of ending on a hard edge.
- Data & history reads as one page. The third action no longer runs off the edge of the panel, and each explanation sits under the control it describes.
Added
- Clear activity log (Settings → Data & history) empties the stored log on demand - the last 500 events behind the activity feed and the live project rows. A second press confirms. Stats, achievements and settings are separate files and are not touched.
Changed
- Rebuilt as a native app. Vigil used to ship its own copy of a web browser to draw a menu-bar pill - about 226 MB of it. It now uses the one already in macOS. The download drops from 95 MB to 6.6 MB and the installed app from 238 MB to 14 MB, with roughly a quarter of the CPU while your agents are working. Same Island, same Watchtower, same sounds, same hooks - and your history, settings and achievements carry over untouched. Being honest about the part the numbers overstate: memory is better, not twenty times better, around 40% lower here, and the saving shrinks the more monitors you use.
- Less memory, again. The ambient edge glow used to be a full web page per monitor, kept loaded for the life of the app to draw four gradients; macOS draws them directly now. The Watchtower also lets go of its contents while hidden and rebuilds them when you open it.
- The native edge pulse keeps the original shape. Its shrinking border, inner-shadow glow, and fade now match the old animation without keeping a browser window alive on every display.
- The pill dissolves between monitors instead of sliding. It never actually crossed the gap between your displays, so a slide implied a journey it did not make.
- Durations speak your language. Times like “41m” and “2h”, and the weekday on a reset estimate, were assembled from English and then dropped into otherwise-translated sentences. They now follow the language you picked.
- Achievements look earned. Completed milestones carry a confident green check and completion date, while the active tier and its completed count are larger and use that tier’s badge colour.
- One visual language across Vigil. Watchtower and Island cards, rows, buttons, tracks, and segmented tabs now share the same neutral surface palette. Tabs use direct hover, pressed, and selected states, provider switches blur and settle their content, and controls keep consistent sizing, padding, hover states, and hit areas. Eight app-wide themes range from the restrained Indigo default to terminal, molten, and gradient accents.
- Share cards and settings are easier to operate. The share sheet has clearer tabs and a modern date control; exported cards name the exact rolling date span, retain precise API-rate estimates, and use the current Vigil surfaces; Stats actions have a deliberate hierarchy; and sound, provider, About, and Data & history controls now read as actual controls. Empty achievement tiers explain what comes next, completed milestones fold into their own expandable section, and long notification text wraps without displacing its actions or timestamp.
Added
- Stats, reorganized into a story. One range now drives the full Breakdown - Today (with hourly bars), 7, 30, or 90 days - from spend and tokens through cache economics, projects or models, sessions, pace, and task outcomes. Charts carry dated axes; all-time activity and records have their own chapter; and Recalculate, Share card, and Export CSV stay beside the data they act on.
- An agent-first Watching card. Claude Code and Codex now each get one clear row for hook health, the exact detected plan, available meter summaries, and their own “Show limits in the menu bar” switch. Optional limit providers live in a dedicated Manage page instead of crowding Settings.
- Claude and Codex can share the menu bar. Each enabled service gets its official mark, a usage-health dot, and stacked 5-hour / weekly values when those windows are available. A provider that temporarily stops reporting a window no longer has another meter mislabeled in its place.
- A place to find things. The language picker moved to the Settings page, and Recalculate and Export CSV now live on Data & history.
- Limit meters as status pills, with a page of their own for turning individual ones off.
- Crash follow-up. If Vigil quits unexpectedly, the next launch puts one local notice in the alert log with a link into the existing bug-report flow. Nothing is uploaded automatically.
- Alert log. The Watchtower bell keeps the last 20 noteworthy events, separates unseen information from unacknowledged major alerts, and lets you acknowledge or clear them.
- Share a card. Create a square, branded image for a day, period, live limits, plan value, or summary; choose a theme, preview it, and copy or save it.
Fixed
- Session starts now match what you hear. A real start or resume plays its configured sound, flashes that project’s pill blue, and uses the optional blue edge pulse. Routine acknowledgements, progress, user activity, and session ends still update status and history without taking over the Island.
- “Play sound for” now controls sound only. Turning off a sound category no longer drops that event before status, history, alerts, and visual signals can see it.
- Claude and Codex now speak the same alert language. Equivalent lifecycle moments use the same status, colour, acknowledgement, visual alert, and selected-pack sound. Subagent and compaction activity stays silent, reset events do not replay the startup chime, and Claude failures distinguish ordinary errors from rate or output limits.
- Codex hook review cannot double-fire completions. The transcript fallback hands off as soon as Vigil’s Stop hook is trusted, even while other new hooks still await review.
