2.7.1

Fixed

• Desktop 2.7.0 failed to start after updating. The packaged ASAR shipped
  the ChatGPT bridge but excluded the companion runtime modules it imports, so
  the main process stopped with ERR_MODULE_NOT_FOUND for
  desktop/chatgpt-companion/sign-in.mjs. The companion tree is now packaged in
  the ASAR as well as its existing real-file extraResources copy, and a
  packaging regression test walks the shipped import graph so an excluded
  module fails the suite instead of the app.

2.7.0

Added

• Community contribution: the codebase-tour skill by
  Pradyumna Parida (@Pradyumna-red).
  Merged from #69, it
  gives Ankita a careful, verification-first way to explain an unfamiliar
  repository: inspect the real top-level layout, find documentation and
  manifests with targeted globs, read only the files needed, then report
  entry points, build/run/test commands and component relationships with
  repository-relative paths while separating observed facts from inferences.
  It ships with its README, permission manifest and golden fixtures, stays
  inside an eight-step budget, and never modifies or runs the project.
• Projects that maintain themselves. A session started inside a registered
  project folder now attaches to that project without changing the global
  active project; explicit /project or a desktop assignment still wins, and
  nested folders resolve to the longest match. After a turn that changes files
  or tasks, Ankita appends one bounded work-log line and syncs up to five open
  todos, each tagged with its session so /project undo in the CLI and
  Undo in the desktop Overview remove exactly that session's automatic
  entries. Sessions with no project record nothing. PROJECT_INLINE_CONSOLIDATION=on
  opts into one small background extraction of notes and decisions, the desktop
  scheduler now consolidates prior-day journals, and project_memory is
  directly callable whenever a project is active.
• Managed ChatGPT browser. Settings offers both CoS-style modes: a built-in
  compact Electron window with saved sign-in and automatic internal connection,
  or the existing Chrome companion with automatic local discovery and token
  provisioning instead of a copied pairing link. A new chat is adopted only by
  its exact first receipt, each teammate remembers its own chat, app identity is
  proven by served native requests, and both modes share one Send, Stop and
  receipt contract. See
  docs/superpowers/plans/2026-10-23-managed-chatgpt-browser.md.
• Trust & safety batch (Ankita ideas #8). Undo for destructive actions via
  .ankita_backups + restore_file, size-aware delete/move previews,
  append-only scrubbed audit log (.ankita_backups/audit.jsonl, owner-only),
  and advisory skill permission manifests (allowed-tools, touches) parsed,
  validated and shown in the skill catalogue; tool approvals remain the
  enforcement boundary. move_file also keeps an undo copy of the source.
  Verified by test/tools/trust-safety.test.mjs (11 tests).
• Skill discovery in find_tools. find_tools(query="skills") now lists
  installed skill names and descriptions, bounded and honoring disabled skills
  and skills-off mode.
• Interactive desktop slash commands. A searchable command menu covers
  model, project, skill and navigation actions without starting work on a bare
  /, with draft preservation and keyboard/IME handling. See
  docs/findings/desktop-slash-commands.md.
• Sub-agents. delegate_task hands a self-contained brief to an explore,
  reviewer or worker child that runs its own tool loop and returns one
  capped result envelope. Read-only children overlap through the existing
  read-only batch; workers serialize per canonical workspace path. Children are
  isolated (no memory, browser, MCP, skills, scheduling or recursion), inherit
  the approval gate with attribution, inherit cancellation and budgets, and
  write scrubbed subagent-<id>.json transcripts. Delegation is discovered
  through find_tools and is absent from background jobs, the daemon and
  one-shot routines. See docs/subagents.md.
• Desktop UI polish. Connection state now uses one pill and dot language
  across chat, sidebar, jobs, browser, plugins and ChatGPT settings. Providers
  and ChatGPT setup keep one reading column with grouped actions, session
  controls and a single save bar. Settings share tokenized inputs, switches,
  focus rings and destructive confirmations. See
  docs/findings/2026-10-24-desktop-ui-polish.md.
• Grouped transcript activity. Consecutive tool calls and intermediate
  reasoning fold into one collapsible Ran N tools block with compact rows and
  inline input/result details; the final answer stays prominent. Each edited
  turn ends with an Edited N files card (+added -removed per file, Review
  opens Work review). Sub-agent, scheduled-task, sign-in and image cards keep
  their dedicated renderers. Verified by
  test/desktop/transcript-activity-ui.test.mjs.
• Live sub-agent side panel. Launching a child now opens a right-side panel,
  narrows the chat beside it, and streams the child's output, status, elapsed
  time, tokens and tool calls in place. Inline sub-agent cards are hidden while
  the panel owns the run and return when it closes. Multiple children share a
  switcher, the N agents working chip and each restored inline card reopen the
  remembered run, and closing gives the chat its width back without
  self-reopening. The panel shares one side slot with Work review, browser and
  job sheets, overlays below 1200px, and falls back to the stored receipt for
  historical children. Verified by test/desktop/subagent-panel-ui.test.mjs.
• Roomier jobs and child work. Scheduled jobs no longer take a card above
  the composer. One context-bar chip carries the live summary (1 job · All paused, Running, Needs attention, or the next run), marks blocked or
  running work with a dot, and opens the Scheduled tasks panel for detail and
  actions. Repeated child tools fold into one expandable row with a call count,
  source URLs lose their scheme for scanning, and sub-agent output reads in the
  UI font at a comfortable measure. Verified by
  test/desktop/jobs-entry-ui.test.mjs and the updated subagent-state /
  subagent-panel-ui suites.

