Biorouter v1.88.5

Biorouter v1.88.5 release notes

Release date: July 21, 2026

Repository: github.com/BaranziniLab/biorouter

Biorouter v1.88.5 is an agent-autonomy and desktop-polish release. It introduces
Fully-Automatic mode — the agent works with broad file autonomy and only stops
to ask about genuinely sensitive system operations — hardens the permission engine
against a class of false-positive prompts that could stall an unattended run, and
lands a round of desktop chat, tab, terminal, and artifact-preview fixes on top of
the v1.88.3 interface-cohesion work.

Existing settings, sessions, providers, extensions, skills, workflows,
applications, knowledge bases, and usage history remain compatible.

Downloads

Platform	File	Install
macOS Apple Silicon	Biorouter-1.88.5-arm64.dmg	Open the DMG and drag Biorouter.app to /Applications
macOS Intel	Biorouter-1.88.5-x64.dmg	Open the DMG and drag Biorouter.app to /Applications
Windows x64	Biorouter-win32-x64-1.88.5.zip	Unzip and run Biorouter.exe
Linux desktop Debian / Ubuntu	biorouter_1.88.5_amd64.deb	sudo apt install ./biorouter_1.88.5_amd64.deb
Linux desktop Fedora / RHEL	Biorouter-1.88.5-1.x86_64.rpm	sudo dnf install ./Biorouter-1.88.5-1.x86_64.rpm
Linux CLI + daemon Debian / Ubuntu	biorouter-cli_1.88.5_amd64.deb	sudo apt install ./biorouter-cli_1.88.5_amd64.deb
Linux CLI + daemon Fedora / RHEL	biorouter-cli-1.88.5-1.x86_64.rpm	sudo dnf install ./biorouter-cli-1.88.5-1.x86_64.rpm

The macOS builds are signed with the UCSF Developer ID, notarized by Apple, and
stapled. Signed updater ZIPs for both Mac architectures and latest-mac.yml are
included for one-click in-app updates. The CLI + daemon packages install the
headless biorouterd server and the interactive biorouter terminal client
without the desktop GUI.

Fully-Automatic mode

• A new Fully-Automatic permission mode gives the agent broad autonomy over
  ordinary file work — reading, writing, and editing inside your project run
  without a prompt — while still stopping to ask before a small, well-defined set
  of sensitive system operations (writes or deletes under system directories,
  SSH keys, keychains, launchd/login items, and browser credential stores).
• The mode is the recommended default for long, unattended agent runs: it keeps
  the loop moving without a permission prompt on every edit, but preserves a hard
  approval floor around the operations that actually carry blast radius.

Permission-engine hardening

The sensitive-operation classifier that backs Fully-Automatic mode was tightened
so it stops on real risk and stays out of the way otherwise:

• /dev/null and the benign character devices are no longer flagged. A routine
  … 2>/dev/null redirect — or a /dev/null literal embedded in code the agent
  writes — used to be misread as a write to a "protected system directory" and
  raise a Destructive approval prompt that Fully-Automatic mode never
  auto-approves, silently stalling autonomous agents. Writes to /dev/null,
  /dev/std{in,out,err}, /dev/tty, /dev/zero, and /dev/fd/* are now treated
  as ordinary; real writes to /etc, ~/.ssh, and block devices are still gated.
• Sensitive writes hidden inside shell command lines and execute_code bodies
  are detected (redirect targets and mutating-binary arguments), while
  angle-bracket prose placeholders like <word> are no longer misread as shell
  redirects.
• The text_editor working-directory jail is relaxed in Auto mode so ordinary
  project edits are not blocked, without loosening the catastrophic-path denylist.

Desktop chat, tabs, and terminals

• Window focus and per-pane terminals. The "Always on Top" toggle no longer
  silently pins the first window (it was bound to a stray accelerator), and its
  menu state tracks the focused window. In-app terminals are scoped to their own
  chat pane rather than spanning the whole window, and each opens in that
  session's working folder.
• Grabbable split dividers. Dividers between split chat panes can now be
  dragged to resize — they were painted under the chat content and swallowed the
  pointer. Both row and column dividers drag smoothly and preserve their ratio on
  window resize.
• Split cap raised from 4 to 6 panes.
• Composer toolbar collapse. When the composer row gets too narrow the tool
  pickers collapse behind a lower-left + popover instead of overlapping, then
  expand again when there is room.
• Chat names stay in sync across Recents, history, tabs, and diverged
  branches — the backend-owned canonical name now propagates everywhere, including
  the locked (branch N) diverge names.
• Drag-to-reorder tabs track the pointer instead of jumping away from it.

Artifact preview

• Files an agent creates inside code_execution now surface in the artifact
  side panel, not just files written by a top-level editor call.
• The markdown preview renders images and links correctly.
• The folder preview no longer occasionally opens the wrong directory —
  same-basename folders are disambiguated and unanchorable relative paths are
  dropped rather than resolved against the wrong root.
• Auto-open of a new artifact is a tested pure decision, and the historical-reload
  guard is locked so reopening an old session does not silently resume it.

Chat reliability

• A rapid double-submit no longer appends a phantom duplicate user bubble, and
  a transient send/load backend blip degrades to an inline retryable error
  instead of the fatal session card.
• Soft interrupt and hard stop are acknowledged immediately, and a user's own
  submit always returns them to the bottom of the conversation.
• Terminal PTY slots are no longer leaked on reload, and a stale resumeSessionId
  is cleared from the URL when an empty New Session tab takes focus.

Themes and observability

• Theme families are generated from one definition file per family; the Alma
  Mater family is recoloured to UCSF teal and a JupyterLab-inspired Roche Limit
  family is added.
• Structured per-tool-result logging gives every tool call a machine-readable
  record for observability and debugging.

Documentation

• The documentation tree was reorganized and brought to a single house style
  in a per-folder audit, a dev-GUI launch guide was added for driving the app from
  a shell without a TTY, and a docs conformance linter guards the format.

Release verification

The 1.88.5 release pipeline verifies Rust formatting, strict linting, workspace
tests, generated API consistency, desktop type-checking and tests, signed and
notarized macOS arm64/x64 apps, the Windows desktop package, Linux DEB/RPM desktop
packages, and the CLI + daemon Linux packages. The full Rust library suite
(1493 tests) and the desktop unit suite pass, and the built app was smoke-tested
end-to-end (UI and agent loop) before publication.