What the team
has shipped.
Every version, documented. What changed, why it changed, and what comes next.
Every version, documented. What changed, why it changed, and what comes next.
Current build: v5.4.91 — July 31, 2026
v5.4.63 is the biggest drop of the v5.4.34 series — the team now schedules real meetings (calendar invite in the inbox, Accept/Decline that work), places the call itself at the scheduled time, sends the recap, and follows up on every commitment by text and email until it's done. Dynamic Souls gives the team durable memory across phone calls, and a rebuilt live-call pipeline streams context to the team mid-conversation. See the full version history below.
Highlights from the v5.4.34 release series
settings.json. Existing keys are migrated automatically.Authorization: Bearer … header instead of the request body. Excluded from generic request-body logging, error-tracker payloads, and HTTP proxy debug captures.loam.team as the address to download and install from — the same signed installer, the same published hash. The network guidance for IT now lists both loam.team and docpro.cloud, because existing installs still talk to the original address and nothing about them needs to change.loam.team was never added when the product took its new name, so entering the address the product itself advertises got every update refused. The list now includes loam.team — the guard itself is unchanged..docpro/surface.json — and if that file was committed into the repository, the address in it came from the repository rather than from you. Loam now uses only a declaration you wrote on this machine, and says so plainly when it skips one, with the two commands that make it yours again. A repo you cloned can no longer put its own website on your review schedule..docpro/surface.json naming where that site is published. From then on she reviews the live pages herself, on her own schedule. If she finds something worth your time she calls; if she doesn’t, she stays quiet, which is most of the time and entirely the point..claude/settings.json pointing at its own copy of the auto-log script — and never removed the entries that prior versions had added at paths that no longer exist on disk. Those orphaned entries failed with Cannot find module on every Claude Code response, and surviving duplicates caused the same conversation turn to be saved to the server twice. The extension now prunes any stale or legacy auto-log entry before adding its own, so the list stays at one current entry no matter how many times the extension is upgraded.~/.claude/projects/**/*.jsonl files older than 1 day on activation. Off by default. Backed by docpro.cleanupClaudeTranscripts.docpro.installPlaywrightMcp.Admin → Templates without a redeploy.Admin → Templates.Admin → Templates. Edit the prompt directly in the web admin without a redeploy.auto-log.mjs and have the extension execute it.bypassPermissions is written, instead of taking effect silently from the dropdown.execFile with an argv array instead of child_process.exec, removing the shell-injection surface.install-docpro.ps1 checks API keys against dp_[A-Za-z0-9_-]+ before passing them through PowerShell strings, blocking quote-injection during setup.REMOTE_MCP_ALLOWED_ORIGINS, per-token rate limit (60 requests / 60 seconds), and a 5 MB request-body cap.~/.claude/settings.json. It's now additive: it appends Loam's hook entry to whatever you already have.Authorization: Bearer … header instead of (just) the request body. Header values are excluded from generic request-body logging, error-tracker payloads, and HTTP proxy debug captures by convention, so credentials no longer ride along in places they shouldn't be. Older plugin builds remain compatible — the backend still accepts body-field keys during the rollout window.anthropic.docpro.cloud redirects to the canonical apex; it's no longer in the invitation-origin allowlist.application/octet-stream instead of image/svg+xml so the browser never executes script inside an attachment named like an image.PUBLIC_URL environment variable; hardcoded subdomain fallbacks removed..env, *.pem, id_rsa*, *.key, and files containing credentials are now excluded from the session-start workspace bundle and from "Read this folder."docpro.apiUrl at a plaintext http:// host (other than localhost) is now rejected before any request fires, instead of silently sending API keys in the clear.~/.claude/projects/**/*.jsonl files older than a day on activation. Set docpro.cleanupClaudeTranscripts to true to enable.passlib dependency dropped from the lockfile.settings.json. Existing keys are migrated on the first sidebar load.docpro.installPlaywrightMcp to true in settings to enable it.docpro.cloud. Older host names continue to work and redirect.docpro.cloud.docpro.docpro-app.