5.0.6

Dive 5.0.6

A release about trust. Dive now tells you when it drops something, stops when you tell it to stop, and comes with documentation that matches what the code actually does.

Highlights

Deep research is now an evidence pipeline, not a bigger web search. Orientation, multiple research angles, candidate ranking, page-quality validation, deduplication, domain-diverse selection, and a structured dossier. It rejects CAPTCHA and bot-protection pages, raw HTML, paywalls, error payloads and syndicated duplicates instead of passing them off as evidence — and it no longer pads an answer with weak sources to reach a count.

Four new encyclopedic sources. Larousse (French), Scholarpedia (specialist science), Store norske leksikon (Norwegian), alongside Wikipedia and Britannica. Answers stay in your language even when the evidence is not.

Skills from the composer. Enable any of 17 skills to appear as a button above the input. Clicking inserts its slash command. Per mode, and never in Pi.

Source pills everywhere. One renderer for every mode and skill. Deep research reads only its own verified manifest, so links inside fetched article text can never become sources.

Archive recovery. Unreachable pages are retried through the Wayback Machine and archive.ph, labelled with the service, archived URL, original URL and capture date, and treated as historical rather than current.

Fixes

Stop actually stops. Pressing Stop tore down the browser's connection while the model kept generating. Every mode now tears down the upstream connection — for Cloud, that is billed tokens you cancelled. Pi additionally sends real abort_bash, abort_retry and abort commands, in that order, so sub-activities stop before the agent does.

Quitting is instant. Shutdown always took five seconds and exited with an error, because the app-event stream was never closed and the server waited on it. Now 0.02 seconds and a clean exit.

No more placeholder bubbles. The pulsing drum icon that appeared before the model had said anything is gone. A turn that only runs a tool creates no answer bubble at all — the activity panel carries it, naming the tool as it runs. A related bug meant such turns came back as an empty bordered box when you reopened the conversation; the live path and the reload path now share one rule.

Attachments no longer vanish silently. Attach ten images and only eight reached the model, while your own message showed all ten. Anything dropped — past the eight-image limit, unreadable, or malformed — is now reported, and the turn still runs.

Malformed tool arguments are refused. They used to be logged where you would never see them and the skill run with no arguments, so it either failed for an unrelated reason or answered a question nobody asked. Skills that legitimately take no arguments are unaffected, and valid arguments that omit a field keep each skill's own defaults.

Pi reports failed library lookups. The streaming route said so; the non-streaming route swallowed it and returned an ordinary answer that was not grounded in your database and could not be told apart from one that was. An explicit /db request that cannot reach the library now fails instead of answering anyway.

Look-alike domains cannot borrow authority. Trusted domains were matched as substrings, so nih.gov.evil-mirror.com scored exactly the same as nih.gov, and cheap-university-essays.biz inherited institutional authority. Since authority decides what gets read and cited, a registered look-alike could walk into your research. Now matched by domain suffix.

Disambiguation buttons are precise. When research finds several possible people, only the exact name is clickable — the description stays as ordinary text. Previously an entire bullet or heading could become one button.

The skill launcher stays in its own mode. Buttons enabled in llama.cpp remained visible after switching to Pi. The composer is repainted on every mode change.

Grokipedia is blocked by host label on every fetch path, so subdomains and mirrors cannot slip through.

Also: a deep_etymology crash on a missing language, the Pi sandbox indicator reading the wrong file and reporting a sandbox that was not in force, and a Pi command path that silently blanked itself on restart when installed via a symlink.

Under the hood

• One mode registry. Adding or changing a mode is a single-file edit.
• Per-mode state accessors. Stale aliases that had to be re-pointed on every mode change are gone — they were the cause of skills and settings showing the wrong mode's data.
• skills.js split from 4,679 lines into six focused modules.
• Injectable data directory via DIVE_DATA_DIR, so tests never touch your real data.
• Whole-program frontend lint catching cross-file reference errors that per-file linting cannot see.
• 406 tests, up from 52. Every one verified by breaking the code it covers and confirming it fails.

Documentation

Thirteen documents in [docs/](https://claude.ai/epitaxy/docs/README.md) covering architecture, modes, the HTTP API, all 27 skills, slash commands, Pi, the library, MCP, plugins, security, the data directory, development and testing. Written from the code, with every limit and default checked against its source.

Notes for existing users

• No migration needed. Your ~/dive directory is unchanged.
• Cloud API keys are never sent back to the client.
• If a fix appears missing after updating, rebuild — the packaged app copies its files to a runtime directory on launch, and a stale build faithfully reproduces stale behaviour.