Fixed

• The edited-files card waits for the turn to finish. It used to render as
  soon as a write landed and jump between the tool rows and the streaming
  answer; it now appears once at turn end with the final list and line counts.
• Chat header and composer are quieter. The green Ready / Working pill
  and the mascot's ↗ browser-helper badge are removed. Helper setup now lives
  in the conversation menu (Conversation options → Browser helper) and the
  island Settings view. The composer keeps its rounded focus border without the
  extra square focus rectangle around the text box.
• Failures no longer expose IPC or port strings. Engine errors are humanized
  into compact notices (icon, title, two lines) with the hint and original
  message behind an on-demand Details popover instead of a card that stretches
  over the chat. Plugins, Skills, Settings and the floating island reuse the
  same cleaner instead of duplicating the regex.
• A busy capture bridge no longer rejects engine:invoke. If another Ankita
  owns the remembered companion port, setup returns an actionable unavailable
  state and background capture requests return inert values; passive mascot
  hover/focus stays silent and tooltips never show capture text. Interrupted
  npm run desktop:dev sessions now terminate the whole Electron tree, so a
  stale host cannot keep owning the port and scheduler.
• Backups no longer share filename prefixes. Each original path has its own
  backup directory, so foo can never list, restore or prune foo.txt backups
  and pruning one path leaves its siblings untouched.
• Connected Computer Use no longer crashes the prompt. The missing
  COMPUTER_DIRECT_CONFIG import is restored; connecting the native desktop
  server builds the system prompt instead of throwing. See
  docs/findings/computer-direct-config.md.

Thanks

A huge thank you to Pradyumna Parida
(@Pradyumna-red), who contributed the
codebase-tour skill in
#69. The contribution
was done the right way: a clear README, a permission manifest, golden fixtures,
bounded tool use, node scripts/check-skills.mjs clean (7 skills, 0 errors) and
the targeted skill suite green (19/19). That care makes onboarding to any new
repository materially easier for everyone. Welcome aboard, and thank you for
showing up and building with us — this release is better because of you.

2.6.0

Added

• ChatGPT Browser provider. Send messages and attachments from ANKITA to
  your selected, already-open Chrome conversation and read its correlated
  public replies back into ANKITA. The current model stays selected; ordinary
  chat needs no API chat key or running Chat On Steroids application. Your
  ChatGPT account's availability and limits still apply.
• Native ChatGPT tools. Separate Core, Desktop and Plugins MCP connections
  expose ANKITA's workspace tools, task browsers, connected computer controls
  and enabled external plugins through dedicated OpenAI tunnels. Secure device
  storage protects saved pairing and tunnel keys. Windows packages include the
  companion, pinned publisher helpers and license notices.
• Windows Computer Use. Connect the existing Cua driver from Plugins, see
  the animated pointer during actions, toggle its visibility and stop owned
  control. Desktop computer actions use the existing direct-action policy.
  Styled controls show connection and driver state clearly.
• Skill authoring and checks. Offline golden fixtures, an executable author
  handbook, interactive/offline scaffolding and complete contribution CI help
  authors build skills. Custom installation roots are discovered across chat
  and desktop, including simultaneous root registrations.
• Useful work templates. Searchable terminal/desktop cheat sheets, measured
  skill/MCP startup timings, schedule templates and protected operator runbooks
  make repeated tasks easier to start and understand.

Fixed

• Native calls in one ChatGPT reply no longer conflict merely because the
  provider reused a generation root or RPC number. Exact retries return their
  durable result; accepted work retains its real outcome after HTTP disconnect.
• Stop fences further actions, terminates owned commands/helpers and releases
  the pointer while keeping Chrome and user apps open. Encrypted restart and
  explicit Resume read the original reply without replaying its question.
• Repeating Observe keeps the selected chat's original custody. Selection
  changes and Send admission serialize; unresolved replies or unconfirmed Stop
  cannot be stranded by changing chats. Recovery updates while the app is open.
• Always allow applies to later native browser actions for that teammate.
  Clear removes cached local messages/checklists while retaining action receipts.
• Native discovery matches the tools callable on each connection. Core cannot
  mutate global connection settings; active groups cannot reuse a tunnel ID.
  Missing or over-quota images report unavailable visual state explicitly.
• The owned pointer retains its layer across native popup menus. Strict driver
  discovery and named pointer sessions initialize correctly without silently
  reviving a stopped existing session.

Setup and limits

• The final serial suite passed 1,344 tests, zero failures, one existing skip.
  The rebuilt 2.6.0 app passed its packaged lifecycle check and actual ChatGPT
  file/edit/read/command/wait flow with zero approval cards or errors.
  Hosted computer vision/action, owned Stop, upload and restart/Resume proofs
  are recorded separately in the verification guide.

• Follow the ChatGPT Browser guide. Connected
  ANKITA tunnel cards and installed/enabled ChatGPT MCP apps are separate setup
  steps. Each active group needs a dedicated tunnel.

• One browser conversation/teammate/workspace is supported at a time. Unknown
  page layouts and missing exact native ownership can remain unconfirmed.
  Additional helper platforms and independent publisher scanning remain
  unverified. See the verification record
  for exact hosted, fixture, packaging and suite evidence.

