What's new in ClaudeNotch

A plan with five questions of four options each is taller than the screen, and there was no way to set one aside and come back to it. The shrink button at the top right of the card tucks it away without answering. The notch grows a small purple stub on its left to say one is still waiting, and clicking that opens it back up. The session keeps waiting the whole time, so nothing is lost by putting it down.

Brushing the cursor past the top of the screen used to bury the thing you still had to answer under the session list and the meters.

Optionally it can hold the switch for your approval: off by default, in Settings under Privacy and permissions, and only for a move up to a more expensive family. Switching down, or between versions of one family, is never held.

Menu bar Demos, or Settings, Developer.

Claude Code reports a mid-run switch outright now, so a /model change shows up as one line the moment it happens. Before this the notch found out only when some later tool call happened to mention which model was running, and until then the session list named the old model and the cost meter counted the spend against it.

Off by default, in Settings under Privacy and permissions. With it on, a session moving up to a more expensive family, sonnet to opus say, raises a card and waits for your answer before the switch happens. Only upgrades are held. Switching down, or between versions of one family, goes straight through, because those do not cost more, and a gate that fires on changes that cost nothing is one you would rightly turn off.

A dismissed card, a timeout, a model it does not recognise, the setting being off: all of them behave exactly as if no gate existed. Your own /model in your own terminal should never end up stuck behind a card you are not looking at.

Notarizing used to be skipped with a one-line note when the credentials were missing, which meant the tag, the Homebrew formula and the download could all go out around a file every user would be warned about. It stops before touching anything now.

It asserts fifteen properties of the bundle: the signing identity and team, the hardened runtime, a timestamp that outlives the certificate, the entitlements, the reasons shown in the macOS permission prompts, a stapled notarization ticket, and that the hooks, the ten translations and the URL scheme really are inside. Signing can succeed and still leave the app broken in ways that produce no error anywhere, which is how a build carrying no entitlements at all nearly shipped.

Downloading it no longer produces the warning that Apple could not verify it is free of malware, and there is no longer a trip through System Settings to Privacy and Security to allow it to run. Download the DMG, drag it to Applications, open it. That is the entire install now, and it is what the last several releases have been building toward.

The pause after every update, where the notch received nothing for the better part of a minute and Claude Code printed a connection error for every hook it fired, is gone: that was macOS assessing an app it could not verify, and there is nothing left to assess. And because the app is now signed with one stable identity rather than a throwaway one regenerated on every build, macOS stops treating each update as a different app, so Accessibility permission is granted once rather than asked for again after updates.

A release no longer depends on one machine's keychain, one person's Apple session, or that person being awake, and the file people download is built from exactly the commit its tag points at by something anyone can inspect.

tools/xcode.sh generates the project from a definition in the repository and opens it, which makes editing, debugging and breakpoints available for the first time. The project file itself is deliberately not committed, because it lists every source file individually and would go stale the moment one was added. build.sh remains what produces a release.

Auto mode became Claude Code's default permission mode on 14 August: a separate classifier reviews each action instead of stopping to ask you, and it is markedly better at the job than the people it replaced, catching a deliberately dangerous command 89% of the time against 13.6% for the humans in Anthropic's own test. This does not argue with that. What nothing reports is the remainder, and Anthropic publishes a 17% false-negative rate on genuinely overeager actions, the classifier finding approval-shaped evidence without checking the blast radius of what it is approving. You are told neither which actions those were nor how many went by at all. After fifty actions in a session that never prompted you, the notch says so once. It makes the case for auto mode while it does so, because a card that reported only the alarming half would be lobbying against a setting that is measurably safer than what it replaced. This also settles a question about the app's future: hook events run before the permission system, so the notch still sees every tool call even when nothing is ever prompted.

No tests, no build, nothing that could have failed. An agent stops when the work looks done, and without a check it can run, looking done is the only signal it had, so a session that edited nine files and ran nothing is unverified rather than finished, and from the outside those look the same. A build counts as well as a test suite: weaker evidence, and it still has the property that matters, which is that it can say no. Three edited files before it says anything, once per session, because a one-file change with an obvious diff is exactly where running the suite is overkill and a nudge there is how people learn to ignore nudges.

Running several sessions in parallel is the most recommended way to get more out of these tools, and this is the specific way it goes wrong: both edit the same files underneath each other, one reads a file while the other rewrites it, and nothing errors. The work simply disagrees with itself. Sessions already in their own worktree are excluded, since that is precisely the thing being recommended and telling somebody who took the advice to take it again is how a fair point becomes noise. The card carries the honest limit as well: a worktree separates files, but not ports, databases, or environment, and discovering that by running two dev servers on one port is how people learn to distrust the advice.

Both are checkable without understanding a word of the content: one is a length, the other a count of shouting. Both bars sit well above the usual recommendation rather than at it, because the cost of being wrong here is telling somebody their careful, correct file is a problem.

Where a CLI exists it is the more efficient way in, because the model already knows the tool or can read its help, while a server spends context on tool definitions in every session whether or not it gets used. Two conditions, both required: the session actually used the server, and the matching command is installed here. Recommending a command you do not have is homework, not advice.

