0.31.0

What is new in 0.31.0

The release before the first two installations outside the maker's own machines. The agent gets a new face and a place of its own under the conversation, the sidebar is organised in sections, and the stream stays calm while the agent works.

Meet Monty

• The agent's avatar is redrawn, with eyes you can see through, and a fresh installation now names the agent Monty. An existing installation keeps the name it has; you can change it at Agent settings.
• Monty sits under the conversation, with his name. While he works, his gears turn; when he needs you, for a question or an approval, he says Waiting for you. The name row above every reply is gone: a reply is the plain text, your messages are the bubbles.
• On Windows, the app icon now fills its tile on the taskbar and in the Start menu, like the icons of other apps. If a pinned button still shows the old icon, unpin it and pin it again; Windows keeps icons in a cache.

The sidebar in sections

• Under the fixed destinations the sidebar has three sections, in one scroll: Pinned (only when you pinned something), Projects and Recents. A section folds away with the chevron that appears when you point at its title, and the + next to Projects and Recents starts a new project or a new conversation.
• A project can be pinned from its row menu, in the sidebar or on the projects page, and unfolds to its five most recent conversations. View all under a section opens its page; the pages Conversations and Projects are still there.
• A conversation row shows a spinner while a turn runs in that conversation and a hand when the agent is waiting for you, next to the unread dot you already had. The same marks appear on the Conversations page, on a project page and under Scheduled tasks. A turn started elsewhere, on another device or by a scheduled task, shows up at the next refresh of the list, for a scheduled run up to a minute later.

A calmer stream

• One process block per reply holds everything the agent did, thinking included. It stays closed while the agent works and says on one line what is happening ("Search the web · …", "Thinking…"); when the reply is done it sums the work up ("Looked up 3 things, ran 2 commands"). Click the block, or a step inside it, for the details. It opens by itself only when a step asks for your approval, and stays open after you decided.
• Words fade in as a reply streams; the blinking cursor is gone. Nothing under the block moves while you read.
• Duration, tokens and cost under a reply, and the actions next to them, appear when you point at the reply (on a touch screen they are always there). Interrupted and the source verdict stay visible.
• Two Terminal commands in one step run one after the other, and the second says Waiting its turn until the first is done. An approval question for a Terminal or Script step says This step runs outside the sandbox. when the conversation is set that way.
• While working, the agent is asked to acknowledge a longer task in one line, to speak up when something takes a while or does not go as planned, and otherwise to save its words for the answer.

Fixes

• A skill attached to a message no longer puts a "1 skill attached" block inside your own message bubble.
• A long model name in the input bar no longer slides over the + and the approval level when the window is narrow.
• Stopping while a Terminal command runs now closes that step honestly, instead of leaving it spinning until a reload.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.31.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.31.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.30.0

What is new in 0.30.0

A maintenance release before the first two installations outside the maker's own machines. Babbage moves to Electron 44 and a new database driver, documents as sources now work on Windows, and installing an update on Windows asks first. On macOS, Babbage now needs macOS 13 or later.

Documents as sources now work on Windows

Until now, adding a document on Windows (Add, then Document, then Text, File or URL in the sources panel) failed with "The document could not be processed." The Windows build was missing one native library (sharp, which the local embeddings load on start) and had been missing it since the first Windows release. The build now carries it, checks for it, and refuses to build without it. Searching and viewing sources works as it already did on the Mac. The first document on a machine still downloads the embeddings model once (about 465 MB) into Babbage's data folder.

Updating on Windows asks first

The update item at the bottom of the sidebar works as before: it says when a new version is ready to download, shows the progress, and then asks you to restart. What changed is Restart: it no longer installs straight away. It opens a confirmation ("Install version …?") with what is in the new version, and the line "Babbage closes, installs the update and starts again." Only Install installs; Not now closes the confirmation and leaves the update ready for later. You will see this for the first time at the update after 0.30.0; the update to 0.30.0 itself still installs the old way.

Under the hood

• Electron 44 (Chromium 152, Node 24). Electron 41 had reached the end of its support. Because of this, Babbage needs macOS 13 or later; the download page and the installation page say so.
• A new database driver (better-sqlite3 13), the same binary under Node and Electron, so the desktop build no longer swaps binaries per runtime.
• The updater and the folder dialog answer only Babbage's own window, not any other page that might end up inside the app.
• The build checks each installer for exactly one copy of each native library for its own platform, and stops when one is missing or one for another platform is left in.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.30.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.30.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.29.0

What is new in 0.29.0

This is the release for the first two installations outside the maker's own machines. Babbage now has a first start that gets you to a working model in a few steps, with or without a cloud key; a diagnostics export for reporting a problem; a tidier interface with one consistent set of shapes, sizes and colours; and a stricter web version. Under the hood, the server log no longer carries the content of your conversations when a provider returns an error, and the writing boundary on Windows closes a gap found in the last measurement.

