Stable downloads: https://download.cmtraceopen.com/?source=github-release CMTrace Open v1.5.0 Open-source CMTrace log viewer with built-in Intune diagnostics. What's New Added

• ESP Diagnostics workspace: Added a dedicated, full-width, no-sidebar workspace for troubleshooting Windows Autopilot Enrollment Status Page, Autopilot Device Preparation, and software deployment failures. It combines scenario/phase progress, actionable evidence-backed findings, workload state, enrollment/profile/registry/event evidence, Delivery Optimization, coverage gaps, and a live What MSIEXEC is doing now sampler on one page. Live Windows sessions continue collecting while the log surface is collapsed or another workspace is active; captured CMTrace Open evidence folders, manifests, CABs, and ZIPs are also supported. Features include failure detection (InstallationState / ErrorHresult from Sidecar registry), live current-task hero showing what's installing now with progress, session capture/replay (export live/failed sessions as JSON for offline analysis), workloads search/filter (name, ID, status) plus Failed / Running / Installed / Queued category chips, section jump navigation (sticky bar with per-section jump pills and return-to-top), and timeline GUID→name resolution (Intune app names in event stream). Read-only throughout except one opt-in, backed-up remediation action: on Windows with elevation, a Force past ESP button backs up the failing app's registry key, sets InstallationState=3, clears ErrorHresult, and offers one-click restore—allowing a Try again to proceed when ESP is blocked by a false negative.
• Bounded live deployment evidence: Added curated IME, ConfigMgr, Patch My PC, PSAppDeployToolkit, installer, and shallow high-signal temporary-log discovery with rotation/truncation handling and explicit retention limits. The live-log surface is collapsed by default, vertically resizable when docked, expandable to the full workspace, and available from a prominent Open live logs app-chrome action. No deep-scan or full-drive route is provided.
• Optional ESP Microsoft Graph enrichment: When the existing Graph option is enabled and its WAM connection is already authenticated, the workspace can add managed-device, Autopilot profile/event, ESP configuration, app, policy, certificate, platform-script, and remediation context while preserving raw local IDs. Per-section permission, offline, throttled, skipped, beta, partial, cancelled, and ambiguous-device states remain visible; connecting never queues work or opens a second sign-in flow. The managed-device correlation now captures the device's Entra device ID via NetGetAadJoinInformation (the same source Windows dsregcmd uses), so device matching resolves reliably and Graph sections enrich even on re-imaged VMs where serial-number fallback would fail.
• User-triggered Graph permission upgrade: Settings now offers Request missing permissions for an authenticated partial WAM connection. One explicit click re-requests the fixed five delegated read permissions; successful candidates can add capabilities without removing working ones. Unchanged, cancelled, denied, or failed outcomes retain the existing in-memory partial connection, while a stale outcome leaves the newer authoritative authentication state untouched. Startup and ESP refresh never initiate the upgrade, and tokens remain excluded from IPC and logs.
• Window state persistence (#260, closes #253): The app now restores its window size, position, and maximized state across launches via the official Tauri window-state plugin, so a resized, moved, or maximized window comes back the way you left it. The configured 1200×800 geometry remains the first-launch default. Changed
• Administrator coverage guidance and retained sessions: ESP Diagnostics now checks elevation on workspace entry, recommends administrator access before collection when needed, and offers an explicit administrator restart on supported Windows builds. Non-elevated sessions remain usable but identify the protected registry, event-log, process-command-line, SYSTEM-temp, and user-temp evidence that could not be read. Every device and user enrollment session remains available through latest, all-session, and individual-session views.
• Redesigned native application menu: Reworked and synchronized the native application menu — a centralized action layer behind the menu items, synchronized menu state, and platform-consistent accelerators. Window items (Toggle Details/Info panes, Always on Top) now live under a View submenu, with Always on Top preserved as a checkable item that reflects and persists the window's pinned state.