Ankita 2.5.2 — Desktop startup hotfix

Fixed

• Blank desktop startup in development and packaged builds. Shared browser
  progress metadata imported a host-only DOM probe that compiles a function at
  module initialization. The renderer's Content Security Policy correctly
  refused it before React mounted. The form-field limit now lives in the pure
  operation-policy module, and the ref module re-exports it for compatibility.
  Browser batching is preserved; the security policy still refuses unsafe-eval.

Verification and limits

• New startup regressions exercise both complete renderer entry points with
  their shipped HTML and CSP, rather than an isolated component without CSP.
  The focused startup/progress/browser recovery suite passes 33/33, including
  real Playwright and connected-Chrome form batches and stale-ref recovery.
• The full serial local suite reports 1,121 passed, zero failures, one existing
  POSIX permission skip on Windows. TypeScript/Vite builds pass. Hidden native
  Electron checks mount both complete entries through the shipped preload and
  real IPC in dev and built-file mode, with offline engine fixtures, disposable
  profiles, zero renderer exceptions and the security policy unchanged.
• The packaged ASAR also mounts both entries in native Electron with the actual
  packaged preload and offline engine fixture. All 23 audited runtime/guide files
  match source bytes; the executable reports 2.5.2 and includes the native browser
  bridge and capture helper.
• This hotfix does not address the connected-Chrome Windows CI navigation/cart
  failures recorded for 2.5.1. Publication uses the locally checked Windows
  package; no exact-commit remote CI pass is claimed, and the normal workflow's
  required tests remain unchanged. See the
  desktop startup findings for the full
  before/after traces, packaging checks and remaining verification limits.

2.5.1

Added

• Automatic browser instructions. Interactive desktop and CLI chats load the
  complete browser-use guide when browser tools are discovered or already
  available, including short continuations. The desktop header shows
  Instructions loaded: browser-use when the whole body is included in a prepared
  request. Disabled or omitted guides do not produce that status; no extra router,
  skill-tool call or memory handoff is required.
• Readable page evidence. Browser reads return Markdown headings, paragraphs,
  links, lists and tables. Literal find locates text beyond the first chunk;
  bounded reads continue with source identity. Optional hidden DOM evidence is
  labelled separately from actionable controls. Scripts, styles and private field
  values stay out of page text.
• Clearer live browser progress. Thinking, reading, acting, checking, recovery,
  manual help and Stop have separate states and completed-operation counts.
  Native dialogs can be accepted or dismissed during takeover; transient dialog
  and prompt text stays out of shared thumbnails and progress broadcasts.
• Experimental browser runtime. BROWSER_RUNTIME_V2=on exposes structured
  executed/partial/failed/uncertain receipts, capability metadata and guarded
  Playwright sequences. Isolated Chromium supports explicitly selected uploads
  and bounded workspace downloads with completion evidence and cancellation.
  Unsupported connected-Chrome transfers are refused rather than guessed.
• Optional context controls. Browser tool focus keeps the same agent, chat,
  memory and approvals while refusing unrelated discovery until an explicit
  general-scope switch. Request-only history compaction, grounded evidence
  retention and unchanged-page diagnostics have independent opt-in switches.
  Request/schema/history byte metrics support controlled lab comparisons.
• CLI command discovery. /commands provides a grouped cheatsheet. Help,
  subcommand completion and typo suggestions share one registry; startup reports
  the app version and provider. Composio tier-management subcommands now complete
  and validate consistently.
• Browser regression and verification utilities. Real Playwright and bundled
  Chrome fixtures cover forms, original flight direction/date, ref replacement,
  overlays, Markdown reads, dialogs, transfers, Stop and actual desktop guide
  delivery. Release CI provisions the locked Chromium runtime before native tests.

Fixed

• Mixed batches invalidating their own refs. Independent same-tab fills,
  clicks and native selects now check all live targets before the first edit and
  each later step before dispatch. Original node/UID bindings remain valid through
  intermediate steps; the final snapshot supplies new refs. Disabled or replaced
  targets stop safely, completed edits are retained, and a failed batch is never
  automatically replayed. Malformed form fields retain ordinary argument errors.
• Same-named controls and cloned DOM ref attributes cannot inherit an old
  Playwright node identity. Stale refs return observed recovery controls;
  first-field failures before dispatch remain recoverable zero-write failures.
• Native select refuses custom menus with guidance to click their observed
  options. The guide distinguishes committed autocomplete choices from typed
  text, real tab IDs from ref segments, and independent batches from dynamic
  picker transitions; oversized forms must be split at the advertised limit.
• Recent user goals and corrections survive long tool loops within bounded
  history limits. Flight guidance verifies origin, destination, trip type and
  exact date before Search and on results, keeps results open when requested,
  and distinguishes readable fares from an unpriced results shell or a booking.
• Printed tool-call JSON or browser-form markup gets one bounded native-protocol
  correction. The printed payload is never executed; repeated proposals end as
  unfinished work. Partial batch failures remain failures through verification
  and request projection, without turning page prose into execution errors.
• Provider errors now distinguish rate limits, quota, authentication, paid-model
  access, client-only routes, unavailable upstreams and unsupported image input.
  Keyless Kilo model discovery filters out routes requiring paid/account access;
  model vision capability comes from advertised metadata.
• Connected Chrome scrolling uses observed native targets, and navigation/history
  actions return current controls. Native dialogs do not trigger automatic replay
  of the action that opened them. Timeouts after dispatch remain uncertain.
• Native Chrome opens create a bootstrap tab, identify its native page ID and then
  navigate to the requested site once. This separates startup from site loading;
  ambiguous tab identity, Stop and refused navigation never replay the operation.
  It adds one native browser call without adding a model round.
• Compact browser schema wording retains the tool under the default context
  budget with longer workspace paths. Windows short-name paths retain authorized
  upload/download identity; actual ancestor junctions and changed files still refuse.
• Hidden/minimized desktop windows throttle browser preview capture; parallel
  preview requests share pending work and preserve the last useful frame. Browser
  panels and background scopes retain their own state and cancellation boundaries.
• Source desktop development uses a separate Electron profile to avoid installed
  app cache/single-instance conflicts. Shutdown drains work and releases the
  protected companion window. Failed Windows command termination stays visible
  on its live job rather than causing an unhandled rejection or false completion.

