What's new

• Saved work has its own page, and agents can build pages you use. Saved work opens as a full page beside Today and Routines: what your agents made for you and what you kept, by kind and by who made it, with search. An agent can build an interactive page, such as a reading list or a tracker, that keeps its own data in Saved work. It opens in a window of its own with no internet. A new version runs only after you press Use the new version, on a card that says who wrote it and what it changes. Every change to a page’s data shows in its Changes, with Undo, and Who can use this says which teams may use it. An agent changes a page’s data only when you ask it: in a conversation, a task you start, or a routine you set up for that page.
• On a Mac, a socket an agent leaves in a run’s folder no longer breaks the team’s run list or Storage. The app refuses it as not a plain file, as it already did on other systems, and a file tool refuses to open one in the same words.
• An agent’s shell can no longer move its team’s runs out of the app’s view. Before, an agent that runs code could rename its team’s runs folder, or move the runs out of it, and the app then stopped showing the team’s earlier runs (they were not deleted). The sandbox now keeps the runs folder, the knowledge folder and the folders of the team’s 500 most recent runs where the app made them, in any spelling; writing inside them is unchanged. An agent’s shell is also refused the team’s agents folder and settings in any case of letters.
• An answer the app cannot save no longer ends the run. If the app could not write your answer to an agent’s question (on a Mac whose copy of the app’s file helper did not load, or with a full disk), it tells you, and the question stays waiting: answer it again in a minute and the run goes on. Before, the run ended and your answer was lost.
• What a task cost now includes a helper’s request that a stop cut off. When a task stopped at its limit while one of its agent’s copies was mid-request, that request was charged by Anthropic but missing from what the app recorded, so Usage and your limits could read low. The app now records it, marked as an estimate.

1.1.2 was built and not released on its own; its changes are the last four above. That is why the numbering skips it.

• A lead may make a small change to the code itself. On a team set to Lead and team with a project folder, when you write to the team yourself, in its chat or in Compare, a lead with Run code on may now make a small change itself: one file and at most 20 lines added and removed across all its changes in the run (an edited line counts as two), no dependency file such as package.json, nothing binary. It does this only when no member who runs code is better placed, and the chat says which it chose. Its change goes the way a member’s does: in a checkout of its own, never your working copy, then the project’s tests, Show me the patch before merging and the verification. A larger change, or one too long to show whole, is kept off and never said as Verified. The lead does not review its own change: to have it reviewed, ask a member who runs code. In a run your assistant, a routine, a trigger, an email, a task or another team starts, and in a one-to-one chat with the lead, the lead still reads the project only, and a change goes to a member who runs code.
• A change kept off your project is never said as Verified. When a member’s change could not go into your project, because it conflicts with edits already there, because you stopped that member, or because the model check held it back, the run now says NOT VERIFIED, why, and the branch the change is kept on. The lead’s write-up is told too, a one-to-one chat says it as well, and a restart while the run waits keeps it. A conflict is said as one with edits already in the file, whoever made them. In a task, a one-agent team’s step that the model check marked failed keeps its change on a branch of its own. A member’s change whose session ended on an error is no longer merged, or offered on a patch card, untested.
• A Word file with a chart keeps its original. A chart’s data is a small workbook inside the Word file. Bring your workspace now looks inside a workbook, document or deck embedded in a Word file for keys, as it does the Word file itself, and brings the original in when there is none; a key anywhere still leaves only its text. A Word file you brought in before as its text now says when its original can come in. A Word file holding something the app can’t look inside, such as an inserted object, a PDF, a zip, a font, or a video or sound, has Bring the original anyway, unticked, on its row and under Needs you. Ticked, it comes in with its original as it is, unless the app finds a key in the rest of it or can’t finish looking, and the import’s report and the Record say so.
• A link an agent plants no longer leads the app astray. A member that runs code can write in its run’s folder and in its team’s runs, shared and knowledge folders. Every file the app reads, writes, moves or removes there is now opened following no link on the way; a write is made as a fresh file and moved into place, so a link at its name is replaced, never written through; and a file with a second name (a hard link) is never read. A rating or an agent’s question the app could not read safely is not saved, and it says why. On a Mac, the app moves, removes and writes those files inside the folder it opened; making a folder and listing one still look it up by name, and the app checks afterwards that it was the same folder. What the app did not follow is on the Record, under Links the app did not follow.
• A Stop is final, and only runs the app made count. After you press Stop, nothing in the run’s folder can make the app treat the run as finished: a procedure’s next step does not start, and a team waiting on that run does not either. Then run another team… now says whether the team started, is waiting for a run still going, or could not start, and why. A member can make a folder in its team’s runs folder under any name: the Record no longer shows one as a run, and rating, drafting a skill from, waiting on or deleting it is refused, in words. The automatic archive moves only runs the app made, and agents are not offered such a folder as earlier work, though it still shows in the team’s list of runs. A skill is now drafted only from a run that has finished.
• Export everything copies only plain files from your team folders. It leaves out a link, a file with a second name, and a file that takes far less room on disk than its size says (a sparse file, which an agent can make in a moment), so a file an agent linked there from outside your workspace does not go to your Desktop, and it tells you how many it left out. A file an agent keeps growing is copied as it was when the app opened it.
• Saving your API key empties every other name of your .env. Every line of that file is a credential, so a second name of it (a hard link) is now emptied whole when you save or remove your key, not only its key lines. Your .env itself keeps all its settings.
• The app’s own git leaves your project’s git settings alone. A member that runs code can write in its project’s git folder. The app’s own git now deletes and makes branches without rewriting the project’s git settings, and that member’s shell can no longer write the file git rewrites them through. The first time the app uses a project after it opens, it notes the filters, merge drivers and signing settings your git settings hold; until it is closed, its git runs no filter or merge driver added or changed since, and signs nothing if a signing setting changed, so git-lfs and your own settings keep working. Where your git settings bring in a file from a folder an agent can write (a team’s folder, a folder you let an agent change, the workspace), the app’s git stops and names the file; a file you bring in from anywhere else, such as ~/.gitconfig-work, keeps working.
• Your Executive Assistant reads only what it needs. In your workspace it reads every team’s folder, its own folder, About you, the workspace rules and its skills’ files, and nothing else: not your settings, the files your conversations are kept in, the Record or the app’s other records, and not a folder the app adds later. A team’s folder still keeps part of your chats with its agents, and it reads that to check on their work. To search what files say it uses the app’s own search on every model, which says what it left out and passes over a file with a second name; on Claude models that search is slower than before in a very large workspace.
• A search no longer holds the app up. On another AI company’s model, an agent’s search of what files say reads each file apart from the rest of the app, so a large file or a search pattern that takes a long time no longer stops everything else, and Stop ends it. A search for files by name works the same way. Both stop after 60 seconds and say so, and a search of what files say passes over files over 10 MB and files that are not text, and says when it did. Your Executive Assistant’s search keeps the same limits on every model.
• Your data says more of where your data goes. The Your data section of Settings → What it can do now also names Vercel’s AI Gateway, Google for Gmail and the connectors you add, beside Anthropic and the access service, and says what the app keeps on this Mac from a connected mailbox.

• Bring your workspace. Used Claude Code or Cowork with folders of your own? Choose the folder (Settings → What it can do → Bring in a workspace…, New team → From a folder on this Mac…, or the row on Today) and the app shows what would come in: one line per team, and what needs you. Nothing is saved until you press Bring it in, and your folder is only read, never changed. New members can only read until you tick the tools they asked for. Key and password files, links, and another app’s settings and hooks are never brought in, and a Word file with a key, or with an embedded file in it (a chart’s data, another document), comes in as its text only; its pictures don’t stop it. A team’s right-click menu has Team rules…: a text every member of the team reads on every task.
• Leads take the smaller way. A team’s lead now chooses how each request is handled, and says so in the conversation and on the Record: it answers, does the work itself, hands it to one member, has one member’s work reviewed by another, splits it across members, or asks you. When unsure, it takes the smaller one. On a team with a project folder, the lead never changes or runs the code: it reads the project, and a change goes to a member who runs code.
• Your Executive Assistant does small work itself. It answers questions, looks things up and does small work for no particular team, and hands a team’s work to that team. It has a daily limit of its own, 500 credits unless you change it in its editor. Past it, it does no work itself until the next day and its routines stop, but a message from you is still handed on to a team, on the app’s daily limit.
• Parallel copies, read only. A team’s agent working on Haiku 4.5, the one model copies have passed their check on, can start copies of itself in work you start (in a team’s run, only its lead or its one agent): a copy reads files in its agent’s folders, or searches and reads web pages, and nothing else. It cannot write, run a command or use a connector. A team that never changed the setting has Parallel copies at up to 5 at once, and across the app at most 10 work at a time; raising it asks for Touch ID if that setting is on. The chat shows each copy with a Stop of its own, and Stop copies stops them all while the agent goes on.
• Agents keep their finished work in Saved work. An agent that may write files saves a finished report, draft or plan to Saved work itself, and can revise a piece its own team saved, with the earlier version kept. It cannot change a piece you saved or another team’s, a Practice run saves nothing, and each save is on the Record. Agents can no longer open, change or search Saved work’s files, the app’s trash, or the earlier copies the app keeps of agents’ memory: to give an agent a piece, attach it to your message.
• An agent’s questions come with choices. When an agent stops to ask you something, each question has a short label and, where it is a choice, two to four options with a line on what each means: pick one (or several, where the question allows it), or write your own answer under Other. A question only you can answer in words still has a box. Skip still lets the agent decide.
• Spending is now Usage, one list at a time. Settings → Usage starts with a meter for each limit that applies now, such as today against your daily limit and each team’s monthly credits; a meter changes colour at 80% and again when it is used up. Under a short summary (this week, your weekly average, all time), pick a period (Today, Last 7 days, Last 30 days, This month, All time) and a view (By team, By agent, By day, By week, By task) to see one list, with your Executive Assistant’s own work as its own row.
• Calendly connects. Signing in to Calendly from Discover stopped with “Calendly refused this app’s registration”. Calendly now sends your browser back to this Mac at a “localhost” address it accepts, and the connector is saved.
• File tools no longer follow a link past the folder rules. An agent’s file tools refuse a link, or a file with a second name (a hard link), in a folder the agent can write, so neither can lead to a file the folder rules keep it from. With another AI company’s model, through the AI Gateway, the app opens the file at exactly the place it checked, and your Mac refuses the open if anything on the way became a link. Known issue: with a Claude model, the app checks the path and Claude’s own tool then opens it, so a link that a member who runs code makes with its shell just after the check can still be followed. Your Mac’s sandbox lets that shell make a link, though not a second name of a file it is kept from.
• Leaner short messages. A short message such as “Thanks!” to a one-agent team or to a team with a lead now takes one model call. Measured with a real model, that call sends about 9,400 tokens to a one-agent team and about 12,300 to a team with a lead. What you pay depends on your model and on what the AI company caches.

