Releases
What shipped, and why it mattered · all builds on GitHubv1.27.0
LATEST 14 September 2026The release where xNAUT built itself. 199 commits since 1.26.3; the last five tickets were dispatched, built, verified and merged by the app on its own fleet host, with one owner click each.
Added
- A workspace per project. Click a project and you are in its code: the file tree, the file in the centre, every other surface (Work, Delivery, NAUT-Flow, Vault, Memory) as a tab beside it. Every file type opens colour-coded. "Start something new…" creates the ticket and, if you say so, the worktree.
- A sidebar that is a tree. Five icons and a More menu instead of twelve rows; projects with their worktrees as children; a Pinned block that keeps a project's worktrees; the name opens and folds.
- One Code View. Files and diffs render through one module everywhere, with green and red rows in diffs.
- The Work list, done properly. List by default, every header sorts (Priority and Status by rank), a filter that reads the columns (
status:review owner:claude release:1.28), a Type column that shows the type, a Release column. - NautBot offers the swarm. "Work on all open tickets for X" becomes a plan card, one yes, and every run goes through dispatch, the registry, the jury and the ledger. The Multi-Agent Manager pane is gone.
- NAUT-Flow personas are agent profiles, matched by role; a role nobody holds runs as NautBot and says so. The Agent roster page is gone.
- A Researcher who looks outside. A Perplexity-backed profile gives the Analyst and Architect stages a brief with numbered sources; they cite from it.
- The core team (off by default): Researcher, Reviewer, PoC, Judge, a loop that reads other people's code, files findings, builds a proof of concept under a budget and writes a verdict to the decision log. Nothing merges without you.
- Machine roles. A machine says whether it dispatches, plans or only verifies; the instance and version are on every ledger line, so two machines never act on one queue without knowing it.
- Chat. Replies render as markdown; ticket ids are links with a hover card; click opens the ticket.
- Delivery rebuilt around the ticket, release notes rendered, evidence readable; a Memory view; sessions in the Observatory, foreign sessions reaped, compaction storms caught.
Fixed
- A Claude seat is never rerouted to a local model. With its gateway down it runs on its own subscription; a run stuck on Claude Code's key prompt is ended with a ledger line instead of reading as Working.
- A mutation check is not a failed run. A live run that checks out its base commit for a minute keeps running; a branch mismatch counts once the writer is gone.
- An already-integrated branch is signed, not bounced. The sign-off used to treat "nothing to merge" as a failed merge and send the owner's approval back as a block. A refused decision now says why.
- The interface fits the window at any zoom; ripgrep is found from a Finder-launched app; the Type column was empty; release notes rendered raw; the composer painted scrollbars while empty.
Known
- Windows builds are still unsigned; some AV suites sandbox the installer. Signing is the next release-pipeline item.
v1.26.3
5 September 2026Third tag of the day, and the last before xNAUT is left alone to run its own board overnight. Three things a day of watching it exposed.
Fixed
- NautBot can move its own tickets. Agents on the Codex runtime never received xNAUT's tool server, so the one agent whose job is the board asked its owner to move tickets for it. Codex now gets the server, with no secret on the command line.
- A restart no longer doubles the agent list. Every restart added an "adopted" twin beside each surviving agent, and each twin counted toward the launch ceiling; three agents read as six. Rows whose session has ended are dropped, not kept.
- The health check no longer waits for a machine-wide scan on every request. It reads a snapshot refreshed in the background, so a slow mount cannot hold it past a client's deadline.
v1.26.2
5 September 2026Same day as 1.26.1, with the parts that were reviewed but not yet merged, and the two faults a day of restarts exposed: a duplicate NautBot per restart, and a verification the app died on that nobody ever corrected.
Fixed
- A restart no longer spawns a second NautBot. The app re-adopts a surviving agent after a restart but no longer holds its terminal, and the wake read that as "no agent" and launched another. Four were created in one day. A wake now reaches the surviving session directly.
- A verification the app died on is corrected within a sweep tick, not only at the next start. A ghost run blocked its whole project for an hour.
- Two verifications no longer fight over one directory. One per project per pass; the second handback waits a tick instead of failing at warm-up.
- A surviving agent keeps its worktree after a restart. The lease that stops two agents sharing a checkout was held under the old app's process; adoption re-takes it.
- Release builds keep line tables, so a freeze in the field can be read as a backtrace. The binary grows from 34 MB to 58 MB.
Added
- The loop's five stations ship seeded: NautBot, a coding agent, Ralph (validates on a clean machine), Otto (releases only from a validator record), and the Librarian.
- Publishing gets a state machine, not a prompt.
- Chat streams: a message is a question, and the harness starts on a build handshake.
- Windows install smoke gate in the release workflow.
- A housekeeper reclaims the disk that agent worktrees ate.
v1.26.1
5 September 2026If you installed 1.26.0, update: waking an agent could still leave the message sitting unsent in its prompt on older installs. Around that fix is the day the loop closed for real. An agent was handed a ticket, worked it without asking a single question, handed back a structured record, and xNAUT verified the result in a clean sandbox and closed the ticket itself. That had never happened before.
Fixed
- A woken agent no longer waits for an Enter nobody presses. The runtime settings from an older install were never brought up to date, so Claude Code was still launched in draft mode. Those settings now heal themselves once on start. Every 1.26.0 install was missing this.
- Codex agents stop at nothing of their own making. NautBot on Codex asked "Would you like to run the following command?" for every push and every message to you, and the question never reached your inbox. Approvals are off for that runtime, as they already were for Claude; xNAUT's own guard rails stay in front.
- Two agents cannot share one checkout. The lease that prevents it was only taken by the build flow. Every launch takes it now, and the second agent is told who holds the directory.
- Agents look up your conventions instead of asking. The launch prompt named a tool the agent did not have. It exists now: branch naming, commit style, the test command and what "done" means are read from the vault.
- xNAUT can verify itself. The sandbox never installed a browser, looked for it at the macOS path on Linux, was sent the entire build tree, and inherited a stuck sandbox after any restart. All four fixed; the first green verification of xNAUT's own code ran today.
- A verification checks the ticket's own tree. It used to run one fixed directory for every ticket in a project. The commit under test is now on the result.
- A woken agent starts inside a git repository, so its worktree rules apply from the first command.
- Every launched agent gets xNAUT's tools. Agents were editing the ticket store by hand because the connection was never in their launch configuration.
- "Remove" asks first. The app's native confirmation dialogs did nothing, so every delete acted immediately. An in-app dialog replaces them, and 58 silent alerts now show a toast.
Added
- A finished agent hands back a record: what changed, which commits, how it was verified, what it did not finish. An empty or evasive handback is refused with the gaps listed.
- Dispatch a ticket to its owner in one action. A worktree off the live branch, the agent launched inside it with the ticket and its documents, the ticket moved to in progress.
- The Agent pane is one timeline. Today's live view, cost, sandbox runs and actions under collapsible dates; two tabs are gone.
- Answer the inbox from your phone.
- Switch an agent's harness per thread, with the transcript carried over.