Opus falls back to Sonnet on a cap, a new session starts on Sonnet despite Opus being the one you chose, re-authenticating moves you down, an account is served Haiku for hours. Every account of this carries the same sentence in some form: there was no notification, and no clear indication of which model was actually active. The app already knew, since it refreshes the model from the status line every turn; it had simply never compared that against what it was a moment before. It is deliberately narrow, because the failure mode here is crying wolf. Only a drop in tier counts, so a version bump inside a family is not a drop and moving up is not news, and a model it cannot rank produces nothing at all rather than a guess about where that model sits. The card also does not claim a reason: a drop can be a plan cap or your own /model, the app cannot tell which, so it names both instead of picking the alarming one.

The shape people report is a few hundred dollars burned across an afternoon on something like a hundred near-identical calls, none of it noticed until the bill, because there is no circuit breaker and no per-session ceiling anywhere in the loop. The notch sees every tool call, which makes it the one place that can count them. Nothing is stopped, and deliberately so: ending somebody's session on a heuristic is a far worse failure than letting a loop run one more minute. It says the number and nothing else. The bar is forty identical calls, which sits above honest iteration, since re-running one test command while chasing a fix reaches double digits legitimately and a card that fires on that is a card everybody switches off. Editing one file forty times counts; reading forty different files does not.

Claude Code grew a teammate system: named persistent agents, each in a tmux pane of its own, with a roster and a mailbox. They are not subagents, which return into the conversation that spawned them. A teammate sits in its own pane and can be idle for twenty minutes with nothing on screen saying so, and a pane does not report the status of the agent inside it. That is the problem this app already exists for, one level out: the most repeated complaint about running several sessions is that one of them is always waiting on you and you never saw it. The event existed in Claude Code and was registered by nothing here, so it was arriving nowhere.

Parallel checkouts are how people run several agents at once without them colliding on files, and the cost every account of them mentions is losing track of which checkout is which. The card names the caveat people otherwise discover the hard way: a worktree isolates files, but not ports, databases, or environment. Removal is logged rather than carded, because it usually happens right after the work in it was merged, which is the least welcome moment for an interruption, and there is nothing to act on.

The port this app listens on accepted anything that could reach it, and on a developer machine that means every process running as you: enough to invent a session, fake activity, or put a card in front of you that looks like Claude asking for permission and read whatever you answer. The hook URL now carries a token which the app checks on every request. Said plainly, because this is easy to oversell: a program determined to find that token can read it, since it lives in a settings file your own account owns. What it stops is the casual version of the problem, another account on the same Mac, and anything that has not gone looking for it, and it turns a payload arriving without one from a normal event into something the app can notice. The check switches itself on only when the URL Claude Code is actually posting to carries a token, so an install that has not been re-run keeps working exactly as before instead of going deaf, which is the one outcome a feature like this must never produce.

Claude Code keeps a managed-policy file that nothing has ever surfaced. On a personal Mac this shows nothing at all. On a company Mac it answers the question this app exists for, one level up: not what an agent may do inside this project, but what somebody above you has already decided, and whether these sessions are being recorded. A monitoring notice in particular is something a person should be told plainly and once, rather than discover later. Only real restrictions are listed, and a policy entry the app cannot parse is not treated as a restriction, because telling you a machine is locked down when it is not is the same size of mistake as missing a lock.

Every CLAUDE.md, imported memory file and glob match that Claude Code pulls in is now listed against the session that loaded it. What an agent has been told is as much a part of what it may do as its permissions are, and the interesting case is the file that arrives halfway through a session, because by then the startup output where it would have scrolled past is long gone.

The task hooks only describe what happened while this app was running and listening; the directory on disk describes what is true, which is what a session resumed after a restart, or one whose hooks were never installed, actually needs. It also carries the dependency edges between tasks, so a task waiting on another can be told apart from one nobody has started. This does not bring the meter back on the newest models, which no longer have the to-do tools at all: it makes the meter right when there is something to be right about.

A file changing that Claude did not change is usually you editing in another window, a branch switch, or a build writing output, and it is how an agent ends up reasoning carefully about a file that no longer says what it read. Counted quietly rather than announced, because a card for every file would be noise during an ordinary build and the count is the part worth looking at.

Claude Code 2.1.234 changed what running out of usage means: rather than ending the turn, it waits for the limit to reset and carries the task on by itself. Nothing announces that restart, and by the time a limit lifts you are somewhere else, because being told to stop for several hours is exactly the thing that makes you walk away from the machine. A session that starts working again now raises a card and, when you are away from the Mac, a notification: which project it was, and how long it waited. The restart is worked out from evidence rather than from a clock, since the turn simply continues and no event says so; a session that was waiting and then fires any hook at all has started again, with a few seconds of grace so the stop's own trailing hooks are not mistaken for the restart.

It used to raise a red "Session stopped on an error" card, which is the wrong story twice over: nothing is broken, and nothing is being asked of you. It now reads as a pause with a time on it, taken from the real reset timestamp that your Claude Code status line already reports, so the card says roughly what time the work will start again and that there is nothing for you to do. If you have switched off "Continue automatically at usage limit" in Claude Code, the card says the opposite thing, because then the session is not waiting for a clock, it is holding a dialog and waiting for a human. That setting is read from your own configuration rather than assumed, and an absent setting counts as on, matching the CLI's default.

Everything the notch shows comes from hooks that Claude Code fires at it over a loopback socket, none of that is visible, and when nothing appears there was no way to tell a quiet afternoon from a broken pipe. The previous release made a server that failed to start visible; a server that is listening and simply never hears from anyone looked healthy from the inside and was just as useless. One line now says which it is: receiving events and how long ago the last one was, or nothing yet since the app started, or nothing for six hours, or the hooks are not in your Claude Code settings at all, or the server is not listening. The two you can act on say what to do about it.