The first start

A fresh installation no longer opens on an empty conversation. It opens on a short setup, four steps, before anything else:

• The agent introduces itself ("Hello. My name is Babbage.") and you can keep that name or give it another one. Then it asks what to call you. Both can be changed later under Agent settings and Settings.
• Then the model, because without one Babbage cannot answer anything: "Before we can talk, I need a model to think with. That takes a minute." Three ways in. Use an API key: pick Google or Anthropic, follow the link to the page where you create a key, paste it, Check and save. Babbage checks the key with the provider once and stores it in its own .env file; it is never shown again and never put in a conversation. Run a model on this computer: free and private, with Ollama or LM Studio. Connect something else: Open Settings takes you to Models for your own endpoint; the setup continues where it was when you come back.
• The local path does the looking for you. Babbage searches for Ollama or LM Studio on this computer; if there is none, you get Get Ollama and Get LM Studio and I've installed it, check again; if there is one, Connect. Then you pick the model. A model that cannot use tools is greyed out, and a server without models gets a short list of models that fit this computer, chosen by its memory, each with a Download button. After the choice Babbage loads the model once to see how much context it gets: Ollama gives 4k by default, Babbage needs 16k to work with files and tools, and if it is less the setup says exactly what to change in the Ollama app, in Ollama without the app or in LM Studio, with Check again and Skip for now.
• When there is a model, the agent thanks you by name and Start opens the app.

If the model disappears later, a new conversation shows "No model available yet" with Set up a model…, which opens the same setup at the model step. The name field on the web login screen is gone; the setup asks for your name instead.

Reporting a problem

Settings → About → Diagnostics → Export… puts together one zip file for whoever is helping you, saved on your computer and sent nowhere by itself. It always contains a description of the installation (version, platform, which providers are set up, the state of the sandbox), the server log of this start and the previous one with secrets masked and errors summarized, and your settings without your name. You tick the conversations to include and write a note about what went wrong. Never included: API keys, the database, memory, the agent's soul, skills, and files from linked folders.

A tidier interface

• Settings is organised in blocks: every group has a heading and one bordered block of rows, the same shape everywhere.
• One system of shapes and sizes across the app: buttons and controls on a few fixed heights, one ladder of corner radii, hairline borders on cards and panels, and cards and dialogs that nest concentrically.
• The theme colour has a smaller, more deliberate role: the primary button is ink, and your accent colour comes back in the send button, links, focus rings, selections, your own messages and other small accents. Text on the accent is picked per colour for contrast, so every preset reads well in light and dark.
• The sidebar remembers whether you collapsed it, also over Settings and a reload.
• A folder that Babbage may not read is no longer shown as empty: the sources panel says "Babbage is not allowed to read this folder." and the agent is told the same.

A stricter web version

Nothing here changes the desktop app, which still has no password and still listens on your own machine only.

• The first password needs a token. When the web version starts without a password, it writes a one-time token to its .env as BABBAGE_SETUP_TOKEN, and the login screen asks for it under Setup token. So only someone who can open the files on that computer sets the first password. Once the password is set, Babbage removes the token.
• Only known addresses. The web version answers on localhost, 127.0.0.1 and the addresses you list in BABBAGE_ALLOWED_HOSTS in .env; any other address gets "This address is not allowed. Add it to BABBAGE_ALLOWED_HOSTS in Babbage's .env file." If you use Babbage over Tailscale or behind a proxy, add that address once and restart.
• A request that changes something is refused when it comes from another website, and every page carries a content security policy. The desktop app only grants a web page the permission to write to the clipboard; everything else a page could ask for (microphone, camera, location, notifications) is refused.
• Next.js moved to 16.4.2 and the HTML sanitizer to a patched version.

The server log

When a model or server returns an error, the log now records what kind of error it was, the status and a short, masked reason, instead of the whole error object. That matters for the diagnostics export: a provider that echoes your request in its error message no longer puts your conversation, your memory or the agent's soul in a log that you might send to someone. API keys are masked by shape as well as by value, so a key you replaced since the last start is masked too.

