Weekly development log 2026-W34: From the phone screen to the CLI on your own machine · partial week

01

What changed

Thirty-seven commits shipped three releases this week — 1.26.0, 1.27.0, and 1.28.0. Answer rendering was rebuilt for phone screens and Kakao map blocks became native cards, while OpenMake Code opened a path for running tools on the user's own machine instead of the server sandbox. In parallel, quietly leaking boundaries — skill injection, SSRF, API key scopes — were tightened and unused code and the GitHub integration were removed.

• OpenMake Code: a local CLI agent task that runs tools on the user's machine instead of the server sandbox. A bridge folder-selection protocol followed, letting the web pick the working folder without restarting the CLI, with the selected folder recorded in the readiness log, Desktop 1.9.0, and a CLI README.
• Mobile answer rendering was reworked: tables are structured as phone-sized cards, format hints and collapsible sections were added for long answers, and truncated image responses, markdown block formatting, pipe-less tables, and exposed artifact placeholders were fixed.
• Kakao map blocks now render as native map cards, moved to Kakao tiles served through a server embed with a MapKit fallback, and the embed that returned 404 on the external path was relocated to /api/embed.
• Input handling for attachments and compatible clients was reworked: PDF attachments now use a vision hybrid that injects the leading pages as images, bounded by a resolution ceiling; an OpenAI-compatible client's system message is merged into the leading system prompt instead of being dropped; and a model fallback label that did not match the actual behaviour was corrected.
• Defaults that failed runs for no good reason were corrected: agent-task max_turns moved from 10 to 32 so a default run no longer dies on the turn ceiling, the per-user MCP tool exposure cap moved from 12 to 20 with budget as the real guard, and skills declaring triggers are now injected only on relevant turns instead of every turn.
• Boundaries and observability were strengthened: a least-privilege host:port form was added to the SSRF allowlist, API key bridge/chat scopes were hardened, the unrecorded MCP instance pid that left health checks unable to detect dead processes is now written, and four agent-task workflow observability metrics reached the admin surface. A retention sweep now reclaims the uploaded originals of agent tasks once they are N days past completion.
• The product surface was cleaned up: the brand mark was redrawn in SVG and the favicon, logo, and iOS/PWA icons replaced; backend features left without any UI were wired up and a broken input path in the self-improvement loop was fixed; five unreferenced sources, six unused dependencies, and the agent-task GitHub integration (clone→PR) were removed. On the web, history cards were rearranged, the repository UI is hidden when work runs locally and has nothing to point at, and builds restart automatically.

02

How this week was reconstructed

No matching local Claude Code project transcript was recovered for this period. This entry therefore describes only what the Git history can prove.

We audited the available Claude Code main sessions, their proven child lineages, and the repository history. Session notes explain intent and investigation; Git remains the authority for code that actually landed.

The final week is still in progress. Counts and claims stop at the audit cutoff of August 21, 2026.

03

Team identity and project roles

OpenMake Team is the community identity; openmake_llm is the software project; OpenMake is the product name. Non-developer maker riskpw leads openmake_llm through vibe coding, and professional developer rocky supports its development.