Its one privileged verb now asks before it does anything, but some people would rather the surface did not exist on their machine, and until now the only way to say so was not to install the app. Settings > Notch, on by default, because the scheme is also how a Shortcut or a Raycast script reaches the notch. Off means nothing a link asks for happens, not even a card.

Claude Code has reported failures for a while and this app never listened, so a session whose every command was failing looked exactly like a session working: the only thing on screen was the name of the tool it had just started. Every failure now goes to the history with the first line of its error, and three failures of the same tool in a row raise a card, because tools fail on purpose all the time and a card for each one is noise you learn to dismiss, while a run of the same failure is a session going in circles with nothing else on screen to say so. The card comes once, at the third, and a tool that works ends the run. Pressing Escape arrives through the same channel and is the one failure that is not one, so it is recorded nowhere: you already know.

Claude Code 2.1.233 took the to-do tools away from Opus 4.8, Sonnet 5 and newer models unless a setting brings them back, so sessions stopped reporting a checklist and the meter had nothing to draw. An empty meter and a broken feature look identical from the outside. Settings now explains what happened and copies the line that restores it, but only where there is evidence for the claim: a session that has run twenty tool calls without ever once mentioning a task, on a version new enough to have removed them, on a machine where the setting is not already on. An older version is never blamed, because there an empty meter just means the work had no checklist.

GitLab issues a family of prefixed tokens for runners, deploys, pipeline triggers, agents and more, and this app knew one of them. It matters more here than in a terminal window: history entries are written to disk, kept for five hundred entries, and every CSV and JSON export is built from them, so a token that slipped through outlived the session it appeared in. The patterns stay narrow, so a branch named after one of those prefixes is still a branch.

The app has always known its own version and said nothing about the CLI it exists to watch, which is the one that actually changes under you. It reads the installed version, asks the npm registry for the current one, and works out from the binary's path how you installed it, so the command it offers is the right one for a native, npm or Homebrew install rather than a guess that fails. The card carries the headline changes from the release you are missing, so updating is a decision rather than an obligation, and it stops asking once the update lands.

Servers can stop in the middle of a tool call to ask you something, and until now that question sat in a terminal window you were not looking at while the tool call waited. It now arrives as the same card Claude's own questions use, and the answer goes straight back to the server. Only questions a card of buttons can answer honestly are taken: a yes or no, or a pick from a list the server supplied. Free text, numbers and browser sign-in flows are handed back to Claude Code's own dialog untouched, because a card that cannot ask for a typed value should not pretend it can, and an answer is only sent when every field of the request has one and every value is one the server offered. If the question ends anywhere else, cancelled or answered in the terminal, the card comes down by itself instead of waiting five minutes for an answer nobody can give any more.

A fork is a second copy of a conversation you are probably still sitting in, running in its own worktree and spending its own money, and in the session list it looked exactly like a resume: same project, same branch, same everything, so the two rows read as one session drawn twice. Forks now carry their own chip. It is shown only when that session's Claude Code is new enough to tell a fork from a resume, since older builds call every fork a resume and no chip is the honest answer there.

Claude Code lets a session run twenty subagents at once and make two hundred web searches in its lifetime. Neither limit has an event of its own; the refusal arrives as an ordinary tool result, Claude reads it, carries on without the work it was going to delegate, and says nothing about it in the reply. From the outside the session simply does less, which reads as stuck or as having decided not to bother. The agent badge now turns into a fraction once the cap is reached, and stays that way afterwards if a spawn was actually refused, since the agents that were running have long since finished by the time anyone looks. The web search budget gets the same treatment in its final tenth, where a session is about to lose the ability to look anything up. Raised limits in your settings are read the same way Claude Code reads them, so a raised cap shows as a raised cap.

The "compacting context" cue was raised when compaction began and lowered by whatever hook happened to arrive next, which meant it disappeared almost immediately on a busy session and hung around on a quiet one. Claude Code now fires an event when compaction actually finishes, so the cue ends on the thing that ended it, and the summary the session keeps in place of the conversation it just dropped is recorded in the history.

Claude Code can fence a session in: the filesystem is limited, network egress goes through a proxy that only lets an allowlist through, and credentials can be masked so a sandboxed command reads a sentinel rather than the real secret. Whether a session runs that way is exactly the "what is this agent allowed to do" question the notch exists to answer, and nothing showed it. No hook carries it either, so the app reads it the way the CLI does, from the settings chain for the session's folder, merged with the CLI's own precedence rules. A sandboxed session now carries a badge, green when the fence is whole and amber when something is allowed to run outside it, with the allowed domains, masked credentials and exceptions in the tooltip. It appears on the session row, in the header, and on the permission card, where whether a command is fenced in changes the answer to whether you should allow it.

The badge says a fence exists; this says when the agent walked into it. A blocked host or file path raises a card naming what was refused, goes to the history, and adds to a count that rides on the badge, so a session quietly hitting the fence a dozen times reads as that rather than as a session failing for no visible reason. The format those details arrive in is not a documented contract, so the reader degrades rather than guesses: it names the host or path for the shapes it knows and keeps the raw line verbatim for the rest.

Auto mode decides in both directions and the notch only ever showed one of them. An auto-approved action popped a card; an action the classifier blocked showed nothing at all, so a session being refused over and over looked exactly like a session thinking. Denials now get the same card in the other direction, with the reason underneath, the deny sound rather than the allow one, and twice as long on screen, because a refusal can need acting on while a receipt does not. They are counted apart from the denials you made yourself.

