Go to Dashboard

Changelog

What shipped and when, summarized from the repository CHANGELOG — newest first.

In progress

Invitations, engineer analytics & desktop auth fixes

  • webFixed a team lead access-control bug — a team lead with no team assigned could see other team-less engineers' data within the organization.
  • webClosed a cross-organization hole in the learning progress API — an organization admin could update or verify another organization's engineer progress.
  • webA team lead with no team assigned no longer sees the whole organization's projects and analytics — their scope is now limited to their own data.
  • webFixed an open redirect in the login flow — a crafted next parameter could bounce a signed-in user to an external site.
  • webThe daily-scores sweep no longer permanently skips a day when a session syncs mid-sweep, so trends and leaderboards can't silently miss data.
  • desktopThe macOS notch overlay now matches the physical camera cutout exactly — it no longer extends black past the housing edges, on either the native or the fallback renderer.
  • desktopThe tray menu and notch panel no longer show logged-in actions while you're signed out — sign-in, sign-out, org switches, and expired sessions now update every surface (and start/stop background sync) immediately.
  • desktopThe notch/tray panel's sign-in button no longer sticks on a disabled "Waiting for browser…" after a cancelled browser login.
  • desktopFinishing a browser sign-in on macOS now brings the app to the front — even over a fullscreen browser — and the handoff page clearly confirms success instead of appearing stuck on "Returning you to the app…".
  • desktopThe login screen now links to the TrayToken home page, Privacy Policy and Terms of Use, opening them in your browser.
  • desktopPlan usage now refreshes without a running Claude Code session — a refresh button on the companion panel (tray and macOS notch) plus automatic refresh when the panel opens with stale data; expired windows no longer show yesterday's percentage.
  • webAnalytics tab on the engineer details page mirroring My Analytics, with role-gated access (admin, team lead, self).
  • webAdding an already-registered user now sends an invitation they explicitly accept or decline; admins see Invited/Pending badges and can revoke or re-send invites.
  • webInvite and password-reset email links no longer sign you in — the link only lets you set a password, after which you sign in with it; abandoned invites keep their Pending badge and can be re-sent.
  • webCalendar picker on the Day Timeline and My Timeline date navigation, with per-day dots reflecting how many sessions were recorded.
  • web"My Profile" is now a dedicated /profile page with a Light/Dark/Auto theme switcher.
  • webThe "Total tokens" KPI counts input + output tokens only — cache traffic is excluded, so the figure reflects actual work.
  • webSession prompt lists render Claude Code system XML (slash commands, bash passthrough, background tasks) as readable chips instead of raw tags.
  • webThe marketing landing page stays viewable while signed in; the role-based dashboard dispatch moved to /home.
  • allSentry error monitoring wired into both the web app and the desktop tray app.
  • allDesktop browser login no longer logs the user out after about a day — the desktop app now receives its own session via a single-use code exchange instead of sharing the browser's tokens.
  • allDesktop project selection is scoped per organization and stored server-side, so switching organizations can no longer sync one org's projects into another.
  • desktopFixed the permanently greyed-out Sync button, the broken "Open Dashboard" action, the undersized settings window on Linux, and the browser-login callback on Linux and macOS.
  • webEmail confirmation links no longer bounce to localhost on the self-hosted deploy.
2026-07-10

Auto-update, platform console & the new marketing site

  • desktopAuto-update shipped end-to-end — background checks with silent installs on Windows and Linux AppImage, a custom swap updater on macOS, and a manifest-driven forced-update floor for retiring old clients.
  • webNew downloads API serves the desktop installers and the auto-update feed; the landing page's download and dashboard links are wired up.
  • webRedesigned TrayToken marketing site — new landing page plus about, docs, changelog, contact, and legal pages under clean URLs.
  • webPlatform super-admin console — manage organizations and users, enter any organization with full admin access, and a filterable audit log.
  • webReal auth emails via Supabase — signup verification, password reset, and engineer invites; admin-visible temporary passwords are gone.
  • webOrganizations can be archived and restored; archived organizations are frozen for sync and get a dedicated screen.
  • allAnalytics section — extended desktop ingestion plus organization-wide and personal usage dashboards.
  • allBrowser-based desktop login via a state-verified cctracker:// deep link, with email/password sign-in kept as a fallback.
  • webTimeline v1.1 — packed session lanes, collapsed idle glyphs, research probe strips, attention ribbon, outcome-paired token figures.
  • webRole-grouped sidebar with an avatar dropdown, breadcrumbs, a session-aware 404, and redesigned auth screens.
  • allPrompt Quality is no longer dragged down by terse steering replies, ESC interrupts, or command-only sessions (lockstep scoring fix).
  • allDaily scores aggregate at sync time, so trends and leaderboards update without waiting for the nightly cron.
  • desktopSupabase tokens encrypted at rest via OS key storage; Electron upgraded to 39.x; reliable cross-platform autostart.
  • webSecurity hardening — row-level security across all tables, CSV formula-injection neutralized, brute-force rate limiting, and the per-engineer API token removed entirely.
  • agentThe CLI sync agent is removed — the desktop tray app is the only supported sync client.
2026-06-11

Reliability & lockstep

  • allVitest suites in all three packages (207 tests at the time) with shared fixtures enforcing scoring lockstep.
  • desktopSwitch organizations from the profile view without re-login; organization picker for multi-org sign-ins.
  • allSync made idempotent, race-safe, and failure-honest; failed sessions are never marked synced.
  • webCross-org data leaks closed, auth-callback open redirect fixed, API tokens no longer exposed via the me endpoint.
2026-05-15

Middleware fix

  • webRequest middleware moved to the Node runtime.
2026-05-14

Initial release

  • allInitial monorepo: web dashboard with REST API, sync agent, and the desktop tray app.

Summarized from the repository CHANGELOG (Keep a Changelog format, grouped by date).