• Connectors, redone. Settings → Connectors has two tabs: Yours, what you have connected, and Discover, what you can connect. Connecting is one sheet. Press + on a service you sign in to and the desktop app opens its sign-in page in your browser by itself; a key is tested before it is saved, and a wrong one saves nothing. Then the same sheet asks who can use it and what it can do.
• Gmail connects with Google sign-in: Settings → Email → Connect Gmail, then Open Google’s sign-in page. Google first warns that it hasn’t verified the app, because Google hasn’t reviewed it: press Advanced on that page, then the link to go on to the app. The app checks it can read and send before it saves anything. An app password still works, under Advanced. A build without Google sign-in says so, and connects Gmail with an app password only.
• Signing in follows “Require Touch ID for approvals”. Signing in to a connector, or to Gmail with Google, asks for Touch ID while that setting is on, as every other approval does, and also whenever the Record can’t be written. Otherwise your press is enough, and the Record marks the sign-in “without Touch ID”. On, a Mac that can’t ask for Touch ID can’t sign in.
• Settings’ “Leave without saving?” always offers Save, and that Save stores everything it is asked about: settings on any tab, Email rules, a new key, a procedure, someone you were adding on People, a connector. If one is refused, Settings stays open on it with the reason. A Save can’t sign in to Google for you, and says so. The Touch ID switch no longer flickers while it waits for your finger, and switching it no longer makes Settings ask about unsaved changes.
• “See full instructions” shows what each agent is sent, whatever the team’s structure: a one-agent team’s agent, a step of a sequence and a seat at a round table each see their own part, as a run you start sends it. A member a one-agent team gives no work is told so.
• A change to how a team works is on the Record: its structure, a sequence’s order or a round table’s rounds, each with what it was and what it is. In Settings → People → Teams…, a team role that would leave a team without a sponsor asks first, before its routines, automations and procedures stop.
• A file automation waits for a write to finish. It waits for the file to hold still, so a file written in pieces, or saved by an editor that swaps in a copy, starts one run on the finished file. A file that keeps changing for more than 30 seconds starts a run then anyway, which says the file may be half-written, and another once it stops changing. Known issue: an automation that watches one file, rather than its folder, can stop hearing it after such a save, until the automation is saved again. Watching the folder hears every save.
• Plainer. In a team that works in sequence, the last member now reviews the work, and the Plan, build, review, verify task is reviewed and verified: a check is a team on another AI company’s model. In a chat with one agent, a note can’t reach a reply that is already running, so the note box says so and Add note is not offered. A Practice run never changes About you, and nor does the work it hands on.

• Spending is in credits: one credit is one cent of AI cost. Limits: a daily limit for the app (2,500 to start; a team or member can have a lower one), the most per task (500), a team’s monthly credits, and an invite’s included credits. Your old limits carry over ($25 is 2,500 credits). The daily limit’s stop lifts by itself the next day; Pause all work stays until you resume.
• New: Require Touch ID for approvals (Settings → Pre-approvals). It starts off, on updated apps too, so approvals no longer ask for your finger: another AI using your screen could click them, and on a Mac with Touch ID the Record marks each “without Touch ID”. Turning it off takes an Admin or an Owner and Touch ID. Signing in to a connector always needs Touch ID.
• Giving an agent more (tools, a connector, a skill, a folder, email or texts, a higher daily limit, the lead role) asks for Touch ID when that setting is on, wherever it is done; lowering never asks. A Member can no longer do it: that needs an Admin or an Owner.
• Safer with code. The app’s git no longer runs git hooks. Where your project holds a git repository of its own (a submodule), the app won’t land, merge or commit, and says so. Undo of a run puts back only what that run changed, and stops rather than overwrite your later changes. Runs from before 1.0.0 may not be undoable; use git.
• Export everything no longer copies the mail fetched for your agents. An export made with 0.9.0 may hold it: delete it if you don’t need it.
• Changed your email? An email with no role here can still view, and is told whom to ask. The Owner or an Admin sees it in Settings → People and can give it a role, or press Same person… to give it the role of an email already listed. Each is on the Record; only an Owner can give the Owner role.
• Counted right. A team made under a name another team used to have is charged for its own work only. A team’s daily limit now stops its sub-teams too. The app’s own limits count Fable 5.1 cache reads at their published price, $0.25 a million tokens, not four times it; an invite’s included credits will too once its access service is updated.
• Plainer. When a team answers your question, Today lists it as answered, not as one to look at, and names each team by its name, never its folder. Bring your context no longer warns over a plain fact such as “I keep my API key for Stripe in 1Password”. Saved work says what can be saved and how.

Roughly in the order you would meet it.

Getting started

• New: Bring your context, from ChatGPT, Claude, Gemini or Grok. It is on Today while you have no teams, in the welcome until you make your first team, and under Settings → About you. Copy the prompt it gives you into the assistant you used before, and paste that assistant’s answer back. Before anything is sent, private keys, secrets in links and card numbers are taken out, and so are keys and tokens in a form the app knows or that the text calls a key, token or secret, and passwords, account and ID numbers where the text says what they are; the window says what was taken. Read it goes to your usual model, or to a Claude model when your usual one runs through the AI Gateway, and not to an AI company a team’s rule leaves out; the model is given no tools. The window says which model reads it, and if, by the time you press Read it, the model it goes to has changed, it asks you again. The most a read can cost, which counts the model being asked to go on, up to three more times, when its answer runs long, is held against your spending limits while it runs, and a read that any of them has too little room left for is not sent. The Record lists each read with what it cost, and says when that was more than the most it could cost. Then you choose what to keep: lines for About you, which you can change first; notes for your Executive Assistant, each ticked or not; and suggested agents, some in a new team of their own, and Routines, each on a card of its own that makes nothing until you press Create or Turn on. About you and the notes are kept only when you press Save, which adds the lines and the ticked notes and keeps each file’s version before; an agent you create, with any new team made for it, or a Routine you turn on is kept at once, and Cancel keeps nothing else. It is a one-time copy: it won’t stay in sync, and nothing is sent to the other assistant.
• About you describes you, and gives no agent permission. Nothing in About you grants a permission either way: what agents may do is set in their settings, and every agent is told that About you approves nothing. As a best effort, the app holds back the lines it drafts from the other assistant’s answer that read like orders to agents, such as to follow instructions in email, web pages or files, to act without checking with you, to share a password or an API key, to switch off a check, or to approve anything in advance, even when they say not to, such as “Does not want agents to share passwords”; it lists each with what it is about. It goes by the wording, so it misses some, and it sometimes holds back a fact about a person, such as what your own assistant may do; a fact about your work, such as “Handles orders from the website”, is kept. If a line held back really is yours, you can type it in yourself, and read About you before you press Save. What you keep in About you and the notes is marked as brought from another assistant and reviewed by you.

Your agents

• New: use an agent again, in another team. In a member’s settings, Copy to team… makes a copy in the team you choose, and Save as a saved agent… keeps one in Settings → Saved agents, with Use in a team…, Rename… and Delete…, which moves it to the app’s trash. New agent can start from a saved agent too. Every copy is separate, with files of its own: changing one never changes another. Its lessons come with it, each listed so you can drop any; its memory comes only line by line, as you tick it, and none is ticked to start with. Its folders, notes folder, connectors, email, texts and permission to spend money stay behind for the new team to set. What only limits it comes with it: its own daily limit, its website list, and the names of the skills it was kept to, if it was — it gets its new team’s skills of those names, or all of them if it was kept to none in particular, except where Settings → Skills sets who may use a skill, which decides for every member. A saved agent kept before this version has no website list, and its card says it can read any site. It runs code only where that team can. Nothing is made until you press Create, or Save for a saved agent, and Create asks for Touch ID when the copy could do more than read there. No agent can change the saved agents.
• A team’s rule for AI companies travels with its lessons and memory. When the team an agent comes from limits which AI companies may receive its data, the team it goes to, and every team above, beside or under it, is held to that rule too once any of those lessons or memory lines arrive. The card says so before you press Create, refuses a model the rule would refuse, and names whom the rule would then stop on any of those teams — past two, how many and one of them — and it makes nothing until you leave those lessons and memory out, or change the model the rule would stop. Copy to team… is on both teams’ Records, each naming the other only as “another team”; a copy made from a saved agent is on the Record of the team it joins, and saving one is on its own team’s Record.
• An agent can be suggested from a saved one. Your Executive Assistant and a team’s lead can propose a new agent based on a saved agent. Its card says what it is based on and lists every lesson it brings — its newest 200, if it has more — each one to keep or drop, and, for a saved agent with lessons, says so if it has since been deleted, renamed or replaced. Its website list, skill list and daily limit come with it, as a copy’s do, and its card says so. A lead is told the saved agents’ names, not what they do. Still open, and older than this: a proposed agent’s card does not check the model it names against the team’s rule for AI companies, so an agent that rule refuses can be made, and is then refused whenever it is given work.