- The Observatory shows all 30 agents of a fleet run instead of stopping at a ceiling.
- The agent runtime registry is versioned, with a diff against this build's defaults, so a drift is a record and one runtime can be rolled back.
- A boot self-check says why NautBot cannot work on this machine, before you find out the slow way.
v1.26.0
3 September 2026xNAUT has been able to wake an agent, verify a ticket and record what happened for months. This is the release where those actually connect: a wake that lands, work you can watch, and a verification that can finish a ticket instead of handing it back to itself.
Fixed
- Waking an agent now reaches it. The message was typed into the agent's prompt and the Enter never arrived, so the text sat there unsent and a second agent was launched to do the same work. The submit is now sent on its own.
- A working agent is visible. An agent you woke, or one that survived a restart, had no tab and no status anywhere in the app. It now has both, and the dot says what it is really doing rather than what its terminal last painted.
- A verification can pass. Runs against a sandbox that had gone to sleep failed before a single step, because nothing woke it. Nothing had ever verified green.
- A finished ticket finishes. A passing verification returned the ticket to the review queue it had just left, so the same work was checked again every half hour, forever. Green now closes it, and red leaves it alone.
- The board keeps working past a stuck ticket. One ticket that could not be verified stopped every ticket behind it. A check that fails three times now steps aside and says so, once.
- The work report shows agent work. It only ever recorded commands a person typed, so a day of agent work produced an empty page. It now reads what actually happened, including for days that have already passed.
- The Evidence tab opens. Its five commands were the only ones in the app the permission list did not grant, so every one failed silently.
- Refresh in the Observatory did something. The button called a function that did not exist.
- An agent that outlives the app can still reach you. A restart quietly invalidated its way of sending you a message, and the error told it to use a route that does not work.
Added
- Finished agents are cleaned up. An agent that has stopped working is closed after four hours idle. One that is still working, or that you are sitting in, is never touched.
- The app can tell you whether it is still working. Its health now reports when its background clock last ran, so a stalled app is distinguishable from a quiet one.
- One place decides where an agent runs. Local, exe.dev or GitVM, chosen by configuration rather than by code. Local behaviour is unchanged.
v1.25.2
29 August 2026Agents got xNAUT's own tools in v1.25.0. This is the half that makes the safeguards on those tools apply to them.
Fixed
- An agent finishing a ticket hands it back for real. Agents could call xNAUT's tools, but their calls arrived anonymously, so the safeguards treated them as your own actions and stayed out of the way. A finished ticket stayed owned by the agent that finished it, and nobody was told it needed review. Tool calls now identify the agent making them.
- Vault search stops leading with dependency files. The indexer walked
node_modules,targetand friends, so a search could return three files from a checked-in dependency before any real note.
v1.25.1
29 August 2026A terminal that needs the internet to draw a terminal is not a terminal.
Fixed
- Terminals work without an internet connection. The terminal engine was fetched from a CDN each time the app started, so a brief network problem meant no terminal or agent session could be opened at all, and restarting was the only way back even once the connection returned. It now ships inside xNAUT.
- Crash reports in the debug log include what went wrong, not only where.
v1.25.0
29 August 2026The first run where an agent worked a ticket end to end found three things in the loop around it. All three are fixed here.
Fixed
- Agents can use xNAUT's own tools. A launched agent got the plugins you had enabled and nothing else, so the ticket, decision and document tools did not exist for it. It fell back to editing project files by hand, which works but skips every safeguard those tools enforce.
- A woken agent works the ticket you woke it for. The queue was ordered oldest-change-first, so a fresh assignment came last behind anything that had been sitting around. It now orders by what is already started, then priority, then recency, and a wake can name the ticket to start with.
- A prefilled task gets submitted. The agent is launched with its task already in the composer and waits for a return key before running it. Nothing sent that key, so a woken agent sat looking idle until somebody pressed Enter by hand.
v1.24.6
28 August 2026Two fixes from watching an agent work for the first time.
Fixed
- A woken agent starts working instead of waiting at its input box. The task was pasted into the agent's terminal but never submitted, so it looked idle and unresponsive when it was simply waiting for a return key that never came.
- Flow Watch shows readable output. Agent terminals draw by moving the cursor rather than writing spaces, so the previous view glued words together and lost every column. It now renders the terminal honestly.
v1.24.5
28 August 2026Two fixes found by using the thing: one by an agent refusing a nonsense prompt, one by an agent reporting that it had nothing to wait on.
Fixed
- Asking you a question no longer leaves the agent with nothing to wait on. A question or approval request held its reply for two minutes before answering, so an agent whose own timeout was shorter received nothing at all, not even the request's id, and could not follow it up. The request was on your screen the whole time; only the agent was blind to it.
v1.24.4
28 August 2026Answer a blocked agent where the work is, and a button that finally sends what you typed.
Added
- Answer a blocked agent from Flow Watch. Open questions and approval requests sit above the running sessions: approve, deny, pick an option or type an answer without leaving the view where the work is happening. They are the same Mesh items, one glance from the run they are blocking.
Fixed
- The Send button in Agent Space sent a placeholder instead of your message. Clicking Send passed the click event itself as the prompt, so the agent received the text "[object PointerEvent]" and never saw what you typed. Pressing Enter always worked, which is why this looked like an agent problem rather than a button problem.
v1.24.3
28 August 2026Found by letting an agent run a ticket end to end and watching what the record did afterwards.
Fixed
- An agent finishing a ticket now really hands it back. The rule that
donereturns a ticket to NautBot, and that only NautBot may mark itcomplete, was enforced only for agents writing through chat. An agent working inside a run writes through a different path that had neither, so a finished ticket stayed owned by the agent that finished it and nobody was told it needed review. Both rules now live at the single write every caller passes through.
v1.24.2
28 August 2026Watch your agents work. The first live run of the self-building loop launched an agent nobody could see; this release is the window.
Added
- Flow Watch. A right-pane view with one collapsible row per running agent session: status dot, click to open the live terminal output. Read-only by construction, so watching a flow can never type into it.
v1.23.1
28 August 2026Found in the first minutes of dogfooding v1.23.0.
Fixed
- Agents can be addressed by their display name. Waking an agent by display name found no profile, and a ticket assigned to one was owned by a string no agent would match, so the loop no-opped silently. Spoken names now resolve to handles everywhere; an unknown name is refused with the roster.
v1.23.0
27 August 2026The supervised self-building loop. NautBot runs a ticket end to end from chat: assign it, wake the agent, verify the work in a sandbox, put a cross-model panel on it, and land it through a risk-scored merge gate. Every step is guarded, every guard has a kill-switch, and your phone is told at the human gates.
Added
- The ticket loop. Agents pull their assigned tickets from the bridge, identity resolved server-side from the session token, and setting a ticket to done hands it back for review automatically. NautBot wakes an agent with a nudge typed into its idle session, or launches it cold when no session exists.
- A merge gate with a risk score. Diffs are scored deterministically: size, breadth, sensitive paths, shrinking tests, missing verification. High-risk merges wait for your approval in the Mesh, conflicts abort clean, and any landed ticket can be un-merged with one revert.