Changed

• The default tool-round ceiling is now 100, configurable through MAX_TOOL_STEPS;
  the separate call ceiling and repeat/Stop guards remain enforced. Browser form
  and sequence primitives count against the call budget.
• Scheduled-browser permission classification shares operation metadata with the
  foreground runtime. Test/provider configuration can use a read-only global
  source while keeping disposable runtime storage separate from user data.
• README, browser/skill instructions, release setup and investigation ledgers now
  document current behavior, measured token costs, failed experiments and remaining
  limitations. Generated logs, media, dumps and local assistant settings are not
  release source.

Verification and limits

• Local full suite: 1,119 passed, zero failures, one existing POSIX permission
  skip on Windows; browser/desktop batch focus: 37/37; release hardening:
  54/54; Chrome startup focus: 46/46, boundaries: 23/23;
  browser lab: 183/183.
  Real native forms independently record one correct submission per backend and
  receipt-mode variant; blocked/replaced controls produce no extra submission.
• Desktop TypeScript/Vite builds pass, and the shipped ChatPane renders an actual
  engine skill event with zero page errors. Two additional release-contract tests
  enforce matching version/changelog metadata and browser setup before CI tests.
• The unpacked Windows package reports version 2.5.1. Its full browser guide and
  22 runtime modules match the source byte for byte; the renderer skill receipt,
  unpacked native Chrome bridge and capture helper are present.
• Experimental runtime/focus/history/evidence/progress flags remain off by
  default. Connected Chrome still has its documented frame/transfer limits;
  hidden text is evidence, not permission or proof of interaction availability.
• No universal browser speedup, arbitrary-model success rate, completed flight
  purchase or customer-form submission is claimed. Earlier free-model attempts
  hit provider 429; full parity/timing and native headful checks remain documented
  in browser findings.
• Known release issue: the final Windows CI run recorded 1,106 passed,
  three failed, 11 skipped. Two connected-Chrome fixtures abort their first
  navigation while the new tab stays blank; a cart fixture records no edit.
  Local native suites pass, but staged opening has not resolved the runner issue.
  This version is published manually at the user's request to stop further tests;
  the failing assertions and normal CI test gate remain intact.

2.5.0

Added

• A live desktop companion. The top-edge island uses ANKITA's real threads,
  tools and approvals. Four teammate mascots fit in two columns; activity rolls
  upward without a history scrollbar, and additional teammates remain selectable
  in chat. Restoring/minimizing retains the same draft and companion window.
• Animated file capture. The selected mascot opens its mouth for supported
  dropped files, swallows, chews while the reader works, and reacts to success or
  failure. Desktop and island use the existing document/image readers and keep
  attachments with their original teammate. Reduced motion skips the swallow.
• Chrome/Edge webpage-capture helper. An MV3 extension captures readable page
  text when a teammate mascot is dropped onto an ordinary HTTP/HTTPS page.
  Pairing uses the desktop's authenticated loopback bridge and single-use drag
  tickets. Captures preserve existing drafts, wait in an inbox when attachment
  slots are full, and never send a model request automatically. The helper is
  included in the package and loaded unpacked separately; it is not store-published.
• Project sections. Overview, Tasks and Context organize folders, assignments,
  rules, open/completed tasks and searchable note/decision records. Long records
  expand on demand; keyboard tab navigation and per-project draft retention make
  larger projects usable without one long page.
• Release verification utilities. Real renderer, capture-extension and native
  Electron checks cover tool/approval flows, attachments, projects, settings,
  responsive widths, themes and failure recovery. Coucou-derived software carries
  an included MIT notice; its artwork and recordings are not bundled.
• Keyless Composio sign-in — no API key, nothing to host. Connecting an app
  now runs a browser OAuth 2.1 + PKCE flow: discovery, dynamic client
  registration as a public client (no secret issued), a single-use
  http://127.0.0.1:<port>/callback loopback redirect, and a PKCE S256 code
  exchange. There is no public callback URL, domain, certificate or broker to
  stand up. The access token is written to the OS vault; the grant file holds
  only a grantId, endpoint, apps and timestamps — never the token, verifier or
  refresh token. Revoking deletes both in one step. COMPOSIO_API_KEY and
  COMPOSIO_BROKER_URL keep working until the deprecation window closes.
• MCP approval tiers replace the trusted-server bypass. Tool calls now
  resolve a four-level gate — auto-allow, ask once, always ask, deny — instead of
  the old read-only-hint rule, and a connection's trusted flag no longer skips
  it. Composio meta-tools are classified by the worst action they enclose, so
  COMPOSIO_MULTI_EXECUTE_TOOL wrapping GMAIL_SEND_EMAIL always asks while
  read-only catalog discovery stays frictionless. Resolution order is blocklist →
  explicit tool rule → per-app rule → locked app defaults → heuristic (a
  heuristic can never deny). Overrides, a blocklist and allowed/asked/denied
  counters persist to mcp-tiers.json, and gmail ships locked to always ask.
• composio tier controls. New tiers, allow, always and deny actions
  inspect and change the gate. They are refusal-guarded: a call that loosens
  protection can never run under auto-approve, so an unattended scheduled job
  cannot quietly grant itself a lower tier for every later session.
• Real integration icons in Plugins. Every Composio app row renders the
  toolkit's real brand mark from its logo URL, with the curated mark or a
  monogram as the offline/unknown fallback.
• Deprecation notice on composio status naming the exact variable to
  replace, derived from the version in package.json rather than hardcoded, and
  worded so it never promises a switch the build does not offer yet.