Tasks

• New: a team’s lead can propose a task, and nothing runs until you apply it. Instead of describing the work in its reply, a team’s lead, or a team of one agent, can put a task in front of you — one per reply, at most three waiting, and none while all work is paused. The Executive Assistant does not. It is a card under Needs you in Tasks, counted on Today and in the menu bar, and its notification says who proposed a task, never what. The card shows what it would do and why, who does each step and which only look, and the budget, which you set, within what the team may spend in a day and your spending limit per task. Rehearse runs it with every step only looking, and shows what that cost. Edit opens New task filled in, on the same team, and starting it from there unchanged asks what Apply asks. Not now puts it aside. Apply needs someone who may change the team’s agents, and asks for Touch ID when a member of the team, in a step that does more than look, could write files, run commands, send email, use a connector or send requests to your dev server, or holds the tool for clicking and typing on web pages, which no agent can use yet — and, in a step for the whole team, a member of any sub-team the lead could hand part of it to, named with its team — which the card lists before you press it. A proposal made in work nobody was watching, such as a Routine’s, says so first.
• New: + Add a teammate, on a task that is still going. On a task on one team, add one more member of that team to work after its last step, from what that step produced, and tick it if they should only look. It only adds: the steps already there stay as they were, and the new step shares what is left of the budget, never more.
• A task’s budget is no more than your spending limit per task. Each step of a task stopped at Settings’ Spending limit per task, while the task’s budget could go past it: a task given $20 under a $5 limit could spend $5 a step, so the limit held no task as a whole. Now the whole task is held to it — one from New task, a proposal or Continue, and a run from Procedures, whatever budget its procedure was saved with — and a limit lowered while a step runs holds that step too. New task, a proposal’s card and Continue refuse a budget above that limit and say which limit it is, and a step stopped by what was left of its task’s budget says so, not to raise Settings. A task given more before this, or before the limit was lowered, is offered a budget within it beside Continue — or, once it has spent that much, told to raise the limit — and + Add a teammate still adds to it.
• New: agents can bring in a teammate, off until you turn it on. In a team’s own limits, “Teammates may join tasks” asks for Touch ID to turn on. Then an agent working on a task — one started from New task or Procedures, or a proposal you applied, never a chat — can bring in a teammate from its own team, at most two in a task; a teammate it brought in cannot bring in another. The teammate works as itself, with its own permissions, and can do only what both it and the agent that asked may do, their rules in Settings → Email, their daily limits and whether they may start helpers among them: one that could do anything the asking agent can’t is not brought in, and the agent is told why, having been told beforehand which teammates it can bring in. It works the way the step does — if the step only looks, or is a rehearsal, so does the teammate — its spending is part of the step’s and counts against the asking agent’s own daily limit too, and it stops when the step’s budget is spent, or what is left of that limit, and code it writes goes on the task’s branch, to reach yours only when you land the task. Stopping the agent that asked stops its teammate; stopping the teammate stops only it. Never in work nobody started by hand: a Routine, an automation or an incoming email. Each join is a line in the conversation of the step that asked and on the Record, with who asked, who joined and who turned joins on, and in Tasks the teammate is drawn under that step, marked as brought in by the agent that asked. And when a step’s lead hands work to a sub-team, what the sub-team spends counts toward the task and is held to what is left of the step’s budget.

Watching work

• New: What is it doing?, and Check on it. In Tasks, a working task has What is it doing?, and each agent working in it has a magnifying glass that asks the same of that agent; in a task of several steps, open the step that is running. It answers at once, at no cost, from what the app recorded: how long it has run, and since its last action; how many actions and steps it has taken; what it has spent; whether it is waiting for you; its last few actions; and signs that it may be going round in circles, said as “Possible loop, worth a look”, never as a verdict. Check on it goes one further: a short reading of its recent actions by the cheapest Claude model the team’s rule allows, which has no tools and can do nothing. Its price is on the button before anything is sent, as the most it should cost — a few cents — and a check that answers at once costs a fraction of that; one that costs more than shown says so on the Record. The answer says whether it is getting somewhere, going round in circles, stuck, waiting, or finished and still going, or that it can’t tell; points to the actions it read, as the app recorded them; and if it says it is getting somewhere when the app counted a possible loop, says so beside it. Stop is beside it, and the check never presses it. A check is paid from the team’s spending, not the task’s budget, and each is on the Record with what it cost, and with nothing the agent wrote. You can also ask your Executive Assistant, or a team’s lead about its own team’s tasks, what a task is doing: it reads the same facts. It is told to pay for a check only when you ask for one, and it can pay only while answering a message you wrote to it yourself, once per message and under 5¢; a dearer check is made only from Tasks. Not yet: the app does not point out a possible loop until someone opens What is it doing? or asks about the task, and a team whose rule allows no Claude model gets no check, which is said above its greyed-out Check on it.

Code and your project

• New: two shapes of task for code, each ending in Land. On a team with a project folder and a member who can change code, New task offers “Plan, build, review, verify, land” and “Build, review ×N, verify, land”; elsewhere they are greyed out. Reviews and the verify only read, from a copy of the task’s branch they cannot change. In the second, every member who can change code reviews — all but the one making the last check, below, and any a rule on the work refuses — up to three at a time, and a fourth is shown waiting its turn. A member checking its own work is marked Self-review or Self-verify. Where the team has a member who can change code on another AI company’s model than the builder’s, and every rule on the work allows it, a last check by that member is added; otherwise there is none. These tasks, and any other the app tried to land, now end in a Land row in Tasks that says whether it is waiting for you, landed, landed and then undone, not landed, not landed yet because its Land card could not be drawn — the team’s chat says why — or had nothing to land, and, once there is a Land, opens it.
• A task’s build whose tests fail stops the task there. Before, a step that built code whose tests then failed was counted as done: the reviews read a branch without its work, and the task finished with nothing to land. Now the task stops at that step and says where the work is kept, off the task’s branch, and Continue picks it up from there; on a team, members its lead set to work after that do not start. When a worker’s changes conflict with another’s on the task’s branch, the task stops at that step too, the members set to work after it do not start, and it says whose work is kept where — but that work is not carried on: Continue runs the step again from the task’s branch. Two cases are not covered yet: “Just do it”, with no member chosen, on a team of one agent or on a team set to In sequence.
• After a turn whose tests failed, your next message carries on from its work. In a chat with an agent that writes code, or the run of a team set to Lead and team, work whose tests did not pass is kept off your branch, as before. Now the next turn starts from that work — on a team, when its lead gives that same member work in it — and the agent is told why it did not merge, what it did, and the test command it has to pass. Only work whose tests failed is carried on — never work you stopped, a change you declined, or one that could not be merged. When it does merge, you are shown the change first, both turns on one patch card, even on a team that does not ask to see patches, and no standing approval answers that card. A turn that adds nothing merges nothing.
• New: Continue, for a task that did not finish. A task you started from New task that stopped, failed, or was cut off by the app closing has Continue in Tasks for as long as it can be continued, not only for a day after it ended, and a finished task whose work you have not landed, kept or discarded stays in Tasks as long, with Land…, Keep branch and Discard… (Tasks shows at most 50 runs, so an old one can drop off the list). It runs only the steps that had not finished, on the same branch, checked against the team’s rules as they are now, so a rule added since applies and may refuse it. What the task already spent counts against the same budget, including what a step had spent when the task was stopped, by Stop or Pause all work, or the app closed; if the app closed before it could record that, Tasks shows what the task spent as “at least” the amount it could record, and Continue asks you for a budget. Once the budget is spent, Tasks offers a larger one beside Continue, up to your spending limit per task. It never goes past a step where someone said No, and it is not offered for a rehearsal, for a task that began as an agent’s proposal, or for one whose work has since been landed or discarded. Undo the Land puts a task’s work back on its branch: Tasks lists it again with Land… and Discard…, as work not yet landed. A commit made on the task’s branch that its Land did not take stays as you made it, and landing the task again lands it once: a line you moved is where you moved it, and a file you deleted stays deleted. Where your branch has changed since in a way that cannot merge with it, that commit is kept apart in git, and Undo and the Land’s row in Tasks say where. Work that cannot be put back at all is said so, with git’s reason, in Undo’s answer, the Land’s chat and its row in Tasks, and the app tries again on its own, a minute later and then less often. An Undo, a Land, a team’s merge into your branch and a run’s snapshot of your project take turns in your project, never at once. A task is continued once; if its continuation stops too, continue that one.

The beta

• Invite testers: other companies’ models, once we switch them on. The beta service can now run models from AI companies other than Anthropic for an invite, with no AI Gateway key of your own. It is switched off for now, so nothing changes yet: the model menus still offer Claude’s models only, as before, and nothing is sent. Once it is on, the models it runs appear there by name; a request to one goes through the Agent Platform access service and then Vercel’s AI Gateway, so a team’s rule for which AI companies may receive its data has to allow both, as well as the company that made the model; and it counts against your beta limit as a Claude request does. One change reaches invite testers now: a request the access service had handed to Anthropic when the connection was lost — any it cannot tell was never sent — counts against your limit, as a stopped one does. Before, it counted for nothing.

