Skip to main content
Working with an agent? Give them a link to this page as markdown.

Automatically review high-risk coding-agent sessions

Watcher adds automatic follow-up reviews for high-risk sessions and organization-level controls for grading usage. The release also expands session search and makes the self-host deployment bundle publicly available.

What's new?​

  • High-risk sessions now receive an automated, in-depth security review after they finish. Real-time monitoring continues to review tool calls while the agent works.
  • Organizations can have monthly grading limits. Analyzer shows usage against the limit, and Watcher Live reports when the limit prevents grading.
  • Session search also matches the owner's name. Analyzer displays the deployment version and the signed-in user's organization role, and exposes monitor IDs for copying.
  • Summaries of continuously active sessions refresh at least once every 24 hours. Grading requests that save results finish and store their results even if the caller disconnects.
  • Watcher Live no longer includes an embedded terminal. Sessions started in an external terminal are still discovered and monitored, and existing settings files still load.
  • The self-host deployment bundle is available on the public release channels with checksums, alongside the client and Python SDK.

Required upgrade steps​

Self-hosted WorkOS deployments: check the Analyzer origin​

This release documents a configuration requirement for the Analyzer Members page in self-hosted deployments using WorkOS single sign-on. Watcher Cloud users and deployments using proxy authentication do not need this step.

  1. Confirm that the deployment's Analyzer origin, for example https://watcher.example.com, is registered in the WorkOS environment's allowed CORS origins. This is separate from the Watcher API's CORS setting.
  2. If it is missing, have the administrator of that WorkOS environment add it under Authentication, Sessions. Do not change provider credentials.
  3. Sign in and open Organization, Members. Confirm that the members load. A working sign-in alone does not verify this setting. CORS errors for api.workos.com/_widgets/ in the browser console identify this failure.

Use Update Watcher for the normal upgrade procedure and check every later release you cross.

Found an issue with this page? Report it on GitHub.