Deskfolk v0.1.0-rc.12

Unsigned macOS rc, now with an experimental unsigned Windows installer beside the .dmgs. This is not a supported signed installer; Gatekeeper or SmartScreen may block it. Prefer running from source.

• The status line leads with what is waiting on you — an action a Bot needs you to approve, a question it asked — and lists the check-backs Bots have booked in the job and when they come due. In a job split across several Bots and sessions, what holds everything up is most often one of those, not a Bot that stopped.

• Deskfolk starts to run on Windows, as an experimental preview that has so far run on one Windows machine (Windows Server 2022), not yet on Windows 10 or 11. From source it is the same pnpm install / pnpm dev, with Rust's MSVC toolchain and the Visual Studio C++ build tools in place of Xcode and a one-time build of the terminal helper; releases carry an NSIS installer (Deskfolk_<version>_x64-setup.exe), unsigned until the repository sets WINDOWS_SIGN_COMMAND (SmartScreen warns about the unknown publisher). The window finds its runtime (data lives in %LOCALAPPDATA%\real-bot), setup takes a C:\… or \\server\share workspace, and Bots read, write and list files there. Their shell tool runs commands in Git Bash when Git for Windows is installed and in PowerShell otherwise (REAL_BOT_TOOL_SHELL picks another), and the prompt tells the model which one it has. A command that reaches outside the workspace asks first, as on the Mac: on Windows that includes C:\… and C:/…, ..\, %USERPROFILE% and $env:…, another drive and a network share. Terminals run in a new ConPTY helper (PowerShell by default), and closing one ends everything started in it. Stdio MCP servers launched through npx go through cmd.exe with every argument escaped, links open in the default browser, Show in File Explorer and Move to Recycle Bin stand in for Finder and the Trash, shortcut labels read Ctrl instead of ⌘, and the terminal's copy, paste, find and clear are Ctrl+Shift+C/V/F/K so that Ctrl+C and Ctrl+K still reach the shell. Not on Windows yet: remote access and phone pairing, the independent runtime, installing an update inside the app (About opens the download in the browser), desktop notifications and the badge, and image thumbnails. Keys are kept in Windows Credential Manager. Setup and known gaps are in the development guide.

• Windows, after a first run on a real machine. The installer ships with each release next to the .dmgs, and the update check only counts a release that carries this platform's installer: a macOS-only release is no update on Windows, and one whose installers are still uploading is none yet anywhere. The check and the download follow the Windows system proxy (Settings → Network → Proxy, the switch Clash or v2rayN turns on) the way they follow the macOS one. Upgrading or uninstalling no longer trips over a runtime that is still running: the runtime and its terminals end with the window, and the installer stops any left behind. Move to Recycle Bin no longer deletes for good what Windows cannot recycle (a network share, a USB stick, a subst drive, a file bigger than the bin); the file stays and the dialog says why. Open with default app shows an .exe, script, shortcut or installer in File Explorer instead of running it. Pictures sent to the model are shrunk on Windows too, and turned upright first. PowerShell terminals report their folder, so a terminal's title and working directory follow cd. In a Windows terminal Ctrl+Shift+K clears instead of opening search and Ctrl+B reaches the shell instead of folding the sidebar; on the Mac the sidebar now folds on ⌘B only, so ⌃B reaches the shell there as well. The interface uses Segoe UI and Microsoft YaHei UI on Windows rather than fallback fonts, and a ticket's description in the flow's task list no longer shows the top of a third line under its two.

• The README, the website, the security policy, the contributing guide, the bug report and pull request templates, the glossary and the roadmap no longer call Deskfolk macOS-only. They say where to get the Windows preview (the installer in each release, or from source), what it does not have yet (remote access, the independent runtime, installing an update inside the app, notifications and the badge, image thumbnails), and where it keeps data (%LOCALAPPDATA%\real-bot) and keys (Credential Manager). The website's download button no longer says macOS, and remote access is marked as macOS only. The Windows checks (windows.yml) now run on every pull request and push to main as well, not only on the branch Windows support was built on.

• Asking "how's it going" no longer wakes or interrupts anyone. A line that only asks for status ("how's it going", "done yet", "any update", 「怎么样了」「好了吗」「成片呢」; the whole line, with no @) is answered by the app itself with a status line: who is working on the job and for how long, what they last ran, each ticket's state, the latest files handed over, and the acceptance checks' results. It used to go through the organizer (once filing 「怎么样了」 as a job of its own), then participation judgement, and a Bot that joined had its turn in progress redirected — in one video group, 18 turns were redirected over five days, many by status questions. No model is called, no Bot is woken or redirected, and the line stays out of Bots' context. When nobody is working and tickets are open or checks failing, the question also calls a Bot back once, under the plan call-back rules. To hear it from a particular Bot, @ it.

• pnpm dev:steady runs the source build with a daemon that does not restart on code changes. pnpm dev keeps restarting the daemon whenever apps/daemon changes, which ends every turn in progress; on a source build used for real work (one video job saw 19 interrupted turns in five days, most of them from restarts) that is a lost render each time. The steady variant runs the daemon without --watch, and tells the window not to add it when it starts the daemon itself; the messenger still hot-reloads. Quit and start again, when nothing is running, to pick up new daemon code.

• A new acceptance check for work several Bots make in parts: seams. Each Bot reviews its own part and nobody looks at where the parts meet, so the app does: give it the parts in order (a command that lists them, a glob, or one document split at its headings, or a video split at its cuts) and it takes both sides of every seam — the last and first frames around a cut, two neighbouring images side by side, or the end of one section and the start of the next — and has the default model compare them against the plan's rules and one general list: follows on, the same thing named and counted the same way (characters, products, terms, numbers and units, orientation), the same style, no repeats or gaps. Text also gets one pass over the whole set for names and numbers that drift between parts. It passes only when every seam and the whole set hold, and says which seams failed and why, keeping the image evidence under the plan folder's checks/. It began with a video job where every problem the user sent back sat between shots, and applies just as much to a report's chapters, a storyboard or a deck; seams between code modules stay with an integration command check. The model calls are billed as their own spend kind. In the check form, the chosen kind's label no longer disappears while the pointer is still on it.

• A Bot's check-back in its direct with you no longer starts a second turn beside one already doing the same job. It used to fork a turn there, as a second message of yours would, so a Bot busy on your request woke a copy of itself on the same job and the two did the work twice at once — a video Bot re-rendered the same shots in two turns side by side, and the chat showed two activity lines for it, one under your message on your side. Now a turn of that Bot already on the job hears the reminder at its next step, without being interrupted, and a reminder about another job still opens its own turn. See ADR 0031.

• A correction chain is now reviewed only after its last turn ends, so what you say after a long turn reaches the review and the learning step, and what the learning step writes names the thing that went wrong. The chain's three-minute quiet clock used to start when a turn started, so any turn longer than that was reviewed while it still ran — with no outcome and nothing counted yet, it closed as "no complaint" — and whatever you said about it afterwards landed on a chain that was already closed. On one install in daily use, 237 of 436 reviews happened mid-turn, 104 of the 160 replies about a turn reached no review, and the "the request was unclear" lesson never fired. The clock now pauses while a turn of the chain runs, starts when it ends and runs for 15 minutes; after a daemon restart, a chain that was not quiet yet gets its clock back instead of waiting for the next restart. The learning step after a review also reads the first few calls that failed in the chain (tool, target, error) and writes only a conclusion that names something concrete, not reminders like "verify first". See ADR 0035.

• A Bot's memories now reach it in the order they were last written, newest last, with their age counted from the last write (the Bot panel shows the same); when two disagree, the later one holds. When a Bot opens a new memory topic, the result lists its other memories from the same session in the last day, so revising a preference replaces the old entry instead of stacking another version beside it: one Bot had stored five versions of one poster layout in an hour, each under a new topic, and read all five at once in every later session.

• The flow board has a minimap. Above the zoom controls in the bottom-r...

Deskfolk v0.1.0-rc.11

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• The installed app can set up remote access and pair devices. Until now only Deskfolk run from source could: the app's remote credential store needed a Keychain access group and a signed, sealed runtime that no build has, and the window's setup channel failed its signature check before getting that far. The app now keeps the Mac's remote identity in a private file in its data folder (dev-remote/credentials.json, the same file source runs use, so a Mac registered from source keeps its identity and paired devices in the app), and approves each pairing or device removal with Touch ID or your login password, on a sheet that names the device and its fingerprint. Dismissing the sheet pairs nothing and leaves the approve button there. When the Mac is not registered yet, Settings → General → Remote (experimental) asks for the relay address, the relay ID and the one-time bootstrap token; a mistyped address or a refused token leaves nothing behind, and the card says which it was. What the file gives up against the Keychain is in ADR 0033: any program running as you can read it.