Safety

• Three ways for another program on your Mac to run its own code as Agent Platform are closed. Electron, which the app is built on, can be started in ways that run another program’s script as the app, and until this version a script handed to Agent Platform that way ran — we tried it. Every build now turns off three of those ways — starting it as plain Node, a setting that loads a script first, and its debugger — and a build with any of the three on is not published. Nothing you do changes, and neither does installing: this version is still not signed by Apple, so Open Anyway is still the way in — and until it is, macOS itself still lets another program load its own code into the app.

The Record

• The Record says what a Land and an Undo did. A task’s Land is on the Record under its task, as the change it made to your branch, with its merge. Before, every Land was listed as a run that changed nothing and was worth a look: on Today, in the export and on the weekly receipt. A Land you declined, or that nobody answered, says so in its own words. Undo, of a Land or of any run, is now a line of its own: who pressed it, which merges it reverted or which checkpoint it put back, and whether it finished; the run’s line says it was undone. Pressing Undo again says it was already undone, where it said later work depended on it. A Discard or Keep of a task’s unmerged work is on its team’s Record.
• More ways of typing a password into a command are written as “…”. The lines a code run writes about the team’s test command kept the command whole, with any password typed into it, on every run; they are now masked as the team’s settings line is, and so is what the run’s folder keeps of it, and what an agent is sent to fix the tests. The masking now also knows a password after mysql’s -p, sshpass’s -p, a registry login’s -p (az’s and expo’s login too), redis-cli’s -a, the mongo tools’ -p, sqlcmd’s and zip’s -P, 7z’s -p, openssl’s -k, smbclient’s -U user%, twine’s -p, the ldap tools’ -w, gh secret set’s -b and --body, dotnet nuget push’s -k and codecov’s -t; the token after vault login, cargo login and snyk auth, after their own options too, and ngrok’s authtoken; a password fed by <<< to op signin or wrangler secret put; a password set in SQL with ALTER USER or CREATE ROLE … PASSWORD '…', E'…' or $$…$$, the role’s name in quotes or not, MySQL’s IDENTIFIED BY '…' (and \"…\" inside a quoted command) and SET PASSWORD, or MariaDB’s USING PASSWORD('…'); curl’s -u, and its proxy’s -U and --proxy-user, however they are written, a space in the password included; cookies typed into curl’s -b or --cookie; a token fed by <<< to a flag such as gh’s --with-token; a value set under a key’s name with npm, aws or git config, or inside another setting, as kubectl’s --from-literal=password=…; a git setting typed into a command that can hold one — -c http.extraheader=…, or a credential.…, ….password or ….token setting, and the value in GIT_CONFIG_VALUE_… or GIT_CONFIG_PARAMETERS; names such as STRIPE_SK, GH_PAT and DB_PWD, and flags such as --passwd, --pw and --bearer; a header named like a key or token; a password in a JSON body or a .netrc line; a secret inside a quoted value; a key in a web address’s query, in a Telegram, Slack or Discord webhook address’s path, or as its user part, including an address an agent opens; a Bearer token; and the shapes of GitHub, GitLab, npm, Stripe, AWS, Slack, Hugging Face and PyPI keys. A shell variable such as $TOKEN is kept as typed, except in single quotes, where it is no variable and is what is sent. A setting about a key, such as KEY_LENGTH=32, USE_TOKEN=true or --token-budget 1000, is kept as typed when its value is a number, a switch or one short word. So is a git setting under credential.… with such a value, such as the helper osxkeychain, and the value in GIT_CONFIG_VALUE_… beside a key that holds no secret, such as core.autocrlf (only a switch or a number when its key is not in the command). These are the common forms, not every form. What is already on the Record stays as it was written: changing it would break the chain that shows nothing was changed.
• Moving the clock back across midnight no longer breaks the Record. Flying west across midnight, or a clock put right, made the app say entries had been removed and a receipt issued before no longer match, and the next start could give two entries one number. New entries now go on in the file that holds the Record’s last entry, or in a new day’s file when its name sorts after every other, and the Record is read in the order of its entries’ numbers, so a Record an earlier version split this way checks again, even where one day’s file holds two separate runs of entries, and still checks after the next entry, unless that version was started in between and gave two entries one number.
• Entries cut from the end of the Record stay shown as cut. When the last entries of the Record were deleted, the app’s own next two entries made the check pass again. Now the Record goes on after the last entry it had reached, so the gap is shown however much is written after it, and putting the deleted entries back makes the Record whole again. The same holds for a last entry replaced. If one of the Record’s day files cannot be read, nothing more is written to the Record until it can, and the check names the file: before, the next entry could take a number already used. While nothing can be written to the Record, all work is paused, because no spending limit can see what is not on it: the sidebar says why, and work starts again by itself once the Record can be written. A protected setting saved meanwhile is kept, and goes on the Record once it can be written, so it is not undone at the next start (it holds 20,000 of them at most, a run of saves of one file folded into one, and the app’s log says if it can hold no more). A change made to one by another program is still caught: at the next start, or, while one of the Record’s day files can’t be read, once it can — the app’s last save may be in that file, so until then nothing is accepted or put back, and the sidebar says so. The same holds while the file the app keeps those saves in can’t be read: all work is paused, the sidebar names the file, and work starts again by itself once it can be read. A setting saved in the app over such a change is put back with it, to the version the app saved before that change, so a save of your own made over it is undone too: make it again in the app. Dismissing the notice of a change made outside the app while a day file can’t be read clears only the changes it showed you. A save cut off by a crash before the file was written is not called a change made outside the app. Stop everything works meanwhile, and stays on the page, so you can make a stop that lasts after the Record is back. The end of the Record is also kept when the app’s marker of where it ended is deleted, or the end is rewritten under one more entry: that stays shown until you dismiss it in Settings → Storage, which accepts the Record’s end as it then is. An entry cut short by a crash or a full disk no longer takes the next entry with it, and a day file named after tomorrow takes no new entries.
• The weekly receipt says what happened to each approval and each refusal. A proposed task you changed and started counts as approved by a person; a Land stopped before anyone answered says so; a proposal that could not start is not counted as a second approval; none of them reads as “an outcome this receipt could not read”. A refused use of one of the app’s own tools says what it was, such as bringing in a teammate, proposing a task or starting a helper, instead of “use a connector”.
• The Auto model router’s cost is counted. With Auto on, the call that picks the model is on the Record as a cost: what the AI Gateway says it cost, or an estimate marked as one when it says nothing. So it counts against your limits, in the cost report and on the receipt.

Smaller fixes

• Smaller fixes. New task no longer hands the work to someone else when the member you chose is no longer on the team — removed or renamed since you opened the sheet: it refuses, and says who. A team where one member’s model is one the team’s own rule for AI companies does not allow can now run a task in which that member has no part; before, it failed at its first step. A task started with Run as a task from another team’s conversation, or your Executive Assistant’s, is now checked as each step starts against that team’s rule for AI companies, or every team’s: one tightened while the task runs refuses the next step before it begins, where before that step failed once it had begun. Nothing was sent either way. Pressing Stop or Keep branch in Tasks redraws it at once, not up to two seconds later, and a proposal waiting there no longer shows a clock that looks as if it is running. A proposed agent’s card fits a narrow window.

Roughly in the order you would meet it. What was called Jobs, schedules or scheduled tasks is now called Routines, everywhere: one thing had three names. The entries below this one keep the names they were written with.

Starting work

• New: start a task from one sheet, and nothing runs until you press Start. Run as a task, under the message box, opens the New task sheet, and so does New task in an empty Tasks panel. Choose the team, say what you want in a sentence or two, and choose how it runs: “Just do it”, or “Plan, build, review, verify”. Then choose who does it, a budget for the whole task, and whether to see each plan before it starts. Rehearse runs it changing nothing, and costs what its model calls cost. A budget above what the team may spend in a day is refused, and on a team that asks before starting work every plan is shown whatever you tick. In “Plan, build, review, verify”, reviewing and checking only look; on a team of one agent the review is that agent’s own, and is labelled Self-review, not Review.
• A step for one member runs that member alone. A procedure step that named one member used to ask the team’s lead to pass it on, and paid for the lead’s planning either way. Now only that member works, within the task’s budget, and a team that asks before starting work still shows its plan first. A step whose plan was declined, or not answered within 30 minutes, does nothing, and the task says so; before, its planning reply was handed to the next step as if the work had been done. Inside a task, a lead can no longer start a side chat with a member, which the task’s budget and approvals did not reach.
• New: Plan first. Tick it under the message box in a chat with one agent, or on a team with a lead or a team of one agent — not with the Executive Assistant. The agent plans, changing nothing, and shows you the plan; the work starts only when you press Run this plan, which asks for Touch ID, as every plan approval does. On a code agent nothing runs before that, not even the project’s tests. A standing approval never answers a plan you asked to see. Regenerate and Edit & resend now send a message the way it was first sent, with Plan first, Plan only or Practice run still on.

