v0.7.0

​

Changelog

​

✨ Features

• MCP Inspection Broker - Edge now runs a client-side MCP broker that wraps managed MCP registrations and routes every tool call through the gateway’s inspection pipeline. Arguments are submitted before execution and the result or error is submitted afterwards, so guardrails and governance run on both sides of the call, and the client only ever receives post-hook output. The exchange uses two HTTP phases through the existing local IPC client, so credentials stay in the daemon. Docs
• Remote HTTP and SSE MCP Servers - The broker gains an HTTP and legacy-SSE transport adapter, so managed remote registrations get the same pre and post inspection exchange as local stdio servers. Static headers and environment-backed bearer credentials stay local to the machine, and an MCP route already configured on the Bifrost gateway bypasses the adapter so hooks and logs are not duplicated.
• Broker-Owned OAuth Reconnect - Remote MCP services that support dynamic client registration can obtain a new grant in the launching user’s browser. The callback verifies state, uses PKCE and binds the authorization and token requests to the upstream resource. Grants use the OS keyring where one is available and fall back to process-only retention on headless systems, and native client token caches are never imported. OAuth retry is limited to connection and discovery requests; a tool execution is never retried automatically after an authentication failure.
• Approval Required Before MCP Startup - Opening a client can no longer start a pending MCP server or launch its OAuth browser before inspection runs. Pending servers stay inventory-only, and pending, denied or unknown targets stop startup before OAuth or tool discovery. When the fleet allows pending apps and MCP servers, pending servers are admitted to the connection allowlist while explicit global, user and team denials stay blocked.
• MCP Configuration Watching and Coverage Reporting - Inventory sync is triggered by file changes, known sources are tracked so a deleted registration is reconciled, and client workspace indexes and Windows service profiles are discovered. Installed Claude plugin definitions are read from root maps, declared files and inline manifests, including enablement and registry versions, and nearby package manifests enrich version data without launching any commands. The MCP details view shows individual registrations, where each version came from, and an explicit routing and coverage state; a rewritten configuration is marked reconnect required rather than claimed as active.
• Runtime Catalog and Version Sync Across Restarts - Handshake versions and observed tool catalogs are persisted and connected to scan and upload, so a catalog observed before a restart still reaches device inventory afterwards. Installation IDs preserve positional source fields, and an invalid TOML scan is now distinguished from an empty one.
• Native Tool Call Reporting - When the fleet enables it, Edge passively records shell commands, file reads and other native tool executions from coding apps as they pass through the proxy, with no hooks installed and no client behaviour changed. Request and response bodies are teed through the forwarder and tool call and result pairs are correlated across the Anthropic Messages, OpenAI Chat Completions and Responses envelopes for Claude Code, Cowork, Conductor, Codex CLI and Desktop, OpenCode and Cursor. Only known native tool names are classified as native, payloads are bounded to 16 KiB, and a bounded cache deduplicates replayed history.
• Gemini CLI Support - Gemini CLI is now a fully managed intercepted application. Process detection matches both native gemini binaries and Node-hosted launches, a dedicated proxy package normalizes Google’s query-string key= credential into the x-goog-api-key header before gateway rewriting, and managed settings write ~/.gemini/settings.json with the native model picker constrained to the identity-scoped allowed list. A sidecar journal records every managed field’s before and after values so rollback restores only what Edge last wrote, and capture happens only when the owning process is positively attributed as Gemini CLI, so browsers on shared Google hosts are left alone. Docs
• Provider Login Controls - Three fleet-level toggles change how Edge handles credentials. Require Anthropic login and Require ChatGPT login switch Claude Code and Codex to native-login rendering, which strips Edge’s dummy key while preserving real credentials and the governed model picker, so users sign in with their own accounts and traffic still routes through the gateway. Enable login-free Claude Desktop provisions Claude Desktop through OS managed policy: per-user managed preferences on macOS, /etc/claude-desktop/managed-settings.json on Linux and HKLM\SOFTWARE\Policies\Claude on Windows, each guarded by a write-ahead ownership journal and reverted on sign-out or passthrough. Docs
• Native Diagnostics Window - The diagnostics window is rebuilt on each platform’s own widget toolkit: AppKit on macOS, Win32 controls on Windows and GTK 3 loaded through purego on Linux. The WebView2 dependency and the Linux browser fallback are gone, so diagnostics no longer fails when the WebView2 runtime is missing or damaged, and the GUI runs in an isolated child process on all three platforms so a crash cannot take the tray with it. The controller validates that the diagnostics endpoint is a numeric loopback address with a token, rejects redirects, streams logs with bounded retention and validates archives before writing them.
• Interception Health Check - Diagnostics gains an interception view backed by a network inventory and a live probe, so a user can see whether traffic for each managed application is actually being captured instead of inferring it from logs.
• Cursor Free Plan Support - Edge manages only the useOpenAIKey boolean in Cursor’s local database for eligible free accounts, so the model picker stops resetting on every session. Eligibility requires a signed-in free account with no team, an unexpired local token matching the stored account, and active Edge gateway credentials with trusted Cursor interception. An existing user-set OpenAI key blocks automatic activation, and if the user adds one later Edge hands ownership back without disabling it. All reads and writes run through an account-scoped compare-and-swap transaction executed by a short-lived helper process running as the profile owner, which refuses to run elevated. --revert-cursor-byok restores the original value and exits nonzero if Cursor is still running.
• Cursor Run Improvements - Follow-up messages and plan actions that arrive during an active model step are queued in order and applied after the step and its tool results are checkpointed, instead of being rejected. The context budget system is replaced by projection (removing transport-only fields before sending to the model) plus selective retention that protects the two most recent turns, the active planning phase and the approved plan’s creation turn. Deduplication moves from exact-string comparison to section-level delta encoding, and response.incomplete events surface truncation and content-filter reasons directly instead of reading as generic internal failures.
• Anonymous ChatGPT Web Sessions - Unauthenticated ChatGPT web traffic is now inspected and governed like signed-in traffic. Edge proxies /backend-anon/conversation and /unauth-mweb/conversation/updates, decodes form-encoded request bodies by expanding the conversationState field inline, and inspects the text/vnd.openai.web-mobile-partial+html response format used by unauthenticated mobile web sessions.
• Claude Desktop Code Picker and Codex Tool Exposure - The desktop Code selector surface (ccd) is intercepted alongside code and cowork, so the desktop picker receives the gateway’s allowed model list on restart. Synthesized non-OpenAI Codex catalog entries no longer inherit Code Mode or deferred tool discovery from the OpenAI template, which had made Codex defer discovery to a provider that cannot reach its local catalog.
• Per-Platform Agent CI - Agent unit tests run natively on Linux, macOS, Windows x64 and Windows ARM instead of being cross-compiled on Linux only, so OS-specific code paths are actually executed before release.

