Toolport

Toolport blocks a tool when its definition changes in a risky way. This release fixes the
part where un-blocking it didn't work, and makes the whole thing visible instead of buried.
It also lands a security pass that closes several ways a malicious server could reach past
the gateway, adds four new clients, and clears a batch of reliability and correctness bugs.

Quarantine: blocked tools you can actually see and unblock

Re-approving a blocked tool now unblocks it. Re-approving cleared the list in the app,
but the gateway kept refusing the call with "re-approve to restore" - telling you to do the
thing you had just done, with no way out from inside the app. Restarting Toolport or toggling
a server off and on was the only escape. The gateway now reconciles what's blocked against
what you've approved, so a re-approved tool works on the very next call. (#395)

Blocked tools surface anywhere in the app. A card now appears with the reason the tool
was blocked and a re-approve button right there, plus a count on Settings so it stays easy to
find. Previously the first sign of trouble was an agent call failing, and the remedy was
buried in Settings. (#401)

A damaged quarantine file no longer un-blocks tools. If the file recording what's blocked
couldn't be read, it was treated as "nothing is blocked", quietly dropping the protection. It
now keeps enforcing what it already knows, and says so. (#399)

Updating

Updating now replaces the gateway your AI clients are using. Toolport runs a small
gateway process for each connected client, and that's where most fixes live - including the
re-approve fix above. Those clients could keep running the old gateway until you restarted
them, so you'd install a fix, watch the problem persist, and reasonably conclude the update
hadn't worked. Toolport now retires out-of-date gateways when it starts, and each client picks
up the new one on its next request. (#404)

No more black command windows flashing on launch. A few internal housekeeping steps were
briefly opening console windows on Windows at startup. Harmless, but alarming. (#405)

Clients

Four new clients: Witsy, Oh My Pi, OpenCode, and Qwen Code. Toolport now detects 26
clients. OpenCode and Qwen Code each use their own config shape - OpenCode stores a command
as an argv array, and Qwen Code distinguishes streamable-HTTP from SSE servers - and Toolport
reads and writes both correctly. (#366, #365, #411, #415)

Number and boolean values in a server's args are kept when importing or pasting a
config, instead of being silently dropped (which would shift every argument after them). (#416)

Pasting a Continue config.yaml block works. "Paste from client config" rejected
Continue's format with "Could not detect format", even though Toolport already reads and
writes that exact file for the Continue client. Environment variable values in the pasted
block are preserved. (#403)

Downstream servers run in their own process group on macOS and Linux, so a server
starting up can't disturb the display of a terminal-based AI client. (#364)

Reliability

Tool name collisions get stable suffixes. When two tools on a server would share the same
exposed name, the loser gets a _2 suffix - but that was assigned by list order, so a server
reordering its own tool list could swap the suffix between two real tools, and a cached tool
name would quietly start calling the wrong one. Suffixes are now assigned by tool name, so
they don't move. (#408)

Downstream server processes are fully cleaned up on macOS and Linux. Killing a server (a
toggle, or a catalog rebuild) killed only the wrapper, leaving npx/uvx child processes
running. Toolport now tears down the whole process group, so nothing is left behind. (#406)

A clear error when a server's working directory doesn't exist, instead of a confusing
spawn failure, including which configured path (and which unset variable) was the problem.
(#410)

Security

Tool error messages are now scanned like tool results. Content defense labels untrusted
tool output as data so a server can't slip instructions into your agent - but it only covered
successful results. A server could bypass it by returning an error whose message carried the
payload. Errors now go through the same scan and size cap. (#429)

A server that can't be resolved is no longer treated as local. During sign-in (OAuth), an
unresolvable server address was classified as "local" and had its network-safety checks
switched off - a path a malicious server could use to aim the sign-in flow at your own
network. A server now has to positively resolve to a private address to earn that trust.
(#430)

Renaming a tool no longer disables its safety checks. A tool you renamed couldn't be
blocked and wasn't watched for risky changes, so a rename silently opted it out of the
protection the rest of your tools get. Renamed tools are now blocked and watched like any
other. (#431)

Vendor detection matches the server's host, not anywhere in its address, so a path-based
gateway (for example .../github) is no longer mistaken for the vendor named in the path -
which could otherwise misjudge whether that server needs a token. (#413)

Cleared seven advisories from the dependency tree: two high-severity in brace-expansion and
js-yaml, then one high and four moderate reaching us through fast-uri and hono. The
second batch arrived because shadcn, a code-generation CLI, was listed as a production
dependency - moving it removed that whole subtree from the shipped app rather than patching
versions one at a time. (#367, #396, #402)

Polish

Activity no longer shows a red "0%" for a server that does have errors. Small error rates
read as "0.2%" or "<0.1%" instead of rounding away to nothing. (#388)

The new-profile name box clears when you cancel, so reopening it no longer offers to
create a profile you had already abandoned. (#386)

Thanks

This release includes work from:

• @floze-the-genius - OpenCode client support (#411), Qwen Code client support (#415), Continue YAML write-safety tests (#414)
• @bradhallett - Oh My Pi client support (#365), process-group isolation on Unix (#364)
• @amitvijapur - Witsy client support (#366)
• @BharadwajKanneveti - discovery-ranker blend test (#394), non-string args handling (#416), Activity timestamp formatting (#412)
• @pollychen-lab - Activity error-rate formatting (#388), new-profile field reset (#386)
• @Vermitrude - vendor detection host matching (#413)
• @AnayGarodia - working-directory error reporting (#410), data-directory test isolation (#409)
• @manishchalla - Continue snippet parsing (#403)
• @dubeyharshit0605 - ConfirmDialog test coverage (#393)