Settings files are where permissions, allow rules and sandboxing live, so an edit to one rewrites what your running agents may do, and nothing said so. A change to your settings, the project's, the project-local ones or a managed policy now raises a card naming which of them changed, and refreshes the sandbox badge immediately rather than on its next scheduled read. It never blocks: the hook behind it can veto a settings change, and a monitor should not be able to stop you editing your own settings. It also stays quiet about the app's own writes, and records skills changes without announcing them, since those change what Claude knows rather than what it may do.

The notch knew a session only once it fired a hook, so a session started before the app launched, or one in a project whose settings never got the hooks, did not exist as far as the list was concerned. It now reads Claude Code's own registry of running sessions, which closes that gap and one at the other end: a session that exits leaves the registry, so its row goes at once instead of waiting out the silence that used to be the only evidence it had died. A session you are merely thinking in is no longer mistaken for a dead one either. The CLI version each session runs is in its tooltip, which is the answer to why one session shows something another does not.

A session's folder is what you agreed it could touch, and /add-dir widens that afterwards, so the row went on showing only the folder and quietly understated the session's reach for the rest of its life. Sessions now carry a chip for the extra directories, with the paths on hover, and the history distinguishes you typing /add-dir from the SDK registering its own repo root. The hook fires after the fact and cannot block it, so this is a record rather than a gate.

Most of what the notch shows survives a cd on its own, because every hook carries the folder it fired in, but a session with no id is filed under its folder, so the key it lives at went stale and the next hook opened a second row for the same session. It now moves, with its history intact, and re-reads the branch rather than carrying a stale one into what may be a different repo.

There is a document written for a coding agent rather than for a reader, at rawsun007.github.io/claude-notch/AGENTS.md, and a button on the site that copies a one-line pointer at it. The agent checks the machine, installs through Homebrew, wires the hooks and checks the port actually answers, and then stops: Accessibility and Input Monitoring are macOS permissions only a person can grant, so it says so and hands back rather than pretending otherwise. It is also told not to install by piping a script into a shell and not to switch on Auto-Approve to make its own job smoother, which would be a strange thing for this app in particular to teach.

On the landing page they are illustration: muted, looping, sized to sit beside text. That is the wrong thing for someone who actually wants to watch one, so each now opens full size with real controls, no autoplay, and a note on what it is showing.

The dollar caps could never touch it: pricing a Codex session would mean inventing gpt rates nobody publishes, so its cost reads as zero and every cap passed it straight through while looking like protection. Tokens are the part Codex does report, exactly, on every turn, so that is what gets capped, per session and per day, warning and then stopping exactly as the dollar caps do.

Codex sends its rate limits on every turn and nothing read them, so the first sign of running out was Codex refusing. The windows are named from the length Codex reports rather than a fixed label, since plans do not share a shape: a Go plan reports a single 30-day window, others a 5-hour and a weekly.

Signing in with ANTHROPIC_API_KEY instead of a Claude subscription used to leave the page blank forever, since Claude Code never reports a rate-limit percentage for that kind of session, and it just said come back later to nobody's benefit. It now says plainly that billing is per-token, shows a masked version of the key, and can check with Anthropic on demand whether the key is actually accepted.

Signing in with ANTHROPIC_API_KEY instead of a Claude subscription used to leave the Plan page blank forever, since Claude Code never reports a rate-limit percentage for that kind of session, and the page just said "come back later" to nobody's benefit. It now says plainly that billing is per-token, shows a masked version of the key, and can check with Anthropic on demand whether the key is actually accepted. The menu bar's plan readout does the same, showing "API key" instead of nothing.

Updating used to mean reading a command off the About page, copying it, finding a terminal and pasting it in, and the download counts say exactly how well that worked: the two releases before this one were security fixes and they were downloaded zero times and once. Fixes that nobody installs are not fixes. The button appears in all three places the update prompt already appeared, the card in the notch, the menu-bar alert and Settings > About, and it does the whole job: downloads the new version, checks it against the checksum published with the release, quits, replaces and relaunches. The card in the notch is the one that matters, because most people never open the menu bar menu, and until now it said "download it from the menu bar icon" next to a button that offered to focus your editor, which is not an update. Homebrew installs are still sent to Homebrew rather than fought with, and anyone who would rather run the command themselves still can.

The destructive-command check works by recognising patterns, and a pattern list is never finished: something novel enough is not flagged, and an unflagged command is exactly what Auto-Approve and a tool-wide rule are allowed to wave through. Strict mode asks the other question. Not "is this known to be bad" but "is this known to be harmless", and only a yes gets approved on your behalf. The rule is one sentence: a safe command looks at things and changes nothing. Building, testing, running a script and anything that reaches the network all wait for a click, because they are ordinary and mostly fine and they all execute code somebody else wrote. It narrows the blanket approvals only: a rule you made for one exact command is a decision you made about that command, so it still applies. The list is stricter than it sounds, since every entry has to be read-only with any flags at all, which is why git branch is not on it (-D deletes), nor git config (it writes), nor git stash (it moves your working tree), nor gh pr (create publishes). It blocks nothing and runs nothing; it decides whether a decision gets made for you or by you. Off by default, because it trades clicks for certainty and that is your call to make.

