NativeAgent 0.4.3

NativeAgent 0.4.3

More personality, without turning personality into a script

This release makes the agent feel more present while preserving its own
judgment. Natural expression now draws from the existing persona, recent
conversation, memory, cognition, and organism state instead of adding a second
personality engine or rewriting the final answer after the model speaks.

• A bounded natural-expression layer gives ordinary conversation more warmth,
  texture, humor, affection, and emotional range when the moment supports it.
• Personality range benches exercise difficult, playful, intimate, neutral,
  and repair-oriented conversations on isolated persona-shaped clones—not on
  the resident agent or its real memories.
• The release identity bench now guards against an update quietly changing who
  the agent is, while explicitly treating warmth, intimacy, and humanness as
  valid expression rather than failure modes.
• Memory activation, provider selection, and conversation traces are more
  truthful: recalled items count only when resolved, active providers are not
  inferred from stale snapshots, and configured models are never silently
  substituted.

A screen made native to an agent

Computer use has been consolidated around four natural verbs—screen, act,
go, and wait—with accessibility and vision contributing to the same live
screen representation.

• Semantic controls, unlabeled canvas objects, text areas, sidebar rows, and
  stable ordinal or role references can share one addressable vocabulary.
• The same action path can click, type, scroll, drag, hold, use key chords, and
  sustain movement without exposing a separate collection of vision tools.
• Fresh post-action observations join the action receipt. Visible value changes
  can verify an outcome; animation alone cannot pretend an action succeeded.
• A persistent semantic scene keeps visual-region identities stable as objects
  move, preserves native canvas detail for OCR, and exposes bounded readable
  values from custom-rendered screens.
• Passwordless screen savers can be nudged awake without being misreported as a
  locked screen. Real password locks continue to fail closed.

Complete, reproducible behavior coverage

• The total-coverage ledger now maps every enumerable product surface and keeps
  new screens, tools, settings, scripts, bridges, and runtime owners from
  silently landing without an evaluation row.
• Hundreds of behavior evaluations cover Mac, iPhone, chat, memory, cognition,
  tools, providers, Trust Center, Desk, background work, and release plumbing.
• Coverage gates reject vacuous polling and report-only assertions that do not
  prove the actual user-visible or effect boundary.

Reliability and release honesty

• Internal builds can no longer look identical to a published release and
  silently leave the update train.
• Update notes render as readable styled content in both light and dark mode.
• MCP subprocess failures preserve their final diagnostic output even when a
  child exits at the same instant as the host's pipe reader.
• Public iPhone builds always include the official support and privacy links.

Requires macOS 26 (Tahoe) or later, unchanged from 0.4.2.

NativeAgent 0.4.2

NativeAgent 0.4.2

A calmer, more honest Mac chat

The Mac chat surface was rebuilt around one idea: the conversation should tell
you the truth about what the agent is doing, and nothing else.

• One durable turn card replaces the old thinking rows, typing chips, and
  progress chrome — in the main window and every detached session window. An
  accepted turn renders exactly one card. Terminal states are evidence-based:
  a proven completed, failed, or canceled turn resolves its card away because
  the transcript already carries the result, while an outcome-unknown turn
  keeps its card rather than pretending it ended.
• The card shows the approval it is waiting on. When a turn stops on a
  confirmation-tier tool, the approval now appears inline on the turn card with
  the decision offered right in the conversation — previously the request sat
  in Activity and the chat just looked idle. The card is a projection of the
  same approval inbox every other surface uses; there is no second authority.
• Live turn activity is carried into the chat while a turn runs, so long
  work is visible instead of silent.
• Fenced code blocks survive the transcript. Multi-line code used to arrive
  as one mangled line (fence markers eaten, newlines collapsed); code now
  renders in a real code block with its language label and copy support.
• Chat links are scheme-allowlisted. Only http, https, and mailto links are
  live; a javascript: or file: link loses its linkness and keeps its
  visible label, failing closed on anything unknown.
• Native transcript search and a simplified composer, plus session
  provenance and active-session navigation, and a calmer session rail.
• An accessibility acceptance pass across the Mac chat surface.