未签名的 macOS rc。不是受支持的签名安装包；Gatekeeper 可能拦截。优先从源码运行。

• 安装的应用也能设置远控、配对设备了。之前只有从源码运行的 Deskfolk 可以：应用的远控凭据存储要钥匙串的专用访问组和一个签名封口的运行时，没有哪个构建有；窗交给守护进程的设置通道还没走到那一步就先过不了签名校验。现在应用把 Mac 的远控身份存在数据目录里的一个私有文件里（dev-remote/credentials.json，就是源码态用的那个，所以从源码登记过的 Mac 到了应用里身份和已配对设备都还在），每次配对或移除设备都用触控 ID 或登录密码批准，确认框上写着设备名和指纹。关掉确认框不会配对任何东西，批准按钮也还在。这台 Mac 还没登记时，设置 → 通用 → 远控（实验性） 会要中继地址、中继 ID 和一次性 bootstrap 令牌；地址输错或令牌被拒都不会留下任何东西，卡片会说是哪一种。文件比钥匙串少了什么，见 ADR 0033：以你的身份运行的程序都能读到它。

---

Unsigned macOS snapshot. This is not a supported signed installer.

Gatekeeper may block ad-hoc signed builds (signingIdentity: "-"). Prefer running from source:

pnpm install
pnpm dev

Windows and Linux are out of scope. See CHANGELOG.md and ROADMAP.md.

Deskfolk v0.1.0-rc.10

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• The installed app starts its runtime again. Since 0.1.0-rc.6 the runtime bundled in the app quit before it began listening: it looked for the version in a package.json that only a source checkout has. On a Mac where no runtime was already running, the window kept saying "Can't reach the runtime" and never got past it. The version is now built into the runtime, and a test starts the compiled runtime from outside the source tree, the way the app ships it, before a release is packaged.

• The session list's filter (the pulse button beside search, and its twin on the folded rail) now keeps conversations with messages you have not read, not only the ones a Bot is working in, and says so: "Only working or unread". An unread Bot↔Bot direct still stays out, as its row shows no unread, so the filter does not bring that whole section back. The conversation you have open stays in the filtered list too, so opening an unread row no longer makes it vanish the moment it is read; it goes when you open another. The empty-list hints read "No session is working or unread." and "Nothing outside the pinned ones is working or unread."

• The website's homepage now plays the whole demo film in a window over the page. The first screen's still has a "Play the full video" button in the middle, and "or watch the full video" sits beside the hint to scroll; both open the film of the site's language (1:43 in English, 1:49 in Chinese, the same ones the READMEs link) with its sound on. It loads only once you open it, and Escape, a click outside it or the close button stops it; the walkthrough behind stays where it was. The walkthrough's picture of the app is also bigger: it used to stay 730 px wide on any screen, too small to read the window in it; now it takes the room beside the copy, up to the clips' own 1480 px on a wide screen (about 900 px on a 1440 px-wide laptop), and where it is still small, "Enlarge this step" in its corner (or a click anywhere on it) plays that step's clip in a window over the page.

• A release's notes no longer mention GitHub accounts by accident. A changelog line quoting a chat message such as "the API is ready, @frontend" made GitHub notify the account by that name and list it as the release's contributor, which is how an unrelated "frontend" account showed up on 0.1.0-rc.9 (that release's notes have been corrected). release-notes.ts now puts every @name outside code into a code span, so it reads the same on the release page and in the About card without pointing at anyone.

• The English website's docs pages are in English. The manifesto (the domain language from CONTEXT.md) and the roadmap used to show their Chinese text under English navigation, on pages such as /en/manifesto/runtime; they now read new English editions, CONTEXT.en.md and ROADMAP.en.md, which match the Chinese term for term, and switching language while on a term keeps you on that term. "On this page" beside a docs page now lights the section you are reading as you scroll, not only the entry you last clicked.

• A Bot now knows which job each line it reads is about. A group or a direct often carries several jobs at once, and until now neither a transcript line nor the "this came in for you" note said which one it belonged to, so the Bot had to guess; a line from another job or ticket now carries 〔plan "…" · ticket 03〕 after the speaker's name. The situation block names the job, says which session it was opened in, lists who else is working on it in other sessions right now (the Bot's own turn elsewhere included) and what else the Bot has on, and marks the steps under "So far" that happened in another session. When you redirect a Bot, the new turn is told which job the old one was on. In a group, a Bot judging whether to take up a line of yours with no @ now weighs the job and ticket that line was filed under, not the session's current one.

• What you say in one conversation now lands on the job it is actually about, and the Bots working on that job hear it. When bot1 and bot2 were pushing a job forward in a group (or in a direct between the two of them) and you told bot1 in your direct "keep the title short", that line used to become a new job of the direct: bot1 there could not see how far the group's job had come, and the turns working in the group never heard it. Filing now also looks at the jobs the Bots in the conversation are doing in other sessions; when the line is plainly about one of them, it is filed under that job and its ticket, and the job's rules are updated. The job stays in the group, and the direct's own job is left alone. Every turn working on that job in another session, whichever Bot's it is, reads the line on its next step, marked with where you said it, without its work being interrupted. bot1 still answers you in the direct: it sees the whole job and knows its own turn in the group already has the line, so it does not do the same work twice.

未签名的 macOS rc。不是受支持的签名安装包；Gatekeeper 可能拦截。优先从源码运行。

• 装好的应用又能拉起运行时了。从 0.1.0-rc.6 起，应用里自带的运行时还没开始监听就退出了：它去读一个只有源码目录里才有的 package.json 拿版本号。本机没有已经在跑的运行时时，窗口就一直停在「连不上运行时」。现在版本号在构建时写进运行时；发布打包前还有一个测试，像应用发布出去那样，在源码目录之外启动编译好的运行时。

• 会话列表的筛选（搜索旁的脉搏按钮，以及折叠栏上同一个开关）现在除了 Bot 正在工作的会话，也保留有未读消息的会话，按钮也改叫「只看工作中和未读」。Bot↔Bot 私聊的未读不算：那一栏的行本来就不显示未读，算进来会把整栏都带回来。正在打开的会话也留在筛选后的列表里，点开一条未读不会在读完的那一刻从列表里消失，换去别的会话后它才离开。列表为空时的提示改为「没有正在工作或未读的会话。」和「置顶之外没有正在工作或未读的会话。」

• 网站首页可以直接在弹窗里看完整演示片了。首屏静帧正中有「播放完整视频」，滚动提示旁也有一个「或者直接看完整视频」，两处都打开站点当前语言的那支片子（中文 1:49、英文 1:43，和 README 链接的是同一支），带声音播放。点开才开始加载；按 Esc、点弹窗外面或关闭按钮就停下，背后的滚动演示停在原处。滚动演示里的界面画面也放大了：以前不管屏幕多大都只有 730px 宽，窗口里的字看不清；现在它占满文案旁边的空间，宽屏上最大到短片自身的 1480px（1440px 宽的笔记本上约 900px）。画面仍然偏小时，右上角有「放大看这一步」，点它或画面任意处，就在弹窗里放大播放这一步的短片。

• release 正文不再误提及 GitHub 账号。CHANGELOG 引用群聊原话（比如 "the API is ready, @frontend"）时，GitHub 会把其中的 @frontend 当成提及：通知同名账号，还把它列成这个 release 的贡献者，0.1.0-rc.9 页面上那个无关的「frontend」就是这么来的（该 release 的正文已改正）。release-notes.ts 现在把代码片段之外的 @名字 都包进代码片段，release 页面和「关于」卡片里读起来不变，但不再指向任何人。

• 网站英文版的文档页换成了英文。设计理念（CONTEXT.md 的领域语言）和路线图以前在英文导航下仍是中文正文，比如 /en/manifesto/runtime；现在读新增的英文版 CONTEXT.en.md、ROADMAP.en.md，词条和中文一一对应，停在某个词条上切换语言也仍停在这个词条。文档页右侧的「本页目录」也会随滚动点亮正在读的那一节，不再只亮最后点过的那一条。

• Bot 现在分得清手上每一句话是哪件事的。一个群或一个私聊里常常同时有好几件事，以前转录里的每一行、干活时「有人找你」的那一行都不说自己属于哪件事，Bot 只能猜；现在属于另一件事或另一个任务的那一行，在说话人后面带着 〔规划「…」· 任务 03〕。局面里也写出这件事的名字、它是在哪个会话开的、此刻别的会话里还有谁在做它（包括这个 Bot 自己在别处的那一轮），以及这个 Bot 手上别的活；「经过」里在别的会话做的那一步标明在哪。你改道一个 Bot 时，新的一轮也知道旧的那一轮在做哪件事。群里你没点名的一句话，Bot 判断要不要下场时，现在按这句被归到的那件事和任务来判断，不再按会话当前的那件。

• 你在一个会话里说到的事，现在会被归到它真正属于的那件事上，正在做它的 Bot 也听得到。以前 bot1、bot2 在群里（或它们之间的私聊里）推进一件事时，你在私聊里跟 bot1 说「标题别太长」，这句会被当成私聊里的一件新事：私聊里的 bot1 看不到群里那件事做到哪了，群里正在干活的那几轮也听不到这句。现在整理规划时会一并看在场 Bot 正在别的会话推进的事，这句明显在说其中一件，就归到那件事和对应的任务上，规则跟着更新；那件事还留在群里，私聊自己的事照旧。这件事在别的会话里正在跑的每一轮（不论是哪个 Bot）都会在下一步读到这句，标着是你在哪说的，手上的活不会被打断。私聊里的 bot1 照常回你：它看得到那件事的全部进展，也知道自己在群里那一轮已经收到，所以不会再重复动手。

---

Unsigned macOS snapshot. This is not a supported signed installer.