​

🐞 Fixed

• Codex Integer Settings Rewritten as Floats - Editing an MCP registration converted unrelated Codex settings such as tui.model_availability_nux from 1 to 1.0, which Codex rejects as an invalid u32, and could round large integers. Registrations are now edited inside the native TOML document, so unrelated values keep their TOML types.
• MCP Routing Not Repaired After a Launch Command Change - Persisted wrap state prevented repair when a client changed an MCP launch command. The current registration is reconciled on every pass, nested project entries are addressed by literal source keys, and restoration changes only broker-owned launch fields while preserving other client edits.
• Oversized MCP Responses Bypassed Post Hooks - An oversized MCP response could stream opaquely to the client. Inspected sessions now fail closed on an uninspectable result, reject duplicate active call IDs, cap active calls, distinguish server-initiated requests, and close both relay sockets on cancellation.
• Malformed MCP Scans Read as Empty - Malformed MCP-shaped JSON is no longer treated as an empty scan, idle remote connections are cancelled correctly, log uploads no longer acknowledge an unavailable log store, and denied events no longer appear successful.
• New Connections Attributed to PID 0 - A port missing from a fresh port-to-PID snapshot returned the zero value instead of forcing a refresh, so a connection arriving while the cache was still fresh could be misattributed. A missing port is now always a cache miss.
• Codex Rules on chatgpt.com Treated as the Web App - A rule that declares a non-ChatGPT platform is no longer classified as the ChatGPT web app just because its hostname is chatgpt.com, which had caused its traffic to be relayed directly around the gateway.
• Managed Auth Ownership Repair Noise and Races - An ownership failure now blocks further attempts on that path and its descendants and is logged once, instead of being retried and re-logged on every reconcile. chown runs on the open file descriptor before the atomic rename and opens the target with O_NOFOLLOW, and managed config files are compared by decoded JSON value, so a client reformatting its own config no longer triggers a rewrite.
• macOS Daemon Startup Failures Were Silent - The installer and restart script no longer swallow every launchctl failure. Daemon operations are fatal and report the error, a final verification step confirms the daemon registered with launchd, and tray failures emit a warning instead of blocking daemon startup.
• Windows CI Build of the Agent - The sudo-based live-reload supervisor is excluded from Windows builds, where the process-group and signal calls it uses do not exist.
• Skipped-Inference Logging Coverage - Bypassed inference requests are logged for OpenAI and Codex as well as Anthropic, and the log line carries platform= so a bypass record is readable without cross-referencing the rule config.