Claude Code runs the scripts in ~/.claudenotch/bin on every event, dozens of times an hour, as you. The last release made that directory private to your account, which stops anyone else writing into it, but nothing noticed if something already had, or if an interrupted update left a forwarder half-replaced. At launch the installed copies are compared byte for byte against the ones inside the app, and anything that differs is named, with the option to put the shipped copy back. It is drift detection rather than authentication, deliberately: anyone who can write there could rewrite the app too, so the only claim being made is that these are not the files this version ships. It asks rather than repairing silently, because overwriting a file you edited on purpose without saying so is its own kind of rude, and if you did not edit it then it is the thing you most need to hear about.

The app decides which commands an AI agent may run on your Mac, which makes it a security tool whether or not it is described as one, and until now anyone who found a hole in that had nowhere to send it. SECURITY.md states what the app treats as trusted and what it does not, names the handful of functions where each boundary is actually enforced, and gives response times. It is also candid about the limits: the destructive-command check recognises patterns and a pattern list is never finished, so it is a good catch and not a guarantee; a tool-wide allow rule approves every future call of that tool; the build is signed but not notarized; and any process already running as you can post to the loopback port, which buys an attacker nothing but does mean a card is not proof of where it came from.

They decide what runs without asking you, which makes them the app's security policy, and until now they could only be created by clicking a button on a card and only be seen through a menu-bar submenu nothing pointed at. The page shows the whole list, flags tool-wide rules in amber because those approve every future call of that tool, prints the command as the command rather than as the escaped pattern it is stored as, and lets you delete a row or add one by hand. It also hands the list to Claude Code, which keeps its own allowlist in ~/.claude/settings.json and had no idea about ours: copy the fragment, or merge it in with a backup taken first. A rule Claude Code cannot express is left out and counted rather than approximated into something broader than what you approved.

Today's finishing spend, worked out from the rate since midnight, with the clock time it would cross the daily cap; and the month so far, the mean across completed days, and what the month comes to if the rest of it looks like those. Both stay quiet when they would be wrong: today is left out of the monthly average, because at 9am it is a fraction of a day and would drag every projection down, and the day's own projection waits two hours in, because two pounds by 00:20 extrapolates to a fortune. The forecast also speaks once a day as a card while the cap is still ahead of you, and says nothing once the 80% and 100% alerts have already fired.

A claudenotch:// URL covers the verbs the menu bar already offers, open, settings, history, standup, compose and resume, so a Shortcut, a Raycast script, a Stream Deck button or a link in a note can reach it. An AppleScript dictionary adds the same six verbs plus the state worth reading back: today's spend, session count, working count, pending count, current project and current activity, which reaches Shortcuts through its Run AppleScript action and every other automation tool directly. A URL is untrusted input, so the parser is narrow: only those verbs are recognised, and a project arrives as a name and never as a path, resolved against sessions already on disk, so nothing can aim the agent at a directory of its own choosing.

The permission card was the only part wired to the string table, so choosing Japanese used to get you a mix of the two. The idle pill's status word, the badges, the session rows, the status bar tooltips, the whole history drawer, every menu-bar row and the alerts it puts up, and the entire first-run setup window now follow the setting, with word order left to the translation rather than assumed from English.

After the third time the same command is approved by hand, the card reads "allowed 3 times" beside Always Allow, so the rule is one click away at the moment it is obvious rather than a piece of admin for later. Never for a dangerous command, which is exactly the one that should keep asking, and never for a rule that already exists.

A task finishing while nobody is at the keyboard no longer chimes to an empty room: the cards queue as they always did, and one sound plays when you come back, with VoiceOver hearing how many finished while you were gone.

An auto-approved call, which is both the thing most worth auditing and the one that happens without you, and the composer, which is the one card that takes your keyboard and so needs to say where your typing is going.

The tick that confirms your own keypress, the pop when you deny something, the chime when a task finishes, the noise the composer makes when it types into your terminal: one row each, and every row offers None. Until now the only lever was Mute all sounds, which also took away the prompt you actually wanted to hear.

Everyday is the pet being itself: peeking, strolling, napping, the backflip after too many boops. Guest appearances is the pet dressed as something else, and each costume carries the month it arrived, because a joke pinned to a particular month should say which one. The Spider-Pet is dated July 2026.

Which subscription this Mac is signed into, every limit that plan has rather than the two the status line reports, and what usage credits have cost. A Max plan meters Opus separately, and that window gets its own row and its own bar. The account it belongs to is named on the page, because people sign out of one login and into another and the limits below belong to whichever is current.

Whichever limit is closest to stopping you, since that is the only one worth the width. Off by default: it names your plan, and not everyone wants that on screen while sharing.

It only appears while credits are on, so it never takes one of the two slots to read $0.00.

Credits are the moment money starts and nothing announced it before: a session simply kept going where it would have stopped. Once, not once per refresh.

The nine translations covered the short labels but fell back to English for the explanation under each toggle, which is the part that tells you what the toggle does, so picking a language changed a third of the window. All 179 strings are translated now, in Chinese, Spanish, Hindi, Portuguese, Japanese, German, French, Korean and Russian.

Homebrew users have always had brew upgrade; everyone who installed from the disk image had to download it again and drag it over the running copy by hand, every release. Run ~/.claudenotch/bin/claudenotch-update.sh and it fetches the new version, checks it against the checksum published in the Homebrew tap, quits the running copy, replaces it and relaunches. Pass --check to see what is available without changing anything.

If the copy in Applications came from a cask, it says so and stops, because replacing it by hand would leave Homebrew believing the old version is still installed and put it back on the next upgrade.