GitHub can watch, but it cannot start work

• The GitHub integration is now watcher-only. Refreshes update watcher and
  Desk state, read models, and notifications — no GitHub event can start a
  provider, a tool, or a bridge turn on its own. Explicit user requests still
  work exactly as before.
• Actionable events claim one durable, deduplicated notification
  ("GitHub needs attention") instead of re-notifying on every no-op refresh.
• The check classifier now separates executable CI failures from
  maintainer-controlled review gates, so a PR that is waiting on a human
  maintainer stops being routed as a technical failure and stops consuming
  agent capacity. Lost bridge wakes are recovered from durable state instead
  of being silently marked as handled.

Requires macOS 26 (Tahoe) or later, unchanged from 0.4.1.

NativeAgent 0.4.1

NativeAgent 0.4.1

Requires macOS 26 (Tahoe) or later. This release raises the minimum system
version from macOS 14 — the app now builds on the macOS 26 SDK and adopts
Liquid Glass throughout. If you are on an older macOS, stay on 0.4.0.

Real-time Mac attention

The agent can now explicitly pay attention to the Mac across a sequence of
fused views (mac_attention start / next / status / stop):

• Bounded 15–1,800 s sessions with passive local/global input observers — no
  timers, no frame polling; next wakes event-driven on new activity.
• Human takeover is absolute. Physical input after the agent's last view
  makes every motor call return yielded_to_user until it re-observes — checked
  at tool entry and immediately before each emitted event. A drag interrupted
  mid-gesture releases the button instead of stranding a synthetic press.
• The agent's own synthetic events carry an in-process identity tag so it can
  never mistake itself for the human.
• Privacy: keyboard activity is recorded as a content-free pulse only; no
  screenshots, text, key content, or history are stored; attention state is
  ephemeral and fully torn down on stop/expiry.
• Coordinate drags interpolate locally (80–2,000 ms, 4–60 steps) for smooth
  visible motion without spending model tokens.

Whole-system tightening

A challenged whole-repository audit tightened existing owners across five
waves plus a structural closeout — no new subsystems:

• Fail-closed authority: one immutable trust-policy generation per
  authorization; malformed injection-spend state, invalid signing keys, corrupt
  external-send receipts, and out-of-root backup restores all fail closed;
  pairing secrets are durable before publication on Mac and iOS.
• No lost work, no repeated effects: Telegram updates gain a durable
  replayable claim before their offset advances; scheduler occurrences are
  claimed durably before external effects; timed-out background work stays
  quarantined until it actually exits; Workshop settlement is
  restart-reconcilable; screenshot composers clear only after turn acceptance.
• Activity truth: local-only activity data cannot silently enter a
  cloud-model request (model access is a separate explicit consent that a
  policy file can only turn off); agent-driven Mac actions no longer count as
  human activity; activity queries return complete, bounded, correctly
  filtered results.
• Consolidation: one canonical MemoryV2 owner at the default root; bounded
  Knowledge Graph SQL; per-turn appraisal derived once; manual and automatic
  chat compaction share one compactor (manual force bypasses only the
  automatic gates — never validation, verified backup, keep-tail, or durable
  write); CloudKit transport skips legacy Drive work when active.
• Release proof: published releases require an exact-commit test receipt;
  iOS release tests cannot silently skip; one release attestation binds source,
  test proof, exact artifact bytes, and notarization; shipped symbols are
  stripped with the private dSYM archived.
• Proven-dead code islands removed (Frozen Mind v1 runner, duplicate feedback
  ranker, inert cognition islands) with persisted-compatibility kept.

