All changes
v1.16.0

Only what Clocktopus needs leaves your machine, and more

Only what Clocktopus needs leaves your machine

What reached Clocktopus from your agents used to depend on each agent's own settings. Claude Code could export prompts and tool details if one of its flags was on. Codex's log exporter sent tool results, which can include file contents. Session hooks sent your home directory path, and any credentials written into a git remote. The CLI now sends only what Clocktopus uses.

  • Claude Code: clocktopus agent setup turns off every content flag in ~/.claude/settings.json, which overrides anything exported in your shell. clocktopus agent disable removes them again.
  • Codex: spend is read from the session's own file on your machine and sent as token totals, model, turn durations and the session id, nothing else. Codex's log exporter is no longer configured, and a resumed session or a repeated hook never counts usage twice.
  • Paths and remotes: a working directory under your home folder is sent as ~/…, and git remotes are sent without credentials. The receiver strips them too.

If you use Codex, run clocktopus agent setup again to remove the exporter older setups wrote.

The CLI's README has a new section, What leaves your machine, listing every request, its fields, what the receiver reads and where the token is kept.

See a request before it's sent

  • Set CLOCKTOPUS_HOOK_DRY_RUN=1, or pass --dry-run, and clocktopus agent hook prints each request it would make, with its URL and exact body, and sends nothing. It never prints your token.
  • clocktopus agent doctor and clocktopus agent status warn when a content flag is on in your environment or settings, including when a managed Claude Code settings file turns one back on, and name the file.

The CLI tells you when it's out of date

The CLI says when a newer version is on npm, once per run. It's now released automatically, with a public changelog, and its source is published at blastin-dev/clocktopus-cli. This release ships CLI 0.8.0.

Fixes & improvements

  • A custom clock-out time starts at the minute after the day's last time entry, rather than now. Saving or deleting an entry refreshes your clock status.
  • A bot's commit pushed with a deploy key no longer adds the bot's address to the person who pushed it.
  • Dependabot, Renovate and release branches such as release/release-1.0 no longer read as task keys.
  • OpenCode 2's MCP entry is written where OpenCode 2 reads it.