Nabu 1.7.3

Nabu can look at the computer it is running on. Why is it slow, where did the disk space go, what is that process, why does the connection keep dropping — the questions a chat window cannot answer for you no matter how good the model is, because the answer is on your machine and nowhere else.

• Nabu can check things about your computer, and it does not ask you eight times to do it. Working out why a machine is slow is a dozen small observations in a row, and until now every one of them went through the same door as "run this command" — a dozen permission dialogs before you learned anything. Nabu now has a fixed set of eight things it can look at: the system and how long it has been up, disk space, which folders are eating it, what is loading the processor and memory, memory pressure, what starts with the system, what crashed recently, and the network. Those it just looks at, and tells you what it found.
• It cannot ask to run something instead. The reason it stopped asking is not that we decided some commands are safe — it is that there is no longer anywhere to put a command. Nabu picks which observation from the list of eight; there is no field for it to write into, no shell involved, and an id it made up is refused rather than falling back to running something. An observation that does not exist on your system says so instead of failing.
• Twelve new playbooks, and a Computer section to keep them in. Six about the machine (why it is slow · where the space went · an app keeps crashing · what is this process · the connection drops · a full check-over in three steps), four about money and paperwork (receipts into a spreadsheet · what am I paying for every month · documents for a tax return · a warranty archive), and two about turning data into a report — which was the thinnest area we had, with five playbooks out of forty-seven. Fifty-nine in the library now.

---

macOS — Nabu.dmg, signed and notarized. Existing installs update themselves.

Windows — nabu-1.7.3-setup.exe. Not code-signed yet, so Windows will show a blue "Windows protected your PC" screen: click More info → Run anyway. A certificate is coming; until then this is the honest state of it.

1.7.2

Four small things, all the same complaint: Nabu was not showing you what you are using or what you are paying for.

• How much of your allowance is left is now next to the chat. On a plan where the models are included there was nothing on screen about it — the spend counter is only for people using their own API key — so "you've reached your limit" arrived with no warning on the way. There is now a quiet Max · 34% where that counter sits, which turns amber and then red as the allowance goes. Clicking it opens your plan.
• Let Nabu pick the model is a button now. It was a line inside the model menu, so you only found it if you opened the list and read to the end. It sits next to the model name as an "Auto" switch; while it is on, the model button names whichever model answered last, and choosing a model from the list pins that one and switches Auto off.
• The plan table compares all four plans. It used to be Free against Pro, with the three paid plans folded into one column — so someone on Pro had nothing telling them what Max adds. Free · Pro · Pro+ · Max, the rows where they actually differ first, and the column you are on is marked.
• Your plan badge said someone else's plan. Everyone paying saw "Pro · Supporter" in Settings — the name of one particular plan, shown to all of them. On Max it sat directly above a line reading "Max · Monthly", which is a strange thing to read about your own account.

---

macOS — Nabu.dmg, signed and notarized. Existing installs update themselves.

Windows — nabu-1.7.2-setup.exe. Not code-signed yet, so Windows will show a blue "Windows protected your PC" screen: click More info → Run anyway. A certificate is coming; until then this is the honest state of it.

Nabu 1.7.1

Mostly Windows. There has been a Windows build for a while, but nobody had ever run it — and when someone finally did, four separate things were broken in ways that only Windows can break them. Also in here: two places where Nabu was telling you something untrue.

• Windows works now. Signing in failed outright, because Nabu's own network calls went through a path that ignores Windows' proxy settings and its certificate store — so a machine with corporate networking or antivirus that inspects traffic could reach the internet in every browser and not from Nabu. Everything Nabu does over the network now goes through the same stack the browser uses.
• Stop works on Windows. Stopping a long command, or letting it time out, relied on a way of ending a group of processes that simply does not exist on Windows: nothing was killed, and the turn hung forever. It now ends the whole tree, the way Windows expects.
• Connectors stopped claiming Node.js was missing. Nabu looked for installed tools by splitting the system path on the wrong character, so on Windows it never found anything — including Node.js when Node.js was right there.
• Nabu asks for the microphone on Windows too, instead of assuming it was allowed and discovering otherwise mid-sentence. If it is switched off, the button now opens the right settings page.
• A subscription is enough to start. Signing in with a paid plan still dropped you back onto the setup screen asking for an API key at every launch — the check knew about your own key and about local models, but not about the plan you were paying for.
• The update row no longer invents news. It said "Update available" whenever a check failed, even when the check was what failed and there might be no new version at all. Now it says which of the two happened, and if something went wrong it can tell you what. The download button also used to hand Windows users a macOS disk image.
• Playbook counts in the library sit in their own column instead of running on from the name.