Changed

• The main desktop now shares the companion's graphite style, mascot faces and
  system typography. A compact navigation rail, responsive teammate roster,
  separate project/scheduling/review strip and clearer composer replace the old
  shell. Graphite, Mono and Slate themes remain available.
• Scheduled-task empty/detail views prioritize the next run, owner and readable
  task names. Background preferences show actual scheduled/enabled/running counts,
  open each task in its owner/delivery conversation, and expose startup capability
  and pause-all state. Model choice and optional limits use separate controls.
• Completed Markdown replies are memoized instead of reparsed for every streaming
  token. Hidden mascots and idle activity tickers pause animation work.
• README, contributor setup, configuration comments and release instructions now
  describe the current desktop, capture helper, real dependencies and CI gates.
• Generated launch-film HTML is removed from tracking, with the local copy kept.
  Local verification logs, video project output, crash dumps and media are ignored.
• Plugins Saved sign-ins is now a first-class browser-vault section instead of
  a stray disclosure: a section head with a live count and a framed card that
  states it is what the built-in browser and Chromium fill from. Each row shows
  the site, username, when it was last saved and a Remove action, with loading,
  empty and error states.
• Scheduled-task surfaces are grouped by state (needs attention, running,
  upcoming, paused) with a summary line, count badge and stat tiles. Run receipts
  read as plain status labels with relative times, and the scheduler no longer
  uses the success color — state is carried by theme tokens and motion that
  honours prefers-reduced-motion.

Fixed

• Long teammate names and scheduled jobs no longer distort the island avatar
  grid; the activity footer and approval actions remain visible in narrow windows.
• A closed browser overlay no longer extends the document beyond the viewport.
• Hard rectangular focus outlines around the composer, context editor, settings,
  plugins and island controls are removed; focused fields retain subdued borders.
• Failed project-context saves keep the text; failed startup changes keep the
  confirmed value. Missing-owner tasks route to their delivery conversation,
  while tasks with no usable destination remain disabled.
• Capture pairing persists across browser/service-worker restarts. Remembered-port
  conflicts fail visibly, and replayed, expired or cancelled tickets are rejected.
• A scheduled task and its run result could appear in another teammate's
  conversation. The jobs panel and routine sheet are now scoped to the selected
  thread, matching the chat pane.
• The OAuth flow sends the RFC 8707 resource indicator on both the authorization
  and token requests, which the MCP authorization spec requires and servers use to
  bind the token audience. The endpoint allowlist also accepts the sibling
  login.composio.dev host the live Composio metadata points at.

Release verification

• Windows release workflow: 931 tests; 899 passed, 32 skipped, 0 failed. CI skips optional Chromium/Python/MCP/Scrapling availability checks and the POSIX permission check.
• Local Windows serial suite: 931 tests; 930 passed, 1 POSIX skip, 0 failed. Desktop TypeScript and production renderer build passed.
• Windows unpacked runtime: nine grouped native checks passed, including actual file tools and approvals, capture pairing/delivery, packaged helper resources, projects and settings.
• Focus regression: all three themes passed with no rectangular outlines or brightened focus borders.
• Installer, portable executable, blockmap and latest.yml were downloaded; all sizes and SHA256 hashes match GitHub. The updater manifest version, installer name, size and SHA512 match the downloaded installer.

Successful release workflow

Installation/in-app update execution, physical OS browser dragging, installed Google Chrome, OS login registration, hosted-provider workloads, mixed-DPI displays and macOS/Linux native windows remain outside this verification.