- Low-limit messages say what is low. They name the 5-hour or Weekly window, and add the provider when both Claude and Codex are connected without cluttering single-provider setups.
- Manual limit refreshes say what happened. The result names every provider that updated, counts any that did not, and keeps cached bars from concealing a missing or expired Claude credential. An expired credential gets one quick automatic retry before returning to the normal polling cadence.
- The native edge pulse survives sleep and display changes. Its AppKit work now returns to the main thread before touching windows, fixing the wake-from-sleep crash found in soak testing.
- Codex projects show what they are doing now, not what they finished last. Codex only tells us when a turn ends, so its pill was permanently one turn behind. Vigil now reads the live transcript.
- Opening Claude from the desktop app no longer swallows the bar. It starts a session in your home folder, and since every project lives inside your home folder, all of them folded into a single pill named after your account.
- Project pills return to the task that raised them. Desktop sessions use the agent’s native task link, editor sessions return to their recorded project window, and a Codex subagent resolves to its parent task instead of opening a blank chat. Vigil no longer borrows another agent’s host when provenance is missing.
- Generated ChatGPT/Codex artifacts are not projects. Disposable image and artifact workspaces still produce their completion sound and alert, but no longer become live, recent, or Stats project pills.
- Project identity is less guessy. Vigil finds a nearby app or site icon without assigning an arbitrary child app’s icon to a monorepo root, and falls back to the project initial when no unambiguous icon exists.
- Expanded rows no longer write through each other. Project metadata, branch names, diffs, status, and elapsed time keep separate space at narrow widths, and pacing markers retain their intended triangular shape.
- Project ranges respond again. Today, 7-day, 30-day, and 90-day controls in project drill-ins are clickable, and Today is labelled as the partial day it represents.
- Project detail is quieter and consistent. Its lifetime model chart now shares the interactive Stats renderer, while the exceptional moved-folder history repair stays collapsed until it is needed.
- Your exact Claude plan now shows. Max 5x, Max 20x, and Pro are named and valued correctly instead of all appearing as generic Max.
- History rebuilds preserve task outcomes. Recalculation no longer loses the error, input, and event counts that transcripts cannot reconstruct.
- A calmer first run on a fresh Mac. Missing command-line tools no longer trigger a surprise installer, malformed hook configuration produces a useful error, and onboarding controls are keyboard- and screen-reader-operable.
- Agent hooks stay connected across Vigil updates. Startup refreshes Vigil’s owned scripts and migrates older hook formats without removing the current Claude Code or Codex registration, duplicating entries, or touching foreign hooks.
- Only one Vigil starts at login. Renaming the app left an old login item behind, and launching once from a mounted disk image recorded a path that no longer existed - so a restart could bring up several copies at once.
- Vigil goes back to its usual port. When the port was busy it moved to the next one and wrote that down as the new default, so it never moved back.
- The menu-bar readout no longer disappears after a status change, and no longer prints twice. The right-click tray menu opens above the panel instead of behind it.
- A project no longer shows as “working” when it is not, and one running for more than an hour keeps its row instead of vanishing mid-turn.
- The 24-hour activity chart reflects what actually happened today. The panel returns to where you left it after opening a link, and reloading it no longer leaves it blank.
- Watchtower rail buttons now close open drill-downs and return the selected page to its top. Watching instructions have their own full-width row and say exactly where terminal sign-in and hook review happen.
Site
- The landing-page demos show the whole product. Transparent mock surfaces no longer add grey or black backing plates, the hero cursor lands on the real target, Replay appears clearly only after the tour, and expanded panels are no longer cropped before their lower content.
- The website now matches the shipping app. Landing, feature, install, changelog, privacy, and generated demo surfaces use the same neutral cards, tracks, raised controls, active tabs, and hairlines as beta.11.
- Downloads are measurable without tracking people. Vercel Web Analytics records aggregate download clicks by Apple Silicon versus Intel and button location, with no cookies or in-app telemetry.
- Optional macOS permissions are explained before they appear. The FAQ, install guide, privacy page, and README now spell out that Accessibility and Automation are used only to focus an exact editor or terminal window when you click a project; watching and alerts work without them.
Added
- Watchtower, redesigned. Every page was rebuilt with a calmer, more consistent look: unified cards, clearer hierarchy, and a lighter touch on borders and glow. Overview, Stats, Projects, the Day breakdown, Sound packs, Browse, and Settings all got the pass.
- A year of activity at a glance. The Stats page now shows a full year in the heatmap (it used to stop at about four months), keeps up to 750 days of local history, and adds insight rows: cache economics, sessions, pace against your plan, and task outcomes.