Watching it, and stopping part of it

• Stop one agent, not the whole task. In Tasks, when several of a task’s agents are working, each has a Stop of its own: that agent stops, the others keep going, and it is not started again. Code it had half written is not merged into your project: it stays on a branch of its own, listed in Tasks. Only a person can stop an agent, and the Record says who stopped which one. When the agent you stop is a run’s lead, its only agent or the Executive Assistant, the run ends “Stopped”, not failed. An agent working alone has only the task’s own Stop.
• What a task started is drawn under it. A sub-team’s run, and the runs a procedure’s steps started, are shown under what started them instead of beside it as tasks of their own; one still working after what started it has finished stays under Working. A task’s one-member steps are listed under it in the order they ran, each named by its part — Plan, Build, Review, Verify — and not among that member’s own chats. Procedures are in Tasks while they run and for a day after, each step with its own start and end; Stop on a procedure stops the step that is running and starts no more; and Settings → Procedures has Open in Tasks. While the Executive Assistant’s turn and the team run it started are both working, the Tasks count in the sidebar says one and Today lists two.
• New: an agent’s own checklist. An agent allowed to “Keep a to-do list” can keep a checklist, shown under it in Tasks as “the agent’s own checklist”. It is the agent’s own account of its work: ticking every item never marks the work finished or passing, and it is not written on the Record. On AI Gateway models it replaces a to-do list that nobody was shown.
• A run cut short by a limit is Stopped, not Done. A chat, a team’s run or a routine’s run that ended at a step, length or turn limit was filed as if it had finished, or as an error that did not say why. It is now Stopped, with the limit it reached, in Tasks, on the Record, on the weekly receipt, on the routine’s row and under Today’s “Last window”. What it wrote before it stopped is still handed on, headed as written before it stopped, so that it is checked before anyone relies on it. Its code is still tested and merged as before, and the stop says what was merged.

Code and your project

• A task’s code lands once, when you say so. On a team with a project folder, every step of a procedure, or of a task from New task, now works on the task’s own branch, so your branch does not change while it runs; before, each step merged into it as it finished, and a task stopped half-way left half its work there. A finished task opens a Land card with the whole change, its files and the steps that made it. Land it asks for Touch ID and merges once, into the branch the card names; if you have switched branch, or that branch has moved, nothing is merged and the card says why. “Approve all” leaves Lands waiting, each for its own card, and Undo the Land reverts exactly that merge. A reviewer reads the task’s branch from a copy it cannot change. A stopped task opens no Land: its branch is listed in Tasks as Unmerged work, with Keep branch and Discard…, which asks first and keeps the commits in git. A finished task you have not landed stays listed, with Land… and Discard…. A rehearsal opens no Land. Chats that write code merge when they finish, as before.
• Undo acts only on what the app recorded. Undo used to read two files in a run’s folder, which the run’s own agents can write, so an agent could have made your Undo put an old version of another project back over your uncommitted work. Undo and Changes now take the project from the team’s settings and the commits from the app’s own record, which no agent can reach, and Undo of a run that merged in two waves reverts both, where it reverted only the last. A run from before 0.8.0 has no such record, and says “Undo isn’t available for this run: it is from before 0.8.0.” Undo of one step of a task says its work went to the task’s branch, and changes nothing.
• Two ways an agent could run a program as you, outside the sandbox, are closed. Agents can no longer write a project’s git hooks or git settings, with their file tools or their shell. And when the app commits the work in an agent’s copy of the project, it no longer follows git settings the agent left in that copy; a copy that holds a git repository of its own is not committed, and the app says why.
• A worker that could not get its own copy of the project works without it. It was told it could not write your project, and wrote it directly, beside the other workers. Now it cannot read or change the project and runs no commands, and the chat and the Record say so; inside a task, that step fails instead. A worker you answer after its question now works in a copy of its own too, tested before it is merged, where it wrote your project directly. And a member that runs code can no longer be given its own write access to the team’s project folder, a folder around it or one inside it: saving that is refused, with why. Still open: a project folder that is not a git repository cannot be copied, so a chat with a code agent there now works without it, while a team of one agent and a lead still write it directly.
• A team’s test command is yours to approve, and the app no longer picks one. The test command runs on your Mac, outside the sandbox, after every code run, and it runs the project’s own scripts, which the team’s agents can edit; the Project folder dialog now says so. Setting or changing it asks for Touch ID, and the prompt shows the whole command: one too long for macOS to show is refused, not cut. It gets none of the app’s keys. With no test command set, nothing is run — before, the app picked one from the project itself — and a code run says it was merged without being checked. To have a team’s code runs checked, set its test command in Project folder.
• A test time limit you set, and a timeout is not a failure. In a team’s own limits, the test time limit runs from 30 seconds to 30 minutes; unset, it is 3 minutes, which before was every suite’s limit. Beside it, Fix attempts sets how many times a worker whose tests fail is sent back to fix them, from 0 to 5; unset, it is 2, as before. Each run of the tests says what it runs, and for how long, before it starts, and a task is not called quiet while they run. The tests run once before code agents start, to see whether they were already failing, so a long suite delays the start by that long. Tests that run out of time read “timed out”, are not sent back to the agent to fix, and are not merged, and the final check says “NOT VERIFIED”, never failed. A run’s own time limit now stops its test command too. One line still says the wrong thing: where a timed-out agent’s work is left unmerged, the reason given is “tests did not pass”.
• New: your dev server, started by you. In a team’s own limits, save your dev server’s command and port, with Touch ID, then start it there. While it runs, its row there, and under the team’s working tasks in Tasks, has its address, Open and Stop, and it stops at Stop everything, when you quit, and at the next start after a crash. It runs on your Mac outside the sandbox, in the project folder, with none of the app’s keys, so approving it trusts that project’s scripts, which the team’s agents can change. If it takes a port other than yours it is stopped, with why, and if other computers on your network can reach it, it says so. It will not start while work that began before its port was set is still running. Only you start it, and no agent tool has its Start or Stop; agents’ commands can’t reach it. While it runs, an agent on that team that may open web pages can read its pages, at its own address; the app makes that request, a plain GET that follows no redirect. It runs the project’s code, so a page an agent reads, or code an agent changed, can make it end.
• New: a code agent can keep a command running while it works — a test watcher, say — in its sandbox, and read what it prints. Each is listed in Tasks under its task, with Read and Stop, and ends when the agent’s session ends, and at Stop and Stop everything. One agent may keep two at a time, and the app four across every team: “Background commands at once”, in Settings → General, changes that from 0 to 8, where 0 switches them off and raising it asks for Touch ID. None run while an agent only plans, only looks, works on an email or has no copy of the project. A command that tries to open a local server is stopped at once, with the reason: the sandbox allows none. Your dev server is the way to run one.
• Notebooks, and longer sessions on AI Gateway models. Code agents on Claude models can edit Jupyter notebooks, wherever they may change files. Agents on AI Gateway models stopped at 25 steps in a session; “Steps in one session” raises that to as many as 100, with Touch ID. A team’s own limits now say which models each of these settings works on, and which need Touch ID.

Helpers

• New: helpers, on Haiku 4.5, off until you turn them on. In a team’s own limits, “Helpers per session” (up to 3) needs Touch ID to raise. An agent on Haiku 4.5 can then hand small pieces of work to helpers on the same model. A helper has only its agent’s own built-in tools, no connectors and none of the app’s tools, and cannot start a helper of its own. Each is a row in Tasks under its agent, as part of that agent’s spend, with a Stop that ends that helper only; what it costs counts against your limits while it works, and is counted once. If a helper runs on any other model, its session is marked failed and its code is not merged. Helpers are not offered on other models: only Haiku 4.5 has been measured.

Your settings, the Record and what you spend

• Switching a check off now asks for Touch ID. Turning off “Show me the patch before merging” or “Ask me before starting work” asks for your finger, as turning a permission on does. Turning either on never asks.
• The Record says who changed a team’s settings. A change to a team’s test command, test time limit, dev server, step limit, helpers, patch review or “Ask me before starting work” is a line of its own: who, which setting, from what, to what. A password or key typed into a command in the forms the app knows, such as API_TOKEN=… or --password …, is written as “…” there, and on its row in Tasks.
• A model call that failed, or was stopped part-way, counts what it cost. A call that fails is still charged for, and the app counted it as $0, on the Record and against your limits and credits; an AI Gateway call stopped part-way, by you or by a limit, was counted as nothing too. Now each is counted: from the bill where there is one, and otherwise estimated, and marked as an estimate. A limit it takes you past stops the work before the next call.

Work you leave running

• A routine that is switched off says so. On the Routines page it read “Paused”, with Pause and Resume — the words of Pause all work, so it looked as if everything had stopped. It reads “Switched off” now, with Turn on and Turn off. Today counts every routine and says how many are switched off; it counted only the ones switched on. A routine that is running says “Running now”, with Open in Tasks, and in Tasks its run says when it was due in your Mac’s clock, such as “every day at 8:00 AM”.

Screens and words

• Settings works in a narrow window. Below about 700 pixels wide, its sections are a strip across the top and the section you are in takes the whole width. The strip keeps that section in view, and the arrow keys move along it.
• The sidebar shows each team’s lead, and teams keep the names you give them. The lead is listed first, marked “lead”, and a team with nobody else on it has no arrow that opens onto nothing. A name is kept as you typed it (“Acme Books” came back as “Acme books”), a ready-made team takes its card’s title, and a renamed or imported team keeps its name. Two teams can’t share a name, and a name with hidden characters that could disguise it, or reorder the words of a Touch ID prompt, is refused. The Record names a team as it was called at the time.
• A finished run’s result is in the chat. Where there was only “Done.” and a count of files, the result is folded under its Done line: open it to read it there, or Open the report for the full view. Under a reply, “copy” and “make a skill” are now Copy and Save as a skill…, whose hover says what a skill is, and the second is offered only under a reply long enough to be a way of working.
• Notices no longer cover what you need to press. While a dialog is open it makes room for the notices in the corner, so its buttons stay pressable: the weekly receipt’s Issue was hidden under the update notice, and the whole receipt now fits a 1280 by 700 window. A notice that arrives while the sign-in card is open waits until it closes, the update notice is shown once, not twice, and Sign out closes Settings first.
• Plainer words. The team menu is in four groups, with “Monthly update on this team’s work…”, “Weekly receipt of this team’s work…” and “Notes folder (Obsidian)”. Today says “From the activity record, where an edit made afterwards would show”, and Files marks a run’s “result” and its “working note” where it said SUMMARY and HAND-OFF. Settings → General says once that the beta account covers you. Today’s “Keep working while you’re away” mentions a worker computer only if you have one set up. The Email tab says “Not watching.” or “Watching.”, not “off: Paused: …”. More of the app’s messages name members and teams as you named them, not by their folders, though a team’s report back in the Executive Assistant’s chat still names the team by its folder. Nothing you are shown cites the app’s own internal bug numbers any more; it says what happened.
• Report a problem keeps the app’s own words. A refusal such as “Your role (viewer) cannot change an agent” is kept in the report, where it was left out, and what is on the Record is said in plain words. The data sent with the report still gives the app’s own name for each kind of Record entry, and the dialog says so.
• “Who may do what”, and screen readers. Settings → Who may do what says where a cell was narrowed, “set by the team” or “set on the agent”, with a key above the table, and fits a 1280-pixel window, with a scrollbar where it can’t. The message box, the key field and People’s fields have names a screen reader says; a question or plan card is announced once, when it arrives, and not again when you reopen the chat; and small grey text is darker, at least 4.5 to 1 against its background.
• A team of one agent, exported and imported again, is still a team of one agent. 0.7.3 listed this as still open: it came back as a lead and team with nobody to hand work to. A team’s file now carries how the team works, and its name.