- Kill-switches. Freeze all merges, go read-only, require approval on everything, or quarantine one agent. One audited flag each, owner-only, read at the moment of the action so a flip needs no restart.
- xFusion panels. Two or three models answer, debate or try to refute a piece of work independently. No judge, and the debate ends itself the round nobody moves. A reviewer that shares the worker's model shares its blind spots; the panel does not.
- Sandbox verification. A ticket's verify plan runs in a sandbox; a green record lowers the merge risk, a red one refuses the merge outright.
- Mobile: push notifications. Inbox questions, approvals and agent state changes reach your phone. Plus read-only vault search and reading from the bridge, and per-device tokens so one phone can be revoked without re-pairing the rest.
Changed
- Agents address each other by tag only. Runtimes and models are never disclosed between agents: a model that knows which model it is arguing with postures instead of answering.
Fixed
- Removing a zellij session that was already gone no longer surfaces as an error for callers beyond the phone's path; the guard now accepts both of zellij's phrasings.
v1.22.1
26 August 2026The half of the mobile work that missed v1.22.0, and the regression it shipped instead. If you are on v1.22.0, update: the iOS app cannot connect to it at all, and any zellij session it created has no keybindings.
Fixed
- Zellij sessions came back with no keys at all. The generated layout cleared every default binding instead of the seven that collide with a shell and an agent TUI, so a session created by v1.22.0 had no detach, no pane or tab switching and no scroll mode. Now only those seven are unbound. Sessions made under v1.22.0 keep the broken layout until it is removed: delete
~/.config/xnaut/layouts/and launch the session again. - Session names with a capital letter were rejected. The validator compared a name against its own lowercased form, so every real session failed it. It now refuses only what zellij genuinely cannot take.
- Removing a session that was already gone returned an error. It reports success, because it is.
- Attaching from the phone opened a window on the Mac. It no longer does, unless you ask for it. Zellij sizes a session to its smallest attached client, so a phone left attached used to squeeze the session to phone width on your desktop.
Added
- The iOS app can authenticate. Every bridge route now accepts a standard
Authorization: Bearerheader alongside the existing query token. Without this the mobile client cannot connect at all, which is the reason this release exists. - Answer a blocked agent from your pocket. The bridge exposes your inbox: read what is waiting, approve or deny a request, and type an answer back. An agent stuck on a question no longer waits for you to reach a desk.
- A session opened from the phone starts at the phone's size, rather than being reshaped after the fact.
v1.22.0
26 August 2026An agent that can file a ticket, and a machine you can watch it work on. Both halves of the same idea: work an agent does should leave a trace where you already look, not only inside the chat turn that produced it.
Added
- Agents can work the ticket board. An agent lists, creates and updates tickets through the same write path the app uses, so a ticket it files is indistinguishable from one you filed. Two rails keep the board honest. An agent may mark a ticket done, which hands it straight back to NautBot; only NautBot may mark it complete, which means tested, checked and approved. And an agent may only append to a ticket body, never rewrite it, so a run cannot tidy away the history it is reporting against.
- An agent's computer shows up beside it. A VM an agent spins up on exe.dev used to exist only as a line in the transcript. The agent pane now lists each machine with its state and its ssh line: terminal opens the VM's own web terminal right there in the pane, web opens its public hostname in a tab.
- Zellij sessions on the phone. The mobile bridge lists your sessions live-first, opens one as a tab, and removes one for good. A terminal tab now remembers the session behind it, so a durable session is marked as durable instead of looking like a bare shell.
Fixed
- Removing a session kills it as well as deleting it, so the row stops coming back.
Correction: this release also tried to stop zellij's default keys eating your shell and got it wrong, unbinding every zellij key rather than the seven that collide. Fixed in v1.22.1 below. - Adding a bundled plugin no longer fails with "No such file". The check that runs when you add a plugin started the server from the raw catalog command instead of the resolved one, so exe.dev and NautGate Audit reported a missing script in the installed app even though it was bundled correctly. The check now launches exactly what a run launches. (Shipped as v1.21.2.)
v1.21.1
25 August 2026A sandbox that outlives the run. GitVM's boxes are ephemeral and self-destruct on a timeout, which is right for a build and wrong for anything an agent should be able to come back to. exe.dev gives an agent a persistent Linux VM with root and a public HTTPS hostname, so what it builds has an address while it is still building it.
Added
- exe.dev in the plugin library. An agent can create a persistent Linux VM, run commands on it, and delete it when it is done. Standard library only, like every plugin we ship. Token scoping is exe.dev's own, so a key can be minted per run with a command whitelist and an expiry rather than handing over a long-lived one.
Fixed
- Bundled plugin scripts now start from the installed app. A catalog entry pointing at a script inside the app only resolved when the working directory happened to be the source checkout. In the released build the server failed to start and read as a broken plugin. The scripts ship inside the bundle and the path is resolved at launch. Anything you configured yourself is untouched.
v1.21.0
24 August 2026xNAUT now arrives with two agents already in it. NautBot is the guide and the control layer: it knows the app, and it can drive it. The Librarian knows what you have written, and the Vault workspace is where that pays off, because your files, your uncommitted work and a chat about them are finally in the same window.
Added
- Two default agents out of the box. NautBot is your guide and control layer for xNAUT. The Librarian knows your docs and data: it searches everything you have written, researches and drafts documents into the vault with the right structure, and turns an idea into a diagram in the open document.
- Vault workspace. A file browser for the linked project opens any file in the centre, code syntax-highlighted and markdown rendered. A Changes panel shows uncommitted work grouped by folder, files not yet pushed, recent commits tagged with the release they shipped in, and every worktree; any file or commit opens its diff in the centre. A per-project chat keeps each project's own thread.
- Review queue split into what needs you and what does not, so the queue is a list of decisions rather than a list of events. Agents wake with a project brief instead of a blank context.
Fixed
- Chat kept answering from the wrong model. The provider you pick now holds through the fallback completion instead of quietly dropping to the global default. The document assistant defaults to a funded, tool-capable route.
- Voice dictation reports a silent microphone plainly instead of inserting a phantom word. A denied or muted mic produces near-silence, and the model turns that into a word you never said.
- A referenced note that does not exist is handled as a soft result instead of erroring over the answer it was part of.
- NautGate. A session whose launch binding expired is stopped instead of retrying in a loop, and a Max-plan agent stops rather than looping. Local provider URLs load from saved settings, which fixes a stale model dropdown.
- Diagrams drawn from chat are no longer orphaned: they land in the document that asked for them.
v1.20.1
21 August 2026Agents in Agent Space could talk but not act, on every route except one. The panel pushed its own "Thinking…" placeholder into the thread and then sent the thread as the conversation, so each turn ended on the agent's own voice. Anthropic rejects that outright with a 400, the tool loop died on the rejection, and xNAUT quietly answered with a plain completion instead. It looked like the tools were missing. Switching to a local model appeared to fix it, because a local model accepts the same malformed request.