Gatekeeper may block ad-hoc signed builds (signingIdentity: "-"). Prefer running from source:

pnpm install
pnpm dev

Windows and Linux are out of scope. See CHANGELOG.md and ROADMAP.md.

Deskfolk v0.1.0-rc.9

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• The setup wizard you see the first time you open the app now ends by creating your first bot. Saving the endpoint on step three used to drop you straight into an empty app, where you had to find the + on the roster row yourself. Now a "Create your first bot" step follows, with a name, duties and boundaries already filled in for a general assistant: create it as is, or change it and its avatar first. It runs on the default model you just chose. Creating it opens your direct with it, with starter suggestions drawn from those duties; "Skip, create one later" goes into the app without one. When the roster already has bots (for instance when you run the wizard again after removing the endpoint), the step is left out and saving goes straight into the app as before. On a phone the step bar keeps only the current step's name so four steps fit, and a wizard taller than the window now scrolls from its top instead of pushing the top of the card out of reach.

• The walkthrough on the website now shows the real app. Each of its eleven steps plays a short clip cut from the same recording as the demo film, from the first-run wizard to carrying on from a phone, and the first screen shows the frame where that recording has the conversation, its flow, the generated teaser and a terminal side by side; the clips follow the site's language and its light or dark theme. The hand-built imitation of the window that the walkthrough, the first mock-up film and the Open Graph image were drawn from is gone, and the steps now tell the recording's story, a launch kit for a pour-over kettle, instead of a research report.

• Opening a ticket's status menu on the flow board no longer pushes the ticket's own content out of sight. The ticket card clipped whatever stuck out of it, so the menu showed only its first option, and bringing the current status into view scrolled the card itself: its title and worker line slid up out of the card. The menu now hangs over the tickets below, all its options in reach, and the card stays put. Elsewhere in the app, a dropdown whose menu reaches past the edge of the panel it sits in no longer scrolls that panel when it opens or as you move through it with the arrow keys.

• JavaScript files are highlighted in the editor again. In the desktop window (and Safari) the first line after opening the app took longer than the 500 ms a line is allowed while the highlighter compiled its patterns, and every line after it was read as if it continued that unfinished line: comments, strings and keywords of a whole .js file came out as the same colour, until you opened some other code file first. A line that runs out of time is now tried again until it finishes while the highlighter is still compiling its patterns (a slower Mac can need several tries), and a line that runs out after that starts the next line afresh instead of handing on the half-read state. The same fix restores the light-theme colours of code blocks in messages and previews, whose strings could come out coloured as names.

• Right-clicking a row in the file tree (the workspace browser, and the tree beside an artifact preview) now offers "Open terminal here", "Copy workspace path" and "Copy absolute path", for folders as well as files. A terminal opens in the folder itself, or in the folder a file sits in: a new terminal tab on the desktop, the terminal page on a phone; a workspace browser drawn over the screen closes first, asking about an unsaved file as usual. The workspace path is the one from the workspace root, such as assets/beacon_zero, ready to hand to a Bot; the absolute path is the full path on this machine, for a terminal or another app. Until the workspace root is known, only the workspace path is offered.

• Each flow board tab comes back where you left it. Bringing a board's tab forward again (from another board, a conversation, or any other tab) used to open it afresh on its newest round, so wherever you had dragged or zoomed to was lost every time you looked at something else; a board opened from a message went back to that message's card, and two conversations' boards in one pane could even swap the second for that conversation's latest job. Now each board keeps where it was dragged, how far it was zoomed, the rounds you folded or unfolded, the filter, the lit ticket or highlight and an unfolded model choice, and comes back exactly as it was left; picking a job again in the board's switcher finds it as you left it too. Only a message newly asking for a card moves it. A board you never moved still opens on its newest round as before.

• A Bot that is mid-task in a group is no longer cut off when another Bot @-mentions it or its own check-back comes due. That line used to end the turn it was working in and start a fresh one that could not see what had been written or run: in one job building a video editor, the frontend engineer had written 19 files and made 40 tool calls when the backend's "the API is ready, @frontend" ended its turn; it was cut off three times and never delivered anything. Now the line is read at the start of the Bot's next step and the turn carries on; if the turn wraps up before reading it, one more turn opens to answer it, so nothing is dropped. The same holds in a Bot↔Bot direct. Your own @ still turns the Bot around at once (a group has no Stop button), but the new turn first sees the files the old one wrote, what it was last doing and anything it had not read yet, instead of starting from nothing.

• Tickets on the flow board follow the work as it happens. A ticket's state used to be filed only once the whole plan had gone quiet, so while several Bots worked back to back every ticket read "To do" from start to finish; and an organizer update that gave a ticket's state without its title was dropped entirely, so a plan could be marked done with not one ticket moved. Now a ticket goes to "In progress" as soon as a turn filed under it starts writing files or running commands, and to "Awaiting review" when that turn hands files over, noting who is on it; the organizer can update a ticket by its id with only what changed; and a plan is not marked done while any ticket is still to do or in progress (marking it done yourself on the flow board still works). Tickets are opened with the Bot the plan's division of work names for them (a ticket not started yet reads "For "), and a Bot woken by a handoff works in its own ticket's folder rather than in the ticket of whoever woke it.

• "Tests pass" and "acceptance passed" need a run behind them. The app records the commands each turn actually ran (with exit codes) and its MCP calls, and the closing check before a delivery holds the closing against them: a claim of tests run, a build that succeeds, something verified in a browser or a number measured, with no matching successful run, is sent back once so the Bot runs it or says plainly that it was not verified and why. A testing Bot with no browser could once write "21/21 end-to-end pass, A/V drift ≤33ms" and have the whole job marked done on the strength of it. The organizer no longer marks a ticket done on a Bot's word either; when the job is to build something usable, its acceptance includes "runs on this machine by following the start instructions", work split among several Bots gets a ticket for putting the parts together and saying how to start them, and a Bot handing over something to run includes how to start it and starts it that way first.

• A job that stops halfway gets picked up. When a plan goes quiet with tickets still to do or in progress, the app calls back the Bot on the first open ticket once, listing what is still open and which one is its own; if no ticket has been handed over after that, it stops calling Bots and instead leaves a line in the conversation ("This plan has stopped…") and sends you a notification, so you decide who takes it next. A check-back now also wakes the Bot back in the ticket folder it was booked from. When several Bots in a group decide whether to join, a reasoning model's verdict is no longer silently read as "pass" because its answer was cut off.

• The README opens with the demo film instead of a still banner. A frame from the flow-board step, with a play button, links to the 1:43 English film; the Chinese README links to the 1:49 Chinese one, and each names the other language underneath. Both are the real app, recorded from first setup through a group of Bots delivering a launch kit to following along on a phone, and the website serves them at /media/deskfolk-en.mp4 and /media/deskfolk-zh.mp4, so they play right in the browser.

• While a Bot has not started writing, the "Thinking" line under the message now says which step it is on: "Reading src/app.ts", "Running pnpm test · 12s", "Calling GitHub · create-issue"; between steps it reads "Thinking · Read src/app.ts", and a failed command says so. A turn busy reading files and running tests used to show nothing but "Thinking", so ten minutes of work looked exactly like a stuck model, and a command's output only showed in a bubble the Bot had already started writing. In a group, each thinking Bot's name carries its own step. The line names paths, commands and names only, never a file's content or a message's text; the time appears once a step passes 3 seconds, and hovering shows the whole path or command. After a reload or a reconnect it starts again from "Thinking" until the next step begins. Clicking the line (in a group, the step beside that Bot's name) opens every step the turn has taken so far beneath it: the whole path or command, how long it took, and a failed command's exit code; a running command's output scrolls there as it goes, and a finished one's opens with "Output". Clicking the name still opens the Bot's profile. The list holds what this page has seen: when the turn began...

Deskfolk v0.1.0-rc.8

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• Folding a round on the flow board no longer leaves the view on empty canvas. The board stayed put while the layout changed under it: folding the round you had read down to took its cards out from under the view with nothing below to take their place, and folding the widest round also shifted every round sideways, so the line you had just pressed jumped away. Now the line you press stays where it is on screen when its round folds or unfolds, and a fold that would leave the view looking at empty canvas slides the board back until its cards fill the view. The round lines also no longer slide to their new places a moment after the cards have jumped to theirs.

• The plan picker at the top of a flow board is no longer cut off. The title row and the spec under it scrolled as one block, and that block also clipped the list dropping out of the title: with the spec folded the block is short, so only the first plan showed and the rest were sliced off at the top of the board. Now only the spec scrolls, the list drops out over the board in full, and an open spec still takes at most 60% of the height.

• The About card in Settings shows the Deskfolk mark beside the name, and says what the README says: "A private AI team you can trust." under the name, with "A workbench you arrange freely: chats, terminals, flow boards and the workspace, split however you like." below it. It used to read "Local macOS single-user agent workspace".

• Bots can look at pictures in the workspace themselves. read_file used to read text only: a picture over 1 MB was refused and a smaller one came back as "not UTF-8 text", so a Bot saw only the pictures attached to other members' messages, never one whose path a message body or a file gave. A reviewer handed the paths of 18 start and end frames converted them four ways without getting one in, posted three back to the group saying "checking them pair by pair, conclusion to follow", and ended its turn without having seen any. Now read_file on a PNG, JPEG, GIF or WebP shrinks it and shows it as an image right after that hop's tool results: at most 12 pictures and 8 MB a hop, with the ones that do not fit named in their result so the Bot reads them next hop, and when later reads need the room the earliest leave the context and keep their path. They share the per-turn limit of 20 pictures and 20 MB with the transcript's pictures, so a request carries no more pictures than before. The system instructions now say to read frames handed over for review or comparison before concluding anything, instead of judging from their text description or posting them back for someone else to look at.

