Small changes. Better testing.

Stopping an OpenHTF run from the operator UI, the terminal or a signal used to kill the test outright: no plug tearDown, no PhaseGroup teardown phase, and nothing uploaded.

• Added a clean stop for OpenHTF runs, the way OpenHTF stops on its own Ctrl-C: the running phase is interrupted, the PhaseGroup teardown phases and the plugs' tearDown run, and the run is uploaded as ABORTED with the phases that completed
• Added a Kill that matches OpenHTF's second Ctrl-C: the teardown phase under way is abandoned, the plugs are still released and the run is still uploaded, with a forced kill only when the process has not exited seven seconds later
• Fixed stopped runs being reported as FAIL on both frameworks: they now report ABORTED and exit with code 130, and a run the procedure stops itself exits with code 3
• Added the ui_cancelled event for agents when an open prompt is withdrawn with its interrupted phase

A phase can now change what an operator-screen component offers, not only its value, so choices and input rules that only exist at run time no longer need one procedure per case.

• Added ui.set(key, ...) to change a component's options, label, placeholder, affixes, numeric bounds, text length and pattern while its screen is open. The operator's entry is checked against what the phase sent.
• Added a "Waiting for options" state: a choice declared without options now loads, fills when the phase sends the list, and never pre-selects an entry.
• Improved the agent protocol with a ui_update event and the same entry validation as the kiosk, including pre-baked values.

The Studio plug debugger cut every result at one line and failed with a raw traceback on some return values.

• Added an expandable result under each method: a result too long for its cell opens in full, with a copy button, and a failed call opens its whole error the same way.
• Added image previews: a method returning a PNG, JPEG, GIF or BMP image as base64 text now shows the picture, named with its format and size, in the debugger, the call log and the assistant's chat.
• Improved the error for a return value a phase cannot receive (bytes, a datetime, a numpy number): the debugger and the test run now both say the method ran, which type is the problem and how to convert it, for example x.item() for a numpy number or base64.b64encode(data).decode() for bytes.

Preventive security maintenance. We patched the 2 advisories published on 6 October against dependencies TofuPilot ships, both rated high upstream. We found no way to trigger either flaw through TofuPilot.

• CVE-2026-96889, a memory flaw in the SVG decoder bundled with our image processing library, which could lead to remote code execution on Linux. TofuPilot never decodes SVG files from untrusted sources.
• GHSA-6qxp-vccf-f47h, CVSS 7.5, a flaw in the OAuth client of the Model Context Protocol SDK that could send credentials to an authorization server chosen by the remote server. TofuPilot only uses the server side of this SDK.

TofuPilot Cloud requires no action. Self-hosted instances do not need an urgent update either: the fixes come with your next regular image pull. Taking it also stops vulnerability scanners on your side from reporting these versions.

Test reports in OpenHTF format that were generated by your own tooling rather than by OpenHTF itself could be rejected on upload, and the run was lost.

• Fixed the importer crashing on reports with no log_records or code_info: they now import with no logs and no docstring instead of failing
• Fixed the importer crashing on phases that declare no measurements
• Added a regression test for reports with these sections omitted

A run could pass even when some declared checks never ran. A measurement, Y axis or aggregation declared in procedure.yaml but never recorded by the phase disappeared from the run, failed with no clear reason, or was stored as 0.

• Fixed measurement outcomes. A multi-dimensional measurement now shows PASS or FAIL from its axis and aggregation limits instead of always UNSET. A measurement with no limits stays UNSET.
• Fixed declared measurements, axes and aggregations that a phase never records. They are now kept in the run, empty and in YAML order, with a clear message. If they have limits, they FAIL and the phase fails.
• Fixed axis descriptions from procedure.yaml, which were not uploaded with the run.
• Fixed series with all values at zero, which were dropped on upload. Multi-dimensional measurements with no data are now stored as empty measurements.
• Fixed limit edits in Studio, which could change booleans and numbers into text.
• Updated the API description of measurement outcomes and released new SDK versions.

With two organizations open in two browser tabs, the tab opened first could read the other organization's data after loading: the Link repository dialog on a procedure then listed no repositories, and the assistant and live updates could follow the other organization.

• Fixed every page under an organization to act on that organization, whatever another tab has opened since, including the Link repository dialog, the assistant chats and live updates.
• Fixed the import page for an existing procedure: it now keeps the procedure's root directory instead of preselecting the first directory found in a monorepo, and the repository root can be picked.
• Improved the Link repository dialog to show a loading state instead of "No repositories are granted" while the list loads.

Members without the Admin or Owner role could open an integration, fill in a token, and only then be refused with a message that read like a GitLab or GitHub permission problem.

• Improved the GitHub, GitLab, Bitbucket, Odoo, InvenTree and Linear settings: for Developers and Viewers, the connect, change and remove actions are now disabled up front, with the names of the Admins and Owners to ask.
• Fixed the GitHub buttons outside Settings (new procedure, template cloning, a procedure's Repository tab): members who cannot install the GitHub App now go to the GitHub settings page instead of starting an install that was refused at the end.
• Updated the refusal message to name your TofuPilot role, and rewrote the access roles page with one permission table per area.

Measurement Control could time out on procedures with very high run volume.

• Improved the main chart, the failure bars and the Exclude retries option. They now load in a few seconds where they used to time out.
• Improved the measurement table for a selected measurement, from about 12 seconds to under one second.
• Updated GET /v2/measurements: started_after and started_before now always filter on when the measurement was taken, not on when its run started.

Uninstalling the GitHub App from GitHub left the dashboard showing the account as connected, with a Manage button pointing at a page that no longer existed and no way to install the App again.

• Fixed the GitHub settings page so an App uninstalled from GitHub reads as not installed and the Install button comes back. A suspended App stays visible with a Suspended badge and a pointer to the GitHub App settings, and Manage now opens the right page for organization installs.
• Added a warning on the Repository section of a procedure when the provider of the linked repository is suspended, has lost its token or was disconnected. The repository and its Unlink button stay visible so you can always move on.
• Improved how a missed GitHub notification is caught up: the dashboard re-checks the installation with GitHub when you open the GitHub settings page, and records a suspended or removed App the moment a repository listing fails because of it.