Fixed
- Agents lost every tool on Anthropic routes. The placeholder no longer reaches the history, and a turn now drops any trailing assistant message before it goes out, so no caller can reintroduce it. The reply already carried the notice that named the failure and quoted the upstream verbatim, which is what the fix was read off; the 400 was in plain sight and reads like a model problem rather than a malformed request.
Added
- Two chains in one bundle. An export can now carry NautGate's own routing receipts beside xNAUT's execution record, and the offline verifier checks both, plus the cross-reference between them: every receipt a record names, and every record a receipt belongs to. Two independent parties recording the same decision is a stronger claim than either log alone, and an auditor can check it without believing either product.
- NautGate in the plugin library. A real MCP server rather than a card: list your routing receipts, fetch one as an evidence bundle, verify a bundle offline. Standard library only.
Neither half is a dependency of the other. With no gateway configured the export is byte-for-byte what it was in 1.20.0, and NautGate never learns what xNAUT is. The join is a directory of documents, each valid on its own; nothing is re-signed with our key, because collapsing two parties into one would destroy the only thing the join buys.
v1.20.0
20 August 2026The record every capture point was supposed to be writing. xNAUT had the hooks and connected none of them: across three append-only logs there were 2, 49 and 2 entries, and zero chained records had ever been written. This release writes the record, signs it on hardware, encrypts what is private about it, and ships a verifier that needs neither xNAUT nor us.
Added
- The execution record. Every tool call and every agent run appends a canonical record (JCS, RFC 8785) with a domain-separated SHA-256 and a hash link to the record before it, so changing record N stops every link after it from matching. Canonical means the bytes hash the same on your machine and on the auditor's, which is the part that makes a chain worth anything to somebody else.
- Checkpoints signed on the HSM. A Merkle root over a session's records, signed with SHA256_WITH_RSA on the Securosys TSB and chained to the checkpoint before it. This is the part that is evidence rather than bookkeeping: a chain you compute yourself proves nobody edited an entry in place, and nothing more, because whoever holds the log can rewrite an entry and recompute the chain. A signature from a key we cannot extract, over a root, at a time we did not choose, is the outside witness. A checkpoint is only issued if the chain verifies first.
- Sealing, now meaning encryption. Tool-call arguments (the commands, the paths, the diffs, which is where the sensitive material actually is) are encrypted locally with AES-256-GCM under a per-session key, fresh nonce per blob. That key's 32 bytes are wrapped by a key held inside the HSM. Delete the one key file and every blob in that session is unreadable by anyone, us included, while the chain over it still verifies. Deleting lines from an append-only log cannot do both.
- An offline verifier and a bundle export. Hand a client a bundle and they check it with no xNAUT, no network and no HSM: chain links, Merkle roots, checkpoint chaining and the RSA signatures, in a script that uses the Python standard library only. A redacted bundle, every plaintext argument stripped out, still verifies, because nothing needed to verify it was in the arguments.
- Plugin credentials live in the macOS keychain rather than a file in the config directory, and a plain read migrates one that is already there.
Fixed
- The temp file that carried plugin credentials to an agent was mode 644, readable by any process on the machine.
- A record no longer carries a plaintext preview of its arguments. It held the first 200 characters, which is where a secret usually is.
- Reading a blob after its key was destroyed says so. It used to hand back raw ciphertext as though it were the arguments, and garbage displayed as evidence is worse than an error saying the key is gone.
Changed
- The work session log no longer claims to be signed or tamper-evident. Its chain is computed on your own machine with no outside signature over it. It detects a report that was edited after export, which is genuinely useful and is what it now says. It is not evidence against whoever holds the log.
Three different claims get sold as one word. A chain proves no entry was edited in place. Recomputing a root proves an exported report still matches the record it came from. Only an outside signature over that root is evidence against the party holding the log. The wording across this site was corrected in the same week: the local log says what it does, and the HSM checkpoint chain is the only thing making the third claim.
v1.19.0
20 August 2026The attestation log became a chain, and the middle of the loop became a surface. A receipt used to be signed on its own, which meant deleting one left every remaining signature verifying. And the work between starting a ticket and shipping it had no page at all.
Added
- Delivery: tests, releases and a report, per project. Start Work now binds the ticket to the right pane, so the log you are watching belongs to the ticket you started rather than whatever the pane happened to be showing. When the run ends there is somewhere to go. Tests renders the full record of every verification run, step by step, with the command, the exit code and the log tail. Releases lists the tags and the tickets inside them. Report joins commits to tickets and names the ones sitting in review or done with nothing committed behind them. Sixteen verification records were already on disk, fifteen of them failed, and nothing in the app could show you why.
- Proof of work, derived from the repository. Evidence written from memory is the one source a client cannot audit. This one is generated: ticket joined to commit on the id in the subject line, commit joined to release with git tag --contains. It also reports the gap, which is the useful part. Of 149 commits in five days, 29 carried a ticket id, so 120 pieces of work were unattributable to anything that had been asked for.
- The route that answered you is named in the thread. The gateway replies with the model it actually used, which is not always the model you picked. Six headers were being thrown away, so a substituted model looked identical to the one you chose. That is how a subscription lane quietly served the wrong model for a day.
Fixed
- A deletion can no longer hide in the attestation log. Each receipt now carries its sequence number and the hash of the receipt before it, and the HSM signs over that link rather than over the bare digest, so the newest signature commits to the entire history. Deleting a line, reordering, truncating the head, or editing a receipt in place all break the walk, and the browser verifier checks the chain rather than each signature alone.
Raised by a Securosys engineer reading the claim on this page, and he was right twice. A pile of individually valid signatures is not a tamper-evident record, and "sealed" reads as encryption when what actually happens is signing. Both the mechanism and the sentence changed.
v1.18.1
19 August 2026Claude agents talk again.
Fixed
- A Claude agent stopped paying per token for a plan you already have. Handing the agent a gateway key alongside the gateway address overrode Claude Code's own logged-in session, so the subscription lane was never reached and every request billed the metered key instead. When that balance hit zero, every Claude agent went silent at once. The agent now gets the address and no credential, which is what lets its own token through.
v1.18.0
19 August 2026Agents that tell you the truth about what they can do. An agent that quietly cannot call a tool is worse than one that fails loudly, because it answers anyway and you believe it. This release makes that impossible in four places, and adds a plan you can argue with.
Added
- Ask a model whether it can actually call a tool. The picker lists hundreds of models and used to say nothing about which of them can run a tool call, so choosing one was a coin flip. One request settles it, the answer sits next to the model name, and when the route refuses it quotes the upstream's own sentence, which is what tells you whether the fix is a billing page or a different model. It probes the ROUTE, not the model: the same model id behaves differently through a subscription relay than through an API key, and it is the route that breaks.
- A rule that asks instead of only refusing. A veto can now hold a tool call, send the question to your inbox, and leave the agent waiting for your answer. Refusing was the only option before, so anything uncertain had to be allowed or blocked in advance.