• Bots no longer stop right after "conclusion to follow". A reply without tool calls ends the turn just like send_message, and nothing wakes the Bot afterwards, so "checking the frames, conclusion to follow" promised work that was never going to happen, while the app rightly showed nothing running. The closing check used to accept "says when" as accounted for, which that line passed, and it never looked at replies that cited no file. Now a closing message that says the work is still going ("checking now", "to follow", "later") is checked even without a cited file, the check sees whether the Bot booked a check-back here, and one with no check-back and no one named to take it goes back to the Bot once, to finish the work in the turn or book a check_back before closing. The system instructions now also say that a reply without tool calls ends the turn.

• Folding or unfolding the session list no longer makes the next drag in the workbench jump. The workbench only measured itself when the window was resized, and the list changing width resizes the workbench without resizing the window, so drags kept working from the old width: after folding the list, the first pixel of a divider drag snapped both panes to their old sizes and letting go put the divider short of the pointer; a floating pane stopped at an invisible wall where the old right edge had been; and unfolding the list again left a floating pane near the right edge hanging past it. The workbench now measures itself whenever its own size changes, including when the list is dragged wider or narrower or the preview or thread panel opens, and a floating pane that no longer fits is drawn inside the edge (widening again puts it back where you left it). Separately, a floating pane placed low in a window taller than 800 pixels is no longer pulled up by the next new message.

• A Bot that opens a Bot↔Bot direct now comes back to report once the direct is done. The opener handed its turn off with the opening message, so nobody was left where the work came from, and the outcome stayed in the direct for you to dig out. About 10 seconds after the direct goes quiet, with no turn still running and no check-back pending in it, the app wakes the opener with a check-back in the conversation it opened the direct from, saying who it talked to and who had the last word and what it was (or that the other Bot never answered), so it reports there before moving on; this replaces its pending check-back there. It is not called back again until the direct has something new; a direct opened from such a report-back that the other Bot never answered does not call back at all, so two Bots do not bounce on silence; nor does a direct whose turn was stopped or cut off by a restart, which is yours to pick up.

• Switching tabs no longer jolts the tab strip. With the last tab active, which a pane of one tab always is, the whole row moved 8px to the left and cut into the first tab, so it looked narrower, and switching away moved it back. It came in with the scrolling tab row in the last release: the active tab's right flare, the curve that joins it to the content, stuck out past the last tab, gave the row that much to scroll, and bringing the tab into view scrolled the whole row. The flares past either end of the row, which the row never showed anyway, are no longer drawn, so how wide the row is no longer depends on which tab is active.

• The artifact preview's Source / Preview switch moved into the row of buttons above the file, next to Annotate and Annotations, instead of floating over the middle of the file's first lines. It stays there while HTML elements are being picked; switching to Source leaves picking (the source is annotated by selecting lines) and keeps a spot already picked whose remark is being written. The HTML preview no longer leaves a gap above the page for it, so the page frame gets a little more height.

• A tab's menu closes several tabs at once; before, tabs could only be closed one × at a time. Right-click any tab and, below what the tab itself offers, there are Close tab, Close other tabs, Close tabs to the right and Close all tabs; a conversation tab's ⋯ has the same four. They close tabs in that pane only. An entry with nothing to close, no other tabs or none to the right, is dimmed. Closing all of them closes the pane, as closing its last tab does (the only pane stays, empty); a workspace or artifact preview among them holding an unsaved edit asks first whether to save, discard or cancel.

• Films and other large files open on the phone. Remote access refused every file over 50 MiB, and the phone then said the file was gone instead of saying why: a 72-second 720p film of about 60 MB, handed over in a group, played on the Mac and showed "file not found" on the phone. Remote file transfers no longer have a size limit, in either direction: audio and video of any length stream a piece at a time, other files open or download whole, and the phone attaches files of any size. The 50 MiB note is gone from the phone's message field.

• Every file opened remotely can be downloaded: on the phone from the right end of the preview's top bar, on a wider screen from the row of buttons above the file, and from the head of a file card on the flow board. On a touch device the file goes to the share sheet when the sheet takes that kind of file, and is downloaded otherwise. A file the preview has already read whole is saved from what is on the device instead of crossing the relay again, so on an iPhone the share sheet opens on the first tap; a picture shown as the Mac's scaled copy, or a film that streams, downloads the whole original. Files the preview cannot show, such as subtitle files (.srt, .ass) or archives, now say so instead of showing only their name, with the download in the middle; in the desktop window they offer Open with default app.

• Pane tabs can be reordered by dragging. Dragging a tab along its own strip used to either send it to the front or leave it where it was, because the drop never worked out which two tabs it landed between; dropped on another pane's strip, it always went second to last; dragged within a floating pane's own strip, it fell into the pane underneath the float. Now a bar shows the gap between two tabs as you drag, and the tab lands there on release, on any pane's strip, floating or not. When a strip has more tabs than fit and scrolls sideways, holding the tab near either end scrolls the row that way. The dragged tab stays in place, faded, until you let go. The drop indicator and the name that follows the pointer are now drawn above floating panes instead of under them.

• Two Bots handing work back and forth in a private channel no longer stall halfway. When one Bot answered with its turn's closing reply instead of sending a message, the other Bot never woke up: only group replies were read for who to wake next. A director Bot submitting shot after shot to a reviewer Bot this way stopped after the sixth submission and waited there for good. A closing reply in a Bot↔Bot private channel now wakes the other Bot, the same as a sent message.

• HTML previews scroll on the phone. Remote access blocks every script in a ...

Deskfolk v0.1.0-rc.7

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• A Bot that decides to sit a turn out no longer posts a line saying so. A reviewer Bot kept ending group turns with a bold-italic ***无发言，本轮结束*** ("nothing to say, turn over") as a message of its own: the filter that drops such closers didn't know "无发言", "不发言" or "保持沉默", let "无需发言" through, and counted markdown asterisks as content. Silent passes like these, bold, italic, quoted or bracketed, now end the turn without a message.

• Tabs in a pane keep their width however many are open. Every tab used to shrink to fit, so with six open each name was cut to two or three characters. Past the pane's width the tab row now scrolls sideways — a trackpad swipe or the mouse wheel over it — and a tab you open or switch to scrolls into view.

• Bots can hand pictures from the workspace to MCP tools such as video and image generators. Those tools only take an image URL or data URI, a remote server cannot read your Mac, and a model cannot copy tens of thousands of base64 characters into a call — once a video Bot spent an hour and 99 hops shrinking one storyboard frame into ever smaller base64, sending nothing and never reaching the video tool. A Bot now writes workspace://<path relative to the workspace root> in the argument and the app sends the picture itself (shrunk first when over half a megabyte), while the transcript keeps the short reference; a path outside the workspace, a missing file or a non-picture fails that call with the reason.

• A turn no longer calls tools forever. Every 40 tool hops in a row, the app asks whether it is stuck: if so it stops calling tools and replies with what is done, where it is stuck and what it needs from whom; if it is making progress it carries on. At 160 hops the tools are taken away and its next reply ends the turn (the longest real turn so far was a video Bot's 141 polling hops).

• Plans finally get written up. The organizer used to get 256 tokens per answer, so every plan stopped halfway through its JSON and was thrown away: no job ever got a plan or tickets, and the flow board's plan panel and ticket rail stayed empty. It now has 4,096 tokens. Filing a message you send may take up to 60 seconds (it was 20, and a reasoning model could spend most of that before its first word), and filing a job once it goes quiet up to 2 minutes. A cut-off answer, an answer that doesn't read as a plan, or a failed call still changes nothing and turns open as before, but the log now says which of those it was instead of failing silently. The organizer is shown the job's latest 30 messages and files, not its first 30, which in a long job meant it never saw what you had just said.

• A long flow board stays readable. Past three rounds, only the newest two stay open, along with any round that has a turn still going, holds the card a message asked for, or holds cards a ticket or the Feedback / Blamed-model highlights light up; every other round folds to one line (who said it, the line itself, when it started, how many cards and files, which tickets it worked in) that unfolds on a click. The wheel and a two-finger swipe now pan the board, and zooming moved to ⌘/Ctrl + wheel or a pinch (the wheel used to zoom, so moving around meant dragging). Cards no longer each name the job's own conversation: the header names it once, and only a card from another conversation says where it happened; your own cards no longer say "Done". Before the plan is first written up, the plan panel is a single line saying so, with the opening request, instead of an "Organizing…" note that never went away; before there are tickets, no empty ticket rail takes up the side of the board.

• Cards on the flow board no longer land on top of each other, and a job with many rounds no longer keeps growing sideways. After laying out the cards one Bot woke, the board used to shuffle them into time order by sliding each card together with everything below it, which could drop them onto the cards of a neighbouring branch; siblings are now laid out oldest-first from the start and nothing moves afterwards. Every line you send starts a round: the rounds used to stand side by side, and now stack top to bottom in the order they happened, each starting on one shared vertical line, so the board is only as wide as its widest round. Cards on one row share a top edge. A turn that moved on to a newer message or finished without speaking used to show the line that woke it, which read as the Bot saying it; it now says "Said nothing this turn". A board too big to read whole (below 60%) opens on its newest round instead of shrinking into a field of tiny cards.

