v0.8.0 — A team of agents on a floating island

Clyde can now run a team: a master, an advisor and workers on their own git worktrees, with you watching and steering from a live station.

What changed

• /orchestrate <task>: pick the master, an optional advisor and the workers from the models each connected provider really offers; Clyde briefs you with questions until the request is clear, the team works side by side, and nothing lands until you approve. Claude Code and aider can be workers or the advisor, kept to files-only or ask-only by what they are allowed to do. You can cap the cost of a run (it stops like Ctrl-C when priced spend reaches it).
• The station: clyde station shows a run live from another terminal (who is doing what, spend, waiting requests) and answers them with approve / deny; clyde station web shows it in a browser as a floating island in a night sky, with a workshop for each worker, a front office, a speakeasy and a post room. From the page you can add a worker to a live run, give a worker a task (Clyde hands it over and the run records it), stop every worker, rename anyone, and answer requests; a "Needs you" list and first steps guide you in. Crew walk only when something was recorded, and a bonded pair of worker and orchestrator stand together at the bar.
• Your words survive compaction. After /compact, the files being worked on come back as they are now, and your own messages come back word for word, not only as the summary's wording of them. A second compaction no longer loses what the first one kept.
• Safer by default. Files Clyde rewrites in place (config, settings, sessions, Bonnie's automations, run files) are written so a crash cannot tear them, with the last good copy kept. What comes back from the web or an MCP tool is checked for text addressed to the model and carries a notice when it finds some. Bonnie's automations are safe across windows (a lock, runs fire once, a decision log says why). The in-house skill scanner no longer skips files by path.
• Cheaper turns, and you can see why. /cost shows how the prompt cache did and what each miss cost; Edit takes several edits in one call; long tool output keeps its start and end with the whole of it searchable (RetrieveContext with contains); the context prompt keeps its stable parts first so one new file does not empty the provider's cache.
• Permissions and hooks. ask rules, UserPromptSubmit and Stop hooks in Claude Code's format, project rules from .clyde/settings.json, and answering a permission prompt in your own words ("sure, go ahead", "dale").
• Asking you questions the way Claude Code does (arrow-key choices with descriptions, or your own words), and out of tool turns the model now says what is done and what remains; the limit is a setting.

Fixed

• Lines typed while a turn runs are no longer lost; /brief sees earlier answers and always ends; /harness lists only models a provider really returns; a stream that drops mid-answer continues where it stopped instead of printing twice; a rate-limited request waits out its window; clyde login mistral works.
• Mistral models are handled the way Mistral Vibe handles them (reasoning shown as thinking, the model's own thinking levels).

Security

• Requires certifi 2026.10.19 or later: that release drops a root certificate removed after a weak-key incident, and an older bundle kept trusting it.

Full list: CHANGELOG.md

v0.7.0 — Clyde keeps what a session taught it

Clyde can now keep what a session taught it, and works behind a company proxy.

What changed

• /refine looks back over the session and proposes up to three memory notes to add or drop: a preference you stated, a project fact that took effort to find, a note the session shows is wrong. Each one must quote your own words, and Clyde checks the quote is really in one of your messages, so a web page or a file a tool read can never write a note. It asks before keeping each one, and /refine undo takes back the latest.
• /settings → Auto-refine: off (the default), before compaction, every 10 turns or every 25 turns. Run on its own it only adds notes, never drops one, and prints each note it keeps. The idea comes from prime-agent's continual harness (MIT); this one is built on the memory notes Clyde already had.
• /proxy, and two rows in /settings (Network proxy, Company certificate): use the environment's proxy (the default), a proxy URL, or none, and add a company root certificate for networks that inspect TLS. MCP servers, the oMLX downloader and Bash commands take the same route. Local models (Ollama, oMLX) always go direct.
• /doctor shows the update channel you follow (latest or stable) and checks oMLX's Metal kernels, which, when missing, make GLM-5.2, MiniMax M3 and Qwen3.5 run on much slower generic paths without a word.

Fixed

• Reasoning off on thinking-only models. qwen3:4b (Qwen3 Thinking 2507) reasons whatever it is told; with reasoning off, its reasoning landed in the answer, so compaction summaries came back as prose. Clyde now reads the model's template and keeps that reasoning in its own channel.
• Behind a proxy: WebFetch no longer refuses every URL when the proxy sits on a private address, and an untrusted certificate is reported as one, with the /proxy ca fix, instead of a generic connection error.

Also

The website has new Bonnie and Clyde engravings and a framed page that moves as you scroll: dea6cat.github.io/ClydeCLI.

Full history: CHANGELOG.md · What leaves your machine: EGRESS.md · Found something: SECURITY.md

v0.6.0 — LM Studio out, oMLX in

LM Studio is out. oMLX is in.

