Skip to main content

Changelog

What a participant or operator should be told about each release. The canonical file is CHANGELOG.md in the repository; releases are on the releases page.

v0.4.2 — 2026-10-19​

Two fixes to what the trace sends, a signature check for npm installs, and a guard for searches. The text sent with a search no longer carries an Authorization header's credential or the rest of a secret after an unclosed quote; npm install now checks the project's signature on the binary it downloads; and a crash while preparing the trace no longer stops a search. By default a native install on v0.4.1 takes this release by itself at its daily check, the signature checked, and the upgrade rewrites opencode's plugin and Pi's extension, which carry their own copy of the scrub; an npm install is updated with npm, then jevlin agents install. opencode's plugin and Pi's extension have not been live-smoked with the new scrub rules. This release's updater has not been run on a Windows machine with real-time antivirus protection on; CI's Windows runners carry none.

  • A bug in preparing the trace can no longer stop a search. Had the code that scrubs and caps the text sent with a search ever crashed, jevlin search crashed with it and sent nothing, and under Claude Code the hook that adds the trace exited in the way Claude Code reads as blocking the command, so the search did not run. The search now goes without its trace, and jevlin search says so on stderr; the hook exits quietly and the command runs as written.
  • npm install installs only releases signed by the project. The npm package's installer now checks checksums.txt.sig against the project's release key, which the package carries, before it trusts a checksum, as jevlin upgrade does since v0.4.1. A release that was never signed, or whose files do not match what the key signed, installs nothing. The check applies from the npm install of this release itself, because npm runs the new package's own installer.
  • The trace no longer sends an Authorization header's credential, or the end of a secret after an unclosed quote. The assistant text sent with a search is scrubbed of secrets, and two gaps in that scrub are closed. The credential after Authorization: Bearer (or Basic or Token, and in Proxy-Authorization), as curl -H writes it, is removed whatever its shape; before, only a token of a known shape was, and an opaque one went as written. A variable ($TOKEN) or a placeholder (<token>) there stays. And a quote left open on a line that starts an assignment, as step-by-step instructions leave one (1. Set API_TOKEN="your token), no longer runs into a secret assigned on a later line and leaves most of its value behind. opencode's plugin and Pi's extension carry their own copy of the scrub: jevlin upgrade rewrites them, and after an npm update jevlin agents install does.

v0.4.1 — 2026-10-19​

Releases are now signed, and a native install upgrades itself by default. From v0.4.0, run jevlin upgrade once: v0.4.0 only tells you this release exists, and installs it checking the checksum alone. From then on your copy checks the project's signature on every release and installs a newer one itself at the daily check; add [update] mode = "notify" to your config to be told instead. An npm install is updated with npm, as before. This release's updater has not been run on a Windows machine with real-time antivirus protection on; CI's Windows runners carry none.

  • jevlin upgrade installs only releases signed by the project. A release now carries checksums.txt.sig, a signature over checksums.txt by the project's release key, and the updater checks it against the key built into it before it trusts a checksum. Someone able to replace a release's files can no longer get a binary of their own installed by publishing a checksum that matches it. The automatic upgrade under [update] mode = "apply" checks the same way. This release itself is installed by the copy you have now, which checks only the checksum; the signature is checked from the next upgrade on.
  • A native install now upgrades itself by default. [update] mode defaults to "apply": at the daily check, a native install that finds a newer release replaces itself through the same verified transaction as jevlin upgrade, signature included. To be told instead, set [update] mode = "notify". An npm install is still only told, and a release you rolled back from is still left alone. A copy on v0.4.0 keeps that release's default and only tells you about this one; once jevlin upgrade has installed it, it upgrades itself from then on.

v0.4.0 — 2026-10-18​

A daily check for a new release, and four fixes. By default the check only tells you that a newer release exists; with [update] mode = "apply" a native install upgrades itself, and an npm install never does. The fixes: status says when Codex on Linux is holding your searches back, another installation's epochs no longer show as a delivery fault, a turn a background subagent searched in is now reported, and the trace scrubber removes your account name from Claude Code's project-folder names. Upgrading from v0.3.2 needs nothing else; add [update] to a config only once this release is installed.