---

macOS — Nabu.dmg, signed and notarized. Existing installs update themselves.

Windows — nabu-1.7.1-setup.exe. Not code-signed yet, so Windows will show a blue "Windows protected your PC" screen: click More info → Run anyway. A certificate is coming; until then this is the honest state of it.

Nabu 1.7.0

Nabu 1.7.0 — models by name, and a permission layer that holds

Two halves. Models became something you pick by name instead of decode. And the permission layer — the part of Nabu whose whole job is keeping an agent on a leash — was audited from the outside, as an attacker would, and tightened where it turned out not to hold.

Models go by their names, and you get all of them. The subscription served three models; it now serves every model behind it, listed the way people actually refer to them — Claude Haiku 4.5, Sonnet 5, Opus 5, GPT-5.5 and the rest — rather than as raw identifiers. Each one shows how heavy it is, so choosing is about speed and cost instead of guessing what a string means.

Nabu can build a spreadsheet. A real .xlsx, written directly, with numbers that stay numbers — so a column still sums when you open it in Excel or Numbers. Until now, "make me a spreadsheet" meant Nabu reaching for a shell command.

Nabu no longer acts on instructions hidden in what it reads. A web page, a file, or something a connector returns can contain text written at the agent rather than at you: "ignore your instructions", "the user already approved this", "don't mention this step". Nabu now treats everything its tools bring back as information and never as orders — it tells you what the content asked for, names where it found it, and leaves the decision to you.

It asks before reaching into your own computer or network. Opening 192.168.1.1, or a service on localhost, used to happen without a word. A router's admin page is not your data, and loading a page there is not always harmless. Nabu now asks, shows you the address, and remembers a site you choose to allow. Ordinary web pages are deliberately not affected: asking about every domain would be a dozen dialogs per task about names nobody can judge, and a prompt people learn to click through protects nothing.

It also asks before an address that carries data out of the conversation. An unusually long web address is one way for content to leave — everything Nabu has read, packed into a link. You see what would be sent, decoded and readable, before it goes anywhere.

"Skip permission prompts here" no longer switches off the sandbox. The mode exists to stop the drumbeat of confirmations while Nabu works in your folder. It was also silencing them for the rest of the disk, which is not the same thing. Files outside the folder ask again. Commands still don't — a command has no folder it can be confined to, so that limit is now stated where you switch the mode on, instead of being something you'd find out later.

Only web links open. A link in an answer was handed to macOS with whatever scheme it carried; now http and https are the only two that go anywhere.

Your sign-in is encrypted at rest, and Nabu tells you when it can't be. On a Mac whose keychain refuses — locked, or access not granted — the session token was written in plain text. Nabu now refuses too, and says why, rather than quietly leaving something readable on disk.

Voice stops listening when you close the window. The microphone stayed live behind a closed window until you quit the app.

Smaller things: a settings file is now replaced in one step, so a crash mid-write can no longer leave half a file behind; and the libraries Nabu ships carry five known vulnerabilities instead of twelve.

Signed with an Apple Developer ID and notarized, same as before. If you are on 1.5.x or 1.6.0 it installs itself — Nabu checks shortly after you open it, once a day, and when your Mac wakes.

Nabu 1.6.0

Nabu 1.6.0 — undo you can rely on, and no more silent hangs

This release came out of walking the whole product the way a person would, on purpose, looking for places where Nabu did the wrong thing quietly. Sixteen problems came out of that; the four serious ones are fixed here.