• Rust MSRV raised to 1.88 (#289): The minimum supported Rust toolchain moved from 1.77.2 → 1.88, required by the sha2 0.11 and serde_with/darling 0.23 upgrades in this release. The sha256 hex formatting was reworked to be sha2 0.11-ready ahead of the crate bump, and CI's MSRV gate now validates against 1.88. Fixed
• Failure detection and phase propagation: The reducer now reads the authoritative per-app Sidecar registry (InstallationState / ErrorHresult) instead of the mid-state OMA-DM diagnostics value, so failed apps now correctly report as Failed with their error code (e.g. 0x80079C69), and the session phase reflects Failed when any tracked app fails. Previously, a failed app could remain stuck showing inProgress.
• Graph app enrichment (referencedAppIds): The frontend was silently dropping app GUIDs from Graph requests by matching against a bare GUID with an anchored regex, but real Win32 workload identifiers are decorated (Win32App__1). Now GUIDs are extracted from the decorated identifier, so the request carries the full list of apps to Graph and the Applications section enriches instead of skipping.
• Capture/replay validation (FILETIME QWORDs): Session captures (40+ MB on real devices) were failing to load because registry FILETIME values are ~1.34e17, above JavaScript's safe-integer limit. The wire validator now accepts any integer-valued number for display-only registry values while keeping strict safe-integer validation for structural counts. Both real captures now round-trip cleanly.
• Import button routing: "Import captured evidence" now routes a session JSON to the replay loader (not the bundle analyzer), so either import button works for session files.
• Decorated GUID handling across the UI: Timeline entries, findings, and the workload table now uniformly extract GUIDs from decorated identifiers and resolve them to app names via the shared name map, so workload identifiers like Win32App__1 render as "Citrix Workspace" or "Windows Autopatch Client Broker" instead of raw GUIDs across every surface.
• Message column sizing on open (#292, closes #254): Opening a log almost always produced a horizontal scrollbar, because the Log Text column auto-expanded to the widest line in the file, capped only by a 1200px bound unrelated to how much room the window actually had. The measured width is now clamped to the space genuinely left over — container width minus the other visible columns and the row-marker gutter, floored at the column's own minWidth — so a freshly opened file fits the window. Explicit Fit this column (double-click) and drag-resize still widen past the viewport: once a width is user-owned, the auto-sizer leaves it alone. Security
• Read-only analysis with one backed-up write action: ESP Diagnostics performs registry queries, event/process observation, bounded file reads/tailing, archive inspection, and read-only Graph GETs (including bounded $batch POSTs whose subrequests are GET-only). Analysis findings and UI surfaces remain fully read-only. One explicit opt-in exception exists: the Actions section (Windows-only, local non-replayed sessions, elevation-required) offers Force past ESP on a failed app — it backs up the Sidecar key values, sets InstallationState=3, and clears ErrorHresult so ESP stops blocking, after which a Try again can proceed; a one-click Restore reverts the backup. The button requires explicit confirmation stating it writes to the device, does not install the app, and requires administrator access. It does not sync MDM, retry/install software, control services, import registry files, or mutate Intune. Graph uses the existing memory-only WAM token path and five delegated read scopes; authorization headers and raw response bodies are not logged.
• ESP evidence privacy and archive limits: Sensitive identity/NodeCache fields are classified and masked by default, installer command lines are sanitized before IPC/logging, raw hardware hashes are excluded from normal surfaces, and CAB/ZIP inputs enforce entry, size, path, type, and extraction-root limits with cleanup.
• Close time and serde_with advisories (#290): Dropped the vendored time 0.3.36 backport and its [patch.crates-io] override; time now resolves from crates.io at 0.3.54, closing GHSA-r6v5-fh4h-64xc (stack-exhaustion DoS) — which the backport did not cover — and restoring cargo audit visibility that the path dependency had hidden. serde_with moves 3.17.0 → 3.21.0, closing GHSA-7gcf-g7xr-8hxj (KeyValueMap panic). Both patched releases required the Rust 1.88 MSRV from #289. The RFC 2822 nesting-bound regression test is retained and now guards the upstream crate instead of a local copy. Build & CI