Liquid Glass feel pass

• The UI adopts real Liquid Glass: cards and chrome render with
  glassEffect (tinted where accented), with an opaque fallback under
  Reduce Transparency.
• A shared interaction vocabulary makes the app answer the cursor everywhere:
  spring-animated hover fills on rows and cards, press feedback on buttons —
  reduce-motion aware, and hover state can never stick on recycled rows.
• Smooth composer, session list, Desk, Activity, Inbox, Skills, Trust,
  Settings, MCP Hub, and command-palette interactions.

Memory quality, round 2

• The rule-based extractor no longer parrots first-person speech as facts
  ("my whole thing is I was just trying to…" can never stage), and discourse
  nouns ("my whole thing/point/deal is…") are not attributes.
• Truncation-shaped fragments ending on determiners/quantifiers are rejected
  for automatic extraction — while deliberate agent-committed memories are
  explicitly exempt, so the agent's own judgment lane is untouched.
• Historical junk identity facts swept from the active store.

Docs

• New internals documentation: anatomy of a turn, the optional subconscious
  capsule, and a connected internal-workings map.
• README/CAPABILITIES/USER_GUIDE surface Mac computer control and the ambient
  activity watcher where agents actually read.

NativeAgent 0.4.0

NativeAgent 0.4.0

Your agent gets hands, eyes, and a memory that respects you.

Mac computer control

• A full accessibility perception organ: the agent reads windows, controls,
  and screen structure through the AX tree — read-only, no screenshots
  required.
• Keyboard and mouse injection with non-forgeable approval: every injected
  action is bound to an explicit, capability-minted grant, and the approval
  spend-marker is durable across crashes so a grant can never replay.
• mac_view: a fused set-of-marks screen view with full secret redaction at
  the source — one-time codes, keys, and revealed passwords are stripped
  before the agent ever sees them, on every egress path including titles.
• mac_wake / mac_nudge: dismiss a screensaver or wake the display,
  fail-closed on any real session lock.

Ambient activity watcher (off by default, yours to switch on)

• A local, metadata-only record of which app and window you were in front
  of: app, redacted window title, start/end. No screenshots, no OCR, no
  model calls, event-driven with effectively zero CPU cost.
• Consent is structural: with the Trust Center toggle off, nothing is
  installed and no store file exists on disk. External writes can only make
  capture less permissive — enabling goes through Trust Center only.
• The store is excluded from every export, backup, and support bundle, and
  only a small allowlist of surfaces may read it. Query results never enter
  the agent's long-term memory: the agent can look when you ask and build
  tools to help you, but it keeps nothing.

Memory quality

• New proposal hygiene gates: clipped sentence fragments and facts extracted
  from agent-to-agent bridge traffic can no longer reach your review queue —
  proposals about "the user" now only ever come from the user.
• Context selection rebalance: recall relevance now scores against your raw
  message with a message-coverage feature, and generated-document marker
  atoms are excluded from candidacy.

Performance

• Prompt-cache overhaul for multi-step tool turns: the turn context builds
  once and is reused across iterations, the tool catalog and clock are
  pinned for the turn, and cache reads now grow monotonically instead of
  rebuilding up to 21 times per turn. Long tool sessions are significantly
  cheaper and faster.

Reliability and housekeeping

• Installer launch-proof: after an update swaps the app bundle, launch is
  re-registered and proven by process, closing a case where a good build
  could roll itself back.
• The Telegram surface allowlist now fails closed when empty, on messages
  and button callbacks alike.
• Over 6,200 lines of dead and retired code removed across the core
  modules, each deletion verified caller-by-caller — a leaner app with the
  same behavior.

NativeAgent 0.3.9

NativeAgent 0.3.9

Trust, quiet, and a denser cockpit.

Credential trust

• A fresh install no longer silently adopts an existing Codex CLI sign-in.
  Providers shows a one-click "Use it / Ignore" offer, the sign-in badge names
  the adopted source and account, and sign-out revokes the consent.
• In-app authentication always outranks an adopted CLI session, and malformed
  consent records surface as corrupt with an explicit, byte-safe repair.