- See what changed without leaving the app. When an update is available, the About page shows the release notes and a Download button, with a link to this full changelog. No more guessing what a new version brought.
- Codex prepaid balance. If your Codex account has prepaid credit that's being used, the remaining balance shows under Limits as "Extra Usage", and turns amber when it runs low.
- A provider tab in the Island quota panel. When Claude and Codex both report limits, a Claude/Codex tab (carrying the full plan name, like "Claude Max 20×") switches between them one at a time, so the panel stays short instead of stacking both providers.
- Keep Claude Code transcripts longer. A new Settings option controls how long transcripts are retained, from 30 days up to 10 years, so more history is available to Watchtower.
- The peek and expanded panels, retriaged. Both Island panels were rebuilt around what needs attention now: git diffs sit right-aligned next to status, token usage replaces average cost in the peek, and the layout is quieter with less colour and glow.
Changed
- Currency is spelled out. Every computed cost now carries a small "USD" mark, since those figures are USD API-rate estimates; provider plan balances keep showing their own reported currency, and a Settings note explains the split.
- The Island quota meters use a cleaner two-line layout (label and reset on top, the bar and its numbers together below), the Overview greeting shows today's cost, active agents, and tokens again, and the Overview "Refresh" reads as a quiet button.
- Opening the Watchtower from the Island tucks the Island back to its pill, and the Watchtower's shadows are calmer with less depth.
- Limit meters collapse into an accordion in Settings, showing only the ones in use by default, and the 3-dot menu is now vertical and only offers actions that actually do something.
Fixed
- Opening Watchtower from the expanded panel anchors it under the menu-bar icon now, instead of the far right of the screen.
- Shy Island follow-through. After you glance at the peek, moving off to shove the pill aside now works right away instead of being locked out while the panel settles.
- The About panel animates open and closed now, instead of appearing then vanishing.
- Watchtower tabs respond on the first click when it opens straight to a page (like Settings), and the Stats spend chart no longer jumps its height as you hover across the daily bars.
- Stale hooks cleaned up. Leftover hooks from before the app was renamed, which failed on every agent event, are stripped on install and no longer accumulate.
- Extra Usage no longer draws a full bar when you have no cap set; it reads as text, so an unlimited plan doesn't look maxed out.
Added
- Shy Island. With two apps side by side, the centred menu-bar pill used to sit right over the right window's controls. Now it gets out of your way: come at it from the left or right and a narrow pill slips aside (you can't catch it - it springs back), while a wider bar springs up out of view like the Dynamic Island stepping aside. Reach it from below to open it as normal, and if you pin it to the screen edge it trembles. On by default; toggle in Settings.
Fixed
- "Display with the mouse" follows within about a second now (it could lag up to 20s before) and fades in gracefully when it lands on the monitor your cursor is on.
Fixed
- Usage numbers are finally trustworthy. On-open stats could inflate versus "Recalculate" (and Recalculate could quietly under-count). The accounting core was rewritten around one source of truth, your transcripts, so on-open and Recalculate now run the same math and cannot disagree. Three root causes died with it: a model switch mid-session repricing your whole history onto today, a stray stub transcript dumping a session's entire total onto today, and rebuilds racing live sessions. One automatic rebuild heals existing stats on first launch.
- One pill per workspace, not per sub-repo. Open a top-level folder and let your agent roam the repos inside it: the Island shows a single workspace pill with a live "› atlas" breadcrumb of the sub-repo it's touching.
- Tooltips stay inside the panel instead of clipping mid-sentence at the window edge, and Cmd+R no longer blanks the Watchtower.
- "Limits unavailable" clears on Refresh now, un-parking a provider that backed off after a network hiccup; the Island also lands on the right display immediately.
- Drag-to-track works now: drop a folder onto the menu-bar icon. The original drop targets were unreachable in practice; the tray icon now accepts drops.
Added
- Per-model usage breakdown. Click any Usage row (Today / Last 7 / Last 30 / This month) for a drill-down of cost, share, and tokens by model, straight from your local history.
- An elegant launch entrance. The menu-bar icon and its usage readout fade in on start.
Changed
- The Limits card explains itself. Every window row carries a plain-words verdict ("On pace" / "Running low"), a caret the bar visibly trails or beats marks even pace, resets say what they do ("Resets to full"), the old "Session" row is labeled "5-hour", and projections read as sentences ("At this pace: empty ~4:45 PM"). The same language rides the Island's quota bars.
- Official Claude and Codex marks throughout the menu bar, Watchtower, onboarding, and this site.