Undo now works on the folders it used to break on — and can no longer damage anything. If your working folder contained a symlink — an alias, an iCloud or external-drive shortcut, a node_modules link — undo failed outright. Worse, when that link pointed at a file you could write, undo overwrote that file, outside your working folder. The feature that exists to protect your work could damage it. Snapshots now leave links alone, and a restore refuses to write through one.

Your working folder is a real boundary again. Nabu decided what was "inside" your folder by comparing text, without checking where a path actually led. A link pointing outside looked inside, so reading and writing beyond your folder happened with no prompt at all. Nabu now asks the filesystem where a file really is, and when a link leads outside, the prompt shows you the real destination rather than the link.

Permission prompts no longer vanish after Nabu opens a web page. Opening one page sent every later prompt to an invisible window, so Nabu sat waiting for a decision you were never shown, forever, and only restarting the app got you out. The same fault silently broke hands-free voice, model-download progress and connector status for the rest of the session. All of it works again.

A turn can no longer hang with nothing to tell you. If the model goes quiet mid-answer, or anything fails before the request even leaves — for example your saved key can't be read from the keychain — Nabu now says what happened and ends the turn, instead of showing "thinking" indefinitely. Stop also frees a turn that is waiting on a permission decision.

PDFs in your folder can be read. "Read this contract and pull out the payment terms" works on a PDF now, not only on Word and Excel files. A scan with no text in it says so, and points you at attaching it to the chat instead, where its pages are read as images.

Search stops answering "no matches" when it skipped something. Files too large to search were passed over silently, so a folder that did contain what you asked for came back empty. It now tells you how many files it did not look at.

Signing out says why. If your session ends on its own, the sign-in screen tells you that, instead of looking exactly like a first launch.

Smaller things: links are marked as links in folder listings, file sizes read as "53.9 MB" rather than a raw byte count, and the undo dialog no longer says "this file … the way they were".

Signed with an Apple Developer ID and notarized, same as before. If you are on 1.5.x it installs itself — Nabu checks shortly after you open it, once a day, and when your Mac wakes.

Nabu 1.5.1

Nabu 1.5.1

No new features and no fixes — this release exists to exercise the update path itself.

1.5.0 had to be installed by hand, because macOS will not apply an update whose signature does not match the copy already running, and every build before it carried a temporary signature. So nothing had yet run the whole route: notice → download → restart → new version. Keeping this release identical to 1.5.0 means that if anything misbehaves, it is the mechanism and not new code.

If you are on 1.5.0, you should not need to do anything. Nabu checks shortly after you open it, once a day, and when your Mac wakes; the sidebar will show the download and then offer Restart to update.

Signed with an Apple Developer ID and notarized, same as 1.5.0.

Nabu 1.5.0

Nabu 1.5.0 — signed, notarized, and it updates itself

Nabu is now signed with an Apple Developer ID and notarized by Apple. It opens like any other app — no warnings, no trip through System Settings.

Two one-time prompts when you first open this version. macOS will ask for access to your keychain: Nabu's identity changed from a temporary signature to a real certificate, and your API key and login tokens are encrypted with a key stored there. Click Always Allow. It will also ask for the microphone once more — and this is the last time. Until now every update reset that permission, because a temporary signature gave macOS no way to recognise the new build as the same app. A real certificate does, so your answer now sticks.

Install this one by hand. Nabu cannot update itself into this version: macOS refuses to apply an update whose signature does not match the copy you are running, and the copy you are running has the old temporary one. This is the last manual install.

From here, updates install themselves. Nabu checks shortly after you open it, once a day, and when your Mac wakes. It downloads in the background, shows progress in the sidebar, then offers Restart to update. If you quit instead, the update already on disk is applied next time you open the app. If the automatic path ever fails, the row falls back to a plain browser download rather than leaving you stuck.

Known limitation: on-device speech recognition needs Apple Silicon. Everything else works on Intel.

