Changelog

Every release of Tapproval Base, the helper on your computer, newest first. Starting Claude Code once updates it. Generated from the releases on GitHub, which may already hold a newer one. Security fixes are also explained on the security page.

1.1.48

2026-10-13

Tapproval Base is the computer half of Tapproval: it puts Claude Code's permission prompts on your Apple Watch, each marked with its risk, and one tap answers. Nothing is approved for you unless you ask it to be, and a CRITICAL never is.

Already installed? Starting Claude Code once updates it.

Since 1.1.47

A plan on your wrist shows the plan again. Newer Claude Code keeps a plan in a file rather than sending it with the approval request, so the watch could only say "Claude has a plan" with nothing to read. The helper now reads the plan from Claude's own plans folder, so you see its title and steps before you approve.

1.1.47

2026-10-13

Already installed? Starting Claude Code once updates it.

Since 1.1.46

A watch that drops its connection is no longer reported as a crash. When the watch slept or the network blinked mid-request, the helper could show "hit a problem it did not expect" on the Connection screen. Now it notes the hang-up quietly in its log and carries on, while real problems are still reported.

1.1.46

2026-10-12

Already installed? Starting Claude Code once updates it.

Since 1.1.45

Claude's replies read on the wrist the way they do on the phone. Bold stays bold, bullets and numbered lists keep their shape, and sub-points are indented. Seen on the newest watch app; older ones keep the plain reply.

1.1.45

2026-10-12

Already installed? Starting Claude Code once updates it.

Since 1.1.44

Only a real watch can answer. A test build of the watch app running in Apple's Simulator can no longer approve, deny or send words into a live session on your computer. A real watch is unaffected: it is trusted by its own key, as before.

1.1.44

2026-10-11

Already installed? Starting Claude Code once updates it.

Since 1.1.43

A plan reads on the wrist the way it does on the phone. Headings stand out, bold stays bold, and nested steps are indented. Seen on the newest watch app; older ones keep the plain plan.
A signed-out Mac is said plainly. When Claude Code on your computer is signed out, the watch now shows it as a problem with the one-line fix, not a raw error line.
A plan never carries a secret to the wrist. Tokens and passwords pasted into a plan are hidden, as they already were everywhere else on a card.

1.1.43

2026-10-11

Already installed? Starting Claude Code once updates it.

Since 1.1.42

A question answered at your computer now leaves the watch. Plans approved at the desk used to stay on the wrist, and so did a question in a long session after Claude Code compacted it. Both now leave within seconds.
No card waits longer than a day, even when the Mac sleeps in between.

1.1.42

2026-10-10

Already installed? Starting Claude Code once updates it.

Since 1.1.41

The README says what Tapproval does in its first line, and the repository's description and topics now match.
The website gains llms.txt, a plain summary for AI assistants, and its sitemap dates now follow each page's last change.
The crash reporter's mail code is shared with the developer's report page. Nothing changes for you.

1.1.41

2026-10-05

Already installed? Starting Claude Code once updates it.

Since 1.1.40

The installer says where to get the watch app. After it finishes, it names the App Store and the TestFlight beta, where the unlock is free.
The README and the plugin listing mention the beta too.

1.1.40

2026-10-05

Already installed? Starting Claude Code once updates it.

Since 1.1.39

The Connection screen no longer waits on Claude Code's sign-in check. That check can take 15 seconds, and the watch gave up after 5.
A message or new session sent twice is done once. When the watch gave up waiting and you tapped again, the computer used to do it twice. Now the same words within half a minute get the first answer back.
New Session lists every project you've worked in, including ones Claude used from a subfolder or a separate worktree.
The away address recovers by itself when the tunnel starts but never gets an address.
The computer stays visible on your network: it no longer re-announces itself when nothing changed.
Steadier reading of usage and activity on a long-running computer.

1.1.39

2026-10-05

Already installed? Starting Claude Code once updates it.