What changed

• MLX models now run in oMLX (Apache-2.0) instead of LM Studio, which is closed source. The first time you pick an MLX model, Clyde asks, then installs oMLX's pinned v0.7.2 from source into ~/.clyde/omlx. No Homebrew, and no change outside that folder.
• Clyde holds the key. The oMLX server always starts with a key only Clyde has (~/.clyde/omlx/api_key, readable only by you). Without one, oMLX opens its admin API to anything that can reach the port, a web page in your browser included.
• /models local downloads MLX models through oMLX's own downloader and Hugging Face GGUF through Ollama only.
• /settings → oMLX memory guard: balanced (the default), aggressive, a fixed ceiling, or off.
• clyde -p --time-limit SECONDS and --max-tokens N stop a headless run on time or on tokens. Both ideas come from Mistral Vibe.

Why

oMLX keeps a prompt's work on disk. On an 18 GB M3 Pro, a 3,555-token prompt took 7.56 s cold, 1.01 s warm, and 0.96 s after a server restart: the cache restored it instead of recomputing it. That is the case that matters here, since Clyde starts and stops the server and an 18 GB Mac evicts models often. It is one run, and it is not a comparison with LM Studio; the method and limits are in docs/research/omlx.md.

Coming from LM Studio

• Nothing to re-download. oMLX serves ~/.lmstudio/models where it is.
• A saved lmstudio: default model and your /eval results move to their omlx: names at start, when exactly one folder matches. Two quantizations of the same model are left alone rather than guessed.
• clyde -p, Bonnie and editors never install oMLX: run one MLX model in the terminal first.

Also in this release

• Memory: limits on what the model saves on its own, and your own notes keep at most 1,000 of the prompt's 2,000 characters.
• /doctor lists skill problems the loader used to pass over in silence.
• clyde -p --output-format stream-json, and SIGTERM now stops the running command too.
• SkillSpector scans symlinked skills, and a first launch with 95 skills went from about 5 minutes to 38 s.

Full history: CHANGELOG.md · What leaves your machine: EGRESS.md · Found something: SECURITY.md

v0.5.11 — the sandbox retires (Apple folded first)

Clyde's shell sandbox is retired. In its place: the ask.

What changed

• A shell command that names anything outside the project — an absolute path, ~, $HOME, or .. — now asks first. Even read-only. Even in all-in mode. So does a command that touches .git/config or .git/hooks.
• Read, Write, Edit, NotebookEdit, Glob, Grep, and a Bash cwd outside the project now ask instead of being refused. A yes covers that file — or that folder and everything under it — for the rest of the session. A no does not.
• Headless -p still denies. It cannot ask.

Why

Apple has deprecated sandbox-exec. A future macOS release could remove it and break every shell command, and Clyde should not depend on that. The guard is now the permission prompt alone, so a command you approve can write anywhere you can. Read the command before you say yes.

Housekeeping

• The sandbox block in ~/.clyde/settings.json is ignored — you can delete it. The unsandboxed option is gone, and so is the sandbox line in /doctor.
• Bonnie's hosted previews and the DuckDB data tool keep their own, unrelated isolation.
• Nothing to migrate. If a command that used to run silently now asks, that's the change: approve once, the session remembers.

Full history: CHANGELOG.md · What leaves your machine: EGRESS.md · Found something: SECURITY.md

v0.5.10 — EGRESS.md, enforced by a test

• EGRESS.md: every way Clyde can use the network, what it sends, when, and how to turn it off. A test fails whenever the code names a host the document does not, and when the document promises an off switch the code never reads.
• WebSearch now asks before each search, showing the whole query, the way WebFetch asks before each URL — whatever the model wrote goes to DuckDuckGo, and a key or a snippet of your code can ride in it. In headless clyde -p, a search is denied unless an allow rule exists or you pass --mode all_in.
• LM Studio's installer is no longer downloaded and run on Clyde's own when the headless daemon is missing. The terminal asks first (default No); where nobody can be asked, it stops with the command to run by hand.
• CLYDE_SKILL_SCAN=closed holds back any skill, plugin, agent or MCP server whose SkillSpector scan failed. The default is unchanged — a failed scan still loads, so a broken scanner never locks anyone out — but it is no longer silent.
• Edit now says when a match was loose (it ignored trailing whitespace or indentation): the result tells the model to check the patch, the summary shows matched loosely, and the trace records an edit_loose_match event.
• GOVERNANCE.md (how decisions and releases happen, how to become a maintainer), SECURITY.md (report privately, what counts, the known limits), and a PR template.
• Fixed: a failed scan of an MCP server's tool list is no longer cached as a verdict — one scanner hiccup no longer sticks until the tool list changes.