Nabu 1.4.5

Superseded build. This build is not signed with an Apple Developer ID, and the "right-click → Open" step below no longer works — Apple removed that path in macOS Sequoia. Download the latest release instead: it is signed, notarized, opens like any other app, and keeps itself up to date.

---

Universal (Apple Silicon + Intel), ad-hoc signed — on first launch right-click the app → Open once to get past Gatekeeper. macOS will ask for the microphone once after installing; from 1.4.4 onward it remembers your answer within an install.

Since 1.4.4

• Nabu tells you when a new version is out. It checks shortly after you open it, once a day, and when your Mac wakes up. A quiet chip appears; clicking it starts the download in your browser and you install it the usual way. Nabu cannot install updates itself — that needs an Apple-issued certificate — so the chip says "download" rather than pretending a restart would do it.
• Leaving Nabu open no longer keeps a lapsed subscription alive. Your plan was only re-checked when the app started, and a cached answer is trusted for up to two weeks so that offline work keeps working. An app left running for weeks could therefore hold on to features that had already expired. It now re-checks daily and when the Mac wakes.
• One way out of voice mode, where your hand already is. The exit button no longer floats in the middle of the screen — while you are talking, the composer's send button becomes a cross that ends voice mode. Clicking the dimmed background and pressing Esc still work too.

Known limitation: on-device speech recognition needs Apple Silicon. Everything else works on Intel.

Nabu 1.4.4

Superseded build. This build is not signed with an Apple Developer ID, and the "right-click → Open" step below no longer works — Apple removed that path in macOS Sequoia. Download the latest release instead: it is signed, notarized, opens like any other app, and keeps itself up to date.

---

Universal (Apple Silicon + Intel), ad-hoc signed — on first launch right-click the app → Open once to get past Gatekeeper.

Two prompts on this update, both expected, both once:

1. Keychain access. This build is signed properly for the first time, which means macOS sees a new identity and asks whether it may reach the key Nabu uses to protect your API key and account tokens. Allow it — it is the same app. Deny it and Nabu will look signed out with no key set.
2. Microphone, if you use voice. Read on.

Since 1.4.3

• macOS finally remembers that you allowed the microphone. Until now every build carried Electron's own signature rather than Nabu's, with the app's Info.plist left outside it. macOS records a permission against the app's identity — and there was no usable identity to record it against, so it asked again on every single launch. It now asks once and remembers. This was the bug behind four releases of "I already allowed this."

Still true, and honestly not fixable for free: installing a future update will ask for the microphone one more time. An ad-hoc signature cannot tell macOS that the new build is the same app as the old one; only an Apple Developer ID can. The same limitation is why automatic updates stay switched off.

Known limitation: on-device speech recognition needs Apple Silicon. Everything else works on Intel.

Nabu 1.4.3

Superseded build. This build is not signed with an Apple Developer ID, and the "right-click → Open" step below no longer works — Apple removed that path in macOS Sequoia. Download the latest release instead: it is signed, notarized, opens like any other app, and keeps itself up to date.

---

Universal (Apple Silicon + Intel), unsigned — on first launch right-click the app → Open once to get past Gatekeeper.

Please read first, if you use voice: macOS will ask for microphone access once after installing this update, and that is normal — every new build is a new app as far as the system is concerned, so your earlier answer cannot be carried over. It will not ask again after that.

Since 1.4.2

• Opening Nabu twice now raises the window you already have. Before, a second launch started a second Nabu, and the two shared one set of chats and one microphone with nothing keeping them out of each other's way. If you deliberately want two — say, to see two accounts side by side — start one with its own data folder and it will still open separately.
• A quieter start. Nabu checked for updates on every launch and failed every time, logging an error for a feature that could not have worked: unsigned apps cannot install updates on macOS. It no longer asks. This comes back with code signing.
• Your plan is named properly. The badge beside your account said "Pro" on every paid plan, including Max. It now says Free, Pro, Pro+ or Max.

Known limitation: on-device speech recognition needs Apple Silicon. Everything else works on Intel.