Windows

• A junction whose target is a volume GUID (the form Windows itself uses for some mounts) is now seen for what it is: a link. The file tool resolves it to the real location before it checks the writing boundary, so it cannot be used as a way out of your linked folders. The short 8.3 names of folders (CONFIG~1 and the like) are normalised to their long names for the same checks.
• Babbage's own Python folder is created, empty, when the sandbox starts, so the protection on it is in place before anything is installed there.
• When another program holds the port the sandbox needs, Settings → Tools now says so in plain words instead of showing a raw error. The sandbox cannot start until that port is free; see the troubleshooting page.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.29.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.29.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.28.0

What is new in 0.28.0

The interface is English only, every step the agent takes is easier to follow while it runs, Babbage draws everything you have as one graph, and the file tool keeps to the same boundary as the terminal: it writes where it says it writes, and never through a link to somewhere else. This release also carries the first measurement of that boundary against the real Windows sandbox.

English only

• The interface is in English. The Language row under Settings → General is gone, together with the Dutch translation. An installation that was set to Dutch switches to English at the first start after the update; the language the agent answers in still follows the language you write in.
• A few fixed texts followed: the heading of the readable memory copy (data/memory.md), the fallback file name when you export a conversation (conversation), and the [MASKED] marker for a hidden secret.

Following what the agent does

• A step you approve is shown as running right away, with the shimmer and its parameters in view, until the result comes back. A step you reject is shown as rejected at once. The trail stays: Approved by you or Rejected by you on the step, so a conversation you reread tells you what you decided.
• Stopping a reply, or an error while it resumes, no longer leaves a step hanging as if it were still waiting: the step closes with an honest red end state, and the text says that the action may have run, because a command keeps running after a stop.
• An approved action runs at most once. If a second tab or a second click tries to run the same approved step again, Babbage refuses and offers Reload conversation. Coming back to a conversation while an approved command is still running shows it as running, and the conversation reloads itself when the turn is done.
• The input of a tool step is readable instead of raw JSON: a file write shows the path and the content, a Script its code, a Terminal step its command, a skill its name, description and instructions, and a scheduled task its schedule. Anything else, including MCP tools, gets a plain field list.
• Approving a file write on an existing file shows a diff: added and removed lines with counts, and a switch to New content. A new file says New file. The diff is for you only; it never goes to the model, and a file on the secrets list shows nothing of its current content.
• Error messages across Settings, the document viewers and the login use one error colour.

Graph

Graph in the sidebar draws everything in Babbage as one map, the way the graph view in Obsidian does for notes: conversations, labels, projects, documents, attachments, reports, skills and scheduled tasks as nodes, with a line where two things belong together. Filter by kind, search by name, drag the forces, click a node to open it. In a conversation, the Local graph panel (the button in the header, or ⌥⌘L on a Mac and Ctrl+Alt+L on Windows) shows the neighbourhood of that conversation. Colours follow your theme.

Smaller changes

• The item at the top of the sidebar shows your agent's name and avatar instead of "Agent settings"; the page keeps its name.
• Prompts is now called Prompt library.
• The animated light rays on the login screen and behind an empty conversation are gone; the paper grain stays.

The writing boundary

The file tool runs outside the sandbox, so it now applies the same rules as the terminal does inside it.

• A write goes to the real target. Babbage follows links the way the operating system does, including a link to a file that does not exist yet and a .. inside a link, and checks the secrets list and the protected folders on both the typed path and the real one.
• A write through a link to a place outside the linked folders is refused, with the real location in the message. To write there, the agent has to use that path directly, and then you are asked.
• Files that run code outside the sandbox always ask first, in every approval level: shell startup files such as .zshrc, .zshenv and .bashrc, git hooks and config (also inside submodules and worktrees), .vscode, .config/git, ~/Library/LaunchAgents, the autostart and Startup folders. The approval card says why: "Files like this can run code outside the sandbox, so Babbage always asks before writing them." The question is asked at the moment of writing, not only at the moment of asking.
• Babbage's own data folder (database, memory, snapshots, the agent's home) is closed to the file tool for reading, listing and writing, except the workspaces. Reading is refused with a short reason; memory, the knowledge base and skills have their own tools.
• The file tool only opens regular files. A named pipe or a device no longer blocks the server or fills its memory.
• The snapshot store that protects linked folders cannot be planted by a sandboxed command before the first snapshot, and Babbage's own git runs with its hooks, file monitor and signing switched off on the command line.
• On Windows this boundary is measured against the real sandbox: the protected paths carry a deny on NTFS, a sandboxed command cannot write them, and git init inside the snapshot store is refused.