Since 1.1.38

Some commands were rated lower than what they do, and now aren't. These include a command hidden inside <(…), a disguised spelling of rm ("rm", rm${IFS}…), find ~ -delete (the whole home folder), a command run through xargs, and keychain password reads in their joined-flag form. Each now carries the risk of what it actually runs.
A test run now always asks, even with --quiet. pytest, tox, nox and npm test run your project's own code, so they are MEDIUM, not SAFE.
A Codex file patch with no working folder is HIGH, since nothing can tell where it lands.

1.1.38

2026-10-05

Already installed? Starting Claude Code once updates it.

Since 1.1.37

Security: a program on your computer can no longer pair as a watch. It was refused at 127.0.0.1 but not at the computer's own Wi-Fi address. Now it is refused at every address. The security page explains it in full.
Unpairing and replacing the watch's key need the key file, which only your own user account can read. --pair reads it by itself. Without it, opening pairing still works, but the computer asks you to click Allow first.
A new session started from the watch can't begin with ! or #, which would run a shell command or write a memory note.
The relay takes at most 64 connections at once.

1.1.37

2026-10-04

Already installed? Starting Claude Code once updates it.

Since 1.1.36

Groundwork for Codex. Nothing changes for Claude Code. If you use Codex, running the installer also wires it, and Codex runs it only once you approve it in /hooks. Full Codex support comes in later releases.
A command given as a list no longer skips the wrist. It is checked like any other command.

1.1.36

2026-10-03

Already installed? Starting Claude Code once updates it.

Since 1.1.35

A computer that has never paired now asks before a watch pairs over the network. "Allow a watch to pair?" appears on the computer, and the watch gets its key only after you click Allow. Until now, anyone on the same Wi-Fi could pair during the half hour after a session started. Pairing through iCloud is unchanged. Details on the security page.

1.1.35

2026-10-02

Already installed? Starting Claude Code once updates it.

Since 1.1.34

A card says where it comes from. It names the repository, not the folder Claude happens to work in. A worktree or a subfolder used to stand in for it on most prompts. The session's title goes beside it, so you know which conversation is asking.
An integration call says what it does: "Check PR status" instead of "ccd_pr · get status".
Integration calls that only read are marked LOW (get, list, search and so on). Writes, unknown calls and anything risky keep their marks.

1.1.34

2026-10-01

Already installed? Starting Claude Code once updates it.

Since 1.1.33

A session that will come back by itself says when. When Claude has set a wake-up (a /loop, or a check for later), the session reads as scheduled and carries the time it comes back, ready for the watch to show. A stopped loop leaves it idle.

1.1.33

2026-10-01

Already installed? Starting Claude Code once updates it.

Since 1.1.32

Monitors count as running work. A session whose only work is a monitor (watching an upload, a CI run) used to look idle on the watch. Its start wasn't recognised, and each event it reported was read as its end.
The session list says what is running, in Claude's own words, such as "Wait for build 95 to finish processing", ready for the watch to show.
Updates arrive within the hour. The helper now looks for a new version every hour instead of once a day.

1.1.32

2026-10-01

Already installed? Starting Claude Code once updates it.

Since 1.1.31

Each session says what it is doing. The session list and each thread now carry one state: running (Claude writing, a command in flight, or background tasks still going behind a quiet conversation), needs you (a card on the wrist, or a prompt waiting at the computer's own screen), or idle. Before, the watch guessed from twenty seconds of silence, so background work and a prompt at the computer both looked idle.
The relay's log no longer records the travel address's secret for requests that came in through it.

1.1.31

2026-10-01

Already installed? Starting Claude Code once updates it.

