v0.6.13

The desktop app is updated too: Desktop v0.0.7. This release is about the agent doing the work itself, working in your own browser, and safer defaults.

The agent runs things itself

• Commands run instead of instructions. Asked to set something up, the agent runs the steps that need no input (for example brew install …) with your approval, and hands you only the steps that need you: a browser sign-in, a password, a yes/no. A command that waits for input is stopped quickly with "this step needs you", not left to time out.
• Long-running commands such as dev servers start in the background with readable output. Your usual toolchains (Homebrew, nvm, pyenv) are on the agent's PATH.
• os.shell.run accepts the command in the shapes models actually send, and a background job that ended with its turn is explained instead of polled again.

Browser

• Your own Chrome (opt-in). Set browser.connect to user-chrome and the agent works in a tab of your signed-in Chrome. It sees only its own tabs, asks once per site before opening or reading it, and re-attaches after Chrome restarts. It has no access to cookies, passwords or storage, and password, code and card fields are masked.
• Asks before it acts. Submitting a form, paying, posting or typing a secret asks first, every time. javascript: addresses are refused. Scripting a browser through the shell is refused too; the agent uses its browser tool.
• Screenshots of a page, and a compact page view for small local models: only the interactive parts, and only what changed since the last step.

Screen control on macOS (opt-in)

• With tools.screen.enabled the agent can take a screenshot, click and type in your apps. Browsers are look-only and terminals take clicks only, checked on every action.

Safer by default

• Project folders need your trust. A folder's AGENTS.md, CLAUDE.md and project skills load only after you trust the folder, once per folder.
• Secrets are masked in tool output before the model reads them. Reading the agent's own secret files, and HTTP requests that send data, ask first.
• Every file of every installed skill is scanned.

Local models

• On a GPU with its own memory the automatic context is held to 131,072 tokens and four slots, so big models stop spilling onto the CPU. Starting small and growing with the conversation is available as an option.
• A model that runs out of memory restarts once with half the window. A GPU build that crashes on load falls back to the CPU build.
• A reply cut at its length limit continues; local thinking models get room to finish.
• On Windows the agent waits for an old model server to free its port. On macOS older than the engine build supports, you get one plain sentence instead of a crash.
• Optional DRY anti-repeat sampling for llama.cpp engines.

Agent

• One catalog of failure causes with a plain phrase and a next step.
• os.fs.edit tolerates whitespace, indentation and quote drift; a missing path suggests where the file actually is.
• An unknown tool name is an error the model can recover from, not a dead turn.
• Web search explains unreachable providers instead of waiting on each one.

Also

• verify.syntax skips the Windows python3 and bash stubs.
• The local server reads loopback addresses strictly and refuses a blank key.