0.11.1

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.11.1-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.11.1-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.11.1-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.11.1-x86_64.AppImage Houston-0.11.1-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

This release fixes updates on macOS so an already-downloaded update installs instead of reopening the old version.

Breaking changes

• None.

Fixed

• Check for updates now installs an update that has already been downloaded, instead of restarting Houston into the old version on macOS. (#552)

0.11.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.11.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.11.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.11.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.11.0-x86_64.AppImage Houston-0.11.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Houston now remembers your preferences and project facts across sessions, plus several agent reliability fixes.

Memories are stored locally in ~/.houston/memory. The list of saved memories, and any memory the agent reads, is sent to your model provider along with the rest of the conversation context. You can turn memory off at any time.

Breaking changes

• None.

Added

• Memory across sessions: the agent can save your preferences, corrections, and project facts that the code and git history don't show. It can also update or delete those memories later. Memories are kept per repository or for all projects. (#513, #519, #542)
• Memory in conversations: each conversation includes a short list of saved memories. The agent can use the new recall_memory tool to read a memory in full or search them. Memories are treated as notes and never outrank your instructions, safety rules, or permissions. (#517)
• Memory approvals: saving or deleting a memory asks for approval in the default mode, runs automatically in auto-edit and full auto, and is refused in plan mode. If the conversation has fetched outside content (web, MCP, subagents, or shell commands like curl or git pull), every memory write asks for approval in every mode, and no allow rule skips it. (#519)
• Settings > Memory: a new page to turn memory on or off, open the memory folder, and view, edit, pin, or delete memories (with Undo). Memories left behind by a repository that moved or was cloned again can be moved into the open repository or deleted. (#520)
• /memory command: in the terminal, list, show, edit, pin, unpin, and forget memories, undo the last deletion, and turn memory on or off. In the desktop app, /memory opens Settings > Memory. (#521, #522)
• Turning memory off: use the memoryEnabled setting, or pass --no-memory for a single headless run. (#517)
• Help menu links: new Houston Website and Houston on GitHub items, grouped with the Guide. Report an Issue now sits below a separator. (#525)
• Guide: a new "Memory across sessions" section. (#522)

Fixed

• Closing the update banner now cancels an in-progress macOS update download, even if another update check ran during the download. Before, the download could finish and install on the next quit. (#512)
• run_shell commands that read input (such as npm init, cat with no file, or y/n prompts) now exit right away. Before, they hung until the 300-second timeout. (#534)
• When the agent reads a failed CI log, it now sees the end of the log, where the failure is reported. Long logs are also cleaned of timestamps and color codes. (#510)
• Tool calls with quoted numbers or booleans (for example "42" or "true") are now accepted as their values instead of failing validation. This mostly helps smaller and local models. (#529)
• Headless runs limited with --allowed-tools or --disallowed-tools are no longer told to use tools they can't call. In plan mode without present_plan, the plan goes in the final message. (#530)
• Test results in the run receipt are now read correctly when a test is followed by echo $?. Before, they showed as unknown, or as failed with another command's exit code. (#533)
• A test that reported its status before a later part of the same command timed out is no longer marked as timed out. (#536)

Changed

• When web_search has no API key set, the agent is now told not to guess page URLs to fetch instead, and to tell you which sources it actually read. (#528)
• The GitHub Action now runs the 0.10.0 CLI by default. It also passes the event's repository to the CLI, so GitHub tools work when the working directory has no GitHub remote. (#514)

0.10.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.10.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.10.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.10.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.10.0-x86_64.AppImage Houston-0.10.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Rewind to any message, per-chat model settings, unread chats, language servers, a GitHub Action, and a new Settings.

This release also changes some defaults: each chat now keeps its own model, reasoning and approval mode, full-auto shell commands get allowlisted network from the start, and global rules move to ~/.houston/AGENTS.md.

Breaking changes

• Model, reasoning effort and approval mode now belong to each chat. Changing one in an open chat changes only that chat, and reopening a chat runs it on what it last used. Your saved settings are now the defaults new chats start from; Use for new chats copies a chat's settings to the defaults. (#369, #394, #395, #444, #447, #448)
• Global rules moved to ~/.houston/AGENTS.md. Global # notes saved with "Everywhere" now actually load. ~/.claude/CLAUDE.md is no longer loaded on its own, only when the global file imports it. A one-time banner (a startup line in the terminal) offers to add the import. (#357, #358)
• Full-auto shell commands now have network from the first command, through the egress proxy and limited to its allowlist (package registries, code hosts, and the domains under Sandbox egress). When a command reaches a host the allowlist doesn't list, Houston asks whether to allow that host for this chat. With "All domains" egress, shell still starts offline and asks once. (#300, #504)
• GitHub tool approvals are scoped by repository and action. Allowing a read no longer covers merges, reviews or new repositories, so you may be asked again for write actions. In full auto, reads run without asking; writes ask once per repository. (#402, #403)
• Headless runs (-p) now exit with code 5 when the last --verify check still fails, instead of 0. (#472)
• Esc Esc on an empty composer now opens the rewind picker instead of putting the last prompt back. (#353)