• The Bots your message wakes show up under it as Thinking right away, instead of after the organizer has filed it. During those few seconds nothing used to show, so the message looked ignored. In a direct that is the Bot; in a group it is whoever you named, or everyone present when you named no one, and those who judge to sit it out drop away. The sidebar list, conversation header, tabs and roster say Thinking at the same moment. The line under the message used to read "Thinking & generating"; it now says "Thinking", like the list.

• Redesigned the Spend view UI/UX with dedicated mobile and narrow-pane adaptations. The overview introduces dual hero metric cards for total token usage and cost coverage, displaying prompt/cache/output breakdowns and reported vs. estimated amounts cleanly; interactive daily trend charts feature refined bars, swatches and popover summaries; distribution and call details transform into responsive card feeds on mobile devices with touch-friendly targets, prominent actions and expandable token disclosures; includes mobile safe area inset adaptation and full light/dark theme polish across desktop and mobile.

• The remote-access status now matches what has actually been checked. The README, the remote-access guide, the roadmap and the website used to say only that real-device checks had not passed. They now say everyday use and Web Push work on a real Android phone in Chrome, while real-device checks of the iOS home screen and WebAuthn user verification are still to do and the independent security review has not passed. The README, the roadmap and the website also say a release build needs the packaging gate before it can pair; until then, pairing needs Deskfolk running from source.

• A Bot's question now keeps your answer on the question itself. Answering used to post your reply as a separate message of yours under it; now the question card shows what you chose and wrote, and nothing else is added to the conversation. Questions can also offer choices: the Bot lists the likely answers, as one pick (round marks) or several at once (square marks) depending on the question, with the recommended one first, and a line to write your own answer, or add a note to a pick, is always there. The Bot gets the labels you picked and what you wrote; later turns, the organizer and search read your answer from the question. The API adds POST /v1/messages/:id/answer ({ selected, custom }, also open to paired devices); a reply still posted the old way with ask_id is written onto the question too. Questions answered before this keep their answers as the separate messages they were.

• Billing rates now price the calls you made before you set them. Rates used to apply only to calls recorded afterwards, so if you used a model for a while and then filled in its rates, all those earlier calls kept showing "no billing rate"; and calls priced at a mistyped rate stayed wrong after you fixed it. Estimates now follow the rates configured now: setting, changing or clearing a model's rates re-prices every call of that model on that endpoint that has no reported amount, and an open spend view refreshes. Reported amounts are never touched, and a model removed from the list keeps the estimates it had. The daemon also re-prices on startup, so a ledger whose rates were set before this change catches up when you upgrade.

• A routine no longer fires by posting a message in your name. Your direct chat with the Bot used to show the routine's instruction as something you had just sent, and the organizer read it as your word on the current plan. It is now a system line under that Bot, Routine "<title>": <instruction>, the way a check-back wakes a Bot, and the routine's flow board no longer grows a card of yours for each run.

• The tagline is now "A private AI team you can trust.", on the website, its Open Graph images, the repository's social preview and the README. The website's first screen and a new README section say what the trust rests on: everything stays on your Mac, risky actions wait for your approval, every job shows its work on a flow board, and files are checked against your original ask before they reach you. On a phone the download buttons now come before that list, so they stay above the fold. The subtitle under the tagline is about the workbench: "A workbench you arrange freely: chats, terminals, flow boards and the workspace, split however you like." It appears on the website's first screen and in the README.

• File previews now open Word (.docx), Excel (.xlsx) and PowerPoint (.pptx) locally from chat attachments, the workspace and flow-board outputs. Excel has worksheet switching and PowerPoint has slide navigation; a slide is shown whole and centred in the preview, and the arrow keys turn slides in full screen. The background around pages and slides follows the light or dark theme. All three offer a full-window preview with an exit button. Escape and phone Back exit full screen first, also after clicking into the document, while keeping the current file, sheet and slide open; a subsequent Back leaves the preview. HTML full-screen previews follow the same Back behavior. Previews are read-only; encrypted, oversized and damaged files show an ...

Deskfolk v0.1.0-rc.6

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

• Fixed the self-hosted relay's Caddyfile not starting. The rule that rejects file-path queries wrote CEL's matches as an operator, which Caddy refuses to compile, so caddy run with deploy/remote/Caddyfile exited at once. It now calls .matches(...) on the query.

• Fixed files sent into a Bot-to-Bot chat being written out before the post was refused. That chat is yours to read, not to join, but a post with files staged them in the workspace (or the app's inbox folder when no workspace was set) before checking, and failed with an internal error where that folder did not exist. The post is now refused first, with nothing written.

• In a Bot-to-Bot chat, an interrupted turn and a turn that did not finish — the endpoint unreachable, a refusal, a runtime error, a stall — can be continued. That chat has no composer, so Continue used to be hidden with it, and of the "this turn did not finish" notes only an unreachable endpoint could be resumed. A group and a chat between you and a Bot can resume those unfinished turns the same way.

• Real Bot is now Deskfolk. The app, its window, menus, tray, notifications and web push, the Touch ID prompt, the website and the docs carry the new name, and the app installs as Deskfolk.app. The repository moved to Blackman99/deskfolk and the website to blackman99.github.io/deskfolk: old repository links redirect, the old website address does not. Nothing on your Mac moves — the bundle identifier, the data folder, Keychain items and notification permission stay as they were. A build from before the rename only trusts the old repository address, so Settings → About cannot open or download the new release; download the new .dmg from the releases page once. If Launch at login was on, turn it off and on again so the login item carries the new name. A new setup suggests ~/deskfolk-workspace as the workspace; an existing workspace is untouched.

• Redesigned Bot Skills and Memory settings with touch-friendly mobile layouts. On mobile screens, skill and memory rows display as spacious touch cards with inline switch toggles for quick enable/disable. Tapping a card opens a full-page slide-over editor with clear card groups for owner attribution, description, prompt body, and danger delete zones, anchored by a sticky full-width save button. The skills header features an item count badge and quick-add button, while the memory list presents provenance jump links and learning counts. Mobile back navigation cleanly unwinds the open editor before leaving the section or drawer. Desktop layouts remain intact.

• The website's walkthrough covers what the app does today, in ten steps instead of eight. After the handoff it shows a Bot's command scrolling under its line and folding to one, report.md opening in a pane of its own beside the conversation, the job's flow board with the model each turn ran on and why, a right-click split that opens your own terminal running pnpm dev, and, once the window is closed, a macOS banner and a Dock badge. The window follows the current app: a tab strip on every pane, Trace in the conversation header, a conversation pane that lays out like a phone once it is narrow, the message index, and the default model marked in an endpoint's list. The boundaries table gains rows for the desktop workbench and for remote access (experimental, off by default); the roadmap lists the flow board, the workbench, terminals, routines and pending items as groundwork and has a section for remote access; the Open Graph, social preview and README images are regenerated from the new window. On a phone the quickstart section no longer makes the page wider than the screen.

• Redesigned model settings for phones: endpoint cards use the system default-model picker and a full-width model-list entry. The list has a full-width search, touch-sized selection rows, page scrolling, and separate model-attribute pages with step-by-step Back navigation. Auto-save feedback stays visible, failed saves can be retried, and bulk selection acts on the filtered results. Clearing the enabled list or removing its default now saves correctly.

• Inline image thumbnails, attachment cards inside your message bubbles (including file bundles), and the full-screen image viewer now follow the light or dark theme, including transparent image backgrounds, loading progress, captions and controls. The shared viewer updates immediately when the theme changes, across messages and file previews.

• Redesigned the terminal on a phone. The header is now Back, the shell's name and folder, a new-terminal +, and ⋯: with several terminals open, tap the title to switch (it shows how many), and Stop, Find, Clear, text size and End session live under ⋯, where ending still asks first. The bottom is two rows of seven keys: Esc, ^C, ^D, ^V (how Claude Code pastes an image), Paste, ↑, Enter; Ctrl, Tab, ⇧Tab, a keyboard toggle, ←, ↓, →. Ctrl latches for the next key, including one typed on the software keyboard, so Ctrl-R, Ctrl-U and the rest are all reachable; arrows repeat while held and follow the cursor-key mode the program set; Paste sends the phone's clipboard text as a paste. Tapping these keys no longer hands the focus to the terminal, so the keyboard stays down if it was down and up if it was up; tap the terminal or the keyboard toggle to type. While the software keyboard is up the page shrinks to the space above it, so the keys sit on the keyboard and iOS no longer pushes the header off the screen. Terminals in desktop panes are unchanged.

• On a phone, opening a Bot from a group opens that Bot's settings. The header is a back icon, and tapping it returns to the conversation rather than to the group's settings. A wider window can still step back to the group from there.

• Fixed the app icon badge in the Dock that never went away. An interrupted or unfinished turn only counted as handled once you pressed Continue, so it kept the badge up after you had seen it, and with no notifications page there was nowhere else to dismiss it. If you didn't mean to continue that turn, the number stayed; sending another message there cleared the row's "Interrupted" but not the badge. The badge now counts what you haven't seen plus approvals and questions still waiting on you. A seen interruption or failure no longer counts; the session row still shows it and Continue still works. Notification Center pulls a session's banners under the same rule.