Since 1.1.30: fixes from a whole-codebase review

SAFE now means it reads and runs nothing new. Some commands that wrote a file (cat x 1> ~/.zshrc), ran a program of the caller's choosing (PATH=…, git -c core.pager=…, sed 'w …') or printed a credential (gh auth status -t, ${GITHUB_TOKEN}, App Store Connect .p8 keys) were rated SAFE. With --quiet they went through without asking. They now ask. Writing CLAUDE.md or .claude/commands asks too.
Pairing is for a watch. A program on this computer can no longer claim a pairing key for itself, and no enrolment can take over the iCloud key's place.
The relay proves what it says, not only who it is. Its proof now covers each answer, and a signed request covers its query too, so on shared Wi‑Fi nobody in between can change a card or an address. Older watches keep working.
Changing the key keeps the away address, instead of reopening the tunnel every few minutes under the old secret.
A question answered from the wrist in a message you sent from the watch reaches Claude, instead of being reported as unanswered.
Today is your day, counted and clocked in your own time zone. One odd line in a transcript no longer blanks Sessions or Usage.
Uninstall cleans up fully, and the release scripts stop at a failed step instead of reporting success.

Tapproval Base 1.1.30

2026-09-30

Already installed? Starting Claude Code once updates it.

Since 1.1.29

The relay log says when. Every line starts with the time, and every message sent from the watch says which way it went and how long starting it took, so a slow send can be timed.

Tapproval Base 1.1.29

2026-09-30

Already installed? Starting Claude Code once updates it.

Since 1.1.28

The away address really survives a restart. The program that holds the tunnel open wrote its messages into a pipe only the helper read, so when the helper stopped — every update, every restart — the tunnel died within a second and the address was lost. It writes to its own log now, in its own session, and the next helper takes it over. After this update, the address changes one last time.
A bad moment no longer replaces a good tunnel. The check that decides whether to keep a tunnel allows a few tries, and when the address does change the watch's Connection screen says so until the watch has it.
A stopped Mac bridge is named: "The iCloud route is off", instead of nothing.
--status troubleshoots. python3 ~/.tapproval/ClaudeRiskClassifier.py --status shows the relay, the iCloud route, whether the away address answers from the internet, Tailscale, the watch, every problem the helper has noticed, the one next step, and where the log is. What each row on the watch means: https://tapproval.thoughtfulsteward.org/apple-watch-claude-code.html

Tapproval Base 1.1.28

2026-09-30

Already installed? Starting Claude Code once updates it.

Since 1.1.27

The away address reopens itself. The helper checked its travel tunnel only when it started. If the tunnel stopped later, the helper went on handing out an address that led nowhere, and away from Wi-Fi the watch had no way in and no reason shown. It now checks every minute, asks through the public address every five, and when the tunnel is gone it says so on the watch's Connection screen and opens a new one, which reaches the watch through your iCloud.
Every release carries its provenance. From this release on, each one has an archive of its source and a signed statement from GitHub that the release workflow built it from the tagged commit. Check a download with gh attestation verify tapproval-helper-v1.1.28.tar.gz -R marcobelini/tapproval-helper. It proves where a release came from, not that the code in it is safe.
The security page now lists every security fix so far, and there is a changelog page built from these releases: https://tapproval.thoughtfulsteward.org/security.html

Tapproval Base 1.1.27

2026-09-27

Already installed? Starting Claude Code once updates it. Please update: this release fixes a security issue.

Since 1.1.25

Security: every request now proves its own key. Several requests on one connection were answered with state the first one left behind. A request without a key could ride the key the request before it had proved. On the travel address, Cloudflare shares connections between callers, so that was a way in without a key. It came in with signed requests in 1.1.21, and this release fixes it.
Answers from the wrist register again. The same flaw made an answer that followed a check for new cards read that check's empty body. It was refused, and the answer was lost.
Works with your iPhone off. Without its iPhone, a watch can reach your computer only over the internet. The travel address now stays the same across helper updates and restarts, and only a restart of the Mac itself changes it. A matching watch update (TestFlight build 141 and later) tries every route at once.
Uninstall stops the travel tunnel too, now that it outlives the helper on purpose.

