Clew v0.9.1

Clew v0.9.1

Fixes a tree-building bug that could occasionally surface on autostart, leaving the live-process count out of sync with the process tree.

Fixes

• The process tree no longer drifts on long runs. The ETW process-event decoder was reading kernel events at fixed byte offsets, which could mis-align against the actual event schema and leave orphaned, unreachable nodes in the tree. It now decodes fields by name (via TDH), and the startup process snapshot comes from ETW's own rundown instead of NtQuerySystemInformation — so the tree stays consistent for as long as the app runs.

Network Activity panel

• The "all processes" view now hides PID 0 (Idle) and PID 4 (System). Select the process in the tree if you want to inspect them.
• Tuned the default column widths.

Internal / build

• clew.log is now opened in append mode.
• The vcpkg toolchain path is no longer hard-coded — cmake --preset windows-vcpkg now works for anyone with vcpkg set up the standard way. Also added an optional clangd / LSP preset.
• README: added a ccusage example for command-line keyword matching.

Note

The process list is briefly empty right after startup — Clew now enumerates existing processes via ETW's EVENT_CONTROL_CODE_CAPTURE_STATE, and that batch of events takes a moment to arrive from the kernel; the list fills in once they do. After that it stays consistent. Improvement planned.

Install

Download clew-v0.9.1-windows-x64.zip, extract, and run clew.exe (it'll prompt for admin — WinDivert requires it).

Clew v0.9.0

Changes since v0.8.9:

• chore: gitignore debug_pics/ scratch folder
• fix: WebView2 COM init + tray icon resilience for autostart launches
• ui: ProcessTree search keeps full subtree of matches + amber highlight
• ui: ProcessTree dual-channel encoding + last-child connector fix
• docs: backfill v0.9.0 architecture + archive PHASE0 plan
• ui: Log Level dropdown + publish TROUBLESHOOTING
• v0.9.0 prep: --config + exe-dir paths, autostart, log-scan e2e
• ui: collapse hack/unhack to tree-only; pin auto-rule hack_tree
• docs: backfill v0.8.9 architecture notes

Full diff: v0.8.9...v0.9.0

Clew v0.8.9

Changes since v0.8.8:

• v0.8.9 prep: visibility gate + projection coalesce switch + stress harness

Full diff: v0.8.8...v0.8.9

Clew v0.8.8

Changes since v0.8.1:

• v0.8.8 prep: cpp-httplib DELETE 5s fix + Playwright Phase 1 e2e + post-SSE cleanup
• transport: replace SSE with WebView2 PostMessage + coalesce + ETW diag
• sse: kill double-fire + add diagnostic logs + cleanup

Full diff: v0.8.1...v0.8.8

Clew v0.8.1

Changes since v0.8.0:

• webview: disable default context menu

Full diff: v0.8.0...v0.8.1

Clew v0.8.0

Changes since v0.7.9:

• gitignore: add dup.json + clew_refactor/ + refactor/ archives
• rule_engine: string_view migration for wildcard_match / cmdline_match
• docs: refresh ARCHITECTURE + README for post-refactor state
• sonar dup + DNS coverage: shared json helper, T21 DNS roundtrip
• sonar batch 5: shell_service dead member, init-list cleanup, startup_error
• sonar batch 4: extract clew::app, fix remaining warnings
• sonar batch 3: drop API token auth + dead code, refactor hot paths

Full diff: v0.7.9...v0.8.0

Clew v0.7.3

Changes since v0.7.2:

• Prepare v0.7.3: README overhaul, license hygiene, stale UI cleanup
• docs(readme): drop misleading *.exe example from process name patterns
• docs(readme): split command-line matching into its own bullet

Full diff: v0.7.2...v0.7.3

Clew v0.7.2

Changes since v0.7.1:

• fix(scripts): resolve npm/gh etc via shutil.which for Windows .cmd shims
• chore(scripts): ascii-only in release.py final message
• chore(scripts): replace UTF-8 checkmark with ASCII [OK]
• chore(scripts): add Python release cutter
• feat(build): derive version from git describe at CMake configure time

Full diff: v0.7.1...v0.7.2

Clew v0.7.1

Fixes on top of v0.7.0.

What's fixed

• Bundle completeness: brotlicommon.dll / brotlidec.dll / brotlienc.dll are now included (cpp-httplib runtime deps — v0.7.0 zip was missing brotlidec.dll so the exe refused to launch on a clean machine)
• Window / taskbar / tray icon: actually loads the embedded Clew mark instead of the default Windows icon (resource ID was being skipped by Explorer's default-icon lookup)
• Title bar brand: was showing a Lucide Shield + "Clew v2"; now shows the Clew thread-and-needle mark + "Clew v0.7.0" version label
• README: added a section explaining how to enable optional auth.enabled / auth.token in clew.json

Download

clew-v0.7.1-windows-x64.zip contains:

• clew.exe (admin-elevated on launch)
• WinDivert.dll, WinDivert64.sys
• brotlicommon.dll, brotlidec.dll, brotlienc.dll
• frontend/dist/ (the UI)
• LICENSE, README.md, README.en.md

Requirements

• Windows 10 (version 2004+) / Windows 11
• Administrator privileges (UAC prompt fires automatically on launch)
• VS 2022 C++ runtime (download) if not already installed
• WebView2 Runtime (bundled with Windows 11; download for Win10)

Clew v0.7.0

First public release.

Download

clew-v0.7.0-windows-x64.zip contains:

• clew.exe (administrator-elevated on launch)
• WinDivert.dll, WinDivert64.sys
• frontend/dist/ (the UI)
• LICENSE, README.md, README.en.md

Requirements

• Windows 10 (version 2004+) / Windows 11
• Administrator privileges (UAC prompt fires automatically on launch)
• WebView2 Runtime (bundled with Windows 11; download for Win10)

Usage

Unzip, double-click clew.exe, approve the UAC prompt. See README for configuration.