• Remote video and audio previews now play while loading, with byte-range seeking across message attachments, the workspace and flow outputs. Closing a preview cancels outstanding reads; media continues through the encrypted connection and stays out of the persistent browser cache.

• Fixed clicking a file in a desktop workspace pane's tree doing nothing. The pick went to the narrow window's slide-over, while the workspace tab in the pane shows the file it keeps itself, so the preview never moved. Clicking a file now opens it in that pane and renames the tab, and Quit and reopen comes back to it. The workspace on a narrow window and on a phone is unchanged.

• Mobile push notifications now include the Real Bot app icon and a transparent monochrome badge for Android's notification area. The notification uses the same app icon as the installed PWA.

• Editing a Bot's routine on a phone is now its own page. Tapping a routine opens the editor: the time is the system time picker, the weekdays are a row of taps, and enabled is a switch. Delete sits at the bottom of the page. Back returns to the routine list first. A wide window still edits in the card. The routine count and Add routine sit in the list page's header, and the hint and routine rows line up with the page edge. The editor's header matches the list's, and opening it no longer focuses a field, so the keyboard does not pop up on arrival. The selected half of the Daily / Weekly switch fills its frame instead of leaving a taller gap above and below, and the enabled switch is centred in its row.

• A conversation pane narrower than a phone now lays out like a phone. The phone layout used to follow the window, so a 380-pixel conversation pane in the workbench kept the desktop arrangement: three labelled header actions squeezed the conversation's name aside, and in a group a Bot's name and model broke one character per line above its message. It now follows the conversation's own width. Below 680 pixels the header actions fold into the ⋯ menu, the name above a message truncates and leaves the model to the header, the message index and the Enter-to-send hint step aside, and the composer takes its compact phone form. Under a mouse the hover buttons stay, and a pane shows no Back button, since its tab strip is right above. Phones look the same as before.

• Fixed a message's file chip running past its bubble and under the avatar in a narrow window. The chip took the width of its file name, up to 240 pixels, however wide the bubble was, so a long name such as a screenshot's did not fit once the bubble narrowed. The chip now narrows with the bubble, and the name and path end in an ellipsis.

• Fixed "✓ Copied" breaking into a column, one character per line, in the hover buttons over a short message after Copy. The button strip took the width of the bubble, and a one- or two-word bubble could not hold it. It now stays on one line, and where it is wider than the bubble it reaches out on the side away from the avatar instead of covering it.

• The daemon now keeps each terminal's screen. It parses every byte alongside the shell, and reattaching a terminal hands the pane that screen as it stands, then carries on from that moment, instead of replaying the last 256 KB of raw bytes. Full-screen programs like vim, htop or Claude Code come back as they were — cursor, colour...

Real Bot v0.1.0-rc.5

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

Desktop

• An update now downloads and installs itself. Finding a new version used to hand the .dmg to your browser and leave the rest to you: open it, drag it over the old copy, clear Gatekeeper. The About card now downloads it in the app with a progress bar, checks that the build inside the image really is this app and exactly the version it offered, replaces the installed copy and reopens it. A failed download or a build that doesn't check out leaves the installed copy untouched, and the browser download is still there — it is what you get when the app can't replace itself at all (a copy someone else installed, or one running from source), with a sentence saying which. The download can be cancelled while it runs.
• The update check and the download go through HTTPS_PROXY / ALL_PROXY when the environment sets one (and skip it for hosts in NO_PROXY). On a machine where GitHub is only reachable through a proxy, checking used to fail with "Couldn't check for updates" and no way to say what was wrong.
• The window comes back at the size it was when you quit. Dragging the frame, zooming to fill the screen, hiding to the tray, or quitting writes window-size.json next to the window process's app data; the next launch restores that width and height (and zoomed-to-fill). The position is not stored, so a display change cannot park the window off-screen.

Daemon

• A turn's intermediate files now land in one folder instead of the workspace root. A shell without cwd runs in that turn's work dir (work/<date>-<slug>-<id>), which is where downloads, conversions and script output go without the Bot having to cooperate; the folder is created the first time it is actually used, so a turn that only talks leaves nothing behind. One job keeps one folder across a handoff, a mention, a judgement that joined, a Bot↔Bot direct and a continued interrupt; a routine opens a new one each fire, and so does the next turn after six quiet hours. File tool paths are unchanged — read_file / write_file / delete_file / list_dir stay relative to the workspace root — so the shell and the file tools have different bases on purpose, and every turn's situation block names the work dir.
• A command's output is finally listed. shell now walks its work dir before and after each call and reports what it created or rewrote, so downloads, conversions and renders end up on the message like a write_file always did. A command that leaves more than 200 entries reports none of them and says so instead — npm install is not a list of artifacts.
• The artifact entry opens the whole job, not one message. Its tree lists every path this job's messages cited, anchored at the work dir, with anything cited outside it laid flat beside it and this message's own files marked. A file an earlier Bot produced before the handoff is now one click away instead of a scroll back through the transcript.
• Oversized tool results now spill inside the turn's work dir (work/<…>/tool-results/) instead of a flat folder at the workspace root, and the daemon drops that spill on boot for work dirs whose job closed more than a week ago. Nothing else in a work dir is ever collected. full_result_path stays relative to the workspace root, so a shell reading it needs cwd: "." — the recovery hint and the turn instructions both say so.
• Files a Bot writes into a work dir's tool-results/ or scratch/ are no longer attached to its message as artifacts. The turn instructions point Bots at scratch/ for throwaway files, and that promise is now enforced rather than implied.
• The daemon writes starts, refusals and fatal errors to daemon.log next to its database. A runtime that dies before it listens — a database it cannot open, a port it cannot take — used to leave nothing behind but the window saying it could not reach the runtime.

Messenger

• Creating a Bot draws its generated avatar from the name you type. The create sheet used to freeze on the empty-name drawing, so every new Bot looked the same until you hit Randomize. Typing a name now redraws it; an uploaded picture still stays put.
• Dragging the session list, the artifact preview split, or the preview file tree now survives quit and reopen. Those widths were already written to localStorage, but loading clamped them against a smaller default shell, so a wide list or tree came back narrow. The saved width is restored as-is; a narrower window only shrinks it for the moment, and widening the window brings the remembered width back.
• Video and audio in the preview pane no longer restart when the message that cited the file leaves the loaded transcript — switching chats, or continuing an interrupted turn. The pane chose its byte source from whether that attachment was still loaded (attachment when it was, workspace once it was not), and the flip re-fetched the file and swapped the object URL under a playing element. Each file now loads once, keyed by its path; opening a different file still reloads.

未签名的 macOS rc。不是受支持的签名安装包；Gatekeeper 可能拦截。优先从源码运行。

桌面

• 更新现在自己下载、自己装。 以前发现新版只是把 .dmg 丢给浏览器，剩下的全归你：打开、拖过去覆盖、再过一次 Gatekeeper。现在「关于」卡片里直接下载，带进度条；下完校验镜像里那份确实是本应用、而且正好是它许诺的版本，然后替换当前这份并自动重新打开。下载失败或者校验不过，原来那份一点没动；浏览器下载仍在——当这份应用根本没法自己替换自己（别人装的那份、或者从源码跑的）时给的就是它，并且会写明是哪种情况。下载过程中可以取消。
• 检查更新和下载都会走环境里的 HTTPS_PROXY / ALL_PROXY（NO_PROXY 命中的主机不走）。在 GitHub 只有过代理才通的机器上，以前检查更新只会失败成「没能检查更新」，还看不出是为什么。
• 窗口退出后再开，还是关掉前的大小。拖边框、缩放到填满屏幕、藏到托盘或退出，都会把宽高（以及是否填满）写进窗口进程自己的 window-size.json；下次启动按这份恢复。不记位置，免得换了显示器窗落到屏外。

守护进程

• 一轮的中间产物现在落在一个目录里，不再散在工作区根。 shell 不传 cwd 就在本轮工作目录（work/<日期>-<摘要>-<id>）里跑——下载、转换、脚本产物因此不需要 Bot 配合就不会乱放；目录在第一次真被用到时才创建，只说话的轮次不留空壳。同一件事跨交接、点名、判断下场、Bot↔Bot 私聊和中断续跑都用同一个目录；日程每次触发新开一个，静默六小时后的下一轮也新开。文件工具不变——read_file / write_file / delete_file / list_dir 的路径仍相对工作区根，所以壳和文件工具是两个基准，这是有意的；每轮的局面块都会写出工作目录。
• 命令产出的文件终于会被列出来了。 shell 现在在每次调用前后各扫一遍工作目录，把新增或改写的文件报出来，于是下载、转换、渲染的结果会像 write_file 一直做的那样挂到消息上。留下超过 200 个条目的命令则一个都不报并说明——npm install 不是一份产物清单。
• 产物入口点开的是整件事，不是一条消息。 树里列的是这件事的消息引用过的全部路径，以工作目录为根，目录之外引用的路径与它并列平铺，本条消息自己的那几个打点。交接之前上一个 Bot 做出来的文件，现在点一下就到，不用往回翻转录。
• 超出上下文限额的工具结果改为落在本轮工作目录下的 tool-results/，不再堆在工作区根那个扁平目录里；守护进程启动时会把关闭超过一周的工作目录里的这份 spill 扫掉，工作目录里的其它东西一律不动。full_result_path 仍相对工作区根，所以用 shell 读它要传 cwd: "."——recovery_hint 和轮次指令都写明了。
• Bot 写进工作目录 tool-results/ 或 scratch/ 的文件不再自动挂成消息产物。轮次指令让 Bot 把纯过程文件放进 scratch/，这个承诺现在真的成立了。
• 守护进程把启动、拒绝和致命错误写进数据库旁边的 daemon.log。此前运行时若在开始监听之前就死掉（开不了的数据库、占不到的端口），除了窗口那句「连不上运行时」什么都不会留下。