Under the hood

• One migration runs at the first start (0072): the language setting is removed.
• Three new dependencies: diff for the write diff, d3-force and react-force-graph-2d for the graph.
• The documentation site has a new page, Graph, and the pages on first steps and working in a folder are updated.

What to expect as a tester

After the update, Settings → General has no Language row and the whole interface is English. Click Graph in the sidebar: your conversations appear as nodes; click one to open it, and open the Local graph panel in a conversation. Link a folder with Read and write, ask for a terminal command and approve it: the step shows Approved by you and shimmers until it is done. Ask the agent to change an existing file: the approval card shows the lines that change. Then ask it to write .zshenv in that folder with the approval level on Skip: Babbage still asks, with the sentence about code outside the sandbox.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.28.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.28.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.27.0

What is new in 0.27.0

Babbage has a name, a soul and a face, and a new logo. This release is the foundation of the agent line from the roadmap: the agent gets a home on your computer, a page where you shape who it is, and a place in the interface. The persona feature is gone, the agent knows what day it is, and you can see exactly what it was told at the start of every reply. Three new Claude models are in the picker.

Your agent: a name and a soul

• Agent settings is a new page in the sidebar, above Projects. It shows the agent's name (Babbage, rename it if you like) and its soul: the text the agent reads at the start of every reply, before your project instructions and memory. Both save automatically.
• The soul starts as a short default text about who the agent is and how it behaves. Reset to default brings it back, with an Undo in the toast. As long as you have not changed the default soul, it moves along with updates; your own text is never touched.
• The soul lives as SOUL.md in the agent's home inside Babbage's data folder (agents/babbage/). The agent itself cannot write there: writing is refused for the file tool and the terminal asks you first, the same as for the skills folder.
• The name you give the agent shows up above every reply, in some of the greetings ("Ada is warmed up, Robin.") and in the question "What should Ada call you?" in Settings.

A face

The agent's avatar is in the sidebar button, above every reply next to its name, and large above the greeting of a new conversation. It follows the theme: ink on light, light on dark.

A new logo

• On a Mac and on Windows the app icon is the new Babbage logo in black on a white tile, shaped like Apple's own icons. On Windows, a taskbar button you pinned earlier can keep the old icon until you sign out and back in.
• In the app the logo sits next to the name at the top of the sidebar. When the sidebar is collapsed, it takes the place of the expand button, which appears when you point at it.
• The browser tab, the home screen icon of the web version and the documentation site use the same logo. iOS never refreshes an icon on the home screen: if you added the web version to yours, remove it and add it again.

The persona feature is gone

Personas and persona groups are removed. Prompts stay under Prompts, now without tabs. Existing persona rows are deleted at the first start after the update, not converted; the agent's soul takes their place. The old "default system prompt" setting is gone for the same reason.

The agent knows what day it is

Every reply now carries today's date (weekday and date, no clock time) at the end of the prompt, so "what day is it" and "schedule a task for tomorrow at 9:00" work without guessing.

See what the agent was told

Under Settings → About (Account in the web version) there is a new switch, Show the prompt behind each reply. With it on, Details of this reply gets a section Prompt as sent: the identity and the instructions the agent received for that reply, each with a copy button. Babbage keeps those two layers per reply, deduplicated, so the record stays small; the sources layer is not stored, "What went in" already lists what went along.

Models

Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5 are in the model picker, with the current context windows and cache prices for all Claude models. Haiku 4.5 stays the default. The reasoning effort you choose is now always sent explicitly.

Under the hood

• Four migrations run at the first start (0068 to 0071): the agents table, an agent reference on conversations and memory, the removal of the persona tables, and the prompt layers. The conversations table is rebuilt once at that start to drop its persona columns and two columns that nothing had read for months; every conversation and message stays as it is.
• The readable copy of your memory, data/memory.md, now starts with a neutral heading.
• The self-hosted web version follows the container's clock for the date, which is UTC unless you set TZ in docker-compose.yml.

What to expect as a tester

After the update, click Agent settings in the sidebar: the name, the soul and a greyed-out Reset button. Rename the agent to "Ada", open a new conversation and ask "What is your name?": the reply comes from Ada, with her name above it. Add one sentence to the soul ("You end every reply with the word Done."), ask something, and see it followed; then Reset to default. Ask "What is today's date?" and get the right day. Turn on Show the prompt behind each reply under About and open Details of this reply on any new answer: the soul and your instructions are right there. Prompts no longer has persona tabs.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.27.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.27.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.26.1

What is new in 0.26.1

A small follow-up to 0.26.0: the rough edges found in its Windows test round, a stricter line on refused secrets on both platforms, and two fixes on a Mac that you will not see in daily use but that make the sandbox's explanations and your process list honest.