2.4.4

Added

• Scheduled desktop results now come from the owning teammate's model as normal
  chat replies. The scheduled worker's text and browser screenshot remain
  expandable evidence beneath the reply. The writing pass has no tools, waits
  for an active chat turn and retries delivery without rerunning the job.
• Desktop scheduled browser jobs: timezone-aware cron, independent serial workers
  and Chromium profiles, editable settings, a compact jobs pill, live viewing
  and proof receipts in the owning teammate's chat. The model's schedule tool
  creates active tasks from chat, updates the same task and returns compact
  widgets with the next run; a thin upcoming list replaces the creation form.
• Idle heartbeat tasks use owner/project context and proactive briefing
  instructions, skip busy teammates and suppress uneventful replies. Chat-created
  tasks browse autonomously in isolated Chromium; existing scoped tasks retain
  their approvals. Creation retries are idempotent and lifecycle guards resolve
  model-supplied task names before checking active workers. Names are scoped to
  the owning teammate; ambiguous matches are rejected. A shared typed update
  schema and flat-argument normalization prevent silent empty updates, and
  conflicting values return an actionable error.
• Scheduled workers advertise isolated Chromium only and separate execution
  instructions from job-creation guidance. Saved username/password steps use
  private credential refs; an omitted login URL binds the actual selected tab.
  Generic unattended password fill/type is rejected, including shown passwords.
• Browser form batches preflight every target before writing. Invalid buttons,
  readonly controls and stale refs return fresh refs without partial writes;
  failures after filling starts remain incomplete and are never replayed.
  Chrome retains custom toggle support and reports dialog-interrupted batches
  as incomplete. Concurrent Chromium cleanup shares one owned-context close.
• Printed pretend tool calls trigger one bounded model correction in a job;
  repeated malformed requests and exhausted tool loops produce incomplete
  receipts instead of successful jobs. Printed JSON is never executed directly.
• Secret scrubbing at session, journal, memory, routine, job-log, tool-log,
  diagnostic and export boundaries; deterministic shaped/context/encoded
  detection with a 50-sample regression corpus. Explicit save intent encrypts
  named secrets with the OS vault and persists references. Detected desktop
  pastes remain protected in later unlabeled echoes; short prefixed password
  labels are supported. Privacy settings include an explicit disable warning.
• Idempotent first-launch migration covers transcript/export folders, job state,
  teammate previews and legacy daemon logs while excluding provider/vault
  configuration. Text diagnostics rotate within a bounded disk budget.
• Ctrl/Cmd+K command palette searches app commands, enabled skills/manifest
  actions and scheduled jobs, with keyboard navigation, focus restoration,
  live registry refresh and protection against launching stale search results.
• Real Chromium login verification covers username-first flow, password iframe,
  CSRF, control replacement, expired sessions and MFA handoff in the actual
  development and packaged Windows app. Live model scheduling is checked
  separately from scripted provider/browser verification.
• Routine-scoped inline approvals, optional bounded execution and approval deadlines,
  opt-in daily run/token/minute budgets, saved-only sign-in, late/missed-run reporting,
  delivery-only retry and retained redacted run audits. Background jobs use
  isolated Chromium only; Chrome remains a foreground backend. No mobile wiring.
• Desktop tray hosting with Show, Pause all and Quit, a first-close notice,
  opt-in startup at sign-in, and a shared scheduler ownership lock that prevents
  desktop/CLI double firing and supports cooperative CLI takeover.
• Actual development and packaged Windows job verifiers exercise browser
  submissions, inline approvals, concurrent chat, live viewing, tray completion,
  reload/idempotent delivery and recovery shutdown. A separate verifier can run
  the same browser task through the currently configured provider.
• Secure browser sign-in for desktop Playwright: a compact Secure store chat
  card opens the native Secure credentials store dialog. Website is locked;
  username/password fields, show/hide, optional saving, Escape/Cancel and a focus
  trap follow the existing appearance. Saved sign-ins can be removed in Plugins.
• A main-process vault uses asynchronous Electron OS encryption, exact website
  origins and atomic owner-only files. Only account metadata leaves the vault;
  plaintext is cleared after filling. Unavailable encryption and Linux
  basic_text refuse persistence. CLI, channels and Chrome cannot use the vault.
• browser login can request the secure dialog before any form appears. The
  model selects observed refs through credential_fields (private username/
  password slots) and optional submit_ref, including username-first steps and
  input-based submit controls. Each call returns a fresh snapshot to the model
  to finish sign-in and continue the original task. One-time credentials are
  scoped to thread/origin/tab/page and cleared on password use, Stop, turn end
  or expiry. Password values stay hidden even when a site toggles input type;
  exact-origin, bound-node and native GET submission guards remain enforced.
• Telegram desktop and CLI channels show a typing heartbeat and throttled tool
  progress, acknowledge messages with supported received/completed/failed
  reactions, and send up to five current-turn image artifacts after the final
  text reply. Reads enforce workspace/folder/type/15 MiB limits; photo failures
  fall back to documents. /cancel bypasses approval and task queues. Incoming
  photos/documents/videos receive a not-supported nudge; voice notes still work.
• A disposable packaged verifier reproduces the old Chrome launch failure and
  checks bundled CDP, real OS encryption, cold/warm login, theme/focus/eye controls,
  cancellation, retries, takeover and password-free model/events/persistence.

