NativeAgent 0.4.0

NativeAgent 0.4.0

Your agent gets hands, eyes, and a memory that respects you.

Mac computer control

• A full accessibility perception organ: the agent reads windows, controls,
  and screen structure through the AX tree — read-only, no screenshots
  required.
• Keyboard and mouse injection with non-forgeable approval: every injected
  action is bound to an explicit, capability-minted grant, and the approval
  spend-marker is durable across crashes so a grant can never replay.
• mac_view: a fused set-of-marks screen view with full secret redaction at
  the source — one-time codes, keys, and revealed passwords are stripped
  before the agent ever sees them, on every egress path including titles.
• mac_wake / mac_nudge: dismiss a screensaver or wake the display,
  fail-closed on any real session lock.

Ambient activity watcher (off by default, yours to switch on)

• A local, metadata-only record of which app and window you were in front
  of: app, redacted window title, start/end. No screenshots, no OCR, no
  model calls, event-driven with effectively zero CPU cost.
• Consent is structural: with the Trust Center toggle off, nothing is
  installed and no store file exists on disk. External writes can only make
  capture less permissive — enabling goes through Trust Center only.
• The store is excluded from every export, backup, and support bundle, and
  only a small allowlist of surfaces may read it. Query results never enter
  the agent's long-term memory: the agent can look when you ask and build
  tools to help you, but it keeps nothing.

Memory quality

• New proposal hygiene gates: clipped sentence fragments and facts extracted
  from agent-to-agent bridge traffic can no longer reach your review queue —
  proposals about "the user" now only ever come from the user.
• Context selection rebalance: recall relevance now scores against your raw
  message with a message-coverage feature, and generated-document marker
  atoms are excluded from candidacy.

Performance

• Prompt-cache overhaul for multi-step tool turns: the turn context builds
  once and is reused across iterations, the tool catalog and clock are
  pinned for the turn, and cache reads now grow monotonically instead of
  rebuilding up to 21 times per turn. Long tool sessions are significantly
  cheaper and faster.

Reliability and housekeeping

• Installer launch-proof: after an update swaps the app bundle, launch is
  re-registered and proven by process, closing a case where a good build
  could roll itself back.
• The Telegram surface allowlist now fails closed when empty, on messages
  and button callbacks alike.
• Over 6,200 lines of dead and retired code removed across the core
  modules, each deletion verified caller-by-caller — a leaner app with the
  same behavior.