On Windows: linking and the sandbox list, smoothed out

• The folder picker refuses a whole drive (C:\, D:\) and your user folder right away: Choose this folder is greyed out with the sentence under it, "Babbage cannot link a whole drive or your user folder on Windows; choose a folder inside it.", and typing such a path in the path field gives the same answer. In 0.26.0 the refusal only came after Babbage had counted the files and asked "Link C:?"; a root is also shown as C:\ now, not C:.
• Folders the sandbox can reach (Settings, Tools) says under each folder in how many places it is still linked, "linked in 2 conversations or projects", so you can see why a folder stays reachable after you unlinked it in one conversation.
• Remove the sandbox shows its progress in the dialog itself: first "Releasing 2 folders…", then "Waiting for the Windows prompt…", with the Remove button greyed out. In 0.26.0 that progress was on the Status row, hidden behind the dialog.
• If you unlink a folder, move it, and link it again on its new path, Babbage recognises it as the same folder and does not set the sandbox account's access a second time. In 0.26.0 that only worked when you linked the new path before unlinking the old one.

A refused secret is not something to run outside the sandbox

When a command tries to read a .env or another file on the secrets list, the card "The sandbox blocked a file action" no longer offers Run outside the sandbox for it, on a Mac and on Windows alike: running it outside would only be a way around that list. The refusal is still listed under the step and in the Sandbox log, and the agent is told that the file is protected and not to suggest that route.

On a Mac: the right explanation when a command is refused

When the sandbox refuses a file action on a Mac, the explanation to the agent, the line under the step and the Sandbox log all come from the sandbox's own log. Roughly one in 150 times that log delivered its line a few milliseconds after the command had already finished, and Babbage then told the agent that macOS had refused the action and pointed you to System Settings for something the sandbox did. Now, when a command fails with "Operation not permitted" and the log has nothing for it yet, Babbage waits up to 300 milliseconds for that line before it decides; every other command waits nothing. The Sandbox log in the Command Center also gets a second look half a second after each command, so a refusal that arrived late still lands there.

Your keys stay out of the process list

On a Mac, Babbage's server process carried your API keys and the session secret in its startup environment, which tools such as pgrep -fl show in plain text. The server now reads them from Babbage's own .env after it has started, so they are no longer in that list. Nothing changes in where your keys are stored or how Settings manages them. For the self-hosted web version, the session secret is now created at the first start instead of at the first login, so the restart after that login is no longer needed.

What to expect as a tester

On Windows, after the update, open the folder picker and go to C:\: the button is greyed out and the sentence is under it. Link a test folder in two conversations and look under Folders the sandbox can reach: "linked in 2 conversations or projects". Put a .env in that folder and ask the agent to read it with a script in the terminal: the step fails with a permission error, there is no card offering to run it outside the sandbox, and the agent tells you the file is protected. On a Mac nothing changes in daily use; if you are curious, run pgrep -fl next-server in a terminal while Babbage is open and notice that no key appears.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.26.1-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.26.1.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.26.0

What is new in 0.26.0

On Windows, the sandbox now remembers which folders it may reach. A linked folder is made reachable for the sandbox account once, at the first terminal step that uses it, and stays reachable until the folder is no longer linked anywhere, instead of being granted again in every session and taken back at every quit. Quitting and starting Babbage are fast again, Settings shows the list of those folders with a button to take the access back, a whole drive or your user folder can no longer be linked, and Remove the sandbox cleans up after itself. Nothing changes on a Mac.

On Windows: a folder is made reachable once, not every session

Until 0.25.5, every start of Babbage began with an empty sandbox: the first terminal step in a linked folder gave the sandbox account its access to that folder again, which on a large project folder took fifteen seconds or more, and quitting Babbage took the access back and took just as long. After a crash or a forced quit, the next start first cleaned up what the previous session left behind, with "still starting" on the Sandbox row for tens of seconds.

Now the first terminal step in a linked folder makes it reachable once. The step says so, "1 folder made reachable for the sandbox", and waits for it: a moment for a small folder, tens of seconds for a large one. From then on the access stays, also after a restart. On the test machine the same step in the next session went from 15 seconds to under half a second, quitting with a large project from 18 seconds to a third of a second, and the start after a forced quit from 17 seconds to 3.