• A weekly receipt’s check no longer fails on the one known fault 0.7.1 left in the Record. On its first start, 0.7.1 wrote two Record entries at the same moment, with nothing edited or removed. On a Mac whose Record holds them, the check of every receipt made since failed there, though nothing the receipt covers had changed. A receipt made on 0.7.4 gives a second fingerprint, for the first of those two entries, which the receipt’s own fingerprint does not cover. Keep the two together: whoever checks the receipt needs both. With both, the check passes and names the two entries, and it fails if that entry is later changed, removed or replaced.
• Any other break still fails the check. An entry the receipt covers that was changed, removed or added, or a second pair like 0.7.1’s, fails it as before. A receipt made before 0.7.4 that covers those two entries has no second fingerprint, so its check still fails on them, and the next receipt for the same team says it no longer matches, naming them.

Roughly in the order you would meet it, starting before the download.

Getting started

• The download page says which Macs it runs on, before you download. “Apple silicon Macs only (M1 or newer), macOS 13 or later” now sits above the download button, with how to check yours; an Intel Mac cannot open the app, and the page says not to download it on one. The steps for macOS’s first-open warning are corrected: close it with Done (or Cancel, on macOS 13 and 14), not Move to Trash, and Open Anyway stays in System Settings for about an hour. Getting started says that an invite code has an end date, and what to do when it has passed.
• Signing in with an invite code keeps you signed in, and a refusal is said in one plain sentence. In 0.7.1 and 0.7.2, signing in on a new install said “you’re signed in” and was not, and the first message asked for the code again — which had already been used. The app now reads the sign-in back before it says so. If this happened to you, updating does not give the code back: ask whoever sent your invite for a new code for your email. The first person to sign in on a Mac owns the app there; before, opening Tasks or saving a setting before signing in could leave them a Viewer who could change nothing. When the service refuses a request, the chat now says, for example, “Your beta account has been switched off. Nothing was sent, so nothing was charged.”, or that your sign-in is no longer accepted, with Sign in again in Settings → General; Getting started explains each one. With your own Anthropic key, a refusal is still told in the provider’s own words. A run that failed or was stopped is marked “Did not finish” or “Stopped”, no longer “Done”.
• A new team starts empty, or from one list. New team opens on “Start an empty team”: name it and add members yourself. The ready-made teams are one list under it, and the one you choose shows what it does and who is on it before you press Create. Today, and the welcome in an empty chat, show the same list while you have no teams. An empty team’s chat says nobody is on it yet, with Add a member, where it used to offer a task box and then refuse the task.
• A Mac without Touch ID says what that means. On a Mac with no Touch ID, with Touch ID not set up, or with its lid closed, approvals and the Settings changes Touch ID would guard are one click — and another AI you have let operate your screen could press them too. The approval card and the top of Settings now say so, until you press Got it. Nothing is refused because of it except signing in to a connector. The app looks for Touch ID again before your next approval or change, so opening the lid is enough, and from then on those ask for your finger.
• Email is Gmail, with an app password, and the app says why. Settings → Email explains the Google app password, says to use a Gmail account made for your agents, and says why there is no “Sign in with Google” for mail: while an app like this one is in Google’s testing stage, Google ends its sign-ins after 7 days. A pasted app password with spaces in it is accepted, and an address that is not Gmail is refused in words. The website says “only Gmail, for now”.
• Written for anyone. The app no longer assumes you do this work for someone else: monthly credits, the weekly receipt, the monthly update and a team’s rules are worded for a team, and the ready-made procedure for following up after an intake is now “Chase what you still need”. Members, teams and models are shown by their names in the sidebar, the chat, Tasks, Today and the Record, where a folder name or a model id used to be, and a run’s steps say who is doing what, such as “Strategist is planning the work”, not “Manager planning”. A few lines in the Executive Assistant’s chat still name a team by its folder, among them a team’s report back.

Agents asking you, and waiting their turn

• An agent can stop and ask you. A one-agent team, a lead while it plans, and a member given an assignment can ask you a question on a card, “… needs an answer to continue”, with a box for your answer and “Skip — let it decide”. It waits up to 30 minutes, then goes on with its assumptions stated. A run nobody is there to answer — a scheduled job, a procedure step, work the Executive Assistant handed on — does not ask: it records the question and goes on with its assumptions stated. An agent can still ask in its reply instead, and then the question is its answer; the Executive Assistant and a one-to-one chat always ask that way.
• “Ask me before starting work” now holds for one-agent teams. With it on, a one-agent team shows its plan — “nothing is done until you approve it” — and does nothing else until you do. It is offered only on the teams that plan: lead-and-team and one-agent. Still open: a one-agent team exported and imported again comes back as a lead-and-team team.
• Tasks shows what is waiting its turn, and each thing that needs you gets a notification. Work held back by “Agents working at once” shows as waiting its turn, with how many are already working, in Tasks, on Today and in the menu bar, instead of as working. A proposed agent is listed under Needs you in Tasks, on Today and in the menu bar. With “Notify me when a task finishes or needs me” on, each question, approval and proposed agent gets a notification of its own, and clicking it opens where you answer it; a finished run is announced only while the window is out of sight. An incoming email waiting for your OK to start an email task is counted in the menu bar but raises no notification, and clicking a notification while the window is closed has not yet been tried in the packaged app.
• “Agents working at once” is in Settings → General, and refuses what it cannot use. 0.7.2 put it under Spending; it is not money. A number outside 1 to 16, or not a whole number, is refused with the reason and nothing is saved — 0 used to be saved as 1 without a word. To stop everything for now, use Pause all work. Quitting has one name everywhere, “Quit Agent Platform” (0.7.2’s menu bar called it “Quit completely”), and with the workspace closed the menu bar no longer says “Not running”.
• A round table runs as many rounds as you choose, or until it’s polished. The limit of three rounds is gone. Choose a number, or “Until it’s polished”: after each round the member writing it up says whether the result is ready or what is still missing, and the table ends when it says ready, when a round adds nothing new, or at 20 rounds. Each choice shows its turns, and an estimated cost when every member’s model has a price. Before another round, the table checks that the run’s budget and time limit would still cover it and the write-up, and if not it ends there and is written up; that is a forecast from the turns so far, so a round dearer than forecast can still stop it with nothing written. In a long table each turn reads the latest discussion that fits, and all of it is kept in the run’s discussion.md. A procedure’s panel takes rounds and verdicts the same way, and shows each verdict on its step.

Work you leave running

• Jobs say what happened while the Mac slept or the app was closed. A run the Mac slept through reads “It started late — due …, but the Mac was asleep until …”, and the runs it missed before that are listed as skipped, on the Jobs page and on the Record; days with the app closed read “Skipped 4 runs … — Agent Platform wasn’t open”. None of these is counted as a refusal any more. Quit and reopen across a job’s time and that day’s run still happens once, late. A run cut short by a restart or an update says so and runs again at its next time; it is not resumed. A job stopped by its limit says which limit, with Raise the limit. A job that reads your email, turned on with no mailbox connected, says that every run will fail until one is, on its card and on the Jobs page. Not there yet: after the Mac restarts nothing runs until you open the app, and quitting does not warn you that a job is about to come due.
• A job’s reads tell a hiccup from a failure. An inbox read that failed once and worked when it was tried again leaves the job “Finished”, and says so, instead of “Incomplete”. A refused read by one of a connector’s tools now counts too, and the job names the tool — including a tool you left unticked, which the agent is still offered. A web page an agent reads is cut at 30,000 characters where it is read, and the agent is told to say the page was cut, so one long page no longer marks a job Incomplete. A shell command’s output now reaches the agent up to 100,000 characters; before, anything over 30,000 went to a file it could not read, which is still where output beyond 100,000 goes.

