amrmelsayed · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
diff --git a/apps/streamdeck/com.cluesmith.codev.sdPlugin/manifest.json b/apps/streamdeck/com.cluesmith.codev.sdPlugin/manifest.json
@@ -1,7 +1,7 @@
 {
   "UUID": "com.cluesmith.codev",
   "Name": "Codev",
-  "Version": "3.3.6.0",
+  "Version": "3.3.7.0",
   "Author": "Cluesmith",
   "Category": "Codev",
   "CategoryIcon": "icons/category",

diff --git a/apps/streamdeck/package.json b/apps/streamdeck/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev-streamdeck",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "private": true,
   "description": "Codev Stream Deck plugin — a controller that drives Codev via Tower's command relay + overview API.",
   "type": "module",

diff --git a/apps/vscode/package.json b/apps/vscode/package.json
@@ -3,7 +3,7 @@
   "publisher": "cluesmith",
   "displayName": "Codev for VS Code",
   "description": "Codev helps humans and agents co-develop both the context and the code of the project.",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "license": "Apache-2.0",
   "icon": "icons/codev.png",
   "pricing": "Free",

diff --git a/docs/releases/v3.3.7-luxor.md b/docs/releases/v3.3.7-luxor.md
@@ -0,0 +1,32 @@
+# v3.3.7 Luxor
+
+Released: 2026-11-03
+
+## Summary
+
+A single, focused patch on top of 3.3.6: the Codev IDE can now be opened from Tower's local dashboard. Until now a browser on the same machine was refused at Tower's `/ide/` route and the IDE was reachable only through Codev Cloud or a hand-built URL. Each workspace card now leads with an IDE row whose Open IDE action opens the workbench for that folder through Tower, with the IDE server's connection token kept out of the browser and rotated on every start. The change was designed and reviewed with a dedicated security pass; the trust notes in the `afx ide` reference describe what the new session cookie is and where it should not be used.
+
+## Open the IDE from the local dashboard (#1869, PR #1872)
+
+Each workspace card on Tower's home page now leads with an IDE row whose Open IDE action opens the Codev IDE workbench for that folder in a new tab, through Tower on port 4100, with no cloud session and no hand-built URL. Behind it, Tower accepts an origin-guarded session cookie for the `/ide/` prefix, routes the workbench and its WebSockets through itself, keeps the IDE server's connection token out of the browser's cookie jar, and rotates that token on every IDE server start. The trust notes in the `afx ide` reference describe the cookie and why the Open IDE path is for single-user machines.
+
+What the live review added: the workbench's own WebSockets are routed through Tower rather than straight to the IDE server, the IDE server's connection-token cookie is stripped from forwarded responses and the token is supplied to the workbench page instead, and the token is regenerated on every IDE server start. Any cross-origin header the IDE server sends that would allow credentialed reads is dropped on the way through.
+
+## Breaking changes
+
+None.
+
+## Upgrade
+
+```bash
+npm install -g @cluesmith/codev@3.3.7
+afx tower stop && afx tower start
+afx ide stop && afx ide start
+```
+
+The VS Code extension is unchanged in this release. The Marketplace listing stays at 3.3.6; the sidebar embedded in the npm package is rebuilt from this release.
+
+## Contributors
+
+- **Amr Elsayed (@amrmohamed)** — owner: scoped the local IDE access work, ruled on the security residuals, exercised the dev-approval pass live.
+- Builders working under the PIR protocol on PR #1872, with a dedicated security-architect review of the plan and the implementation.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cluesmith-codev",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "private": true,
   "packageManager": "pnpm@10.33.0",
   "scripts": {

diff --git a/packages/artifact-canvas/package.json b/packages/artifact-canvas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev-artifact-canvas",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Reusable React surface for rendering and reviewing Codev markdown artifacts (specs/plans/reviews) across VSCode, the dashboard, and future mobile hosts.",
   "type": "module",
   "exports": {

diff --git a/packages/codev/package.json b/packages/codev/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Codev CLI - AI-assisted software development framework",
   "type": "module",
   "bin": {

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev-core",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Server-side runtime for Codev — local-key issuance and homedir-derived paths. Client-side Tower access lives in @cluesmith/codev-sdk; the two packages never import each other.",
   "type": "module",
   "exports": {

diff --git a/packages/sdk/package.json b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev-sdk",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Client SDK for Tower: the single implementation of how anything talks to Tower. Environment-agnostic (browser, Node, React Native); auth and transport arrive as injected adapters.",
   "type": "module",
   "exports": {

diff --git a/packages/types/package.json b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cluesmith/codev-types",
-  "version": "3.3.6",
+  "version": "3.3.7",
   "description": "Shared TypeScript types for Codev — WebSocket protocol, API shapes, SSE events",
   "type": "module",
   "exports": {