The access goes away by itself when the folder is no longer linked in any conversation or project, and it drops to read-only when the last conversation that linked it with write access is gone. Settings, Tools, section Sandbox, lists the folders under Folders the sandbox can reach, read-only ones marked as such, each with a button that takes the access back at once; a conversation that still links the folder gives it back at its next terminal step.

The protection of secrets, git hooks and shell startup files at the top level of a linked folder is now set by Babbage itself and checked again at every start, so a .env that appears in a linked folder later is protected from the next start of Babbage on. Babbage keeps its own record of all this in sandbox-grants.json in its data folder, and checks that record against the folders on disk at every start.

Two folders you can no longer link on Windows

A whole drive (C:\, D:\) and your user folder itself are refused as linked folders on Windows, in the folder picker and when the agent asks for them: "Babbage cannot link a whole drive or your user folder on Windows; choose a folder inside it." The reason is the model above: the sandbox's access is set on the linked folder itself and everything below it, and on a drive or your user folder that would be everything. Any folder inside them is fine.

Remove the sandbox cleans up first

Remove the sandbox under Settings, Tools now first takes back the sandbox account's access to every folder it was given, and removes the account only after that, so no folder keeps a permission entry for an account that no longer exists. A folder it could not reach anymore, moved or with permissions Babbage may not change, is counted in a message afterwards, with the hint to remove the entry by hand in the folder's Security tab.

Said plainly

• A folder you move keeps its access and is recognised when you link it again on its new path. A folder you move and never link again keeps its access until you remove the sandbox.
• A folder whose permissions Babbage is not allowed to change, because it belongs to another account, cannot be made reachable; the step then says "Babbage cannot change the permissions of this folder, so the sandbox cannot reach it. Check who owns the folder, or link a different one."
• A folder inside a linked folder that has its own protected permissions stays out of the sandbox's reach, and the step does not say so; the command simply fails there with "Permission denied".
• Everything else about the Windows sandbox is as in 0.25.5: inside your user folder it reaches only the linked folders, the workspaces and Babbage's own folders, outside your user folder it has the default rights Windows gives every account, and the protection of secrets covers the top level of a linked folder.

What to expect as a tester

On Windows, after the update, link a test folder as writable and ask the agent to run ls in the terminal: the step ends with "1 folder made reachable for the sandbox" and a time, and Settings, Tools shows the folder under Folders the sandbox can reach. Quit Babbage, notice that it closes at once, start it again and ask for ls in the same conversation: no such line this time, and the step is immediate. Unlink the folder with the chip under the input field, and the list in Settings is empty again within a second. Try to link C:\ or your user folder in the folder picker and you get the sentence above. If the previous version of Babbage did not quit cleanly, the first start after the update may still take a while once: it finishes cleaning up what that version left behind, as before.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.26.0-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.26.0.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.25.5

What is new in 0.25.5

A security fix for the sandbox on Windows, and an honest correction to what that sandbox does and does not confine. Nothing else changed; on a Mac this version behaves exactly like 0.25.4.

Fixed: a secret at the top of a writable folder was readable inside the Windows sandbox

Since 0.25.0, a command running inside the Windows sandbox could read a secret file sitting at the top level of a writable linked folder: a .env, .ssh, .aws, .npmrc, .netrc and the other names on the secrets list. If you had linked your whole user folder, that included Babbage's own database and its .env with your API keys. Writing to, renaming and deleting those files were refused as intended, and the guard in front of the terminal still refused any command that named such a file; what it could not stop was a script that opened the file from inside. The cause was two overlapping protection entries for the same file, where the weaker one won. There is now one entry, and the fix is proven against the real sandbox: reading, appending, renaming and deleting a top-level .env all fail with "Permission denied", while ordinary files in the same folder work as before. Read-only linked folders were never affected, and neither was the Mac. On Windows this protection covers the top level of a linked folder only, as before: a secret deeper inside is reachable from a script there, and the guard in front of the terminal is the layer that remains. On a Mac the protection covers any depth.

If you use Babbage on Windows with the sandbox on, update. If you linked a folder with secrets in it and let the agent run scripts there, treat those secrets as possibly seen and rotate them; Babbage has no record of what a script read.

What the Windows sandbox confines, said plainly

The sandbox on Windows is a separate Windows account, and like every account it carries the default rights Windows gives everyone. Inside your user folder it has none of its own, so there it can only reach the folders you link, the workspace and Babbage's own folders. Outside your user folder it has what any account has: on a second drive (D:, say) and on folders made directly under C:\ that usually means reading and often writing. Earlier versions described this without that condition; the Sandbox status and setup texts in Settings, the first-start card, the agent's own instructions and the website now say it with the condition. We are taking the underlying cause up with the maker of the sandbox runtime. Until then, keep what the agent must not touch inside your user folder.