Answering "am I up to date" used to mean going to the About page to look. It reads the check that already runs daily, so nothing extra is polled.

The sidebar could always be driven by the keyboard, but only after clicking a row first, which is not something anyone does. Movement stops at the ends rather than wrapping around, and typing in the search box is unaffected.

Pick one in Settings > General > Language and it applies straight away, no restart. The notch cards and most of the settings window are translated; some of the longer explanations are still English and fall back to it.

If the closing message claims a change the turn never made, or says the tests pass when no test ran, the card says so. It stays quiet the rest of the time, which is most of the time: a verifier that cries wolf is worse than none.

Hover a plan-limit bar and it projects when the cap arrives at the rate you are actually spending. It says nothing when the window resets first, when the answer is more than 45 minutes away, or when the readings are too close together to trust.

tools/migrate-from-vibe-notch.sh removes its hooks and installs these, leaving hooks that belong to other tools alone, and backs everything up first. MIGRATING.md maps its open issues to what works here and, just as plainly, what still does not.

The notch never takes focus, which is the whole point of it, but that also meant nothing ever moved the VoiceOver cursor to a card, so a blocking Allow or Deny could sit there unread while Claude waited. Cards are now announced as they appear, and resolving one speaks the outcome so you can tell Allow from Deny without looking.

When several requests are queued Return allows all of them, so it says that rather than a plain "Return allows", and a destructive or over-budget card never promises a key that does nothing.

Question options announce whether they are selected, meters read their values, and the pet is skipped as decoration.

The permission card now reads its text from a strings table, so a translation can be dropped in without touching any Swift.

It still answers a boop and still reacts when a task finishes or fails.

Answer prompts and drop folders from whichever screen you are looking at.

Codex sessions now get a live context meter, resume (codex resume), start Codex in a folder, a task-progress bar from Codex's plan, the git branch, token usage on the Usage page, session previews, and a heads-up card when Codex is about to ask for approval.

When you run more than one agent, each session row shows which CLI it is (a small CODEX or GROK chip; Claude stays untagged), so a mixed list is unambiguous.

Leave it blank to use the agent's name.

Enable it in Settings > General > Integrations, approve Codex's one-time hook-trust prompt, and your OpenAI Codex CLI sessions surface in the notch: live activity, a running-command card, session status, and a heads-up card when Codex is asking to run a risky command. It is beta, so expect rough edges.

When Claude works through a TodoWrite checklist, the open notch card shows a done-over-total progress bar, not just the subagent task system.

When a newer release is out, the General settings page shows the version with a one-click download, release notes, and a copyable Homebrew upgrade command.

The Session settings page now shows how many lines the current session has added and removed, with the net, read straight from Claude Code's status line.

See how close you are to your Claude plan's 5-hour and weekly limits, each as a percentage bar with a reset countdown, turning amber and then red as you approach the cap.

From how fast you are using the window, ClaudeNotch estimates whether you are on track to hit the limit before it resets, for example "at this pace you hit the limit in about 2h".

When the current session is working through a multi-step task list, the open notch card shows a thin done/total progress bar.

Give any resumable session a short name so the list reads by intent instead of by its first prompt; the original prompt stays visible underneath and names persist across relaunches.

Alongside the timed windows, the Session settings page now has a Keep on until I turn it off option for when you want auto-approve to stay on indefinitely, with a matching status and a Turn off now button.

ClaudeNotch reads the sessions Claude Code keeps on disk, so if you close a terminal by accident you can pick up right where you left off. The Session settings page lists your projects, and each one expands to its recent sessions with the first prompt, how long ago it ran, and a Resume button that reopens it with claude --resume in its original folder.

One click reopens the newest session on disk, named after its project, for the fastest recovery after an accidental close. In the notch, the session history's Resume now reopens the exact session rather than starting fresh.

Filter by project name or by anything in a prompt, and matching projects expand so the sessions are visible without a click.

Type a setting's name or a keyword and it lists the matches with the page each lives on, so you can jump straight there.

It shows at a glance whether the Claude Code hooks and the status-line forwarder are wired, with a Fix button that reinstalls them in place if either is missing.

A sidebar (Workspace, Session, Alerts & Cost, Info, Advanced) leads to pages for everything ClaudeNotch does: General, Notch, Pet, Session, Alerts, Sounds, Budget, Privacy, Usage, Developer, and About.

With per-tool sounds on, each kind of pop-up (shell commands, edits, new files, notifications, everything else) gets its own sound, each auditionable and overridable.

Drag a folder over the notch and it turns into a drop panel with a dashed drop zone, blue until the file is right over it and green when it is. Let go and Claude Code opens in that folder; drop a file and it opens in the parent folder with the file already handed to Claude as an @-mention.

The notch now tells you as your 5-hour or weekly usage fills, once at 80% and once at 95%, so a lockout in the middle of a task is not a surprise. On by default, and the pet cries about it on the card so the bad news is not grim.

Turn on "Alert on Long Tool Runs" and the notch notifies you once when one tool call passes five minutes, so a stuck agent does not sit unnoticed while you are looking elsewhere. It fires once per run, not on a loop. Off by default.

The notch had no accessibility labels, which made every card invisible to blind users. Buttons now read their label and announce as buttons, a permission request reads as one sentence with any danger flagged first, and the status pill announces what Claude is doing.