  • A daily check for a new release. Once a day, when an agent session starts or ends (Claude Code, Cursor and Codex; opencode's plugin and Pi's extension now start the flush at a session's start too; Hermes does not), the hooks start a detached check against the project's GitHub releases. By default it only tells you: jevlin status and jevlin doctor's new up to date line say what it found and the one command that installs it. With [update] mode = "apply" a native install installs a newer release itself, the way jevlin upgrade does: verified, run before and after, the old binary kept as jevlin.previous. An npm install is never replaced this way. The default is to tell until releases are signed. The check contacts nothing but GitHub, sends no credential, and is never started from inside an agent's sandbox. It never undoes you: after jevlin upgrade -rollback the release you left is not installed again, only a newer one, and if an automatic upgrade could not put the old binary back, status and doctor list what survives and no check runs until you upgrade. Its record is update_check.json beside your credentials. mode = "off" stops the check. An older jevlin refuses a config that names [update], as it refuses any key it does not know, so add it only once this release is installed.
  • On Linux, jevlin now says when your Codex searches are not being delivered. Codex's Linux sandbox ends the flush a search starts, so evidence from Codex waits for a jevlin run outside it, which Codex's hooks provide once you approve them. With mining on and neither SessionStart nor Stop approved, agents status, status and agents install now say so, and status (and status -json, under delivery) counts the searches waiting and when the oldest was made.
  • A Claude Code turn whose background subagent searched is now reported. With turn_end on, a subagent launched in the background searches under the turn that launched it, usually after that turn has ended, so the turn's end had already found nothing to report and the search was never joined to a turn end. The next turn end in the session now reports that turn, once, with what you asked and its last message. Only a subagent's search does this: a turn you interrupted after the agent's own search still sends nothing. A Codex or opencode subagent's search no longer leaves a mark that nothing takes.
  • Running jevlin on two machines no longer shows a delivery fault on the one not earning. When another installation of yours holds an epoch, this one's searches for it can never be delivered. They were retried until they were quarantined, and status reported a delivery fault for the whole time. They now wait without a fault, and are dropped once the epoch is over, as before. A fault already shown about them clears once they are all that is left, or once they are dropped.
  • The trace scrubber removes your account name from a Claude Code project folder's name. Claude Code names a project's folder after its path with every separator turned into - (-Users-<account>-work-proj), and that name turns up in ordinary assistant text: under ~/.claude/projects/ and in a background task's output path. The scrubber removed the account from /Users/<account>/ but left it in the dashed spelling of the same path. With the trace or the turn end on, it is now removed there too, in both scrubbers; a dashed name that is not your account, or one with no home folder in front of it, is left.

v0.3.2 — 2026-10-17​

A fix for installing from npm: jevlin setup refused every global npm install, so the README's first install path did not work. A native install is unaffected and needs nothing from this release beyond the skill's new wording.

  • jevlin setup works from a global npm install. Until now it refused every one, with "setup must run from a global npm install … npm could not say where this copy is installed": the npm launcher misread where npm puts a scoped package. Run npm install -g @jevlinsearch/jevlin@latest, then jevlin setup. If you got past it by running the binary with JEVLIN_LAUNCH=npm:global, the installation it set up is the same one and needs nothing redone.
  • The skill and setup call the router the Jevlin search router. An agent's installed skill picks up the new description at the next install, setup or upgrade.

v0.3.1 — 2026-10-17​

The rewards service moved to a new address on 16 October, and an installation set up before then stops earning until it is told. The first entry says the one line to change, and what an installation from v0.1.0 or earlier has to do instead. A new installation is set up with the new address, and searching is unaffected either way.

  • The rewards service moved, and an installation set up before the move has to be told. It is now at https://rewards-testnet.jevlin.ai, and a new installation is set up with that address. An installation set up earlier keeps https://rewards.nyks.dev in its config, because jevlin never rewrites your config, and since the move it refuses the old address's answers as coming from a different service: searches work, but nothing earns, and jevlin doctor says it cannot reach the authorization server, which is "off-origin". To fix it, change one line in your config's [mining] table to as_url = "https://rewards-testnet.jevlin.ai", then run jevlin flush and jevlin doctor. Your authorization, wallet and payout address carry over. If you use Codex, also run jevlin agents install -client codex and answer yes, so that Codex's sandbox lets the flush reach the new address.

    An installation set up with v0.1.0 or earlier needs more than that line. Its config also names router-api.nyks.dev and the nyks.dev platform, whose key the jevlin.ai router does not accept, and when this was checked the moved service rejected a search served by the old router. To earn again it registers on jevlin.ai: keep the wallet's recovery phrase or move its funds out, remove the installation with jevlin uninstall -purge-state, and set this release up fresh.