Fixed

• Resolved the README merge blocks while retaining desktop setup, security and
  CLI sign-in guidance. Skill tests now discover the installed catalog instead
  of assuming two skills. Windows launcher crash cleanup checks only its root
  PID before applying the creation-identity guard, avoiding a full process-table
  scan. Command tests now follow a cold shell past the initial yield and wait
  for final output and exit status before asserting that a later background job
  is the only active one.
• Scheduled browser tasks no longer stop on accumulated input-token totals, the
  old three-minute deadline, fixed tool counts or the foreground search ceiling. Regular desktop jobs run until
  completion; usage remains recorded, Stop and no-progress detection remain
  active, and explicit limits are optional. Heartbeats keep bounded defaults.
• Watching another job tab changes only the preview, preserving the worker's
  selected page and snapshot refs. App navigation and foreground browsing remain
  independent. Saved completion URLs and screenshots follow the worker's page.
  Task details/editor now show the full execution prompt; model
  guidance requests clear objectives, steps, evidence and output. Fresh workers
  receive the last successful result for comparisons across failed runs/reloads.
• A malformed model-selected credential field now returns fresh controls and
  correction guidance before vault access or filling. Scheduled workers can
  correct the native call and continue; origin checks and uncertain actions
  remain enforced. Packaged tests exercise the rejection and correction twice.
• Job navigation intercepts redirects before network dispatch, including POST,
  popups and embedded frames; Fetch/XHR requests also pass the runtime permission
  gate. Approval waits no longer inherit foreground browser command timeouts.
• Foreground chat cancellation preserves job approvals and shared Chrome
  connections. Budget checks stop a worker before its next browser side effect;
  yearly cron searches no longer block the main process for seconds.
• Pause/Resume keeps the routine form's Enabled checkbox synchronized, so a
  later Save cannot silently reverse the action. Job control errors stay in the
  sheet, and watching a job no longer adds a duplicate foreground browser card.
• Stale truncated ownership locks recover, heartbeats replace atomically,
  copied proof receipts obey the per-routine retention cap, and recovery relaunch
  drains the scheduler before quitting and releases its ownership.
• Secure login no longer depends on detecting a unique form or a button-name
  whitelist. Cirro's honeypot and input-based Sign In no longer block the
  secure dialog. Model-selected controls are validated before filling, and
  selection failures return to the model without an automatic credential loop.
• Playwright waits for a blank SPA to render before returning its first snapshot.
  HTTP refusals and pages that stay empty are load failures, with Needs attention
  and a concise message instead of a white Ready preview. A later real render
  can recover; snapshots cannot conceal a refused request.
• Desktop tool discovery, prompts and schemas exclude external Playwright/Chrome
  MCP browser tools. Old browser MCP calls are blocked at execution and activate
  the built-in browser, preserving enabled backend choices, refs, secure login and
  live preview. Blocked external calls cannot replace the live stage state.
• Packaged Chrome connections launch the pinned, shipped chrome-devtools-mcp
  bridge from app.asar.unpacked with the packaged executable in Node mode.
  No system Node, npm/npx, runtime download or pre-existing npm cache is needed.
  This fix...

2.4.3

Browser automation, a live browser stage that follows the app appearance,
reliable cancellation and reconnection, filesystem security fixes, and faster
command/file/Markdown processing. Detailed changes and verification follow.

Added

• A packaged desktop verifier exercises the actual executable and shipped
  modules with disposable settings, a local HTTP/SSE model fixture, appearance
  switching, browser submission, screenshot pixels, takeover, Stop, command
  stdin/EOF and the Chromium installer dry run. It downloads no dependencies.
• browser fill_form fills up to ten fields from one snapshot after checking
  their refs. A disposable browser verification script covers both backends,
  screenshots, Stop, reconnect, automatic selection, and preview refresh rate
  without downloading packages or using a personal browser profile.
• Browser tools. Ankita can open real pages, read text and snapshots, act on
  fresh element references, manage tabs, take screenshots, and run batches of up
  to ten steps. Browser tools load on demand through find_tools.
• Two browser plugins. Playwright Browser uses a separate Chromium profile;
  Chrome local connects through the pinned Chrome DevTools MCP server. Desktop
  setup supports Private Chrome, Debug port, and My session, with Chromium
  download progress, a background option, and a debug-port connection test.
  Both plugins start disabled and save their settings across restarts.
• Live browser beside chat. The stage shows tabs, URL, status, and the current
  page, with Stop and Take control. Playwright takeover supports clicking,
  typing, pasting, and scrolling through the preview. Chrome takeover happens
  in Chrome. Hand back or Esc resumes Playwright control;
  Ctrl/Cmd+Shift+B toggles the stage.
• Browser site controls. Each plugin has allowed and blocked domain lists.
  Browser navigation accepts HTTP/HTTPS; private hosts are blocked by default.
  The isolated browser also checks page-initiated navigation and resource hosts.
  Browser actions require approval, and tool-card previews redact entered text.
• Browser setup and verification documentation, including the
  browser guide, implementation plan, real Chrome
  and Playwright benchmark script, desktop UI verification script, and
  security audit record.

Changed

• Windows command creation, shell discovery and process-tree work run in a
  worker so slow native startup can no longer block the owner's event loop.
  PowerShell selection is preserved. Stdin/output use native acknowledgements
  and backpressure; input waits for launch readiness before its write deadline.
• Browser plugin cards now match the existing integration cards in a compact
  By Ankita team section. Settings open in a details dialog. Plugin cards,
  dialogs, and the browser stage follow the app's global appearance colors.
• The browser stage uses the app's restrained tab, address-bar, and footer
  styling. Opening it collapses the left sidebar and closes workspace review
  to give chat and the page more room.
• Visible browser previews target ten updates per second with one capture in
  flight. Chrome returns JPEG data directly through MCP, avoiding temporary
  screenshot files. Live frames update independently of chat; tab metadata and
  chat thumbnails refresh every two seconds. Hidden/lost-connection states poll less
  frequently. Actual refresh rate depends on screenshot latency.
• File inspection reuses a resident worker instead of starting one for every
  call. A local 30-call README sample measured a 3.37 ms warm median and
  5.64 ms p95 after 174 ms initial startup.
• Terminal Markdown redraws coalesce on a fixed 20 ms deadline. Syntax keyword
  and type Sets are reused, skill catalogs load once per turn, tool schemas are
  shared within each model round, and tool-call signatures are computed once.
  History trimming measures message/group costs incrementally and caches image
  costs instead of repeatedly measuring the entire conversation.
• Added the Playwright runtime dependency, pinned the Chrome MCP launch
  version, and raised the desktop IPC contract to 5 for browser events and
  recovered-message replacement.