v0.5.9 — Python 3.12 to 3.14, and Laya becomes optional

• ClydeCLI now runs on Python 3.12, 3.13 and 3.14 — it needed 3.14 before. A new Tests workflow runs the whole suite on all three. The one thing that needed 3.13 (the path-glob matcher for saved permission rules, Edit(docs/**)-style) now falls back to an equivalent that is tested against the real one on every combination tried.
• Laya, the local model that spots a stuck cardShuffle turn, is now an optional extra (clyde-cli[laya]) instead of a required dependency, because it pulls in PyTorch: a new install drops from about 790 MB to about 180 MB. clyde setup offers to add it (default No), and clyde update keeps it for anyone who already has it. Without Laya everything else works — cardShuffle just has no stuck check.

v0.5.8 — the small-model release: measured fixes

Every fix in this release was measured on real models, mostly Qwen2.5-Coder 3B. The numbers:

• Routing: the first request names the tool it needs (Remember, TodoWrite, plan mode, CronCreate, AskUserQuestion, Data, Map), so the model does not have to ask. Right tool in 30 of 35 trials, up from 1 of 35.
• Tool lists: no descriptions for models of about 3.7B parameters or fewer. The 3B called Remember 1 of 6 times with descriptions, 6 of 6 without; first-turn calls across six tools went from 39 of 60 to 50 of 60. The first request shrank from about 3,070 to about 1,880 tokens.
• Fixed: the context window no longer starves the machine. It used to fill about 75% of the RAM left after the weights — on an 18 GB Mac that gave qwen3:4b 68,608 tokens and macOS restarted with a watchdog panic. It now counts free memory, keeps a 3 GB reserve, and holds weights plus cache under 35% of RAM.
• Fixed: a model sending the same tool call again and again no longer burns the turn limit — after two identical calls the third is refused. On the 3B, 12 identical calls became 2.
• Fixed: field-by-field descriptions for AskUserQuestion, TodoWrite and Map (valid AskUserQuestion calls went from 0 of 10 to 10 of 10), CronCreate teaches the schedule format (20/24 → 24/24), Mistral's nine-character tool ids are rewritten, and a lone surrogate character no longer poisons every later request.
• Telemetry: anonymous usage counters, on for a new install with a notice, off after one ask for anyone who already had Clyde. Counts, flags and fixed-set words only — a prompt, path, model name or error message cannot be recorded. clyde telemetry show prints what is queued, off deletes it, and CLYDE_TELEMETRY=off or DO_NOT_TRACK=1 always win.
• clyde tune can apply its own recommendation (Ollama variables and an app restart), editors get the /settings toggles over ACP, and the site counts visits anonymously (no cookie; Do Not Track respected).

Full list: CHANGELOG.md

v0.5.7 — /models local grows model pages

• Choosing a model opens its page: downloads, likes, last update and license, parameters, architecture, context length, and what it can do — then every download of that model as a table: each GGUF quantization and MLX build with its size, fit, estimated speed and quality, the recommended one marked, and options too large for your machine shown but not selectable.
• Results are tables with titled columns (model, fit, format, size, tokens per second, pulls, quantization, publisher); a narrow terminal drops the right-hand columns instead of wrapping.
• Search results are named after the model they were made from when the repo's card says so reliably.
• Ollama replies now record prefill_ms, decode_ms and load_ms in the trace, and tools/analyze_traces.py reads them.
• A model whose best download is 2-bit or lower is listed after the usable ones, and IQ quantizations get a quality note like the others.
• Pylint now runs on Python 3.14 with the project installed and fails below a score of 9 — it used to run on 3.8 to 3.10 and fail every time.

v0.5.6 — the editor stops guessing at auth

• clyde --acp offers terminal login (clyde login) as its auth method and answers authenticate, which the ACP Registry requires of listed agents. With no provider connected, session/new replies with the protocol's auth-required error instead of leaving the editor waiting.
• Files you @-mention in an editor (Zed) now reach the model: it is told the path and line range and reads the file itself, so its permission and secret-file guards still apply.
• --acp no longer hangs the editor when a request makes Clyde exit: the editor gets an error reply.

v0.5.4 — the picker stops selling slow models

• /models local lists models that run slower than about 15 tokens per second last and marks them (slow); CLYDE_MIN_TOKS changes the floor.
• Models whose chat template can't call tools are no longer offered, and a model that failed /eval is hidden whichever app runs it (Ollama, Hugging Face GGUF or LM Studio).
• Downloads through LM Studio warn first that tool use isn't confirmed for that model.
• Clyde asks for GPU offload when a GPU (Apple Silicon or NVIDIA) can hold all or part of the model: Ollama gets num_gpu, lms load gets --gpu.