Quieter, more honest agent

• Self-opened pursuits announce themselves exactly once — the repeated
  notification storm is fixed.
• Near-duplicate pursuit proposals are refused, and a pursuit that exhausts
  its session budget closes itself per its own abandon condition.
• Background telemetry no longer emits false Slack or "waiting on you"
  warnings; GitHub decision labels route to the actual responsible
  contributor.

Native Experience (optional, fully reversible)

• Journey presentation, Project Spaces, resumable builder conversations,
  conversation lineage/comparison/export, a native Workbench, shared
  Capability Kits, and confirm-gated trusted remote effect nodes over system
  SSH. Every surface sits behind its own key; Return to Classic changes
  presentation only. Desk is restored as the canonical work system.

Polish and speed

• Chat sessions sidebar: one-line rows, a Pinned section, and in-place
  rename.
• A persistent update notice survives a dismissed update prompt.
• Retired OpenRouter model ids are refused with a clear error instead of a
  silent failure.
• Faster launch and steadier idle: consolidated subprocess handling,
  advancing CloudKit cursors, linear-time serialization of large canonical
  state, and event-driven session lists.
• Interactive chat turns from Telegram and Slack outrank background
  transport work.
• The agent's voice varies naturally: repeated closing phrases and reused
  response templates are gently damped, with no word bans and no rewriting.

NativeAgent 0.3.8

NativeAgent 0.3.8

Reliability and polish release.

Fixes

• The agent's USER.md identity document now contains only facts about you — the agent's own work journal and operational notes no longer crowd it out (they remain in memory, just not in the doc that rides every prompt).
• ⌘K now opens the Workshop command palette even when the bench has keyboard focus.
• Chat: history compaction is budget-capped and tool activity summaries are bounded, keeping long sessions responsive.
• Sync: completion markers can no longer be evicted from the processed-message cap, eliminating a rare repeat-command path on Mac↔iPhone sync.
• Approvals: remote approval actions are strictly validated and fail closed.
• Background loops: event-listener liveness is now tracked; failure streaks page instead of staying silent.

Improvements

• Trust Center copy now describes what each setting actually permits, and only ever understates permissiveness.
• Desk quick actions route through the same gated tool dispatch as chat, with a real approval record per click.
• iOS: sync errors and Mac status now surface directly in the app.
• Context assembly budgets derive from the model's real window with provably bounded ceilings.
• Memory recall blocks are labeled clearly in context.

NativeAgent 0.3.7

Full Changelog: v0.3.3...v0.3.7

NativeAgent 0.3.3

Full Changelog: v0.3.2...v0.3.3

NativeAgent 0.3.2

Reliability sweep and plain-language pass

Five audit waves swept the whole app ahead of the public baseline, fixing roughly 45 confirmed defects.

Reliability

• Persistence takes the shared file lock at every conformer call site (35 sites across 13 files), retiring a pattern where a failed downcast silently degraded to unlocked writes. New concurrency probes with negative controls guard the invariant.
• The Slack socket loop only advances its history-poll watermark after confirmed delivery, cancels background work with a bounded wait that reports abandoned tasks, and gap-fills history on reconnect instead of polling on a fixed timer.
• Chat session retention gained a second planning pass so stale empty sessions can no longer starve the active-session cap.

Honest, plain-language UI

• Provider keys without a connection test now read "saved · no test available" instead of implying a passed check.
• Doctor, Memory, settings, and status copy drop internal jargon (file paths, database names, endpoint identifiers) from headlines, with regression tests banning it from coming back.

Full details: CHANGELOG.md

Full Changelog: v0.3.1...v0.3.2

NativeAgent 0.3.1

OAuth transport repair and export hardening

• Repaired the direct ChatGPT OAuth transport.
• Hardened the public-source export pipeline: exact tracked-identity scanning, compilation of rewritten tests, purge proofs for retired Git objects, and tracked MiniLM release resources for reproducible public builds.

Full details: CHANGELOG.md

Full Changelog: v0.3.0...v0.3.1