What to expect as a tester

On Windows, link a test folder as writable, put a .env in it with a line like SECRET=42, and ask the agent to write a small Python script that prints the contents of .env and run it in the terminal. The step runs in the sandbox, fails with "Permission denied", and the agent does not get the value; the card that offers to run the step outside the sandbox is the usual escalation (whether it should appear for a secret at all is an open point), but do not use it for this test. Ask for cat .env directly and the guard refuses before the sandbox is even reached, as before. In Settings, Tools, the Sandbox row now says "Inside your user folder, reading and writing are limited to the linked folders, the workspace and Babbage's own folders".

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.25.5-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.25.5.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.25.4

What is new in 0.25.4

Babbage's own Python now comes to Windows too, the Skills page tells you which skills need it and installs it from there, and three rough edges from the 0.25.3 test round are smoothed: the terminal runs its steps in order, the sandbox card only appears when a step actually failed, and scheduled monitors use the same Python as the terminal.

On Windows: Babbage's own Python

Settings, Tools now has the section Python on a PC as well. One click downloads uv, Python 3.13 and the five libraries (openpyxl, python-docx, python-pptx, pypdf and pillow): about 52 MB to download, about 155 MB on disk, in your user folder next to Babbage's own Git, from their official sources, every piece checked against a checksum that is fixed in this version of Babbage. No administrator rights, nothing registered with Windows, and Remove in the same place takes it away again. In Babbage's terminal and scripts, python and python3 are then this Python; the python3 that Windows itself lacks is added by Babbage, so a script written on a Mac runs unchanged. The Python you installed yourself is untouched and still there under its full path.

Inside the sandbox the Python folder can be read and run but not changed, exactly as on a Mac. When a Python script does run into a refused file action there, the step now says so and offers the usual Run outside the sandbox; before, Windows only showed the raw Permission denied from Python. pip's "A new release of pip is available" notice is switched off inside the sandbox on both platforms, so it no longer clutters the output.

Skills say what they need

A skill that comes with scripts shows a grey line on the Skills page: "Needs Python", "Needs bash" or a combination. For Python the line also tells you whether Babbage's own Python is installed on this computer; if not, Install sits right there and opens the same dialog as the section under Settings, and the line follows the progress. Babbage reads this from the skill's scripts folder every time it shows the list, so it is never out of date. When you fetch a skill From a URL… while Babbage's Python is not installed, the same note appears under its files before you install it. It does not block anything: install first, add Python after.

Steps in order, a card only when it matters

In 0.25.3 the model could call the terminal twice in one go, write a file in the first step and read it in the second, and the second step ran before the file existed. Terminal and Script steps in the same turn now run one at a time, in the order the model called them. One honest exception: a step that is waiting for your approval runs after the others, so a model that writes with a Script and reads with the terminal in the same turn can still read too early. The model is told this and advised to put such a step in a later turn.

The card "The sandbox blocked a file action" used to open whenever a step was refused somewhere, even when the command simply fell back and finished fine, such as a program that could not write its cache. It now only opens when the step failed. The refused action is still listed under the step itself and in the sandbox log, so nothing is hidden; only the offer to run it again outside the sandbox is gone where there was nothing to run again. A blocked network request still shows the card, because allowing a domain is a choice for the next attempt.

Monitors use Babbage's Python too

A scheduled monitor that runs python3 check.py used the Python of your machine, even with Babbage's Python installed, and on a PC without one it ran into the Microsoft Store shortcut. The monitor's command now gets the same Python first on its path as the terminal, on both platforms.

What to expect as a tester

On Windows, start on the Skills page: fetch https://github.com/anthropics/skills/tree/main/skills/xlsx From a URL… while Babbage's Python is not installed yet; a grey note says so, and installing the skill is not held up. Its row then reads "Needs Python · not installed" with Install: click it, the dialog names 52 MB and 155 MB, and the row ends on "Babbage's Python 3.13.15, ready". Then ask the agent to create a spreadsheet in a linked folder and set a cell in it: the step runs inside the sandbox and the file opens with the value in it. If the agent puts code straight on the command line or in a heredoc instead of in a script file, you get the usual approval card first on the automatic level; that is the guard for inline code, not the sandbox. A failed command inside the sandbox still shows the card; a command that merely tried something and recovered no longer does.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.25.4-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.25.4.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).