- The Watchtower Settings page got a full redesign (pill switches, accent sliders, cleaner grouping), and the Island moves like the Dynamic Island with a content-size spring and elastic open.
- Power-aware quota polling that sleeps with your Mac and backs off on errors, a faster cold start, and long project names that marquee instead of truncating.
- Update buttons confirm before downloading and fetch the right build for your Mac directly.
Site
- The site you're reading launched. Direct downloads that always serve the newest build (with versioned filenames), the 90-second tour in a lightbox with an end-of-tour download card, a one-minute install guide with macOS mockups (also this changelog), and a quiet download toast that offers the guide when a download starts.
Added
- Records & rhythm on the Stats page. A records row (record day, longest streak, current streak) computed from your full local history, hover tooltips on the daily trend bars, and an Avg / Peak / Yesterday caption under the chart.
- Month projection & plan ROI. Stats projects this month's spend from your pace so far, and when your Claude plan is known, shows what this month's Claude usage would have cost at API rates next to what the plan costs.
- Session economics. Average tokens and estimated cost per session, with a cache-hit KPI showing how much of your token traffic the prompt cache absorbed.
- Capacity estimator. The Limits card learns your tokens-per-percent over time and adds a plain answer under each meter: "≈1.9M tok left". Shown only once the fit is confident.
- Menu-bar spend readout. The tray can show quota, today's spend, or both (Settings → Menu bar shows). Spend keeps ticking even with Limits off.
Changed
- Calmer update prompts. The Watchtower's update button is now a quiet full-width row under the greeting (no more pulsing pill crowding your name), and the Island's peek shows a compact icon-only chip so it never collides with the project pills.
Fixed
- "Check for updates" could show a wall of raw error text (HTTP headers and all) when release metadata was missing. The dialog now shows a one-line reason and logs the rest.
Added
- More agents in Limits. Z.ai (GLM coding plan), OpenRouter, Gemini CLI, and GitHub Copilot quotas now appear as their own groups in the Limits card, each showing up automatically when you're signed in and never otherwise. Third-party models run through Claude Code (Kimi, DeepSeek, GLM, Grok, MiniMax, Qwen) are priced at their real rates instead of a heavy default guess, estimated dollars wear a ≈, and the Stats model mix weighs models by real cost.
- Codex plan limits. The Limits card shows Codex's official meters: Session (5h) and Weekly bars with pace ticks, forecasts, and the limit ETA, as their own group under Claude's, read from the same source the Codex CLI's
/statususes. Appears automatically when you're signed into Codex; invisible otherwise. - Limit ETA. When your burn rate would exhaust a window before it resets, Vigil says when: "Limit in 1h 4m · ~3:42 PM" on the Watchtower, "limit ~3:42 PM" on the Island, replacing the old, misleading "~0% left at reset".
- Politeness layer. Vigil honors macOS Focus and Do Not Disturb (sounds and takeovers pause; status pills keep updating), optional quiet hours, a silent window that skips the chime for tasks under 10 seconds, and per-project mute.
- Click-to-focus. Clicking a session lands on the exact place the agent runs: the right tmux pane, the right iTerm2 / Terminal.app tab, or the editor window. First use asks the one-time macOS Automation permission; denying it keeps the old behavior.
- Early-reset heads-up. When a quota refreshes ahead of schedule, Vigil notices the jump and celebrates it: a green "5-hour limit refreshed early · 97% back" with the completion chime, never the alarm.
- Agent identity at a glance. Each project wears the mark of the agent working it (the Claude Code sunburst or the Codex mark) beside its name, in the Island's live rows and the Watchtower's Active-now list.
- Truer numbers. A running Codex session's tokens land within ~5 minutes instead of at the next launch, subagent transcripts no longer double-count, and date-dependent rates are priced at each event's own date.
- One limits language. The Island's Session/Weekly/Extra bars use the Watchtower's cleaner row layout: label and forecast on top, full-width bar with pace tick, captions beneath.
- Show usage as Used or Remaining (Settings → Alerts) across the Watchtower, the Island, and the tray. Default stays remaining.
- Alerts settings, regrouped. Three tidy clusters (Limits · Alert surfaces · Quiet), working quiet-hours time fields, and no more clipped slider values.
Fixed
- Cost double-counted on resumed sessions. Importing history then resuming a session re-added the whole session's cost. The import now seeds the priced cumulative, so cost and tokens stay in sync.
- A "needs input" alert could be silently dropped when two events landed in the same second and session. Hooks now bake a per-invocation nonce into the dedup key, so genuine events always fire.