Messenger

• 新建 Bot 的生成头像跟着你打的名字走。以前创建弹窗会把空名字那一版锁死，不点「换一个」每个新 Bot 都是同一张脸。现在打名字就会重画；上传的图片不受影响。
• 拖过的会话列表宽度、产物预览分栏宽度和预览里的文件树宽度，退出后再开还在。这些宽度本来就会写进 localStorage，但加载时按偏小的默认壳去钳，宽列表或宽文件树一重开就变窄。现在按记下的宽度还原；窗口变窄只临时收紧，变宽再回到记住的值。
• 预览面板里的视频和音频，不会再因为引用它的那条消息离开已加载的转录而从头开始——切换会话、或者点「继续」续跑中断的轮次时都不会了。面板原先按「那条附件是否还在已加载的转录里」来决定从哪儿取字节（在就走附件、不在就走工作区），这一翻转会重新取一次文件并把正在播放的元素的 object URL 换掉。现在每个文件按路径只加载一次；打开别的文件照常重新加载。

---

Unsigned macOS snapshot. This is not a supported signed installer.

Gatekeeper may block ad-hoc signed builds (signingIdentity: "-"). Prefer running from source:

pnpm install
pnpm dev

Windows and Linux are out of scope. See CHANGELOG.md and ROADMAP.md.

Real Bot v0.1.0-rc.4

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

Desktop

• An installed build can start its runtime. The app never shipped the daemon: it looked for apps/daemon/src/main.ts at a path baked in at compile time, which on a release build is the CI runner's home directory, and then for a bun the machine was not required to have. Neither exists on the machine that downloaded the .dmg, so the window sat at "Can't reach the runtime" for good, for every user, with nothing said about why. The daemon is now compiled with bun build --compile and bundled as externalBin next to the window binary, so an installed app needs no Bun, no Node and no checkout. Running from source is unchanged — a debug build still prefers the checkout and its --watch — and REAL_BOT_DAEMON_MAIN / REAL_BOT_DAEMON_BIN override either shape. The bundled runtime costs about 60MB per architecture.

Daemon

• A wedged turn no longer sits at Thinking for good — the shape you saw most often in a Bot↔Bot private chat, where nobody is watching for a reply that never comes. The hop loop runs detached, so an exception inside it vanished into a swallowed rejection and left the turn running until the next restart. A turn that throws now closes with a "This turn did not finish: the runtime errored" line, and a watchdog on the scheduler's tick closes any turn that has made no progress for 20 minutes with "It stopped making progress". A turn waiting on your approval or your answer is never swept, and a long shell or MCP call marks both of its ends, so real work is not cut off.
• shell gives up on a command that outlives 10 minutes, kills it, and returns the timeout as a failed tool call. A command that exits while a backgrounded grandchild holds its stdout pipe open no longer holds the turn open either — the output is raced against the timeout rather than read to the end.
• An HTTP MCP call gives up when the response stream goes quiet for 5 minutes, and your Stop now reaches it while the body is being read. The request timeout only ever covered the response headers and the abort was unwired as soon as they arrived, so a stream that opened and then said nothing held the call — and the turn behind it — open for good. A lookup or handshake that throws is a failed tool call now, not an exception thrown into the turn.

Messenger

• Selecting text in the Bot settings drawer no longer closes it when the drag ends outside the sheet. The backdrop dismissed on any click whose target was the backdrop, and a press inside the sheet followed by a release over the backdrop reports exactly that — so copying a field closed the drawer you were reading. The backdrop now remembers where the press started and only a press that begins outside closes it; a genuine click outside still does. The press is recorded on the capture phase, so a control inside a sheet that swallows mousedown cannot defeat the guard. The same guard covers the settings modal, the provider editor, the Bot and group create sheets, the MCP and skill editors, the workspace explorer, the route log and the danger confirm.
• Right-clicking any message now selects the message and opens a context menu with actions to Reply (quote-replying into the composer), Copy message content (or selected text), Open associated file tree (opening the message's cited artifact file tree in the preview pane), Copy message ID, and toggle quick emoji reactions.
• The Bot settings drawer now uses category tab navigation (Basics, Skills, Memory, Actions) instead of stacking every card in a single tall column. Tabs display error badges and item counts, switching tabs flushes pending autosaves immediately, and the drawer width expands to 460px for a more spacious layout. The category navigation bar stays permanently pinned to the top, and textarea inputs in the Basics tab have been enlarged for easier reading and editing without frequent scrolling.
• Settings no longer have a Save button. Picking a workspace folder writes immediately; endpoint fields and the model list save as you edit (a pause after typing, a moment after a pick); closing the flyout or settings still sends a pending draft. Adding an MCP server or changing command / args / URL / headers still needs an explicit confirm — there is no Always allow — while the name and usage note save on their own.
• Dense Markdown tables in chat no longer collapse short CJK columns into one character per line. Headers stay on one line, long cells wrap at a readable width, and the table scrolls sideways inside the bubble.
• Editing a memory from the Bot drawer actually shows the dialog. The form used to sit beside the backdrop, so the blur covered it and the pane looked empty.

未签名的 macOS rc。不是受支持的签名安装包；Gatekeeper 可能拦截。优先从源码运行。

Desktop

• **装出来的应用现在能起运行时了。**以前发布包根本没带守护进程：它按编译期烘进二进制的绝对路径去找 apps/daemon/src/main.ts（发布构建里烘的是 CI runner 的家目录），再去找一个用户根本没被要求安装的 bun。下载 .dmg 的机器上两样都不存在，于是窗口永远停在「连不上运行时」，对每个用户都必然复现，而且一句原因都不给。现在守护进程用 bun build --compile 编成独立可执行文件，作为 externalBin 随包放在窗口二进制旁边，装完即用，不需要 Bun、不需要 Node、不需要源码。源码运行方式不变（debug 构建仍优先走源码和 --watch），REAL_BOT_DAEMON_MAIN / REAL_BOT_DAEMON_BIN 可分别覆盖两种形态。自带运行时的代价是每个架构约 60MB。

Daemon

• 卡住的轮次不再永远停在「思考中」——这最常发生在 Bot↔Bot 私聊里：没人盯着，那条永远不来的回复也就没人发现。轮次回路是脱离的，回路里抛出的异常会消失在被吞掉的 rejection 里，轮次一直留在 running，直到下次重启。现在抛错的轮次以「这一轮没写完：运行时出错」收尾；调度器每次 tick 还会扫一遍，20 分钟没有任何进展的轮次以「这一轮没写完：卡住了，很久没有任何进展」收尾。等待批准和等待回复的轮次不在扫描范围内；耗时长的壳命令与 MCP 调用会在两端各记一次活动，正经干活不会被打断。
• shell 单条命令超过 10 分钟就放弃并杀掉进程，超时作为工具失败返回。命令自己退出、但后台孙进程还攥着 stdout 管道的情况也不再吊住轮次——输出改成与超时赛跑，不再读到底。
• HTTP MCP 调用在响应流静默 5 分钟后放弃，读响应体期间你的 Stop 也能真正打断它。此前请求超时只管响应头，且响应头一到就把 abort 监听摘掉，于是「流开了但一直不说话」会把这次调用连同它背后的轮次永远吊住。工具查找或握手抛错现在也是一次失败的工具调用，不再把异常扔进轮次回路。

Messenger

• 在 Bot 设置抽屉里选中文字、拖到抽屉外再松手，不再把抽屉关掉。以前只要 click 的目标是遮罩就关闭，而按下在抽屉内、松开落在遮罩上时浏览器正是这么报的——于是复制一个字段就把正在看的抽屉关了。现在遮罩记住按下的位置，只有按下也在抽屉外才关闭；真正点在外部依然会关。按下在捕获阶段记录，抽屉里拦掉 mousedown 的自定义控件也不会让这个判断失效。同一处理也覆盖设置弹窗、端点编辑器、Bot/群创建面板、MCP 与技能编辑器、工作区浏览器、模型选择日志和危险确认框。
• 支持右键点击消息时选中该消息并呼出右键快捷菜单，包含引用回复（填充至输入框）、复制消息内容（或局部选中文本）、打开关联的文件树（在工件预览分栏中展开该条消息关联的文件树）、复制消息 ID 以及快捷表情回应。
• Bot 设置面板改用带分类导航的布局，分为「基础信息」、「技能」、「记忆」和「操作」四个 Tab，解决内容过多一滚到底的问题。分类项支持未填错误角标与技能数量统计，Tab 切换时立即保存待写入改动，抽屉宽度微调至 460px。分类导航栏常驻吸顶，且基础信息中的职责与边界文本域高度扩容，长说明无需频繁纵向滚动。
• 设置不再有保存按钮。工作区选中即写入；端点字段和模型名单改完即存（文本停手片刻，勾选 / 点选随即）；关浮层或关设置前会把未发出的草稿送出去。新增 MCP 或改 command / args / URL / headers 仍须确认，没有 Always allow；名称和用法备注改完即写入。
• 聊天里文字很多的 Markdown 表格不再把短中文列挤成一字一行。表头保持单行，长单元格在可读宽度换行，超出气泡的部分横向滚动。
• 从 Bot 抽屉编辑记忆时弹窗会真正出现。以前表单和遮罩是平级的，模糊层盖住对话框，看起来像点了没反应。

---

Unsigned macOS snapshot. This is not a supported signed installer.

