Limboo v1.4.2

Limboo v1.4.2 is the first published release carrying the Agent Adapter Architecture — Limboo is no longer "a Claude integration" but a multi-agent orchestration platform, with Cursor running as a first-class second coding agent alongside Claude. It also rolls up everything tagged since v1.3.4 that never shipped as a release (see About this release below).

---

Highlights

Cursor as a runnable second agent (Agent Adapter Architecture, steps 1–6)

The model picker is now the provider selector: choosing a Composer model routes the session through the new Cursor runtime, while the UI above the adapter layer stays completely provider-agnostic.

• Authentication (#56) — local, secret-safe detection of the Cursor CLI (not-installed / CLI login / API key), safeStorage-encrypted secrets, manual-browser login mode, and a Providers card in Settings › Agent with live troubleshooting diagnostics. Native-Windows CLI layouts (shim + node.exe) are fully supported.
• Runtime (#57) — print-mode cursor-agent runs with argv-only spawning, stdin prompts, NDJSON streaming translated into Limboo's existing event pipeline (tool chips, risk gating, auto-checkpoints, and terminal mirroring all work unmodified), and provider-keyed resume so Cursor sessions continue across runs.
• Permissions, context & MCP (#57) — a deny-first per-session permission floor plus an interactive hooks bridge that routes Cursor's tool calls through the same decision core (and the same permission dialogs) Claude uses; memory/search/resume context is injected via a per-run rules file; and both agents now query the same local memory and search index through a per-run MCP bridge. Every generated session file is restored byte-for-byte after the run — git status stays clean.
• Ask mode (#58) — a new read-only Q&A composer mode, enforced for both providers, plus a fix for the propose-only shell lockout so review-style runs can still inspect the repository with read-only commands.

Voice capture fixes (#62, #63)

Voice input no longer gets stuck at "Listening…", and the waveform visualization renders live audio again instead of a dead line.

Streaming UX & model safety

Smoother streaming rendering in the conversation view and safer model handling in the composer.

Resume Pipeline improvements

Unfinished plan items are re-injected on resume, memory revalidation is symbol-aware, and secret redaction is centralized in the logger.

UI polish

A five-bar SessionSpinner for active sessions, an icon-only Git staging toolbar, a settings unsaved-changes guard, composer typewriter effect, and a refreshed chat empty state.

CI & security hardening

A Bitbucket Pipelines mirror of the release pipeline, GitHub token kept out of process argv, and actionable GH_TOKEN pre-flight diagnostics.

Build reliability: incompatible dependency bumps reverted

Two automated dependency-bump merges had silently broken the build (@vitejs/plugin-react@6 requires Vite 7+ while the toolchain pins Vite 5; @electron/fuses@2 breaks npm ci peer resolution; typescript@7 conflicts with the lint toolchain). v1.4.2 reverts those bumps to the last known-good, documented pins — this is also why the v1.4.1 tag was abandoned minutes after it was cut: the tree it pointed at could not build from source.

---

About this release: why only a Windows installer is attached

This release ships a Windows x64 installer, built and verified locally on Windows by a maintainer.

The reason is transparency, not neglect: the hosted-runner release pipeline that normally packages macOS and Linux has been failing to publish (its release credentials never reached the publish jobs — the same failure that left v1.3.5, v1.3.6, v1.4.0, and v1.4.1 tagged but unpublished). Rather than attach artifacts we could not verify, we are publishing only what was actually built and tested. macOS and Linux binaries will return to the release feed once the pipeline is fixed.

Building from source (macOS / Linux — and Windows, if you prefer)

Limboo builds cleanly on all three platforms with Node.js 20+:

git clone https://github.com/BotCoder254/limboo.git
cd limboo
git checkout v1.4.2
npm ci
npm run dist     # per-OS installers land in dist/

npm run dist produces the installer for the OS you run it on (NSIS on Windows, dmg on macOS, deb/rpm/AppImage on Linux). For development, npm start runs the app directly with hot reload.

npm 12 note: npm 12's new security defaults block git-hosted dependencies (allow-git=none) and may skip install scripts. If npm ci fails with EALLOWGIT, run npm ci --allow-git=all, and if Electron's binary is missing afterwards run node node_modules/electron/install.js.

