Small changes. Better testing.

Developing a procedure is now a single tofupilot run from its folder, and moving a machine between station and development work no longer leaves it in a mixed state that opened the kiosk on a developer's computer.

• Added the current folder as the default for tofupilot run, and made the procedure ID optional on --deployment so it picks from the pulled deployments. Station scripts started outside a procedure folder keep running their deployment.
• Added automatic station removal when you log in as a user on a station, and the new tofupilot logout --station: the station service stops, queued runs upload under the station first, then its login, deployments and desktop icon are removed. Nothing changes while a run is still in progress.
• Improved the offline upload queue so each run only uploads with the kind of login that recorded it, so station runs never appear under a user.

Some plug calls in a phase only failed at run time, on the station, after the operator had started the test.

• Added tofupilot validate warnings for a plug method called with a keyword argument, an await on a plug call, and a property called like a method, each with the corrected call when one exists.
• Improved checks on plug classes defined under an if or a try: misspelled methods, unknown with: keys and misspelled class names are now reported there too.

The plug debugger in Studio now gives a plug the procedure's environment variables, secrets included, so a method could return a secret and show it in clear.

• Fixed secret values appearing in plug debugger results and errors: they are now masked, as they already are in tofupilot plug call output and plug logs.
• Added an end-to-end check that the procedure's env: reaches a debugged plug, with the plug's own env: taking precedence.

Deployments on self-hosted servers are now more robust.

• Fixed an issue that could prevent stations from installing new deployments on some self-hosted setups. After updating, deploy a new build to your stations.
• Improved the messages shown when a deployment cannot be installed.

A phase that reads units or batches from your workspace no longer fails when you run a procedure locally without uploading its results.

• Fixed phases and plugs that take dashboard failing on tofupilot run without --upload: they now act as your CLI login whether or not the run uploads.
• Added the same access to Studio runs, Studio plug debugging and tofupilot plug.
• Improved the error on a machine with no login: it now tells you to run tofupilot login instead of adding --upload.

We upgraded the libraries the dashboard, CLI and Rust SDK use to their latest versions for the newest security fixes. We also added extra protection to sign-in.

The public tofupilot/framework repository still held old Studio sources and releases, so it did not match the Framework you run today.

• Updated tofupilot/framework to the current Framework execution engine source, which builds standalone with cargo build.
• Removed the old Studio code, local templates and v1.x releases, and published release v2.0.0.
• Moved templates to tofupilot.com/templates, linked from the repository README.
• Fixed commit titles on the public Framework and CLI repositories, which now carry the change title instead of a description heading.

Writing and debugging a procedure no longer needs a full station run to find a typo, a wrong plug call or a flaky phase.

• Added tofupilot validate, which checks a procedure the way Studio and a run do, with error codes, fix hints and a watch mode that re-checks on every save. It catches misspelled phases and plug methods, missing imports and Python syntax errors in the files a phase imports.
• Added tofupilot plug to list a procedure's plugs, read their methods without opening the instrument, and call them during bench bring-up.
• Added troubleshooting flags to tofupilot run: run only some phases, skip or force a phase result, swap in a simulated instrument, and repeat a run until it fails or passes, with pass rate and measurement statistics.
• Improved stops: Ctrl-C and signals always run the teardown, a stop during start-up never lets the first phase run, and phases that a stop did not cut keep their result.
• Improved plugs and phases: async drivers keep their connection and background tasks between calls, measurements can be set and read by name in a loop, and timeouts below one second are kept.

Operator stations recover on their own after restarts, updates and network drops, and a scanner can no longer submit a prompt by accident.

• Fixed the station window reopening while the station was shutting down, and kept retrying the native window after a browser fallback instead of stopping after one try
• Fixed scanner input submitting a prompt while a field was still loading or right after tapping a choice
• Improved recovery after a CLI restart: fields that failed to load retry when the station reconnects, a field error stays in its own box instead of blanking the page, and the screen no longer reloads while the CLI is down
• Fixed the station serving files through links that point outside the image types it allows

Give a supplier or a customer a viewer seat without opening the rest of your production.

• Added access group scoping: a viewer in a group sees only its stations, their test data and the members of their groups, without email.
• Added Access for new members in Settings › Members, and a switch to turn off API and MCP access for a viewer.
• Changed roles: billing is for owners and admins, admins can edit organization settings, and buttons a role cannot use are hidden.