Fixed

• Windows command cleanup keeps the launcher referenced until every pending
  Stop acknowledgement settles. Native pipe closure can arrive first on fast
  machines; it no longer leaves cleanup promises unresolved or cancels the
  remaining command tests on the clean release runner.
• Recoverable browser errors no longer mark a healthy session disconnected or
  dump fresh snapshots, page code and raw call logs into the live sidebar.
  Page/action notices preserve preview refresh and Take control; only connection
  and startup failures prompt setup. Completed actions keep the last frame.
• An unexpected Windows launcher worker exit cleans up its identity-checked
  native process tree before reporting failure; changed or missing process
  identities are refused instead of killing an unrelated PID.
• Chrome typing no longer sends an unsupported snapshot argument. Keyboard
  presses focus the supplied element ref without clicking it, and refuse to
  send a key when that control cannot receive focus.
• Browser auto mode uses enabled-backend selection. Tool guidance requires
  exact opaque refs rather than invented selectors or labels. Invalid refs
  return a fresh snapshot without replaying the mutation; successful open and
  action results provide the next refs, avoiding redundant snapshot calls.
• Playwright snapshots include visible controls beyond hidden input lists,
  accessible labels and states, custom roles, open shadow roots, and child
  frames. Label queries reach controls beyond snapshot limits. Password values
  remain hidden. Re-rendered refs follow only a unique control in the original
  frame; ambiguous replacements fail safely. Form filling supports selects and
  checkboxes as well as text fields.
• Chrome binds refs to their tab, excludes static text from actionable refs,
  and uses snapshots included in native action and form-fill responses to
  reduce MCP round trips.
• Successful browser interactions reset prior browser-read repetition counts,
  allowing multi-step workflows to continue. Snapshot-only loops and existing
  tool/round limits still stop. Schema budgeting reserves the actual system
  prompt and user attachments so tool discovery does not crowd out the task.
• Browser screenshot receipts attach validated PNG pixels to the next model
  request through the existing user-image format, retaining text tool messages
  and original input attachments. Workspace, file, byte, signature, and image
  count limits apply. MCP shutdown now observes asynchronous process teardown
  failures rather than leaving an unhandled rejection; the older Chrome
  verification script handles the adapter's structured screenshot receipt.
• Disabling Chrome prevents further selection and routes the next page open to
  enabled Playwright. New sessions prefer Playwright when both plugins are
  enabled; an existing session keeps its enabled backend. Old tab IDs and
  element references cannot silently execute against a replacement browser.
• Chrome connects when a browser request needs it and makes one recovery attempt
  after losing its connection. Approval is remembered for the exact server
  command. Read recovery gets fresh references; clicks and form submissions
  are never automatically replayed.
• Composer Stop cancels active and queued browser calls, including calls paused
  for takeover or setup approval. Closing the stage stops the run and disconnects
  Chrome. Browser/MCP deadlines and transport-close rejection prevent lost
  connections from waiting indefinitely; cancelled turns avoid spurious errors.
• Preview captures share pending work, recover their ready state after an error,
  and avoid retaining stale error frames. Browser sessions close during app
  shutdown.
• Interrupted model streams retry the current model step up to twice, preserve
  completed tool results, discard incomplete tool requests, and replace
  unfinished text when recovered wording differs. Stop cancels recovery.
• Desktop replies use consistent Markdown guidance across models. The message
  view repairs common plain-text headings, bullet glyphs, tabular rows, and
  whole-answer Markdown fences while preserving code blocks and existing markup.
• Deferred MCP server activation uses namespaced IDs, preventing collisions
  with built-in tool names. Browser discovery loads the first-party browser
  capability and retains registry guidance for other missing capabilities.
• File tools enforce the workspace boundary for absolute and relative paths,
  including Git inventories. They reject traversal escapes, interior
  symlinks/junctions, Windows device aliases, and alternate data streams while
  supporting a junction at the workspace root. Delete/move refuse both the
  workspace and current-directory roots.
• Approved edits, whole-file writes, and patches retain the displayed plan and
  recheck arguments, workspace identity, file identity, permissions, and bytes.
  Files changed during approval require a new approval. Atomic writes preserve
  permissions and use exclusive, unpredictable staging files with no direct-write
  fallback, closing the temporary-file symlink escape.
• Empty approval previews no longer bypass required confirmation.
  mcp_manage declares its approval policy by action. Auto-approval and
  confirmation results require explicit boolean true, including daemon gates;
  auto-approval remains an opt-in and still prepares file/process snapshots.
• Approval fallback and MCP diagnostics redact recognizable credentials plus
  secrets from environment variables, config files, server settings, and headers.
  ...

2.4.2

Added

• Skills in Plugins. Browse installed workflows, read their instructions, and
  enable or disable each skill. Choices persist across desktop restarts and update
  active chats before their next reply.

Fixed

• Desktop chats now load packaged skills. Disabled skills are absent from the
  model's skill catalogue and cannot be run through the skill tool.
• Session checklists remain visible between turns and after reopening a chat;
  the agent is reminded to update their statuses before finishing work.

Changed

• Reorganized source, tools, tests, scripts, and documentation into focused
  directories, with imports and release packaging updated for the new paths.

2.4.1

Fixed

• Image previews work when a Windows workspace is reached through a junction,
  while canonical path checks still keep previews inside the workspace.
• The Windows release checks now use a deterministic Git line-ending fixture,
  and a failing test suite stops publication.