# Changelog

## Score

- CAI 56 → 56 (+0.4)

## Lenses

- Code Health 71 → 71 (-0.0)
- Architecture 88 → 86 (-1.7)
- Maturity 62 → 65 (+4.0)
- Readiness 42 → 42 (-0.0)
- Security 67 → 64 (-2.8)
- Performance 89 → 89 (+0.0)

## Resolved (35)

- Change-coupling hub: tests.rs → config.rs, basic.rs, pickers.rs, render.rs (src-tauri/src/cli/tui/app/tests.rs)
- Duplicated block (10 lines × 2) (src-tauri/src/services/provider/common_config.rs)
- Duplicated block (16 lines × 2) (src-tauri/src/cli/commands/provider.rs)
- Duplicated block (7 lines × 2) (src-tauri/src/cli/commands/provider.rs)
- Duplicated block (8–9 lines × 2) (src-tauri/src/cli/tui/form/provider_json.rs)
- Hotspot: src-tauri/src/cli/tui/app/content_entities.rs (src-tauri/src/cli/tui/app/content_entities.rs)
- Hotspot: src-tauri/src/cli/tui/app/content_usage.rs (src-tauri/src/cli/tui/app/content_usage.rs)
- Hotspot: src-tauri/src/cli/tui/app/form_handlers/tab.rs (src-tauri/src/cli/tui/app/form_handlers/tab.rs)
- Hotspot: src-tauri/src/cli/tui/ui/overlay/pickers.rs (src-tauri/src/cli/tui/ui/overlay/pickers.rs)
- Hotspot: src-tauri/src/cli/tui/ui/shared.rs (src-tauri/src/cli/tui/ui/shared.rs)
- Hotspot: src-tauri/src/proxy/providers/streaming.rs (src-tauri/src/proxy/providers/streaming.rs)
- Hotspot: src-tauri/src/services/provider/common.rs (src-tauri/src/services/provider/common.rs)
- Hotspot: src-tauri/src/services/session_usage_codex.rs (src-tauri/src/services/session_usage_codex.rs)
- Hotspot: src-tauri/src/services/session_usage_driver.rs (src-tauri/src/services/session_usage_driver.rs)
- Hotspot: src-tauri/src/session_manager/cache.rs (src-tauri/src/session_manager/cache.rs)
- Hotspot: src-tauri/src/session_manager/providers/opencode.rs (src-tauri/src/session_manager/providers/opencode.rs)
- Inconsistent naming pattern for 'get or default' operations. Other methods in the same API use the `_or_default` suffix (e.g., `get_global_proxy_config_or_default`, `get_default_cost_multiplier_or_default`), but this specific method uses a different phrasing or is missing the suffix if it was intended to follow the pattern. More critically, `get_global_proxy_config_or_default` exists, but `get_proxy_config_for_app_or_default` is the only one in the 'app-specific' group with this explicit 'or default' variant, while others like `get_proxy_config` (global) do not have an explicit 'or default' variant listed, creating a fragmented pattern. However, the most glaring inconsistency is between `get_proxy_config` (global, no default variant) and `get_proxy_config_for_app` (app-specific, has default variant).
- Inconsistent return types for querying enabled apps. `McpApps.enabled_apps()` returns `AppType` (singular), which is likely a bug or misleading signature if it's meant to return a collection. If it returns a single app, it's unclear which one. `SkillApps` uses `is_enabled_for` which returns a boolean. `McpApps` also has `is_enabled_for`. The `enabled_apps` method on `McpApps` is suspicious. If it's meant to return a list, it should return `Vec<AppType>` or `impl Iterator`. If it returns a single app, the name is misleading. Given `SkillApps` doesn't have an `enabled_apps` method, this is an inconsistency in capability or naming.
- Members sharing a duplicated core (4 members, 50+ identical tokens) (src-tauri/src/cli/tui/ui/overlay/basic.rs)
- Members sharing a duplicated core (5 members, 50+ identical tokens) (src-tauri/src/cli/tui/runtime_actions/editor.rs)
- …and 15 more

## New (57)

- Change-coupling hub: tests.rs → basic.rs, pickers.rs, render.rs (src-tauri/src/cli/tui/app/tests.rs)
- Database::apply_schema_migrations_on_conn (cognitive 29) (src-tauri/src/database/schema.rs)
- Duplicated block (11 lines × 2) (src-tauri/src/cli/commands/provider_input.rs)
- Duplicated block (7–8 lines × 2) (src-tauri/src/cli/commands/provider.rs)
- Duplicated block (8 lines × 2) (src-tauri/src/services/provider/common_config.rs)
- Duplicated block (9–13 lines × 2) (src-tauri/src/cli/tui/runtime_actions/editor.rs)
- FunctionTooLong: cc_switch::cli::commands::provider::edit_provider (src-tauri/src/cli/commands/provider.rs)
- Medium CVE: RUSTSEC-2026-0381 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0386 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0395 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0396 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0397 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0399 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0400 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0401 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0402 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0404 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0405 (src-tauri/Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0406 (src-tauri/Cargo.lock)
- Medium vulnerability: [GHSA redacted] (src-tauri/Cargo.lock)
- …and 37 more

## Changes since last survey

- 12 commits — 4 feature/other, 8 fixes

## By area

- src-tauri/src — 8 commits
- (repo) — 2 commits
- (root) — 2 commits

## Notable commits

- fix: Merge pull request #534 from zydo/fix/533-codex-oauth-usage-query
- fix: Merge pull request #535 from SaladDay/fix/532-codex-form-auth
- fix: fix(claude): align configuration editing with upstream (#536)
- fix: fix(codex): preserve provider authentication in forms
- fix: fix(database): align schema migrations through upstream v22 (#528)
- fix: fix(tui): add independent 1M toggle for Claude default model (#519)
- fix: fix(tui): align managed OAuth quota controls with upstream
- fix: fix(tui): clarify managed Codex OAuth quota refresh controls
- change: chore(release): prepare v5.11.2 and thank community contributors (#520)
- change: chore(release): prepare v5.11.3 and thank contributors (#529)
- change: feat(presets): add APIMart as second sponsor (#518)
- change: test(tui): load Codex preview through provider form

## Architecture

- Unchanged — 0 containers · 1 contexts · 0 edges