Tapproval Base 1.1.25

2026-09-26

Already installed? Starting Claude Code once updates it.

Since 1.1.24

A session started from the wrist answers briefly. It uses Claude Code's own Concise style from its first reply, just as a message sent into a session already did. If you later sit down at it, /output-style changes that.
Groundwork for notifications on a closed watch. Each card now carries what a notification for it may offer: Allow first only for SAFE and LOW, Deny first for MEDIUM, Deny only for HIGH and CRITICAL, and open only for questions. The watch app that uses this is in testing.
The site says only what is true today. The iCloud route needs an extra program on the Mac that is not part of the standard install yet, so it is no longer promised to everyone.

Tapproval Base 1.1.24

2026-09-25

Already installed? Starting Claude Code once updates it.

Since 1.1.23

Nothing changes on the wrist. Reading Claude Code's transcript now goes through one JSON reader per line and one Markdown pass for every text the watch shows, instead of several near-copies. Behaviour is the same, and tests hold it.
The website has three new pages: a setup guide, how the PermissionRequest hook works (including the string decision that is silently ignored), and an honest comparison with Remote Control, Happy, Omnara and claude-watch.

Tapproval Base 1.1.23

2026-09-25

Already installed? Starting Claude Code once updates it.

Since 1.1.22

A plan waiting for approval reaches the wrist as a plan. When Claude asks to leave plan mode, the watch gets the plan's title and the phone's answers: Approve, Approve & auto mode (which also moves the session to auto mode, as the phone's button does), and Keep planning. A watch app from TestFlight build 139 on also shows the whole plan and takes dictated edits; earlier builds show the three answers.

Tapproval Base 1.1.22

2026-09-25

Already installed? Starting Claude Code once updates it.

Since 1.1.21

Lighter on your Mac while the watch is open. Usage figures follow each transcript instead of re-reading it (a warm /usage: 1.3 s → 0.02 s), and the session list no longer re-reads the start of every active session on each poll.
A helper crash while answering a request is named as such in the report.
Housekeeping: code the review proved unused is gone; no change in behaviour.

Tapproval Base 1.1.21

2026-09-25

Already installed? Starting Claude Code once updates it. New: tell Claude Code Install the Tapproval plugin from marcobelini/tapproval-helper, then get the free watch app: https://apps.apple.com/app/tapproval/id6805869018

Since 1.1.20 — a security release

Your key no longer crosses the network. A watch signs each request instead of sending its key, each signature is good once, and the helper proves itself in its answer; the watch learns an address only from such an answer. The old way is still accepted for one release, for watches that predate it.
No pairing door where iCloud carries the key. A Mac with the iCloud bridge never offers a key on the network, the network door hands out a revocable device key rather than the main one, and a reset replaces the main key.
Commands that change things are no longer read as reads. gh auth logout, fly apps create, swift package update, gcloud config set; awk system(…), rg --pre, git diff --output, find -fprint; and wrappers such as sh -c "rm -rf /", env rm -rf ~ or ( rm -rf ~ ) are now judged by what they do. A write to a path through .. is judged where it lands.
Messages from the watch reach their session's permission prompts on plugin installs, a new session needs the watch's key even from this machine, and a crash in the helper's request handling is reported instead of lost.
Faster and lighter: a session's thread is read from the end of its transcript (one 227 MB transcript: 1.6 GB and 1.6 s → 45 MB and 0.02 s).

Tapproval Base 1.1.20

2026-09-24

Tapproval Base is the computer half of Tapproval: it puts Claude Code's permission prompts on your Apple Watch. When Claude stops to ask before doing something that needs your say-so, the question lands on your wrist, marked with its risk, and one tap answers it.

Nothing is approved for you unless you ask it to be, and a CRITICAL never is. Answer on the wrist, or the usual terminal prompt appears exactly as it would without this installed.

