release: 2.1.5 — Codex P2 follow-up on v2.1.4 (PR #29) (#30)

isWorkingAgentState now treats `'idle <suffix>'` as non-working.

The v2.1.4 send-button safety timer fired
``setAgentStatus('idle (timeout)')`` after the 90s cap. The
predicate only matched exact `'idle'` / `'ready'` / `'reset'` /
`'connected'`, so `'idle (timeout)'` was classified as **working**
— the pulse animation + Stop button stayed visible until a real
status arrived (which may never come if the WS is unavailable).

Functional path was fine because ``clearAwaitingTurnEnd()`` ran
first; the UI was just lying about the agent's state. Codex P2
review on PR #29 caught it.

Fix in td_component/tdpilot_api_chat.html — predicate now also
returns false for ``t.startsWith('idle ')`` and
``t.startsWith('idle(')``. Covers any future
``'idle (<context>)'`` variant. New test
``test_p2_v215_idle_suffix_treated_as_non_working``.

Both .tox binaries rebuilt; all 7 version manifests at v2.1.5.
Pytest 1687 → 1688, ruff format + check clean.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dreamrec

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "tdpilot-dpsk4",
       "description": "AI copilot for TouchDesigner with live MCP control (DeepSeek v4 optimized) \u2014 103 tools, focus + locations, hint injection, component notes, POPx inspection, knowledge corpus, project lifecycle, custom parameter authoring, snapshots, undo-block safety, and typed patch sessions. Works with Claude Desktop, Claude Code (DeepSeek v4 backend), and any MCP-compatible client.",
-      "version": "2.1.4",
+      "version": "2.1.5",
       "author": {
         "name": "silviu"
       },

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tdpilot-dpsk4",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "TDPilot DPSK4 \u2014 AI copilot for TouchDesigner (DeepSeek v4 optimized). 103 MCP tools for live node graph control, parameter management, diagnostics, safety, streaming, knowledge corpus, focus + locations, hint injection, component notes, technique memory, and typed patch sessions.",
   "author": {
     "name": "silviu"

CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 2.1.5 - 2026-05-10
+
+**Patch: Codex P2 follow-up on v2.1.4 (PR #29).** A cosmetic-but-real
+UI bug in the v2.1.4 send-button safety timer.
+
+### Fix
+
+- **`isWorkingAgentState` now treats `'idle <suffix>'` as
+  non-working.** v2.1.4's safety timer fires
+  `setAgentStatus('idle (timeout)')` after the 90s cap. The
+  predicate only treated exact `'idle'` (and `'ready'` / `'reset'`
+  / `'connected'`) as non-working, so `'idle (timeout)'` was
+  classified as **working** — the pulse animation + Stop button
+  stayed visible until a real status event arrived (which may
+  never come if the WS is unavailable). The functional path was
+  fine because `clearAwaitingTurnEnd()` ran first, but the UI
+  lied about the agent's state.
+
+  Fix in `td_component/tdpilot_api_chat.html`: the predicate now
+  also returns `false` when `t.startsWith('idle ')` or
+  `t.startsWith('idle(')`. This covers any future
+  `'idle (<context>)'` variant. Test:
+  `tests/test_v214_codex_followups.py::test_p2_v215_idle_suffix_treated_as_non_working`.
+
+### Context
+
+Codex's automated review on PR #29 caught this as a P2 right
+after v2.1.4 merged. Pattern: each Codex pass on a recent
+release tends to catch one or two real edge-case regressions in
+the new fixes themselves. v2.1.3 → v2.1.4 → v2.1.5 chains three
+of these in a single afternoon.
+
 ## 2.1.4 - 2026-05-10
 