0.25.3

What is new in 0.25.3

Two things Babbage can now fetch for you, one on each platform, and a fix for a switch that got stuck. On Windows, Babbage offers to download Git for Windows when it is missing, so the terminal works on a PC that never had Git. On a Mac with Apple Silicon, Babbage can install its own Python, so the skills for Word, Excel, PowerPoint and PDF files work without you installing anything. Both are optional, both are removable, and neither touches your data. Underneath, the AI SDK moved to its newest v6 releases.

On Windows: Git for Windows, fetched by Babbage

The terminal on Windows runs in Git Bash, which comes with Git for Windows. Until now a PC without it simply had no terminal. From 0.25.3, Settings, Tools, Terminal shows what Babbage found, and when it found nothing it offers to download a portable copy of Git for Windows: 57 MB, about 387 MB on disk, into your user folder, without administrator rights, from the official release on GitHub, checked against a checksum that is fixed in this version of Babbage. The same offer appears as a card on the empty conversation page. The terminal works as soon as the download finishes, no restart needed, and Remove in the same place takes it away again. A Git for Windows you install yourself always goes first, and the offer says so.

An honest limit: the archive is signed, the unpacked programs are not. If Windows Exploit Protection, Smart App Control or a company policy refuses them, the row names that cause, and the fallback is what it always was: install Git for Windows yourself from git-scm.com and Babbage finds it.

On a Mac: Babbage's own Python

Many skills run small Python scripts, and so does the agent when you ask it to change a value in a spreadsheet: an .xlsx file is not text. On a Mac with Apple Silicon, Settings, Tools now has a section Python. One click downloads uv, Python 3.13 and five libraries (openpyxl, python-docx, python-pptx, pypdf and pillow): about 56 MB to download, about 168 MB on disk, inside Babbage's data folder, from their official sources, every piece checked against a checksum that is fixed in this version of Babbage. Only Babbage uses it. In Babbage's terminal and scripts, python and python3 are then this Python, even when your Mac has another one; for another one, use its full path.

Inside the sandbox the Python folder can be read and run, but not changed, so pip install into it is refused there and offers the usual Run outside the sandbox. An extra library can still go into the conversation's workspace with pip install --target <folder>, once you allow the two PyPI domains (pypi.org, then files.pythonhosted.org) when the sandbox asks, and the agent knows this. Nothing is ever updated behind your back: a newer Babbage may pin a newer Python, and the section then says the installed copy differs. Windows follows in a later release; on a PC the section does not appear yet.

Fixed: the sandbox switch on Windows

Since 0.25.0, switching the sandbox off and restarting Babbage left the switch grey, with the row claiming the sandbox helper was missing. The state is now read at every start, also with the sandbox off, so the switch stays usable and the row tells the truth: "Off" when it is off, "not installed" when the sandbox account was never set up, "missing" only when the helper really is missing.

Under the hood

The Vercel AI SDK moved to the newest releases on its v6 line. Nothing changes in how you use Babbage, and every assumption Babbage makes about the SDK was re-measured against the new versions. One known edge, listed for later: when a model ends its turn in a way the SDK no longer executes the tools for, a step can look as if it is still running until your next message.

What to expect as a tester

On Windows with Git already installed, you will see the Terminal row say where it found Git, and nothing more; only a PC without Git gets the offer. Switch the sandbox off, restart Babbage and switch it on again: it should just work. On a Mac, install Python from Settings, Tools, then ask the agent to create a spreadsheet and set a cell in it; the step should run inside the sandbox and the file should open with the value in it. If the agent puts the code straight on the command line (python3 -c) instead of in a script file, you get the usual approval card first on the automatic level; that is the guard for inline code, not the sandbox. Remove should leave nothing behind except uv, which makes the next install faster.

---

📦 Which file do I need?

• Mac (Apple Silicon): Babbage-0.25.3-arm64.dmg
• Windows (64-bit): Babbage-Setup-0.25.3.exe

📖 Guide and installation: https://robinvliet.github.io/babbage-releases

⚠️ macOS: "Babbage is damaged and can't be opened"?

That is to be expected - the app is (deliberately) not signed, so macOS blocks it the first time. It is not really damaged. Fix: open Terminal and paste

xattr -cr /Applications/Babbage.app

then start the app again. (Alternative: System Settings → Privacy & Security → "Open Anyway".) Once per version.

Windows

SmartScreen shows "Windows protected your PC" → More info → Run anyway (once per version).