Screens, notices and connectors

• Sidebar notices are one row each. Press one for what happened and what fixes it — the setting to open, the connector to reconnect, where in the Record — with Dismiss only where dismissing hides nothing still true. The known fault from 0.7.1’s first start, two Record entries written at the same moment with nothing edited or removed, can be acknowledged once: that is written on the Record, and the sidebar stops showing it on this Mac. Any other break in the Record still shows and cannot be dismissed from the sidebar; Settings → Storage can acknowledge it, with Touch ID where the Mac can ask.
• Connectors say what went wrong. A failed test or key reads as one sentence — “It refused the key: it may be mistyped, expired, or not allowed to do this” — with the service’s own words under Details. The Connect card stops waiting after about 25 seconds and offers Try again, instead of “Looking up the sign-in…” for ever; a service that is only slow can run out of that time too. When a service shows its home page instead of asking you to allow access, as Fathom’s did, “Open the sign-in page again” lets you finish it. The card says in words what a service will ask you to allow. Renaming or removing a connector changes the team rules that name it, and says which; a rule that already named a removed connector before 0.7.3 keeps the name. The text box under Advanced still shows raw errors, and treats a rename there as a removal and a new connector.
• Today, Settings and the keyboard. Each section of Today is a card of its own, an empty one says so in one line, and the Jobs page matches; a screen reader hears each section by its heading. Escape in a Settings form closes that form only, and asks first when you have typed a key into it. A member’s folders are rows, “Read only” or “Can read and change files”, instead of a text box. The Stop button in a chat’s header now shows while a run works. “Files” counts only what a run made. Each team’s result asks “How was this result?” once, and a poor rating is read by the lead at the team’s next task. A screen reader hears whether a row’s panel is open and which fields are required. The Team map’s Full process bar still cannot be used from the keyboard.

Help and updates

• New: Report a problem. At the bottom of the sidebar, on a failed line in a chat, and in the Help menu. It builds a short report on this Mac — the app and macOS versions, how you are signed in, how many teams you have, what kinds of thing the last 20 entries on your Record were, and the app’s own words for recent errors — with no names, messages, files, email addresses, keys or passwords. You read the whole report before anything leaves, and nothing is sent until you press Send. On an invite, Send delivers it to us with your sign-in, so we know who it is from, and with the same facts in a form a program can read. With your own key there is no Send: copy it and write to us. No copy is kept on the Mac.
• New: updates install from inside the app. When a new version is out, Settings offers Install update. The app first checks that the release is signed with the app’s own release key (not Apple’s signing), downloads it and checks its size and fingerprint; Restart to install then closes the app and opens the new version. It is refused while anything is working or waiting for you. If the new version does not start, its error screen offers Go back to the version you had, until the new one has started once. It needs an invite sign-in and an owner or admin of the app; otherwise Download from the site, as before. 0.7.3 is the first version with it, so 0.7.3 itself installs the old way, and the first update made from inside the app will be to the version after it — one this app has not yet done on a real Mac.

On this website

• “Why not just a chatbot?” comes after what the app does and how to install it. The proof that the app’s safety claims hold is now a readable page for each version, with the raw text one click away. Every contact shows the email address with a Copy address button, so writing to us works without a mail app.

• A lead can propose a new agent, and you decide. Ask a team’s lead or the Executive Assistant for a new agent and it shows a card: the team it joins, what it does, how it writes, its model and what it may use, each with Change. Nothing is created until you press Create, and Touch ID is asked when the new agent could do more than read, or would start a new team. Before, a lead answered that it could not create agents.
• A question to a one-agent team gets one answer, not a project. It used to plan, work and review in three separate sessions even for a single question — one measured message cost about fifty cents. Now the agent answers a question in one turn, asks you first when you told it to, and only plans when there is real work. Agents are also shown only the tools they may use, so they stop trying ones that are refused.
• Connectors, in one place. Settings → Connectors has your connectors, a library of services that publish their own, and a way to add your own. Some connect with a key; Notion, Fathom, Calendly and others connect by signing in with the service, in your own browser. Keys and sign-ins are kept in the app’s private folder and never reach an agent or the program the agent runs in. A team’s rules can now also say which connectors may receive that team’s data.
• Shared folders replace the old “Files & folders” connector: folders every team can read, read-only unless you let a team write (Touch ID), and never a folder that belongs to one team.
• Tasks. A panel that groups everything by Needs you, Working, Done and Idle. Anything working in a chat has Stop on its row, and anything that needs you has Open, which takes you to where you answer it. Today’s “Working now” says who, on which model, for how long and what it has cost so far.
• Closing the window no longer stops the work. Agent Platform keeps running with an icon in the menu bar that shows what is working and what needs you. “Quit completely” asks first when something would stop, and says what happens to a question that is waiting for you.
• Stop now ends a command that sent itself into the background — the gap the 0.7.1 entry below named as the next piece of work. A program an agent starts belongs to its session, and Stop, “Stop everything” and the end of the session end it too. One case is still open: on a Mac, a command that both detaches and leaves the team’s folder cannot be traced back to the run.
• A question, or a plan or patch waiting for your approval, survives a restart. It used to be lost when the app quit. Now it comes back on its conversation, for the rest of its thirty minutes. Not every one can: an email waiting for your OK is not sent, and the conversation says so whenever one is not re-opened.
• Desktop notifications work. They never did in the Mac app: it refused the permission. Plan and patch approvals now ask for Touch ID, like the other approvals, and a cancelled Touch ID leaves the card usable.
• The morning inbox brief reads a long inbox. A full inbox was too large for the agent to read, so the brief said so instead of summarising it — and was still marked finished. The inbox is now read as a short list first, and only the messages that matter are opened in full. A scheduled job whose inbox read was refused or failed now reads “Incomplete” on Today, and Jobs says it could not read everything; both used to say “Finished”. Mail written in HTML reaches the agent as plain text, without tracking links or hidden text, and a file attached the way Apple Mail attaches it now counts as an attachment.
• A setting for how many agents work at once (Settings → Spending, default 4). Extra work waits its turn instead of slowing everything down on a small Mac.
• The Record now says who created, deleted or renamed a team or a member. Before, a deleted team left no line at all.
• Fixes found by using the app from scratch: Today no longer calls a run that is still working “did not finish”; a ready-made team no longer puts its example into your first message; a refused save in the agent editor now says why instead of vanishing behind “Leave without saving?”; a missing API key says so once instead of reporting a crash twice; saving Settings can no longer remove connectors you did not remove.

0.7.0 was finished on 25 September and never published on its own. Everything made for it is in this release too, listed after what is new.

• No internet, or a network that blocks the AI, is now said as that. Before, the chat and Today said the Executive Assistant was “working” for three minutes or more while nothing could get through. Now they say “Can’t reach the Agent Platform service — check your internet connection, or whether this network blocks it” (“Anthropic” instead, if you use your own key), with when it will try again, and say so when it stops trying. A school’s or company’s block page is no longer reported as a problem with your key or your invite, and the invite sign-in tells the two apart too.
• Stop reaches more of what it should. Stopping a procedure now stops the team work its step had started — before, that work carried on, and kept spending, while the procedure said “stopped”. “Stop everything” leaves running procedures stopped, not failed. Stop in a chat stops that chat: with two chats on one team, the idle one used to offer Stop and stop nothing. On models from other companies, Stop now reaches a shell command that is already running, and no agent can ask for a command to keep running in the background after Stop. One gap is left, and it is the next piece of work: a command that sends itself into the background can still outlive Stop.
• New: a monthly allowance of credits for a team. In a team’s menu, “This team’s own limits” now has a section for it: 500, 1,000 or 2,000 credits a month. A credit is one cent of AI cost at the model’s list price. Once a team has used its credits for the month, no new AI work starts for that team or any team under it until the month renews or you add credits; other teams keep working. Adding credits is free of charge — paid top-ups are not offered yet — and anything that gives a team more room asks for your Touch ID. The weekly receipt shows the credits used and left.
• New: which AI companies may receive each team’s data. In the same place: any company, Anthropic only, or only the ones you tick. It is checked every time a model is asked — by any member, a check step, the model router or a memory tidy-up, on this Mac or on a worker — and a request to any other company is refused before anything is sent, with the reason on the record. The AI Gateway counts as a company of its own, because it reads a request before the model’s maker does. Loosening the rule asks for Touch ID. Because the Executive Assistant can see every team’s work, while any team is set to Anthropic only, the Assistant and anything it starts use Anthropic only too.
• New: Jobs, asked for in a sentence. Tell the Executive Assistant what you want done and when, and it proposes one card that says, a line at a time, what the job will read, what it may do, what it asks you first and what it may spend — each line with a Change that opens the setting that decides it. “Try it now — rehearsal” runs it once as a plan only, and sets the job’s limit from what that cost; “Turn on” schedules it. Nothing is scheduled until you press Turn on. A new Jobs page in the sidebar lists everything that runs on its own: when it runs next, what it did last time in words, and what it cost this week against its limit, with Pause and Resume. A job the Mac slept through now says it was skipped, and one that started late says so.

From 0.7.0:

• Another program on your Mac could approve things for you. It can’t now. Apps that operate a Mac’s screen for you (ChatGPT’s computer use, Claude’s) are now common. Once one of them was allowed to operate apps, nothing stopped it from pressing Approve in this app, or from finding the app’s private session key and approving through it directly — we tried it, and it worked. Now the key never leaves the app, and approving anything that sends outside, raises a spending limit, resumes work or widens a rule asks for your Touch ID. If this Mac can’t ask for Touch ID, Settings says so plainly instead of pretending.
• Your rules can’t be changed behind the app’s back. If a rule file — your email rules, limits, who has access — is edited by anything other than the app, the app puts back the version it last saved, keeps the changed copy, and tells you in the sidebar.
• “Stop everything” now stops work handed to your worker computer too. Before, a procedure running on the worker carried on after you pressed it. If the worker can’t be reached, the app names the runs it could not confirm stopped, and tells the worker the moment it answers again.
• New: a weekly receipt for each team. In a team’s menu, “Weekly receipt…” puts one week of work in plain words: what was done, what was sent and to whom, what waited for approval or was refused, what it cost, and which AI companies received that team’s data. It ends with a fingerprint of the app’s record. Send it to whoever the work is for, and if the record is ever rewritten, the fingerprint they hold no longer matches. Nothing in it is written by an AI.
• Model menus only offer what you can run. Models your sign-in or key can’t use are greyed out, with the reason, instead of failing when a task starts.
• The inbox brief reads your newest mail. It was reading the oldest twenty messages. Scheduled jobs now show “Started”, then “Finished” or “Failed” with the reason, instead of “Ran” the moment they were handed off. “Keep working until” now offers a time that covers your schedules.
• A fourth way for a team to work: Round table, where the members discuss a question freely before one of them writes the answer. And Opus 5.5 is in the model menu.
• Everything works from the keyboard. Dialogs keep the keyboard inside them, Escape closes them, and “Leave without saving?” starts on Cancel. Every menu works with the arrow keys, and every row in Saved work, Chats, Past tasks and Files can be reached with Tab. One set of drawn icons, a sidebar that lines up, and menus that stay inside their box.
• The getting-started page and the email setup guide described screens and steps that no longer exist. Both are corrected.