 **Patch: Codex review follow-ups on v2.1.3 (PR #28).** Two real

README.md

@@ -7,7 +7,7 @@
    ╚═╝   ╚═════╝ ╚═╝     ╚═╝╚══════╝ ╚═════╝    ╚═╝
 ```
 
-# TDPilot — DeepSeek v4 · v2.1.4
+# TDPilot — DeepSeek v4 · v2.1.5
 
 [![CI](https://github.com/dreamrec/TDPilot_deepseekv4/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/dreamrec/TDPilot_deepseekv4/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/tdpilot-dpsk4?label=npm)](https://www.npmjs.com/package/tdpilot-dpsk4)
@@ -20,7 +20,7 @@
 
 An AI assistant that lives inside TouchDesigner. It can inspect your network, build new operators, wire them up, debug errors, take screenshots, remember things between sessions, replay successful patterns, surface relevant memories before each turn, batch tool calls, recover from failures with actionable hints, and survive long conversations via context compaction.
 
-> **v2.1.4 just shipped (May 10, 2026)** — patch on top of v2.1.3 closing two reliability holes that Codex's automated review caught on PR #28. The new inbox queue now drains on `EV_ERROR` (not just `EV_DONE`) so a queued message after a failed turn doesn't sit in storage forever. The chat HTML's send-button gate now has a 90s safety timer + a `ws.onopen` reset so a dropped WS connection mid-turn no longer locks the user out of the chat. See [CHANGELOG](CHANGELOG.md#214---2026-05-10) for the v2.1.4 details, or [v2.1.3 below](#whats-new-since-v15x) for the underlying security/queue/path-harmonization release.
+> **v2.1.5 just shipped (May 10, 2026)** — micro-patch on v2.1.4 catching one cosmetic regression Codex flagged on PR #29: `isWorkingAgentState` now treats `'idle <suffix>'` (e.g. `'idle (timeout)'` from the v2.1.4 safety timer) as non-working, so the pulse animation + Stop button don't keep showing after the timer fires. See [CHANGELOG](CHANGELOG.md#215---2026-05-10) for v2.1.5 details, [v2.1.4](CHANGELOG.md#214---2026-05-10) for the prior Codex follow-ups, or [v2.1.3 below](#whats-new-since-v15x) for the underlying security/queue/path-harmonization release.
 
 There are two ways to run it. Pick whichever fits — they coexist in the same TD project if you want both.
 
@@ -210,10 +210,11 @@ The standalone has 91 tools that cover the everyday inspect → build → wire 
 
 ## What's new since v1.5.x
 
-The line from v1.5.0 (Apr 25, 2026) to v2.1.4 (May 10, 2026) shipped in tight bursts. Most important updates, newest first:
+The line from v1.5.0 (Apr 25, 2026) to v2.1.5 (May 10, 2026) shipped in tight bursts. Most important updates, newest first:
 
 | Version | Date | Headline |
 |---|---|---|
+| **v2.1.5** | May 10 | **Codex P2 follow-up on v2.1.4.** `isWorkingAgentState` now classifies `'idle <suffix>'` (e.g. `'idle (timeout)'` from the v2.1.4 safety timer) as non-working. Pre-2.1.5 the predicate only matched exact `'idle'` / `'ready'` / `'reset'` / `'connected'`, so the v2.1.4 timer's diagnostic suffix kept the pulse animation + Stop button visible after the timer fired. Functional path was unaffected (button re-enable worked); UI lied about state. |
 | **v2.1.4** | May 10 | **Codex follow-ups on v2.1.3.** Two reliability holes the automated Codex review caught on PR #28: (P1) the new inbox queue now drains on `EV_ERROR` too — pre-2.1.4 a queued message after an errored turn sat in storage forever until a later successful turn happened to fire `EV_DONE`; (P2) the chat HTML's send-button gate now has a 90s safety timer + a `ws.onopen` reset, so a dropped WS connection between `/send` and the terminal status event no longer locks the user out of the chat permanently. |
 | **v2.1.3** | May 9 | **Security hardening + chat-pipe queue + path harmonization.** Audit found a CSRF / drive-by RCE chain in `tdpilot_API.tox` (insecure-mode bypassed origin checks AND `EXEC_MODE=full` was hardcoded). Closed by always-on origin enforcement (insecure-mode bypasses only the token check), `EXEC_MODE` clamp to `restricted` whenever insecure-mode is active (opt back into full with `TDPILOT_API_ALLOW_INSECURE_FULL_EXEC=1`), `application/json` requirement on `/send` (forces CORS preflight for cross-origin POSTs), and a loud textport banner when insecure-mode is on. Rapid-`/send` message-drop bug fixed via FIFO inbox queue on `comp.storage` + chat HTML send-button gate on the runtime's turn-end signal (not on the fetch resolution). Chat-pipe storage namespaced under `~/.tdpilot-dpsk4/api/` with `~/.tdpilot-api/` legacy fallback in `resolve_user_dir`. |
 | **v2.1.2** | May 9 | **Opt-in MCP auth.** `autostart.onStart()` no longer wipes persistent secrets; `TDPILOT_DISABLE_AUTH_BYPASS=1` opts into the env-file-driven shared-secret flow. |

docs/MANUAL.md

@@ -1,4 +1,4 @@
-# TDPilot v2.1.4 Manual
+# TDPilot v2.1.5 Manual
 
 The full reference. Read the [README](../README.md) first if you haven't installed yet — this manual assumes you've got either the standalone .tox or the Claude Code plugin running.
 

mcp/manifest.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "name": "TDPilot DPSK4",
   "slug": "tdpilot-dpsk4",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "repository": "https://github.com/dreamrec/TDPilot_deepseekv4",
   "description": "MCP server for TouchDesigner (DeepSeek v4 optimized) with live graph control, diagnostics, safety, streaming, knowledge corpus, technique memory, and typed patch sessions.",
   "entrypoints": {

npm/README.md

@@ -1,4 +1,4 @@
-# TDPilot v2.1.4
+# TDPilot v2.1.5
 
 [![CI](https://github.com/dreamrec/TDPilot_deepseekv4/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/dreamrec/TDPilot_deepseekv4/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/tdpilot-dpsk4?label=npm)](https://www.npmjs.com/package/tdpilot-dpsk4)

npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tdpilot-dpsk4",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "AI copilot for TouchDesigner with live MCP control (DeepSeek v4 optimized) \u2014 103 tools, focus + locations, hint injection, component notes, POPx inspection, knowledge corpus, project lifecycle control, technique memory, typed patch sessions.",
   "keywords": [
     "touchdesigner",

plugin_README.md

@@ -1,4 +1,4 @@
-# TDPilot v2.1.4 — TouchDesigner AI Assistant Plugin
+# TDPilot v2.1.5 — TouchDesigner AI Assistant Plugin
 
 This plugin installs the **DPSK4 (Claude Code CLI) variant** of TDPilot.
 Two variants ship in the same repo:
@@ -12,7 +12,7 @@ For the standalone .tox path, see the [main README](https://github.com/dreamrec/
 
 ---
 
-TDPilot v2.1.4 provides 103 MCP tools for live control of TouchDesigner projects from Claude Code, optimized for DeepSeek v4. The bundled `.tox` includes a one-button installer (drag-drop into TD, click "Bootstrap All", done) — no manual setup script.
+TDPilot v2.1.5 provides 103 MCP tools for live control of TouchDesigner projects from Claude Code, optimized for DeepSeek v4. The bundled `.tox` includes a one-button installer (drag-drop into TD, click "Bootstrap All", done) — no manual setup script.
 
 ## Components
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tdpilot-dpsk4"
-version = "2.1.4"
+version = "2.1.5"
 description = "MCP server for live control of TouchDesigner — create, inspect, connect, and manipulate nodes via AI agents"
 readme = "README.md"
 license = "MIT"