Install

Tell Claude Code on your computer:

Install the Tapproval plugin from marcobelini/tapproval-helper

Already installed? Starting Claude Code once updates it.

Then get the watch app, free: https://apps.apple.com/app/tapproval/id6805869018 (outside the EU for now — the beta works everywhere: https://testflight.apple.com/join/dW1tYBQG).

You need an Apple Watch and Claude Code on a Mac or Linux machine.

Since 1.1.16

Sessions started from the watch reach the watch. A Terminal opened from inside a Claude Code session handed that session's markers to every window, and a session that thinks it is another's child saves no transcript — so New session started a session the phone could see and the watch never did. The helper now sheds those markers, and the window it opens unsets them too.
New session answers in under a second. The helper tried to script Terminal first and waited four seconds for a permission it cannot ask for; the watch gave up and said the computer did not answer, about a session that had started. It now opens the window the way that needs no permission, first.
An update reaches a busy helper. An outdated helper that answered slowly was left running beside its installed update; it is now asked again, patiently, and replaced.
What you said stays in the thread. Your latest message stays at the head of a session's thread on the watch, and Claude Code's own notes no longer pass as yours or hide what you wrote.
The watch knows which sessions are open on your computer, so it can say, where you type, that a message from the wrist runs beside that open session rather than inside it.
An end-to-end check (e2e_new_session.py, in the product repository) now starts a real session the way the watch does before a change to how sessions start is published.

Tapproval Base 1.1.16

2026-09-23

Nothing is approved for you unless you ask it to be, and a CRITICAL never is. Answer on the wrist, or the usual terminal prompt appears exactly as it would without this installed.

Install

Tell Claude Code on your computer:

Install the Tapproval plugin from marcobelini/tapproval-helper

Then get the watch app, free: https://apps.apple.com/app/tapproval/id6805869018 (outside the EU for now — the beta works everywhere: https://testflight.apple.com/join/dW1tYBQG).

You need an Apple Watch and Claude Code on a Mac or Linux machine.

What it is

Python, standard library only: no dependencies to audit and none to install. No server, no account, no analytics. A tool that reads your sessions and carries your approvals should be one you can read, so all of it is here.

Loopback is the only free pass: every other caller, on your Wi-Fi or not, must present a token issued to one device.

Since 1.1.4

Sessions carry the names the Claude app gives them, and name the repository rather than a session's worktree. Starting a new session offers your real projects — no worktrees, no folders only scheduled runs use.
Messages from the watch work after a restart. Started at login with a bare search path, the helper could not find Claude Code; it now looks where the installers put it, and says so on the watch if Claude Code is truly missing.
A second copy of the helper no longer crashes. A slow start-up check could launch a second helper beside a busy first one; it now sees the port is taken and leaves it.
An update put off for a waiting card is tried again on every start, never while a card is waiting.
The helper knows which code it runs however it was started, and the watch's Connection screen shows where that code is from.

Tapproval Base 1.1.4

2026-09-10

Nothing is ever approved automatically. You tap Allow or Deny, or the usual terminal prompt appears exactly as it would without this installed.

Install

Tell Claude Code on your Mac:

Install github.com/marcobelini/tapproval-helper

Then get the watch app: https://testflight.apple.com/join/dW1tYBQG — free while it is in beta.

You need an Apple Watch and Claude Code on a Mac.

What it is

Five Python files, standard library only, no dependencies to audit and none to install. No server, no account, no analytics. A tool that reads your sessions and carries your approvals should be one you can read, so all of it is here.

Loopback is the only free pass: every other caller, on your Wi-Fi or not, must present a token issued to one device.

In this version

A message sent from the watch can raise a permission card on the same wrist.
The helper and the watch each report their own faults, on the wrist and on disk.
/health says which day the helper's code is from, so an out-of-date computer cannot go unnoticed.

Full history: CHANGELOG.md · Website: https://tapproval.thoughtfulsteward.org