• Today stops being a catalogue. On a new install the ready-made teams used to fill the first screen. They are now one row at the bottom, “Start from a ready-made team”, that opens into a short list — and every link that sends you to them opens it, rather than scrolling to a closed section.
• Buttons and icons behave like one material. Every hover now eases in instead of snapping; icon buttons stay quiet until you point at them; in dark mode a hovered row lifts instead of going darker than the sidebar around it; and the ring that shows where the keyboard is looks the same on every control.
• The sidebar works from the keyboard. Executive Assistant, Saved work, and every team and team member can now be reached with Tab and opened with Enter. Before this, the keyboard skipped straight past them.
• Dark mode is dark all the way through. Scrollbars and the clock in the “Keep working until” box were still drawn light, because the app never told the system which mode it was in.
• Smaller things you may notice: two dialogs had square corners, a secondary button turned the accent colour when hovered, Today had two main buttons competing, the refresh and menu icons were tiny text characters, and a few sidebar icons were a different style from the rest.
• “New chat” on a chat that was already empty used to make another empty chat that looked identical — so the button seemed to do nothing, and left conversations behind. Now it says you are already in a new one.

Also: the checks behind the “planted bugs caught” figure on the security page were tightened. A planted bug now only counts as caught if the test written to catch it is the one that fails — before, for about three in ten of them, any failure in the same file counted.

• A new page: who may do what. Every agent you have, against every power it could be given — email, spending, the websites it can reach, which tools of a connected app, whether it can run code or install packages, which folders it can write to. One table, with the level that decided each answer, and a copy you can export. If somebody’s IT person asks what this thing is allowed to do, that page is the answer, and it is produced by asking the same code the app asks before it lets an agent do anything.
• You can watch it work before you have a key. There is now a recording of a real run — a lead planning, spending four cents, stopping to ask a person, and a worker being sent off once they said yes. It is a recording of something that actually happened, not an animation: it costs nothing, changes nothing, and is marked as a recording throughout.
• A new procedure is no longer “unsaved work” before you have touched it. Press New, press Escape, and it just closes.
• Changing the theme and then pressing Escape puts the theme back, instead of leaving the setting you discarded still applied.
• The Files drawer names things. “Ana — what they produced, 8:04pm”, rather than the folder it happens to live in.
• “10 need a look” is now “10 to review”, it is a link to them — and the number was wrong. Work stopped part-way inside a procedure was left out of the count whose entire job is to tell you what needs looking at.
• A wide procedure now says “2 more →” at the edge where the picture is cut, instead of simply ending.

Also: the security page quoted the date of its last full test run from a number somebody typed, sitting between two that are computed. It said the 23rd on the day it was the 24th, and would have drifted further at every release. It is read from the same file as the figures beside it now.

Everything in 0.6.4 that you could not actually use. This release is almost entirely fixes, and most of them were found by someone opening the app and pressing things rather than by a test.

• The Procedures screen works now. In 0.6.4 the first button a new person presses — the one on an empty procedure — did nothing at all. Sixteen tests drove that screen and every one of them started from a procedure that already had steps.
• Three dialogs were painted behind the window that opened them. Removing someone’s access had not worked in four published versions: the confirmation was there, underneath, waiting for a click nobody could give it.
• Escape no longer throws away what you were typing. Settings, the agent editor and the procedure editor all now ask before discarding, and they ask once — a first attempt at this asked every time you pressed it, about work it had already kept.
• Clicking outside the agent editor kept your edits instead of silently dropping them.
• The procedure graph fits the window, does not draw over itself, and tells you the truth after you delete a step. A run is shown on the same picture you built.
• Dark mode: controls that nothing painted at all, a checkbox whose off state read as on, and toggles that came out invisible against their own track.
• The first sentence someone without a key sees said the same thing three times. It says it once.
• The command palette no longer opens behind a dialog, and two ways out of the app stopped leaving a sign-in token behind.

Also settled, because it was written down wrong: the app’s stop-everything confirmation does work in the packaged build. The belief that it did not had been carried for weeks without being measured.

• Procedures are rebuilt. A procedure is now a picture: boxes for the steps, lines between them, and two teams can work at once and come back together. You add a step after another one, or alongside it, and where branches meet the app offers to wait for both. The same picture shows a run happening, with each box lit and what it has cost underneath.
• Procedures moved into Settings, next to Skills, where the things you set up live.
• Settings has been rebuilt around one shape — what the setting is, what it does, and its control — instead of every setting being its own little stack.
• A connected app can be allowed to read without being allowed to change. You pick which of its tools an agent may use; a tool it grows later is refused until you say otherwise. Before this, allowing a connected app allowed all of it.
• Three more pages here: what is new, how to get started, and a security and data page for whoever asks for one.
• More money counted correctly: cached input was charged at the wrong rate in both directions, a new point release was priced as the model whose name it starts with, and a run's own total was discarded whenever anything disagreed with it.
• Smaller things you may notice: the morning summary no longer mixes "spent while you were away" with "left today" in one sentence; teams are named the way you named them rather than by their internal slug; and a payload that tried to give an agent instructions now shows up where you look, instead of only in the log.

• A scheduled task that was refused now says why, instead of sitting there looking like it will run tomorrow. Before this, a schedule that a rule stopped left no trace at all, and the morning said nothing had run.
• Signing out no longer locks you out of your own Mac.
• Edit a procedure after you have made it — its name, its purpose, its budget and its steps.
• A team whose accountable person has left stops running unattended work: its schedules, triggers and procedures stop. You can still sit down and run it yourself.
• Text that arrives from outside — a webhook payload, or whatever a connected app hands back — now reaches the model fenced and labelled as outside material, the same way a web page already did.
• Two more ways money could go uncounted, both fixed: a task stopped partway recorded nothing for the turn it was stopped in, and the check before a run started could not see money already committed.
• The command that prints each safety claim proven or unproven was run, properly, for the first time — and fixed. On its first real run it printed every claim unproven.

While you were away; roles on teams; the whole-app review's fixes.

Today now tells you what happened since you last looked, rather than only what is happening now. Teams can have their own roles — Sponsor, Editor, Viewer — which can only narrow what a person is already allowed.

Check steps (a second opinion from another AI provider); the agent runtime sends only model traffic on an own API key too.

Procedures can be handed to a worker — a separate machine — so a run does not need this Mac. An Administrator allows each procedure one at a time; the run stops at its first approval and comes back here to wait for you.

Built, and not usable yet. There is no worker host to hand anything to, so in practice this changes nothing about what your Mac has to be doing. It is listed because the code is in the version you have, not because you can use it.

Also: agents on other AI providers get their team's website list for shell commands, the same as the rest.

Rehearsal; procedures you can account for, with approvals in the tamper-evident log; every procedure step leading with its content.

A rehearsal does the real work against the real material and changes nothing — no file written, no command run, nothing sent. It is the first thing worth doing with any procedure.

People and roles, the Record, and Procedures — one release, because they are one story: who did the work, who may see it, what happened, and a process that runs.

• A page an agent is working on that you can watch while it works, and click in.
• What was refused is written to the record, at both of the places work can be refused.
• Fixed: an agent's sandboxed shell could read the app's own API keys.
• Fixed: four ways a symbolic link could be used to step outside the folder an agent was confined to, plus what three testers found by using the app.
• Fixed: three faults in the message box — a message that could send twice, a date in the wrong time zone, and a mangled name.

• Fixed: plan mode — look at anything, change nothing — did nothing at all, and the agent was not told it was supposed to be in it.
• Files can be dropped straight onto a chat.
• A request you cancel is still counted against your spending, because the model provider still charges for it.

0.4.2 was built the same week and deliberately not released; nothing a tester downloaded changed. That is why the numbering skips it.

• Plan mode: let an agent look at anything and change nothing.
• Connect other apps to an agent — except this one, which it is refused.
• Two kinds of result, kept apart: the thing you keep, and the working material agents pass between themselves.
• Fixed: a price the app could not work out was being treated as zero, which emptied every spending ceiling that relied on it. It now refuses instead.

Check the credential, not just the door: the sign-in service now proves it can actually reach the model provider, rather than only answering that it is running.

• Settings that work at all three levels — the whole installation, a team, and one team member — and the flaws that finding it exposed.
• Say how you want to be spoken to, and have every agent read it.
• Agents can read pages that only exist once the page's own scripts have run.

Say why a key was refused, and let it be removed.

The first tester pasted an organisation admin key and was told "the API returned 400" — true, useless, and unactionable. Every way a key can fail now names the cause and the next step. The key box also hid itself from exactly the person who went looking for it, and a saved key could never be taken back out; it is now a visible section with a Remove key button.

The first version a tester could install: sign in with an invite code, three shapes of team to start from, and the update check that tells the app when a new version is out.