---

Known issues — Cursor agent integration

The Cursor integration is new, deliberately conservative, and some rough edges are known and not yet fully fixed:

• "Ask before edits" (the default mode) runs propose-only. Until the interactive hooks bridge is verified for your exact installed CLI version, Cursor runs without --force: proposed file mutations surface as a reviewable plan artifact, and clicking Approve re-runs the turn with edits enabled. This is a safety posture, not a bug — but it can feel like an extra step.
• The interactive permission-hooks bridge is capability-gated per CLI version. When hooks fail to connect for your CLI build, the deny-first permission floor still holds (nothing runs that shouldn't), but per-tool permission prompts may not appear. Whether the bridge connected is visible under Settings › Agent › Troubleshooting.
• Plan capture in plan mode is parsed from terminal output (the Cursor CLI has no structured plan event), so occasionally a plan can be captured imperfectly or with formatting noise.
• Cursor Cloud Agents and ACP are not yet supported — only local CLI print-mode runs. Image/vision attachments remain Claude-only for now.

If you hit anything else, please open an issue.

---

Supersedes v1.3.5, v1.3.6, v1.4.0, and v1.4.1

Tags v1.3.5, v1.3.6, and v1.4.0 exist in the repository but no release was ever published for them due to the CI credential failure described above. v1.4.1 was cut and immediately abandoned when its tree turned out not to build (see Build reliability above). Every change from all of those tags is included in v1.4.2 — there is nothing to install from them, and they will not receive releases retroactively.

---

Updating & verifying

• Existing Windows installs update automatically: the app's built-in updater reads latest.yml from this release.
• Fresh install: download Limboo-Setup-1.4.2-x64.exe below.
• Verify your download against the attached manifest:

sha256sum -c SHA256SUMS

Full changelog: v1.3.4...v1.4.2

1.3.4

Merge pull request #39 from BotCoder254/feat/ai-commit-message-subagent

The design agent is now drafting the implementation plan covering the…

Limboo v1.3.2

Limboo 1.3.2 (2026-07-03)

Changes since v1.3.1.

Features

• resume auto-update downloads with taskbar progress + closable editor tabs

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.

Limboo v1.3.0

Limboo 1.3.0 (2026-07-03)

Changes since v1.2.9.

Other

• What was fixed (all built + linted clean) The reported crash was the ?? [] selector in ServicesStrip.tsx — already fixed with the stable NO_SERVICES fallback; both audits confirmed no other unstable selectors or push feedback loops exist. Major: the limboo.json trust gate was unreachable for repos with services/scripts but no setup hooks — added worktree:ackConfig (WorktreeManager.ts, handler, preload), generalized the approval dialog to show setup/teardown/scripts/services, and added a "Review commands…" affordance in the strip. Session delete now stops services + PTYs unconditionally (sessionHandlers.ts); hook timeouts kill their PTY; service restart no longer lets the old PTY's exit mark the new process crashed; a failed worktree Recreate no longer loses the branch metadata; scripts got run buttons in the strip.

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.

Limboo v1.2.9

Limboo 1.2.9 (2026-07-03)

Changes since v1.2.7.

Other

• fixed the isssues with the llm stream

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.

Limboo v1.2.8

Limboo 1.2.8 (2026-07-03)

Changes since v1.2.7.

Other

• fixed the isssues with the llm stream

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.

Limboo v1.2.7

Limboo 1.2.7 (2026-07-03)

Changes since v1.2.6.

Other

• buildOptions — added env: { ...process.env, CLAUDE_CODE_ENABLE_TASKS: '0' } to the SDK Options. This re-enables the legacy TodoWrite tool that SDK 0.3.197 otherwise suppresses in favor of the new Task* tools. TodoWrite is the only tool onTodoWrite ingests, so this restores the live checklist that feeds the Plan panel's completed/total count.
• electron-updater reads \app-update.yml on every update check. That file was only written by scripts/dist.mjs (the installer build) — never by electron-forge package. So plain Forge packages and older installers were missing it, and AutoUpdateManager.computeEnabled() didn't check for it, so the raw ENOENT surfaced.

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

2 commit(s) in this release.

Limboo v1.2.6

Limboo 1.2.6 (2026-07-03)

Changes since v1.2.5.

Bug Fixes

• repair packaged agent launch, update strip, app icon, launch identity; feat(ci): tag-driven versioning

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.

Limboo v1.2.5

Limboo 1.2.5 (2026-07-02)

Changes since v1.2.4.

Other

• v1.2.5 — bump version; guard tag↔version in CI
• Lint clean, renderer build succeeds. The worker .ts (built by esbuild on npm start) passes lint, which is the CLAUDE.md-prescribed check for main-side code.

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

2 commit(s) in this release.

Limboo v1.2.4

Limboo 1.2.4 (2026-07-02)

Changes since v1.2.2.

Build & CI

• pin electron-builder to 26.13.0; bump to 1.2.3

Contributors

@telvin TEUM

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo BotCoder254/limboo.

1 commit(s) in this release.