- A plan you can annotate and answer. A plan used to end as a wall of markdown in a terminal, and the feedback loop was retyping the part you wanted changed. Click the block you mean, attach a numbered note, then Approve or Request changes. The agent blocks until you answer and picks up your notes attached to the exact lines.
- Two agents reaching for the same file is noticed while both are still running, rather than found afterwards in the diff.
Fixed
- Both chat surfaces run the same turn path. The chat pane posted messages and nothing else while Agent Space ran the full tool loop, so the same agent was more capable in one pane than the other and reported it in words that read like a regression.
- A reply that lost its tools says so. When the tool loop could not run, the fallback answered without tools and said nothing; the reply now names the model and quotes the upstream verbatim. That silence cost four days of hunting a bug that was one line in a log.
- SSH gets a real channel, so a session types and answers instead of connecting and going quiet.
- Triggers match output rather than escape codes. Creating a trigger never reached the backend at all before this.
- Five surfaces stopped claiming more than the code did. A capability shown as ON that was off in the runtime is a lie the app was telling on its own behalf.
v1.17.2
18 August 2026A click means the same thing everywhere.
Fixed
- Interface zoom stopped moving every click. Context menus opened a third of the way down the screen and a terminal click selected three or four lines below the pointer. Any zoom other than 100% put the pointer and the app in different coordinate systems.
v1.17.1
18 August 2026Dictation that reaches an actual microphone.
Added
- Voice dictation in both composers. Local whisper speech to text, nothing leaves the machine. The button had been there for months calling a browser API that WebKit does not implement, so it had never once recorded anything.
- Attestation receipts can be published from the plugin library.
Fixed
- A project row stops offering dead zellij sessions you cannot attach to.
v1.17.0
18 August 2026Hardware attestation. A Securosys Primus HSM signs what your agents did; the private key cannot leave the hardware, and anyone can verify a receipt at xnaut.dev/attest. Proofs, not promises.
Added
- Securosys Attestation plugin. Sign digests on a Securosys HSM and keep the receipts: hardware attestation for agent work, releases, or any artifact. Standalone by design, no NautGate required; a dependency-free MCP server talks straight to the TSB REST API, and receipts append to attestations.jsonl in app support. Configure a TSB endpoint plus an API key or JWT and the same plugin works against CloudHSM, the free 90-day sandbox, or an on-prem Primus. Verified end to end against a real partition before shipping.
- Brand marks in the plugin library can be images now, not only vector paths, which is how Securosys shows its real logo instead of a monogram tile.
Fixed
- An agent allowed the network can actually bind a port. The policy translated network access into egress only, so a dev server died on bind.
v1.16.2
16 August 2026The agent system, rebuilt across 1.16, and then held together: a message is a question again, a build asks where before it touches anything, and 162 MCP servers are one click from an agent.
Fixed
- A build thread survives its second turn. Every follow-up message in a codex build died the instant it started, with error: unexpected argument '--approve-for-me'. codex exec resume takes a different argument set from codex exec and accepts neither --sandbox nor --approve-for-me, so the first turn worked and the agent then looked mute. Proven by running the real CLI twice, launch then resume from its own session id, for both codex and claude.
v1.16.1
16 August 2026Windows builds again.
Fixed
- The Windows leg died at link time with LNK1181: cannot open input file 'sqlite3.lib', so 1.16.0 shipped both macOS DMGs and the cask but no .exe and no .msi. rusqlite was linking the system SQLite, which macOS ships and Windows does not, so the failure could only ever appear in CI. It builds SQLite from source now, the same library on all three platforms.
v1.16.0
16 August 2026The agent system, rebuilt. Step one of two: this is how you talk to an agent and what an agent can do. Step two is the Task side, where a task picks an agent rather than a runtime, and it is deliberately not in this release.
Added
- Chat first. A message goes to the agent's own model. No worktree, no zellij session, no coding CLI. Asking for a status is a question, and it is answered like one.
- A build handshake. When a request needs code, the agent says so and xNAUT asks WHERE. The run happens in a worktree under .worktrees/, never in the checkout you have open, and the repository is asked for once per thread.
- Plugins. A library of 162 MCP servers: 32 we have run ourselves plus 130 compiled from the public registries. Enabling one is what makes it reach a run: claude via --mcp-config, codex via -c mcp_servers. Each is handed to one agent rather than pooled. Browse them →
- Agents use their plugins in chat. A turn opens the MCP servers that agent holds and offers their tools to the model, so "how many repos do we have?" is answered from Forgejo's own tools rather than described.
- Agents fix their own connectors. Given a package that ships no executable, an agent inspects npm, finds one that does, repairs the plugin and connects it, instead of handing back the error.
- A canvas and documents in a split of the main screen. The agent sends the whole graph or the whole document, boxes you move keep their positions, and "save to vault" writes the document with its frontmatter.
- The Librarian is an agent, not a pane: it searches, reads and writes the vault through tools, and its old conversations came with it.
- The Mesh inbox. Agents ask, request approval, notify, and leave you tasks. A question parks until you answer it and survives a restart.
- Skills library with starring and grouping by source, and app zoom on Cmd/Ctrl + = / - / 0.
Fixed
- Failures say what the CLI actually said: a run that dies prints its stderr instead of "open Terminal to see what it did".
- codex runs outside a git repository, and a run that needs to bind a port is no longer blocked by its own sandbox.
v1.15.0
14 August 2026Pages multiply inside a browser pane rather than in the tab strip.
Added
- Page tabs inside browser panes. Every browser pane, split or full tab, gets a strip above the address bar: a + opens another page, each page is a closable chip, and switching chips swaps native webviews with their state preserved. Closing the last page closes the pane cleanly.
Changed
- The globe opens one browser tab. The first click creates it, further clicks focus it. Shift-click still forces an extra tab.
v1.14.1
14 August 2026The Observatory listed nothing while sessions were live, and the same binary behaved differently depending on how it was opened.
Fixed
- A launchd-launched app inherits a four-entry PATH, where a bare zellij does not exist. Listing sessions spawned exactly that and concluded none existed; clicking a project then died on spawn and left a black terminal with a blinking cursor. A terminal-launched instance inherits a full PATH, which is why the two disagreed. Every zellij spawn now goes through the resolver, verified under the app's exact PATH read off the running process.
v1.14.0
14 August 2026A build stage that stops reporting success it did not have. Slices now declare what they are supposed to produce and are held to it, a failing slice fails instead of restarting forever, and verification runs where the work ran rather than being asserted afterwards.
Added
- Verification where the work happened. The Sandbox Verify module is wired to the ticket panel, and Loops runs are bridged into GitVM sandbox verification. A run is now checked in the environment that produced it, instead of being reported finished and believed.
- Build slices declare their output ports, and are gated on delivering them. The typed handoff between slices was decorative: a declared type was never checked, and an explicit null counted as a produced value. Both are now real, so a slice that promises an artifact and returns nothing fails at the boundary rather than three steps later.
- A failing slice has a real failure state. Restarts were previously unbounded, which reads as work in progress and is not.