Gatekeeper may block ad-hoc signed builds (signingIdentity: "-"). Prefer running from source:

pnpm install
pnpm dev

Windows and Linux are out of scope. See CHANGELOG.md and ROADMAP.md.

Real Bot v0.1.0-rc.3

Unsigned macOS rc. This is not a supported signed installer; Gatekeeper may block it. Prefer running from source.

Daemon

• Clearing history or deleting a group no longer silently fails once that session has a model-choice review. route_reviews points at the turn and session; those rows were left in place, the foreign key rolled the whole transaction back, and the messenger treated the 500 as a disconnect — so the confirm closed while the group and its messages stayed. Reviews for that session go with the history.
• read_file (and the other workspace tools besides write_file) no longer stamp their paths as message attachments. A path the Bot only read is an input; only a write becomes a cited artifact on the message.
• Bots now remember across sessions. A Bot writes down a fact with remember and it enters the system block of every later turn, in any session — so a preference you stated in a private chat is still in effect in a group tomorrow. Memories belong to one Bot: another never sees them, deleting the Bot deletes them, archiving keeps them. Re-using a subject replaces that memory rather than adding a second one, which is also how a Bot corrects itself; forget drops one that no longer holds. A full Bot (20 memories) is refused and told which entry has gone longest without an update, so it chooses what to drop instead of something disappearing behind your back. There is no retrieval, no background distiller and no extra model call: the whole enabled set is rendered, bounded by a budget derived from the caps.
• The system prompt no longer tells a Bot there is no memory layer, and now states the separation once: the profile is who you are, a skill is how to do something, a memory is what you learned. A memory is an earlier conclusion, not a source of truth — when it conflicts with this turn's transcript, the transcript wins.

Messenger

• Markdown in the artifact preview shows workspace image and SVG links as thumbnails; a click still opens the preview, and a failed load keeps the original link. Tables in that same renderer fill the pane and wrap long cells instead of overflowing sideways.
• Right-click Delete or Clear history on a sidebar session now opens the confirm for that row. It used to switch to the conversation first, and the confirm disappeared because the session drawer was not open.
• The model choice log can be filtered: search across bot, model, reason, review and notes; multi-select outcome, Bot, model and message kind; and two toggles for turns with model feedback or a review that blamed the model. The subtitle becomes shown / total while a filter is on; clearing it restores the full list. Filter state is local to the open overlay.
• The Bot settings drawer has a Memory card under Skills: what the Bot remembers, when it was formed, and which session it came from — a Bot↔Bot direct is labelled as one, since you were not in that conversation. Click the source to jump to the message that triggered it. You can correct, disable or delete a memory; you cannot add one, because the Bot is the writer. Disabling drops it from the prompt while keeping the record of what the Bot had concluded.

Docs

• README, the landing page and the roadmap now describe how a model actually gets chosen, which they had stopped doing. The roadmap still listed rule-based scoring, negative feedback gathered by keyword, and penalties worked off by clean turns as shipped groundwork, and self-reflection as not yet built — ADR 0019 replaced all of that in 0.1.0-rc.2. What ships today: an agent picks the model and thinking level before each turn with a one-line reason, a correction chain is reviewed when it ends, and only a verdict against the model is kept as that bot's experience. It is a conclusion, not a score — there are no weights, no offsets and no caps, and the glossary already says so. What is still open is narrowed to the truth: tools and collaboration are not chosen up front, execution results are not verified, and nothing yet measures whether reuse picks better or finishes faster.

Daemon

• A Bot↔Bot direct is now one conversation per initiation instead of one long-running thread per pair. Each create_direct call opens a fresh session stamped with its source — the message that woke the bot that opened it — and calling it again for the same bot in the same turn returns that same session rather than a duplicate. Sessions carry origin_session_id and origin_message_id, which ride along on GET /v1/sessions and session.upsert.
• A Bot↔Bot direct is now read-only to you. Posting into one returns 403 not_a_member; marking read, archiving, clearing history, Stop, and resolving approvals all keep working. This applies to Bot↔Bot directs you already have, which become read-only on upgrade. A bot calling ask_user inside one is refused rather than parking its turn on an answer nobody could give.
• With no user in a direct, a bot's second message now retunes the live turn instead of forking a second one, matching how a group already treats bots.
• list_sessions returns the 30 most recently touched sessions and includes updated_at, so a pile of same-pair directs no longer fills a bot's context window with indistinguishable rows.

Messenger

• Composer chips and chat markdown now parse @ the same way the daemon does: longest roster name, unique prefix or suffix, CJK punctuation as a token end, and emails / @scope/pkg left as plain text. Adding a Bot name or a file suffix no longer needs a second copy of those rules in the messenger.
• Markdown in the artifact preview uses the same renderer as chat bubbles (MarkdownBody): tables keep their columns, with borders, header fill, and sideways scroll when the table is wider than the pane. Fenced code, mentions, and links match the Bot message.
• Settings, the session drawer, and the workspace overlay now survive a refresh the same way the open session and artifact preview already do. They share ?o= (settings, session, bot plus ?b=<id>, workspace plus ?w=<relpath> when a file is selected). Closing one drops the query; a missing session, Bot, or workspace path is treated as closed. Model selection logs, create dialogs, and confirmations stay out of the URL.
• Bot↔Bot directs are now entered from the message that started them: an entry card hangs under that message and opens the direct. Several directs opened from one message collapse into a single card.
• The composer is locked in a Bot↔Bot direct, with a notice saying you are not a participant. Quote reply, the ask reply box, and reaction toggles are withdrawn there too; approvals stay actionable.
• The sidebar's Bot ↔ Bot list shows only the most recently active directs, with the rest behind a toggle. Each row names its source and clicking it jumps back to the triggering message. Rows carry no unread badge, since you cannot reply one away. Recency comes from the last message rather than updated_at, so merely opening a direct no longer floats it to the top.
• Composer no longer uses a full-width frosted glass bar: frost hugs the pipe-shaped dock — suggestion chips sit on the left shoulder of the input in a single row sized to the chips (not a fixed width, no wrap), with a separate ring on the shortcut hint. Wide-screen gutters stay clear.
• The "About" card directly lists what changed in new versions when an update is found: update check results now carry the release body (the CHANGELOG section for that version). The card groups items by ### headings into a bullet list; the "View release notes" browser link remains available but is no longer the sole entry point. The list only extracts headings and bullet items, leaving prose paragraphs and fenced code blocks on the release page. The body avoids the chat Markdown renderer to prevent changelog paths from being treated as workspace artifact links.
• Redesigned the "Skills" interaction and layout in the Bot settings panel:
  • Eliminated sidebar overflow: Creating and editing skills now opens in a dedicated centered modal dialog (Skill Modal, 520px wide, closable via Escape or clicking the backdrop) instead of expanding inline inside the card, providing ample room for Markdown editing while keeping the card compact.
  • Clearer action controls: Added a permanent "+ Add Skill" button in the card header. Each list item now features explicit toggle switches, edit (pencil icon), and delete (trash icon) action buttons, with direct click-to-edit support on the skill info block. Empty state is redesigned into a lightweight card with onboarding guidance and a quick-add button.

Desktop

• The update card in About now follows the app's locale. A release has one body and the app has two languages, so the body carries both: release-notes.ts reads this version's section from CHANGELOG.md and CHANGELOG.zh.md and marks each off with an HTML comment, invisible on the release page, which just shows the sections stacked. The card picks the section matching settings.locale, falls back to English for a release that was never translated, and appends the shared tail. Bodies published before the markers existed — rc.2 and earlier — carry none and are rendered whole, exactly as before. A missing translation does not block a release; a version missing from CHANGELOG.md still does.
• Automatically extract release bodies from CHANGELOG.md for the given version (apps/desktop/scripts/release-notes.ts) instead of a generic "See CHANGELOG and ROADMAP" message; check_for_update returns the release body along with the update check results to the Messenger. Packaging builds now fail immediately if the section for that version is missing from CHANGELOG, preventing empty release notes from shipping.

未签名的 macOS rc。不是受支持的签名安装包；Gatekeeper 可能拦截。优先从源码运行。

Daemon

• 清空历史或删除群不再在该会话已有模型选择复盘时静默失败。route_reviews 指向轮次和会话，这些行以前没删，外键把整段事务滚回去，信使把 500 当成断线——确认框关了，群和消息还在。该会话上的复盘随历史一起去掉。
• `read_...