- Codex usage was over-counted. Cached input was being counted twice on cache-heavy sessions; input is now stored net of cache, matching the rest of the pipeline.
- Extra Usage with no monthly cap was mislabeled "Not enabled"; it now shows "$X used (no cap)" and honors non-USD decimal places.
- Quota could render blank on a fresh install, and overlapping automatic + manual update checks could clobber each other. Both resolved.
- Hardening. The local status endpoint now requires the auth token, token-write failures surface instead of causing a silent outage, and project paths with quotes or backslashes are escaped in hook payloads.
- Notification titles and the notch "needs input" label now localize.
Performance
- The tray alert pulse pre-renders its two frames once instead of re-rasterizing every 750 ms, the Island no longer re-ships the whole translation catalog on every event, and the Watchtower coalesces bursts of events into one repaint.
Changed
- Quota empty states are actionable with inline Enable / Refresh, the Watchtower's "N need input" is a one-click triage jump to the top blocked agent, and the Island's controls are keyboard-operable with visible focus.
Added
- Update prompts across every surface. When a newer version is out, Vigil lights up: an up-arrow badge on the menu-bar icon, an Update button in the Watchtower overview, and a matching chip beside the Island's peek pills. Any of them opens the download.
Changed
- Update flow is now "new version → Download". Ad-hoc builds can't swap themselves in place, so the prompt downloads the new build instead of attempting a swap that silently fails.
Added
- Recalculate usage (Settings → Help) rebuilds token and cost stats from your transcripts to correct any accumulated drift, keeping achievements, settings, and packs.
Fixed
- Usage & cost over-counting. A long-running session's entire cumulative usage could be re-added to the current day when its bookkeeping entry was evicted too eagerly. The session ledger is now LRU-ordered so an active session is never evicted, and totals line up with your transcripts.
First release published to the public downloads repo.
Fixed
- Onboarding sound previews for the recommended packs (Orb Ping, Rocky) now play instantly and offline, with a real clip from each shipped inside the app.
- Low-quota reminders no longer repeat every few minutes at the same level. The 50/25/10/5% takeover re-arms only when a window genuinely resets.
The first public beta of Vigil: a quiet, real-time watch over your Claude Code and Codex sessions, right from the menu bar.
Added
- Status Island. Lives beside the notch with a glance-able status pill, a running stopwatch, the latest prompt snippet, and live session rows with a token in/out split. Pills rank by urgency, attention dots are colored by reason, and a kebab menu opens any project in Finder or your editor.
- Attention alerts. Full-screen visual overlays and screen-edge pulses when an agent needs you, debounced per project so several running at once never drop or overlap, and able to break through even in a fullscreen app.
- Watchtower popover. A menu-bar home with an Overview, a Stats drill-in, and Packs, Achievements, and Settings panels. Limits and Usage cards add burn-rate forecasts with a pace tick on each quota bar, an Active-now list, frosted scroll edges, bottom-sheet drill-ins, and full keyboard navigation.
- Usage & cost tracking. Per-project stats with charts and insights: quota rows with refresh countdowns and trend arrows, a usage readout stacked beside the tray icon, and project drill-ins with lifetime tokens, cost, turns, an input/output split, models used, and an activity heatmap. Cost is estimated at API rates with model-aware pricing; tracking is fully opt-out.
- Stats. A Model-mix card shows your turn share per model, the single biggest cost lever, alongside an activity heatmap. Every chart is keyboard- and screen-reader-accessible.
- Sound packs. CESP-compatible packs from the OpenPeon community play audio cues on agent events, with a card picker, per-pack detail sheets that preview each sound by its trigger name, and a startup chime. Built-in silent and macOS System Sounds choices mean fresh installs are audible out of the box.
- Achievements. 110 unlockable badges across five tiers, Bronze to a holographic Mythic, browsable by tier with chase-next sorting and real unlock dates. Unlocks celebrate with a banner and a toast beneath the Island.
- First-run tour. A four-step walkthrough sets up hooks, previews sound packs, and sets volume, finishing with a confetti send-off. Replayable anytime from Settings.
- Six languages. English, Spanish, French, German, Japanese, and Chinese, with a live picker in Settings and all 110 badges translated.
- Updates & feedback. Update checks with a manual trigger in Settings, and in-app feedback that opens a prefilled GitHub issue showing the exact log lines before anything leaves your machine.
- Themes. Five color themes: Indigo, Candlelight, Sage, Dusk, and Aurora.
- Native & accessible. A native macOS liquid-glass interface with status colors unified across the Island, Watchtower, and tray, plus keyboard navigation, focus outlines, and higher-contrast text throughout.