  • The wallet's default chain node is https://rpc-testnet.twilight.org, the same node under its new name. This needs nothing from you; -node and JEVLIN_WALLET_NODE still override it.

v0.3.0 — 2026-10-16​

Two fixes to how the client lives inside a coding agent's hooks. Nothing changes on the search or rewards side, and jevlin upgrade from v0.2.0 is the first upgrade this repository's updater performs against a previous release of its own.

  • A hook of yours in the same group as jevlin's is no longer removed with it. Claude Code's /hooks adds a hook to the group already under the same matcher, which can be the one jevlin wrote. agents install, uninstall and the re-render an upgrade runs used to treat that whole group as jevlin's, replacing or deleting your hook without a word, and an uninstall could delete the file. Now only jevlin's own hook is touched, yours stays where it was, and the plan says so. Affects Claude Code and Codex.
  • The turn end no longer sends text Claude Code wrote as your message. With [miner] turn_end = true, a turn Claude Code started itself sent what it wrote as what you asked: a background task's result (<task-notification>, which names the task's output file under your account), a continuation or loop tick, a message from another session, the output of a ! command, or the summary written when the conversation is compacted. Such a turn is now reported with its searches and no user text.

v0.2.0 — 2026-10-14​

The search platform's hosts move to jevlin.ai, and claim links now come from platform.jevlin.ai, which v0.1.0 refuses: an installation on v0.1.0 cannot show its claim link until it upgrades (jevlin upgrade, or npm install -g @jevlinsearch/jevlin@latest for an npm install). This release also explains the rewards service's region refusals and adds a participant-level search band.

  • A region refusal from the rewards service is explained, not reported as a broken credential. When the rewards service refuses mining from your address (REGION_RESTRICTED, REGION_INELIGIBLE, or the REGION_UNVERIFIED hold for a VPN, proxy or Tor exit), status, doctor, jevlin join and the flush say so in plain words, searches recorded meanwhile wait instead of failing delivery, and search is unaffected. See Earning with mining.
  • The search platform moved to jevlin.ai: the router is api.jevlin.ai (was router-api.nyks.dev), the portal and claim pages are platform.jevlin.ai (was platform.nyks.dev), and the agents API is agents-v1.jevlin.ai (was agents-v1.nyks.dev). The defaults, the help text, the docs and the Codex sandbox allowlist a fresh install writes all name the new hosts. The authorization server (rewards.nyks.dev) and the chain RPC (rpc.nyks.dev) are unchanged in this release. Upgrade note: jevlin setup writes these URLs into ~/.jevlin/jevlin.toml and never rewrites a config it finds there, so running it again changes nothing: an existing installation keeps the old hosts, which still answer today. A config that names only the old base_url keeps loading, with the old agents API implied from it as before. Claim and console links now come on platform.jevlin.ai, and an installation configured for platform.nyks.dev accepts them. To move an existing installation to the new hosts, edit router_url, base_url and agents_api_url in that file, then run jevlin agents install so a Codex sandbox allowlist names them too.
  • jevlin agents tier fast|balanced|max|default|status, and /jevlin tier <band> in every agent that has the skill: the band a search carries when the request names none, saved beside the config as search-tier and read by search on its next request. [miner] tier in the config is the same setting one layer down; the request's own tier outranks both, and with none set the request carries no tier and the router applies the default for the key. The skill now tells the agent to leave tier unset rather than calling fast the default, and never to send max. agents status shows the band in force; purge removes the file. Setting a band asks first in Cursor, as it does in Claude Code and Codex, and a [miner] tier this version cannot use is ignored and named by agents tier status rather than stopping the config from loading.

v0.1.0 — 2026-10-13​

This is the first release of jevlin-go, published on npm as @jevlinsearch/jevlin; there is nothing earlier to upgrade from, so jevlin upgrade has not been exercised against a previous release. The repository starts from an earlier project's code, imported as one commit, and that project's own changelog covers everything before it.

  • Codex commands no longer get open network from jevlin; only the search hosts do. agents install used to set network_access = true in Codex's sandbox, which let every command Codex runs reach any host. On macOS and Linux it now writes a Codex permission profile that allows only the router, the authorization server and the platform's agents API, enforced by Codex's network proxy, and the next install (or upgrade) replaces the old block. Supported with Codex 0.158.0 or newer; older versions are not supported.

The rest of the v0.1.0 entry, and every earlier change, is in CHANGELOG.md.