- The decision log. Decisions are recorded, summarised by an agent reading the build log, and read back as a brief. Settled entries are marked, because a summariser that keeps reporting fixed bugs as live is worse than no summary.
- Agents read what past runs learned. Engram recall is scoped strictly to the current project, so one project's lessons do not leak into another's context.
- Per-account usage labelling in the footer, and constrained Vault document tools in the MCP.
Fixed
- The update banner offered to update a version to itself, and covered the top bar while doing it. The version it compared against was a constant last edited at 1.5.0, so every release after that one concluded an update existed, including the one already running. Worse and entirely separate: the banner was fixed to the top of the window with no layout offset, so it sat on the toolbar. Measured rather than assumed, all nine top-bar controls returned the banner instead of themselves, and the only way out was the small dismiss button. That half landed on every user the moment a genuine update existed.
- A work log no longer dies with the app. The session was always written to disk; only the in-memory pointer to it was lost on quit. So the monitor stopped recording silently, the file stayed marked active forever, and the hours vanished from the project dashboard. On restart xNAUT now offers the session back, newest first, and asks. It never resumes by itself: time passes between the close and the relaunch that nobody worked, and where several logs were left open, adopting the newest silently would close whichever one was real.
- Local AI providers ignored the endpoint you configured. The address was a literal in the source, so a machine running LM Studio on any other port was told the connection was refused, naming a port that appears nowhere in its settings. The setting was right and the code was not reading it. The failure message now names the endpoint actually dialled.
- A new NAUT-Flow case no longer copies the previous one, and the Knowledge Graph names the command and path when a scan returns nothing instead of reporting a null property error.
Removed
- AntBot. Both AI paths tried it before the provider you configured, which is why a missing binary was the first half of every AI error message. "Explain command" used to type a CLI invocation into your terminal, so the feature only worked if that CLI happened to be installed and it left a command in your shell history that you did not write. It now asks your configured provider and answers in the chat panel.
v1.13.10
10 August 2026A control that cannot be addressed by name cannot be tested, and seven screens went unchecked on every release because of one word.
Fixed
- The Settings menu item could not be pressed by name. The accessibility matcher works by substring, and three other controls contain the word: the Open Settings button added in 1.13.8, plus macOS's own "System Settings…" and "Show System Settings in Finder", which sit in the accessibility tree of every Mac app. Rather than guess which one it meant, the release test refused to press any of them, so all seven Settings sections went untested from that release onward. The item is now named "xNAUT settings", which collides with none of them.
- A guard test now covers every control the smoke test presses, not only the close buttons. A fix in 1.13.8 made a control unaddressable in 1.13.9 and nothing caught it until someone ran the test by hand against the shipped build.
v1.13.9
10 August 2026The Settings panel could not be reached by keyboard or by a screen reader. All seven sections were plain divs: no role, no tab stop, no accessible name. It was found by the release test, which refused to press them rather than guess which one it was pressing, and the honest reading of that refusal was that the app was at fault, not the test.
Fixed
- The Settings sections are real buttons. AI, Tasks Mode, Appearance, Keyboard Shortcuts, Mobile, Nautify and Triggers now have a role, a tab stop and a name each, so you can tab to them and a screen reader can announce them. Hardening the test around the defect would have been fixing the wrong thing.
- Each section carries its own name, because visible text is not an address. "AI" is a substring of "Explain Screen", so the visible label is ambiguous and matching it could land on the wrong control. The close control had the same problem in a worse form: its only accessible name was ×, which every tab close button also carries.
Also in this line
- The release test walks two levels deeper. It used to open each top-bar icon and stop, so every surface that is itself a menu counted as one control and its contents counted nowhere. It now replays a click path from a fresh page load, which also stops one broken surface poisoning every surface after it. What the app renders went from 351 controls to 1332; what the smoke test actually presses went from 11 of 150 to 19 of 157. The second number is smaller than it was flattering to believe, which is the point of measuring it.
v1.13.8
10 August 2026A fresh install was told it was broken. Open the Projects panel on a machine that has never configured Project Management and it painted a red error box, "Project Management module is disabled", with a Retry button that repainted the same box forever. That is the default state of a new install, so the first thing xNAUT said to a first-run user was that something had failed.
Fixed
- An unconfigured module reads as setup, not as failure. The bug was ordering, not the backend. The panel asked for data first, every data call returns an error while the module is off, and so the one call that explains why was never made at all. A single catch block then treated "not set up yet" exactly like "the git command blew up". Status is now read first, and an unconfigured module gets a neutral empty state, the backend's own reason as the explanation, and an Open Settings button that deep-links the right card. A real failure still gets the red box, which is correct.
Also in this line
- A dashboard for test runs. One page over a directory of runs: the task that was sent, the agent's write-up as markdown, every screenshot, the video, and the bugs found across every run rather than only the last one. Statuses are passed, failed and untested, and untested is the point: folding "nothing was running to test" into passed reports a green run that tested nothing.
- Three test stubs were lying. Two of them described backend responses with fields the backend cannot return, so every test that touched those screens was passing against a shape that does not exist. A stub that lies is not a weak test, it is a test of something else.
v1.13.7
10 August 2026If your Mac runs macOS in Light appearance, xNAUT came up light, and the Appearance picker could not put it back. Reported from a machine where it had presumably always been true. Along with it, two errors the interface threw during ordinary use, both invisible because neither one stopped anything.
Fixed
- A Light-appearance Mac could hijack the whole UI. The stylesheet carried a light palette behind a system-appearance query, guarded so that anything explicitly choosing a theme would win. Nothing ever chose one. The guard therefore always matched, and every machine set to Light got the light token set for the entire app. The Appearance picker could not undo it because it recolours terminals and touches no theme token at all. The theme is now pinned, and light stays reachable for a future toggle.
- Two errors thrown while using the interface. The LLM provider submenu threw twice on every pass over the UI, from reading a property off something that is not an element. The worktree agent dropdown threw whenever the agent list came back empty, leaving it blank and unusable. Neither surfaced as a visible failure, which is why both survived: the console check in the test suite only looks for a different class of error, so a TypeError passed it silently.
Also in this line
- The test suite ran on nothing. npm test was pointed at a hardcoded Linux browser path, so on macOS it was dead. The release scenarios are now written from the user guide rather than from the code, and the app is served against a stub so every control it renders can be enumerated and counted.
v1.13.6
9 August 2026The Designer works without a sandbox. Until now it needed the GitVM CLI, an API key and Tailscale reach, which is 48Nauts infrastructure; for everyone else the Designer opened, said "Starting the sandbox", and never recovered. New designs now run on your own machine by default.
Added
- A local runtime for the Designer. Your design is served from your own machine on a loopback port. No warm-up, no lease, no rsync, no tunnel, no teardown. It turned out to be a small change for a good reason: the design agent already ran on your machine and wrote straight into the vault, so the sandbox was only ever where the result was served. Publishing becomes a near no-op, and stopping a design cannot lose work because the vault is the working copy.
- A Local / Sandbox switch in the design header, per design rather than global, so one project can hold a throwaway you build locally and a client-facing one on a shareable URL. New designs default to local. Designs you already have keep the runtime they were created under, so none of them abandon a sandbox that is currently running.