When Claude sits in one long tool call, the notch now ticks a count beside the command, so you can tell at a glance whether it is still working or stuck. Past a minute it warms to amber. The clock resets on each new tool call and clears the moment the turn ends, so it only ever times something that is actually running.

Turn Pet Mode on and every so often the mascot suits up, drops head-first out of the notch on a web, hangs upside-down and swings, with a theme to match. Fan build, beta, and wide open to ideas: tell us what he should do next.

Claude Code runs agents in a daemon now (claude --bg), with no terminal attached, which is exactly the situation this app exists for: work happening somewhere you are not looking. Each one shows up named by the task it was given, because a background agent has no other label, and you can attach to it in one click. An agent that is blocked waiting for you says AGENT WAITING, since it has stopped, it has no terminal to be stuck in front of, and nothing else on your machine will tell you.

Every notch app's most-requested feature is some kind of pomodoro, and all of them make you start a timer. This one does not need you to: Claude Code's hooks say when work is actually happening, so the stretch is measured. Eight minutes away counts as the break, and after 55 minutes of real work it nudges once. Off by default.

It used to tuck itself into the notch for the entire length of a tool run, which meant it hid exactly when there was something to watch. Now it comes out and keeps the job company: pacing, bobbing, tracking your cursor. It still never performs over a card you are reading.

A turn that dies (rate limit, overloaded, billing) or a command you deny startles it: arms up, a fast recoil, then a wary look at whatever just happened. It was a mascot for good news only.

"82%" tells you that you are in trouble but not whether you can wait it out, so the notch now reads "82% · 1h 12m", with the exact reset time in the tooltip.

Claude Code resolves it, so nothing shells out to gh.

It hops off the lip, falls under gravity while the rope pays its slack out, and when the rope goes taut its velocity splits: the part along the rope is absorbed by the rope's stretch, and the part across it becomes the swing. So it swings because it was still moving sideways when the rope caught it, not because anything told it to. After that it hangs as an elastic pendulum, swinging at the period its rope length and gravity give it and bleeding the energy off.

While nothing is happening it peeks out, looks around, hangs off a corner, strolls along the edge, and curls up for a nap after five quiet minutes. When a task finishes, it hops with sparkles.

It watches your cursor and turns to face it, holds still to be petted while you rest the pointer on it, and boops when you click it. Boop it five times in a row and it backflips.

Type a follow-up and Send, and it lands in the terminal that ran the session, or a fresh terminal opens in the project folder with your message as the first prompt.

"2 · $1.24", showing working sessions plus today's estimated cost. Toggle: Show Today's Spend in Menu Bar (off by default).

You still see it live; viewers don't. Toggle: Hide from Screen Recordings (on by default).

One nudge per request, never a nag loop.

The notch shows an "N files" chip, and a Files Touched menu lists them newest-first, so you can click to open in your editor, or Reveal All in Finder.

Long tasks no longer die silently while you're away.

Session titles are shown in multi-session rows when set.

"Yesterday: $2.40 · 5 sessions · top: my-app"). Enable it via the new Daily Spend Digest toggle in the Permissions submenu. Off by default.

Off by default, so opt in when you want banners on task completion.

Controlled by the existing Mirror to Notification Center toggle.

A relative cost bar lets you compare projects at a glance. The history drawer now has three tabs: Sessions, Projects, and Events.

The number disappears when all sessions are idle, so a non-zero count means Claude is running right now, visible without opening the notch.

Sessions are archived on Stop/SessionEnd/stale timeout and persist across app restarts. The existing per-tool-call event log is still available on the Events tab.

"45k / 200k") instead of just a percentage. The bar color warms from blue to orange to red as the window fills, and the running session cost appears alongside it. Multi-session rows get the same upgrade.

While an agent is running you'll see its type in the activity strip (e.g. "Agent: Explore"). When it finishes the session goes back to its normal thinking state instead of showing a spurious "Claude finished" notification for each agent.

The first part of the title used to always read "Claude". A new Notch Title menu now lets you choose what it shows: Claude (the default), Project name (which tracks whatever project is active and falls back to Claude when there is none), or a Custom label you type in. Handy when you run several projects at once and want the notch to say MyApp instead of Claude. Thanks to Luca Galli (@Lvcaa) for suggesting it.

The bottom bar used to estimate usage by dividing a guessed dollar cost by a hardcoded cap, which read 100% for heavy users with no way to change it. It now reads the authoritative numbers Claude Code itself reports: real 5-hour and weekly plan-limit usage, plus true context-window usage. Pick any two items to show via menu, Status Bar: 5h plan limit, Weekly plan limit, or session cost. You can also override the context window there (Auto / 200K / 1M). Heads-up: to read those numbers, ClaudeNotch now installs a status line forwarder into Claude Code. It chains to whatever status line you already had so your terminal display is unchanged, is captured and restored if you uninstall, and degrades gracefully if the app is not running. Thanks to Luca Galli (@Lvcaa) for this one.

The collapsed notch header now leads with the Claude brand icon, followed by the project name, a small status dot, and the status text on a single tighter line, so more reads at a glance while Claude is idle. Thanks to Luca Galli (@Lvcaa) for the redesign.

Cost Budget has a new "Enforce: block new commands at 100%" toggle. With it on, once a session or daily cap is reached, the next tool or command Claude tries is held in the notch for a decision instead of running, even when you have auto-approve or an always-allow rule on. The card shows what is over budget and gives you Deny, Allow once, Raise to the next preset above your spend (so the run can continue), or Turn off. Pressing Enter does not auto-allow a budget block, the same as a destructive command, so you can't blow past a cap on muscle memory. Note this gates tool and command calls, which is what drives runaway spend; sending a message and getting a reply are not blocked. There is also a "Budget Hard-Stop" entry under Demos. Off by default.

