Biorouter v1.94.0

Biorouter v1.94.0

This release adds scoped approval for files outside your project, strengthens local session and undo storage, and lets progressing chats continue without default action caps. It also improves stream recovery, permission prompts, tool failure reporting, and the composer, and adds Claude Opus 5.5 and Sonnet 5.5 to Versa API Bedrock. Thank you to Jeff Lin for contributing the Versa model update.

File access and local storage

• Developer file operations can request read-only or read/write access to an external folder, including a connector's returned result file. Choose Allow once for the listed operation or Allow for this session for the displayed folder and descendants; the original operation resumes after approval. Ordinary work inside the project's folder needs no additional folder approval.
• Folder access beneath the composer lists additional grants and lets you revoke them. The local CLI has /folder-access and /folder-access revoke <id>. Read-only grants do not silently become writable, and another chat does not inherit them.
• Managed desktop grants expire on normal app quit. Managed shared Unix connections also revoke grants when their native client disconnects. Browser and manually selected external-backend grants follow the backend's lifetime; reloading or closing that interface does not revoke them. Browser approval uses a separate key, configured with biorouter serve --folder-access-approval.
• File operations retain authority to the approved directory, so changing a symbolic link while approval is pending cannot redirect that operation to a newly selected folder. Unattended runs return a structured authorization_required response instead of waiting for a hidden approval dialog.
• Session history and persisted Developer undo snapshots use account-private storage. Unsuitable storage returns recovery guidance. Linked session directories or database files are refused; deliberate relocation uses a real app-root directory rather than a link.
• Smart Approve's optional model judge is confined to the particular invocation and arguments reviewed; a judgment no longer creates a remembered permission for every use of that tool. Model judgments and pattern filters remain fallible.

Longer-running work and recovery

• Ordinary chats no longer stop at the default 100-turn or 200-tool-call caps. Unlimited is the new default; saved positive limits remain in effect, and you can choose a limit in Settings or use --max-turns. Stop and configured budgets still apply.
• Loop detection better distinguishes repeated failures from progress, such as reading new result pages or waiting on a running job. Stream recovery also handles interrupted response bodies and streams that end without their expected terminal marker, within the retry budget.
• New permission requests are brought into view. Stopping a turn cancels its unanswered approval cards.
• Tool cards distinguish Operation failed from Status lookup completed successfully. Failure reporting preserves the originating tool through nested scripts and saved/reloaded chats, including asynchronous connectors that provide the operation metadata.

Composer, reports and CLI

• The Tools control has a simpler label with enabled counts in its tooltip. Quick, Normal and Deep effort choices use a keyboard-accessible segmented control.
• Bug reports require one-time approval of the exact report before publication, including reports from private chats. The reviewed report does not automatically include the source conversation or diagnostics. If submission may already have reached GitHub, Biorouter asks you to check before retrying rather than opening a duplicate submission.
• JSON and newline-delimited JSON CLI output stays parseable: the startup banner is suppressed in machine formats, and workflow parameter summaries go to stderr. Human-readable text output keeps its usual presentation.

Versa models

• Claude Opus 5.5 and Claude Sonnet 5.5 are offered under Versa API Bedrock. Existing model selections are preserved, and Opus 4.8 remains the default. Basic generation was checked through the UCSF gateway for both new models; access still depends on your institutional credentials and entitlement.

Scope and compatibility

These are targeted file, approval and storage protections, not comprehensive confinement of unrestricted shell or computer-control tools, same-account processes, or administrators. They are not a security certification or a guarantee against prompt injection.

On Windows, retained directory handles can prevent moving an ancestor folder while a child is in use. Finish active work and release the relevant holders before retrying; Biorouter does not bypass file authority to force the move.

Folder access · Local history and relocation · Long-running tasks