CloudZero Desktop Agent 0.2.0

0.2.0 (2026-06-25)

Release 0.2.0 reworks how captured AI usage leaves the device: telemetry is now exported in the OpenTelemetry (OTel) format over an authenticated connection to the CloudZero collector. It also introduces the auto-update path and fixes several install, uninstall, and database-migration reliability issues.

Security

• Authenticated telemetry ingest: The API key is read from the macOS Keychain and injected into the monitoring process at launch — it is never written to the on-disk configuration. Keychain read failures are now distinguished from a genuinely absent key, so a transient Keychain error no longer looks like "no credential configured."
• Signed auto-update packages: Release .pkg artifacts are now EdDSA-signed and validated by Sparkle before any automatic update is installed, so the app will only self-update from a package CloudZero actually produced. The signing public key is locked into the app and cannot be changed via MDM.

New Features

• OpenTelemetry export: Captured AI usage is now exported in the OpenTelemetry (OTel) format, the open standard for telemetry and tracing. The collector's output is interoperable with standard observability tooling and gives a consistent, correlated view of multi-step and multi-agent sessions.
• Context enhancement toggle: The context enhancement feature can now be turned off at runtime from a new Privacy section in Settings. The setting is relaunch-scoped and defaults to on. For IT admins: this provides a supported off-switch for the directive — push the app.contextEnhancement.enabled preference (domain com.cloudzero.Proxy) as a managed value of false to force it off fleet-wide; a managed value takes precedence over the user's setting.
• MDM-managed ingest API key: Administrators can now provision the CloudZero ingest API key through managed app configuration instead of having each user paste it in by hand. Push the key as the forced CloudZeroIngestApiKey value (domain com.cloudzero.Proxy); on launch the app provisions it into the Keychain, locks the corresponding credential field in Settings, and skips the setup-wizard prompt when a key is already present. For IT admins: use a write-only, ingest-scoped, rotatable key for this value.
• Claude Fable 5 / Mythos 5 pricing: The cost estimator now recognizes the Claude Fable 5 and Mythos 5 models, so usage on those models is priced instead of falling through to an unknown-model estimate.
• Org type badges in settings: The organization picker in Settings now shows a badge for each org's type, making it easier to tell organizations apart when selecting one.

Bug Fixes

• MDM / pkg install reliability: The package post-install step now runs its certificate-trust and Network Extension setup inside the logged-in user's session instead of the installer's root context, fixing first-launch trust and activation failures on MDM-pushed installs. If no user is logged in when the package installs (for example, an MDM push to a machine sitting at the login window), this setup is deferred and completed automatically on first login — the app's launch agent is staged during install and runs the remaining steps then.
• Database migrations not applying: Fixed a path bug that prevented the app from locating its bundled database migrations, so schema migrations now apply on launch as intended. A remediation script is included for databases left in a partially-migrated state by the earlier bug.
• Uninstall now removes all proxy certificates: Uninstalling removes every CloudZero proxy CA certificate from the login keychain, not just one — preventing the duplicate-certificate buildup that could leave stale trust entries behind after repeated install/uninstall cycles.
• Git identity misattribution: User identity is now read only from a real [user] section of the Git config, avoiding cases where an unrelated config value could be picked up as the user's identity.
• Auto-update version comparison: Fixed the build version (CFBundleVersion) and hardened the Sparkle update delegate against edge cases during update checks.
• Telemetry pipe race: Fixed a race between two readers draining the same pipe under a timeout, which could intermittently corrupt or truncate captured output.

Improvements

• Selective context-enhancement timing: The business-context enhancement is no longer appended to every round-trip. A single shared decision now utilizes it only on genuine user-prompt turns — skipping continuations, tool-result turns, and quota probes — which lowers token overhead and anchors the tags to the start of a task.
• Expanded business-context tags: The business-context enhancement now captures seven dimensions — cz.context.activity, cz.context.project, cz.context.git_repo, cz.context.git_branch, cz.context.ticket, cz.context.customer, and cz.context.task_summary — up from activity alone, giving much richer attribution of AI spend to the work that drove it.
• Automatic update checks default to off: SUEnableAutomaticChecks now ships as false, so the app no longer checks for updates by default. Manual "Check for Updates" is unaffected.

Build and Infrastructure

• Telemetry now egresses to the CloudZero collector route rather than the previous ingest URL; the destination is built into the signed app bundle (no runtime override).