Runrail 0.4.1

• Version bump to match Runrail Desktop 0.4.1. No engine changes.

Runrail 0.4.0

• Add Grok Build as a coding tool (--backend grok), run through its own Agent
  Client Protocol mode with the Grok sign-in already on the machine. Grok never
  asks before it edits files or runs commands, so a thread starts only with
  full access; any other permission mode is refused with a clear message.
• Keep a value entered for an MCP server's variable in the credential vault
  and hand it to that server when it starts, ahead of the same variable in the
  environment. The control server takes it through a write-only endpoint and
  reports only which names have a value; no method reads a value back.
• Read open GitHub issues through the person's own gh, and run a project's
  worktree setup and archive scripts (.runrail/worktree.json) only when the
  caller sends back the hash of the exact file the person approved.

Runrail 0.3.0

• Add runrail claude and runrail codex launch commands that preserve the
  installed vendor CLIs' arguments, terminal streams, working directory, and
  exit codes. Vendor authentication and execution policy stay caller-owned;
  Runrail-managed sessions remain available through the run backends.
• Add --harness-fast-mode on|off for managed Claude Code and Codex sessions;
  an explicit off selects the standard service tier even when Codex has a
  saved fast-mode preference.
• Keep structured Claude Code and Codex questions pending until complete
  answers arrive. Callers can stop the run instead of declining an unanswered
  form.
• Update the pinned public @nifrajs/* packages and the Nifra app starter to
  5.11.0; the packed-consumer check now tests that published package set.

Runrail 0.2.0

Recall by meaning, sign-in to remote MCP servers, connectors on more routes,
setup runs that resume, and fixes from a security and robustness audit. Runrail
0.1.1 and 0.1.2 were never released, so this release also brings their changes,
listed below.

• Built on the public Nifra 5.8.0 packages (was 5.3.0), and runrail new
  starters scaffold with create-nifra@5.8.0.
• Recall by meaning. Pick an embedding model on one of your connections and
  memories are embedded in the background with that connection's own key;
  recall then finds a memory that says the same thing in other words, joined
  with the keyword matches. How close counts as the same thing is measured for
  each model when you pick it. Every memory is searched: a one-bit-per-dimension
  code of each is scanned and only the closest thousand are compared in full,
  so at the 50,000-memory limit recall holds about 11 MB. Off until you pick a
  model, and it falls back to keywords when the model does not answer.
• Connectors on Pi and the ACP routes. Copilot, OpenCode, Gemini, and Goose
  start Runrail's connectors MCP server for each session, and Pi loads an
  extension that declares the connector tools with registerTool, so it works
  whatever MCP extension Pi has. Like Codex, these routes cannot ask before a
  tool runs, so they get only the tools whose grant needs no approval.
• Sign in to a remote MCP server in the browser. A server that answers 401
  now reports MCP_SIGN_IN_REQUIRED instead of a transport failure, and
  auth.mcp.start signs in the way the MCP authorization spec describes:
  Runrail registers itself with the server's authorization server, signs in
  with PKCE, and keeps the tokens, bound to that server, in the credential
  vault, renewing them before they run out. A token from bearerEnv that the
  server refuses now reports MCP_TOKEN_REJECTED.
• An MCP server whose authorization server does not let apps register
  themselves, such as GitHub's, signs in with an app you registered:
  auth.mcp.client.set names its app ID and callback port, and its secret goes
  only through POST /secret (mcpClientId) into the credential vault. Such
  a server with no app named reports AUTH_CLIENT_REQUIRED.
• Setup runs pick up where they stopped. An engine started with a setup-runs
  folder saves each run a person started as it goes, and Desktop asks the
  project's engine to take it back after a restart: done steps stay done, the
  step that was mid-turn is marked interrupted, and the next turn is told to
  check where things stand (setup.run.saved, setup.run.restore).
• A setup's budget can cap tokens (budget.maxTokens). Each answered turn
  reports its thread's input and output so far, and a run's status and each
  eval case show the total.
• runrail eval run runs a saved eval suite with no desktop, each case's
  turns in this process on the role's own route, model, and access, into the
  same results Desktop lists; runrail eval list shows them. Up to four evals
  now run at once in a project (was one).

Security

• File tools refuse paths that run programs on their own: .husky,
  .githooks, .codex, .mcp.json, .claude/settings*, .claude/hooks, and
  .vscode/tasks.json. They no longer follow a link swapped in after the check.
• Sign-in to a remote MCP server no longer follows the server to a private
  address, and a damaged OAuth file is set aside instead of overwritten. One
  shared private-address check now serves every fetch that needs it.
• Tool descriptions from an MCP server are capped in length.
• run_command rejects input fields it does not read and drops relative
  PATH entries. The approval card shows the folder the command runs in.
• A Codex tool call must name the turn that is running. The Claude Code route
  reads user settings only. install.sh requires https.

Fixes

• The Linear connector sends your personal API key the way Linear's API
  asks, with no Bearer prefix.
• An MCP server's failed HTTP request fails only itself, and a server that
  forgot your session starts a new one and the call is retried. Tool calls get
  their own 120-second timeout. A reply with audio or resource blocks is noted
  instead of failing, and a tool with a badly formed name is skipped instead of
  failing the whole server.
• runGit returns once git exits, even if a helper holds its pipes open, and
  git in a worktree has a timeout and ends its whole process group.
• search_files, find_files and list_files say when a result is partial
  (truncated, skippedFiles), and search now reaches 8,192 files.
• .env.example is readable, and a project under a .ssh folder is no longer
  refused.
• One plugin or package folder that fails verification no longer stops startup;
  it is listed as unavailable, and plugins reload still reports it.
• The share, push (VAPID), connector and checkpoint stores hold up under
  concurrent writes and damaged files. Device sign-in survives a network blip.
  Live frames, terminal output and transcript reads are faster.

Runrail 0.1.0

First public release.

• A local-first native task engine with workspace policy, approvals, budgets,
  verification and repair, sessions, checkpoints, forks, and handoffs.
• run checks each turn with a command you name, or an installed nifra check
  in a Nifra project; console, serve, and control check only when asked.
• In a Nifra project, Runrail's own loop gets the nifra mcp tools, and Pi gets
  Nifra's instructions and tools; other projects get neither. run and
  console say so, nifra.status reports it, and --no-nifra or
  RUNRAIL_NIFRA=off turns it all off.
• run and console save each session (--no-session to skip): --continue,
  --resume <id>, and --fork <id> pick one up on its saved backend and
  model; runrail sessions lists them and runrail export prints one as
  JSON or Markdown.
• runrail doctor checks Bun, git, the coding tools and their sign-ins, the
  key store, and the folders Runrail writes, with no network call.
• runrail new starts an app from a starter: Nifra (the default), Vite, Next.js,
  or an empty folder.
• One capability-routed boundary for native Runrail, Codex, Claude Code (the
  Agent SDK is fetched on first use, never shipped), Pi, ACP agents such as
  Copilot, and a PTY JSONL harness.
• First-party OpenAI, Anthropic, OpenAI-compatible, and xAI/Grok providers,
  with caller-owned slots for Google, Vertex AI, Bedrock, and llama.cpp.
• Bounded native tools, an MCP server, skills, integrity-checked plugins,
  workflows, and caller-owned GitHub, Linear, Jira, and Slack connectors.
• An authenticated loopback control RPC that the Runrail desktop app drives.
• Built on the public Nifra 5.3.0 packages. Licensed AGPL-3.0-only with a
  section 7 permission for Anthropic's Claude Agent SDK (see NOTICE).