Small changes. Better testing.

A phase can now change what an operator-screen component offers, not only its value, so choices and input rules that only exist at run time no longer need one procedure per case.

• Added ui.set(key, ...) to change a component's options, label, placeholder, affixes, numeric bounds, text length and pattern while its screen is open. The operator's entry is checked against what the phase sent.
• Added a "Waiting for options" state: a choice declared without options now loads, fills when the phase sends the list, and never pre-selects an entry.
• Improved the agent protocol with a ui_update event and the same entry validation as the kiosk, including pre-baked values.

The Studio plug debugger cut every result at one line and failed with a raw traceback on some return values.

• Added an expandable result under each method: a result too long for its cell opens in full, with a copy button, and a failed call opens its whole error the same way.
• Added image previews: a method returning a PNG, JPEG, GIF or BMP image as base64 text now shows the picture, named with its format and size, in the debugger, the call log and the assistant's chat.
• Improved the error for a return value a phase cannot receive (bytes, a datetime, a numpy number): the debugger and the test run now both say the method ran, which type is the problem and how to convert it, for example x.item() for a numpy number or base64.b64encode(data).decode() for bytes.

Preventive security maintenance. We patched the 2 advisories published on 6 October against dependencies TofuPilot ships, both rated high upstream. We found no way to trigger either flaw through TofuPilot.

• CVE-2026-96889, a memory flaw in the SVG decoder bundled with our image processing library, which could lead to remote code execution on Linux. TofuPilot never decodes SVG files from untrusted sources.
• GHSA-6qxp-vccf-f47h, CVSS 7.5, a flaw in the OAuth client of the Model Context Protocol SDK that could send credentials to an authorization server chosen by the remote server. TofuPilot only uses the server side of this SDK.

TofuPilot Cloud requires no action. Self-hosted instances do not need an urgent update either: the fixes come with your next regular image pull. Taking it also stops vulnerability scanners on your side from reporting these versions.

Test reports in OpenHTF format that were generated by your own tooling rather than by OpenHTF itself could be rejected on upload, and the run was lost.

• Fixed the importer crashing on reports with no log_records or code_info: they now import with no logs and no docstring instead of failing
• Fixed the importer crashing on phases that declare no measurements
• Added a regression test for reports with these sections omitted

A run could pass even when some declared checks never ran. A measurement, Y axis or aggregation declared in procedure.yaml but never recorded by the phase disappeared from the run, failed with no clear reason, or was stored as 0.

• Fixed measurement outcomes. A multi-dimensional measurement now shows PASS or FAIL from its axis and aggregation limits instead of always UNSET. A measurement with no limits stays UNSET.
• Fixed declared measurements, axes and aggregations that a phase never records. They are now kept in the run, empty and in YAML order, with a clear message. If they have limits, they FAIL and the phase fails.
• Fixed axis descriptions from procedure.yaml, which were not uploaded with the run.
• Fixed series with all values at zero, which were dropped on upload. Multi-dimensional measurements with no data are now stored as empty measurements.
• Fixed limit edits in Studio, which could change booleans and numbers into text.
• Updated the API description of measurement outcomes and released new SDK versions.

With two organizations open in two browser tabs, the tab opened first could read the other organization's data after loading: the Link repository dialog on a procedure then listed no repositories, and the assistant and live updates could follow the other organization.

• Fixed every page under an organization to act on that organization, whatever another tab has opened since, including the Link repository dialog, the assistant chats and live updates.
• Fixed the import page for an existing procedure: it now keeps the procedure's root directory instead of preselecting the first directory found in a monorepo, and the repository root can be picked.
• Improved the Link repository dialog to show a loading state instead of "No repositories are granted" while the list loads.

Members without the Admin or Owner role could open an integration, fill in a token, and only then be refused with a message that read like a GitLab or GitHub permission problem.

• Improved the GitHub, GitLab, Bitbucket, Odoo, InvenTree and Linear settings: for Developers and Viewers, the connect, change and remove actions are now disabled up front, with the names of the Admins and Owners to ask.
• Fixed the GitHub buttons outside Settings (new procedure, template cloning, a procedure's Repository tab): members who cannot install the GitHub App now go to the GitHub settings page instead of starting an install that was refused at the end.
• Updated the refusal message to name your TofuPilot role, and rewrote the access roles page with one permission table per area.

Measurement Control could time out on procedures with very high run volume.

• Improved the main chart, the failure bars and the Exclude retries option. They now load in a few seconds where they used to time out.
• Improved the measurement table for a selected measurement, from about 12 seconds to under one second.
• Updated GET /v2/measurements: started_after and started_before now always filter on when the measurement was taken, not on when its run started.

Uninstalling the GitHub App from GitHub left the dashboard showing the account as connected, with a Manage button pointing at a page that no longer existed and no way to install the App again.

• Fixed the GitHub settings page so an App uninstalled from GitHub reads as not installed and the Install button comes back. A suspended App stays visible with a Suspended badge and a pointer to the GitHub App settings, and Manage now opens the right page for organization installs.
• Added a warning on the Repository section of a procedure when the provider of the linked repository is suspended, has lost its token or was disconnected. The repository and its Unlink button stay visible so you can always move on.
• Improved how a missed GitHub notification is caught up: the dashboard re-checks the installation with GitHub when you open the GitHub settings page, and records a suspended or removed App the moment a repository listing fails because of it.

A Git push to a branch other than your production branch used to roll out to every station linked to the procedure, so work in progress could replace the code running on your line.

• Fixed branch pushes so they still build a preview deployment but no longer reach any station. Only pushes to the production branch roll out automatically.
• Kept the manual path: open a preview deployment in the dashboard and push it to the station you choose when you want to test a branch on real hardware.
• Fixed a deployment that could stay pending forever when its build could not be queued. It now shows as failed, and the other procedures fed by the same repository still get their build.
• Updated the Deployments and Environments docs to describe when a push is built, when it is skipped, and how previews reach a station.