Quieter, more useful telemetry

A small follow-up to v0.2.3, driven by its first day in the wild. No user-facing behaviour changes.

Changed

• A laptop sleeping is no longer reported as an app error. When the network drops mid-poll (sleep/wake, a Wi‑Fi handoff, a VPN flap), OpenTrade now records a single broker_offline event when the outage begins and a single broker_online (with how long it lasted and how many polls it cost) when it ends — instead of one app_error per failed poll. Genuine failures still report as app_error, so that signal stays meaningful.
• Network errors now carry their real code. Node's fetch reports connection problems as a bare TypeError; the actual cause (ENOTFOUND, ECONNRESET, UND_ERR_CONNECT_TIMEOUT, …) is now captured — still just a bounded machine code, never a message or path.
• Connect attempts are counted (broker_connect_started, interactive vs. silent), so a Robinhood connection that never completes can be distinguished from one that was never tried.
• A browser that fails to open for the Robinhood consent is now reported, rather than being indistinguishable from a consent the user abandoned.

Upgrade notes

No schema or data migration. Existing installs keep their Robinhood session.

Full Changelog: v0.2.3...v0.2.4

Robinhood connection: no more stuck "Connecting…"

This release fixes a class of Robinhood connect failures seen during onboarding, and adds a way out when a consent flow is abandoned.

Fixed

• Connect could hang forever after closing the Robinhood tab. The OAuth consent waited on a fixed local port with no timeout and no way to cancel; a closed browser tab left the daemon spinning on "connecting" for the life of the process, and every later Connect failed with EADDRINUSE. The loopback now binds an ephemeral port per consent (RFC 8252 §7.3), only proceeds once it is actually listening, and times out after 10 minutes.
• A second Connect click no longer collides with a pending one — it supersedes it: the abandoned attempt is cancelled and a fresh consent starts, whether the click comes from Onboarding, Settings, or the Portfolio panel.
• Silent reconnect at launch never opens a browser unprompted, and no longer drops still-valid tokens when a token refresh fails for a transient reason (network / 5xx). You re-consent explicitly via Connect.
• Bare Error listener failures during connect no longer surface as unhandled rejections.

Added

• Cancel / Disconnect. While a consent is waiting on the browser, all three Connect surfaces show "Waiting for Robinhood…" with a Cancel button (including Onboarding, where Settings isn't reachable). Settings → Market data gets a Disconnect button when connected — also how to switch Robinhood accounts.

Telemetry

• app_error and broker_connect_failed now carry a bounded error_code (e.g. EADDRINUSE, OAUTH_ACCESS_DENIED) — the machine code only, never a message or path — so async Node system errors, whose stacks have no app frames, are diagnosable.

Upgrade notes

No schema or data migration. Existing installs keep their Robinhood session and refresh silently as before.

Full Changelog: v0.2.2...v0.2.3

Features

• macOS notifications — native alerts for scheduled runs, order fills/rejections, approvals needed, agents paused (turn limit), and app updates; per-kind toggles + per-agent mute in Settings → Notifications.
• Background turn limit — cap how many unattended background turns an agent runs before pausing (default 20), with an agent-view turn button (reset / per-agent on-off) and global controls in Settings → Agents, including a per-run max run-time.
• Use your Claude subscription for background runs — scheduled (headless) runs no longer silently bill your ANTHROPIC_API_KEY by default; toggle in Settings → Agents.
• Production database migrations — existing databases now survive updates via versioned schema migrations.
• Conversation-retention notice — Settings warns when Claude Code's cleanupPeriodDays is low enough that agents could lose memory, with a one-click fix.

Fixes

• Robinhood re-authentication — an expired grant no longer leaves the Connect button permanently failing; boot auto-connect never opens a browser unprompted (re-consent is explicit).
• Broken / failing agents — an unresumable agent now pauses its schedules instead of firing (and notifying) every tick; the failure reason (billing / auth / network) is logged; paused agents stop firing timers and monitors entirely.
• Host stability — the backend host is no longer killed when an update finishes downloading (fixes the "OpenTrade connecting…" hang).