- A durable log per design, in the same place as the build log, with a deadline on every sandbox call. A hang is now a reported failure with a duration attached instead of a spinner that tells you nothing.
Fixed
- Spin-up could hang forever on a sandbox that was working. gitvm run requested a terminal unconditionally, and xNAUT launches it without one, so SSH refused and exited before the remote command ran. xNAUT ignored that exit status and probed an empty port for seven minutes. Two of these calls were found still hung from 2 August, so it had been failing for at least a week. Every attempt to reproduce it by hand succeeded, because a shell has a terminal.
- The dev server never detached. Backgrounding it inside a subshell meant the remote command never returned, so the call held its SSH channel open for the caller's whole deadline while the page was already answering HTTP 200.
- A step that timed out but actually worked is no longer a failure. Spin-up now probes the URL before giving up, because whether something is serving is observable from outside. Deliberately narrow: only a caller-side deadline can be recovered this way, so a failed install still fails even if a stale placeholder answers.
- xNAUT stopped competing with the agent for the dev server. Locally the agent runs on the same machine and starts its own server to screenshot its work, so two servers existed for one project and the canvas showed the wrong one: a finished site on one port behind a holding page on another. Spin-up now adopts the server running in the design folder, and the canvas switches to the real site while the agent is still working rather than at the end.
- An unresponsive network drive could freeze the Designer. Adoption asks the system which process is listening, and that query walks every mounted volume, so a wedged network share blocked it indefinitely, on a five-second poll. Now bounded. Found when a backup jammed an SMB mount and the test suite hung on that exact call.
- The canvas could show [object Object] instead of your design. Worse than it looks: a status that never cleared kept the canvas on a spinner, so a finished site could not appear at all.
- A design could get permanently stuck on its own sandbox, and the holding page is now evicted the moment a real project appears.
Also in this line
- 1.13.5 and 1.13.6. The local runtime is built out of Unix tools, so the Windows build stopped compiling and 1.13.4 shipped with no installer for it. Local mode is macOS and Linux; Windows uses the sandbox. Both are fixed and 1.13.6 is complete on all three platforms.
If you have never been able to use the Designer, this is the release to try. It no longer needs anything from 48Nauts.
v1.13.3
9 August 2026The build stage rebuilt around one idea: a build should be able to tell you what it did. A durable log that outlives the run, a per-slice view of what actually changed, slices that can declare dependencies on each other, and an acceptance gate that reports a score instead of a verdict. Several of the ideas came from reading other people's open-source work: Human-Agent-Society/CORAL, lamalab-org/corral and cdknorow/coral, three unrelated projects that happen to share a name. One of them corrected a design we were a day from shipping. Every borrowed mechanism names its source in its file header.
Added
- A durable build log. Every build writes one append-only JSONL file with a level, source and timestamp per event, and it is kept after the run. The Build run pane gained Manager · Log · Files sub-tabs: the Log filters by level with live counts, filters by source, searches, tails, and can reopen any earlier build. Before this the manager held a single status string that the next event overwrote, so a build's entire decision history existed for a few seconds and was then gone.
- A Files view per slice. Changed files with line counts and an inline diff, measured from the slice's merge base rather than the working tree. An agent that has already committed shows a clean git status while having written hundreds of lines, so a working-tree view reports it as idle. The base is chosen by closest fork rather than by name; measured against main, a ten-file slice came out as 77 files and +8021 lines.
- Build slices can declare dependencies. The planner used to be told to avoid them, which capped parallelism at whatever happened to be independent. Work now splits the way it actually divides: independent slices run at full width, dependent ones wait, and if a foundation fails everything built on it is marked unreachable and never starts. A waiting slice holds no worktree, so an unreachable one leaves nothing behind.
- A bad dependency graph is rejected before anything runs. Cycles named, missing blockers reported, depth capped. A language model writes these plans, so a cycle is not a hypothetical.
- The acceptance gate reports a score, not a verdict. It always ran real checks and then collapsed them to an exit code, so "four checks failing" and "forty checks failing" were the same answer and nothing watching could tell progress from thrashing. It now reports passed-of-total. A gate that crashes and emits no check lines scores null, never zero; a crash is the absence of a measurement, not a bad one.
- Scores describe a commit. The gate runs inside a throwaway detached worktree of one commit, so a score cannot drift because an agent saved a file mid-run.
- Agents are interrupted when they stall, not on a timer. The old behaviour nudged everyone every five minutes, which breaks the concentration of an agent that is working and leaves a stuck one alone for four more. The score history is tracked and an agent is nudged only when it stops improving, and the nudge quotes the exact failing checks, since the gate already knows them.
- Agents on a project share notes. A directory of markdown notes, symlinked into every build worktree, so three agents cannot each independently discover the same broken assumption. Scoped per project and permanent, in the vault; readable in Obsidian, with a git history.
- The manager keeps its history. A levelled feed of what the manager decided and why, instead of its most recent sentence.
- Codex session cost. We already read how much of your Codex plan was consumed; now each session's tokens and an estimated cost, read from Codex's own transcripts. Cached input is priced separately, because on long sessions it dominates and ignoring it would overstate cost roughly tenfold. The figure is a list-price estimate, not a bill.
- Last activity per project in the sidebar. The newest of the last commit and the most recently modified file, so a project being actively edited does not read as nine days stale.
Fixed
- Agents never received their goal. The instruction was word-split on its way through the launch chain and the agent CLI took only the first positional, so every agent started with the prompt Read and the rest was discarded. Some explored the worktree, found the goal file themselves and carried on; others asked "Read what?" and stopped. Which behaviour you got was luck, and it made a missing prompt look like a flaky agent. The prompt now travels in a file, so no quoting has to survive the chain.
- Every agent was reported as dead. The liveness probe shelled out to pgrep -f, which fails for every pattern under some locales: it exits non-zero with empty output while the spawn itself succeeded. The caller answers "dead" by force-killing the session, so healthy agents were destroyed and their slices eventually marked failed. It now uses ps with basename matching, and every inconclusive answer is treated as alive.
- Healthy agents were nudged and restarted. The stall detector read the acceptance gate, a completion metric, as a progress metric, so an agent writing code for four minutes without flipping a check looked stalled. Nudges now require the score flat and nothing written, where "written" includes the agent's own status log, which git cannot see because most repos ignore *.log.
- A build could report success while missing a slice. Recovering an in-flight build rebuilt it from live terminal sessions, so a slice held on a dependency, which by design has no session yet, was silently dropped. The build then went green and merged without it. The plan is now persisted, and a build recovered without it refuses to consolidate.
- A dead slice no longer stalls the whole build. A hopeless slice stayed "running", and because consolidation waits for nothing to be running, the build sat there looking healthy. It now gives up after two restarts and says which slice died and why, and consolidation refuses to merge a build with a dead slice rather than shipping the survivors on top of a foundation that never landed.