Blocking permission requests now also arrive as native macOS notifications, so you don't have to be looking at the notch to respond. Safe commands get Allow, Deny, and Deny with reason right on the banner; dangerous commands offer Deny only, and Allow still brings you back to the Mac to confirm with Touch ID (the Allow action also requires unlocking first). Because they are real macOS notifications, they automatically respect Focus and Do Not Disturb: during a Focus session the banner stays quiet and the request waits for you in Notification Center and on the lock screen. They carry no sound, since the notch already chimes when you are at your desk. You can turn the whole thing off under Permissions, "Mirror Alerts to Notifications".

The activity drawer (the clock in the notch) used to keep only your last 50 decisions with no way to look anything up, so it emptied out fast. It now keeps up to 500, with a search box that filters live across the tool, command, project, and details as you type, plus quick filter chips for All, Allowed, Denied, Risky, and Q&A. A new Export button saves the whole log to a file as JSON or CSV (just name it .csv), so you have an audit trail of everything Claude asked and how you answered.

Destructive actions like rm -rf or sudo can now be approved with Touch ID (or Face ID) instead of press-and-hold. Tap "Confirm to Allow" and authenticate, and only a successful fingerprint runs the command. Turn it on or off under Permissions, "Require Touch ID for dangerous commands" (on by default when your Mac has biometrics); with it off, the press-and-hold button stays exactly as before.

The per-project breakdown under Claude Usage now sorts by cost, highest first, and leads with the dollar figure, so your priciest repos for the week stand out at a glance.

A new Cost Budget menu lets you cap spend per session (say $5) and per day across all your sessions (say $25). As you approach a cap, the session's cost figure in the notch warms orange and then red, and you get a card at 80% and again at 100%. Setting a cap checks what you have already spent right away, so it works even if you set it mid-run. The figures are estimates from public pricing, so treat the caps as a guardrail rather than a hard limit. There is also a "Cost Budget Alert" entry under Demos so you can see exactly what the warning looks like.

The permission card now has a small speech-bubble button next to Deny. Tap it and a quick editor opens where you can tell Claude what to do instead, for example "use ripgrep instead of grep" or "write it to a temp file first". Claude receives your note and adapts, instead of just being blocked. A plain Deny (or Esc) still denies instantly with no note.

When a turn completes, the card now has a Reply button that opens the composer already pointed at that session, typing into the same terminal it ran in (or opening a fresh one in the project folder if that terminal has closed). You can send a follow-up without switching windows.

When Claude asks you to pick from options, each question now has a "Something else…" field, so you are not limited to the presets. For a single-choice question your typed answer is used; for a multi-choice one it is added to whatever you have ticked. Either way Claude receives it just like a picked option.

The notch now shows how full Claude's context window is and a running estimate of what the session has cost so far, next to the model name. The little bar warms from blue to orange to red as the window fills up, so you get a heads-up before Claude pauses to compact, and it switches to "compacting context" while that happens. It handles both the standard and the 1M-token context windows automatically. Cost is an estimate from public pricing, not a real bill, and it lives right on the session row so you can keep an eye on long runs without leaving your editor.

While Claude is working, the notch now shows what it's doing right now, the active tool with an icon and its target (for example a pencil next to "Edit: src/foo.swift"), with the status label gently shimmering. The moment a tool is approved the strip updates to show it running, and it switches to "Thinking" between steps, so the notch reflects what's happening as it happens instead of lagging a step behind. Thanks to @Lvcaa.

Approvals that Claude Code raises separately from a normal tool run, like "proceed with this plan?" after plan mode and the confirmation for updating its to-do list, used to appear only in the terminal. They now show up as a card in the notch so you can approve or deny them without switching back. If the notch can't handle one for any reason, Claude's usual terminal prompt still runs, so nothing ever gets stuck.

When Claude works through a multi-step task list, each session's row now shows a small progress bar with a running count like "3/5", so you can see at a glance how far along it is. The bar fills as tasks complete and turns green once they're all done. It appears automatically whenever Claude uses its task list and clears when a new list starts.

When you run more than one Claude Code session at a time, the notch now tracks each one separately instead of collapsing them into a single status. The header shows how many sessions are live (e.g. "Claude · 2 sessions"), and opening the notch lists each session by project with its own live status and a dot that pulses while that session is working. Tap a session's row to read its latest reply. Sessions drop off the list as soon as you exit Claude (Ctrl+C / Ctrl+D / exit) or close the terminal, so the list reflects only what's actually running.

When turned on, the notch stays open while Claude works and shows a live status line (Claude thinking, running Bash, editing, replying, done) with Claude's latest output as it streams in, and the status dot pulses while Claude is busy. It's off by default and keeps the usual hover-to-open behavior; enable it with "Persistent Notch Display" in the menu bar. Thanks to @Lvcaa.

Token counts come from Claude Code's own local transcripts; cost is an estimate from public API pricing (a subscription isn't billed this way). This is separate from the existing Insights menu, which tracks ClaudeNotch's own permission and tool activity.

Previously they were routed to the terminal.

Survives restarts safely (timed state is never persisted as permanent).

Permission cards still show, because Claude is waiting on them.

All local.