- The status pills stopped blinking in chorus. One tab per session is enforced where tabs are created rather than in each caller, so a double click no longer produces duplicates; and the pills use the sidebar's state vocabulary, where exactly one state animates. Previously both "working" and "waiting" pulsed, so idle sessions read as agents mid-thought.
- The project list stopped flashing every three seconds. The status poll rebuilt every row instead of updating the dots, which also restarted the animation on each tick.
- Opening a new session starts the agent. It created an empty terminal instead; the same command was used for attaching and for opening.
- Sessions can be killed from the project page. There was no control at all.
Removed
- The agent pills in the top bar. The sidebar already shows each project's agent state, so the strip restated it in a second place.
Patches since 1.13.0
- 1.13.1. A design could get permanently stuck on its own sandbox. Opening it reported "Sandbox did not answer, destroying it and retrying" about a sandbox that was answering: running on the control plane, four hours left on the lease, HTTP 200 on its public URL. The design's own record had lost the sandbox id while the sandbox's state file still had it, and that combination wedges permanently, because reconnecting needs the first and creating a new one is refused by the second. xNAUT now adopts a sandbox it finds running, provided the control plane still knows it and the URL actually answers. The retry message also says why the sandbox did not start; it was a fixed string, so a genuine failure looked exactly like a slow boot.
- 1.13.2 and 1.13.3. Windows packaging, broken and then fixed properly. 1.13.1 added a retry around macOS DMG packaging, written as a bash function in a step that runs on every platform; Windows runners default to PowerShell, so that leg failed before compiling anything and 1.13.1 shipped with no .exe or .msi. Forcing the step to bash fixed that and broke the OpenSSL build instead, by putting MSYS perl ahead of Strawberry Perl. The retry only ever mattered on macOS, so the build step is now split by platform.
If you install from Homebrew, 1.13.1 and 1.13.2 were macOS-complete; only the Windows artifacts were missing. Windows users should go straight to 1.13.3.
v1.12.0
7 August 2026Run the full agent harness against your own model, and keep terminal sessions alive after the app closes.
Added
- Run Claude Code and Codex against a local model. Opt-in harness routing: when a local endpoint is configured and reachable, an agent is pointed at it instead of a dead default. The full harness, just not Anthropic. An agent is never handed a base URL that does not answer, because a refused socket makes Claude retry silently rather than fail.
- All three harnesses in the + menu, each routed its own way: Claude Code, Codex and Pi. Pi uses its own provider config; Codex needs its own model provider setting rather than an environment variable. "Local (your LLM)" also appears in the NautFlow and loom model pickers.
- Terminal tabs are Zellij-backed and outlive the app. A named tab runs inside Zellij and detaches on close, so quitting no longer kills a long-running session. Gated behind an opt-in while pane nesting is unfinished.
- The Validator's acceptance gate is actually executed. Before this, the only references to the gate in the tree were the prompt that wrote it and the reset that deleted it.
Fixed
- A fresh install started with a dead UI. A missing element was dereferenced on a path reached only when no chat session had been saved, and the exception stopped the event listeners and the first tab from ever being created. alert() is a no-op in Tauri's WKWebView, so the error was invisible.
- Claude local launch failed to spawn, from an empty working directory plus PATH and probe faults.
- Every harness URL now comes from Settings; nothing is hardcoded. A model mismatch that surfaced as a bare HTTP 400 is now caught and named.
- write_file creates parent directories. The Agent harness switch sits in AI Providers, not the Tasks Mode tab.
Changed
- Release CI updates the Homebrew cask on every tag, and installs tauri-cli with --locked. Without it, transitive dependencies re-resolved per build and a zune-jpeg bump broke the release.
v1.11.1
3 August 2026Fixed
- A new design could never finish its first build. Spin-up probed the sandbox URL once, right after starting the dev server, and treated a 502 as a dead sandbox, destroying it and retrying. But a 502 there means the tunnel is fine and npm install is still running, so each retry threw away the install and hit the same wall: the chat looped on "Sandbox did not answer, destroying it and retrying" while the design folder stayed empty. A gateway error is now a reason to wait, with the wait shown in the chat, and only a genuine no-answer destroys and retries. The in-sandbox wait for the dev server to bind also went from 20 seconds to 300; twenty was never enough to install a project's dependencies.
v1.11.0
2 August 2026Describe something and get a running application on a real domain; no build step, no deploy, just a link you can send. Plus the long-running freeze fixed for good, and two subsystems retired.
Added
- Designer. A tab in the project workspace that turns a sentence into a real, running application on a live hostname. A design is an actual project (Astro, Reveal.js or Next.js depending on what you asked for), scaffolded and edited by an agent, built and served in a sandbox, with the running site in the canvas and the chat beside it. Never a mock: the URL is shareable as it stands.
- Mobile companion. Your terminal sessions, files, git status, artifacts, task runner, and the Observatory and Multi-Agent Manager, on your phone over Tailscale. Nothing exposed to the internet.
- Validator. Before a build starts, the whole documentation chain is checked for contract coverage, stage completeness, cross-stage consistency, testability and build readiness, and the build is blocked on a FAIL. The report lands in the centre pane and you can talk to the Validator about it.
- Observatory. Every live session listed and one click from attaching, run rows that survive a reload, honest local-vs-sandbox labels.
- Help overlay for keyboard shortcuts, command snippets moved into a dropdown, and a work-log clock in the toolbar; one click to start, red while recording, click again for the summary.
Fixed
- The long-running freeze, both halves. Two independent causes, found weeks apart, in one build for the first time. Terminal output is now coalesced into one merged event per 16 ms, so a streaming agent no longer saturates the webview's main thread. And the PTY reader moved off the async pool onto its own thread, where a blocking read used to park one worker per open session. That is the reason keystrokes could stall for seconds with a few tabs open.
- Agent runs finish when the agent finishes. A headless claude -p can sit for minutes after its last message while it tears down. Runs now complete on the result event rather than waiting for the process to exit.
- Sandboxes are proven, not assumed. Spin-up starts the dev server, checks the public URL actually answers, and destroys the sandbox if it does not, instead of handing back a link that 502s. Size and lifetime now come from the template manifest rather than hardcoded numbers.
- A single corrupt project manifest no longer blanks the whole Projects board.
Removed
- Ralph, the first agent flow. Every part of it had a better owner by now: one shared runner for dispatch, the Observatory for cost, a fetched model catalog for model choice, NautFlow for the pipeline.
- The Live Error Monitor. It only collected while its panel was open, and it could not see agent runs, builds or sandboxes at all.
Upgrading from 1.10.x is worth it for the freeze fix alone if you keep long agent sessions open. Both mechanisms lived on separate branches until this release.
Earlier
- 1.9.213 Jul 2026Freeze diagnostics; backend panics written to a log instead of a silent hang. Per-chunk terminal logging made opt-in.
- 1.9.112 Jul 2026Project Management over MCP: list, search, read, create and conflict-safe updates of documents in a project vault.
- 1.9.011 Jul 2026Agent Loops, a visual builder with versioned definitions, bounded retries, approval gates and an emergency stop. Project-scoped Docs.