Required steps

• If you kept global instructions in ~/.claude/CLAUDE.md, choose Import it on the banner, or add @~/.claude/CLAUDE.md to ~/.houston/AGENTS.md. (#357)
• If you script headless runs with --verify, handle the new exit code 5. (#472)

Added

• Rewind from any earlier message: the conversation, the code, or both, with a preview of what changes and an Undo rewind until you send again. Edit and resend reruns from an edited message. Use the Rewind button on a message, Esc Esc, or /rewind. (#353, #476, #485)
• Unread and waiting chats: the sidebar marks chats that finished, failed, or need your input. Collapsed headers, a title-bar "N need you" pill, and the app icon count them, and Mark as unread works from any reply. (#432, #433, #434, #435, #455, #484)
• Language servers: after an edit, the agent sees the compile errors and warnings a language server reports, and it can jump to definitions, find references, and rename symbols across files. (#367, #378, #381, #442, #452, #498, #501)
• A new Settings: a full page with grouped sections, search, and a Permissions page that brings together rules, trusted folders, sandbox egress and the approval mode new chats start in. Changes save as you make them, with Undo. Modified settings are marked, and you can export, import and reset them. Rules can be edited as text, tested against a call, and show when each was last used. Admin and project permission config is shown too. (#411, #412, #413, #414, #415, #416, #417, #418, #419, #441, #456, #466, #469)
• Subagent records: each subagent's steps, report, and setup stream live in the chat and are saved with it. Subagents share the main agent's step budget. (#392)
• GitHub Action: run Houston in your own workflows to answer @houston mentions, review pull requests, or fix failed CI runs, with your own model API key. (#370, #446)
• Agent Client Protocol: houston --acp lets editors that support ACP agents run Houston as their agent. (#364)
• Standalone CLI install channels: npm and bun (@houston-code/cli), Homebrew, the AUR, and an install script. The update notice names the right upgrade command for how you installed. (#422, #424, #427, #428)
• Headless automation flags: allowed and disallowed tools, extra instructions, an output schema, MCP config, and a versioned --json result for CI. (#368)
• One set of slash commands in the desktop app and the terminal. In the desktop app, /model, /undo, /redo, /changes, /cost and others now run instead of being sent to the model. (#344)
• Pick a model from a list with /model in the terminal. (#355, #389)
• Search chats by folder and branch, as well as by what the user and the assistant wrote, with results that stay live. (#483)
• Cancel the update download from the update banner. (#292)
• Close a single dev-server preview pane. (#293)
• GFM task lists render as checkboxes. (#325, #451)
• View, Go and Help menu items for the app's panels and shortcuts. (#488)
• A status-bar chip brings back a minimized terminal. (#464)
• gh_run_view says where a CI run stands now. (#401)
• The product guide is published at houstoncode.ai/docs. (#437)

Fixed

• Never lose a message typed during a run, including while the agent waits on a question or approval, during retries, or when the run stops. (#393)
• The desktop app reopens the chat that was open when it quit. (#505)
• New chat no longer opens a folder picker when no project is set, and the project folder picker opens next to your last project. (#477, #503)
• Refuse to edit a file that isn't UTF-8 instead of corrupting it. (#310)
• Honor .gitignore and never hide tracked files in file search. (#340)
• Stream large text files instead of loading them whole; read_file on a folder returns its listing. (#405, #407)
• Refuse notebook_edit on a notebook changed since it was read. (#342)
• Accept the "*** End of File" line in patches. (#341)
• Recover when the session's working folder was deleted, and warn when the shell is in another checkout of the same repository. (#314, #384)
• Flag unrelated or stale chat history and keep the agent in its worktree. (#382)
• Tell the model when Plan mode switches on or off. (#408)
• Stop retrying an exhausted OpenAI quota. (#335)
• Don't report a review as clean when some reviewers failed. (#453)
• Say a denied call was denied, in plain terms, in both clients. (#454, #474)
• A fork's spend starts at zero, so usage totals don't count it twice. (#475)
• Settings, credentials and schedules saved by another Houston process (the desktop app or the terminal) are picked up instead of overwritten. (#327, #343, #457)
• Saving a # note locks the rules file, keeps a symlinked AGENTS.md intact, and works around Windows busy-file errors. (#359, #404, #406, #445)
• Keep a worktree another chat still uses when deleting a chat. (#322)
• Share one checkpoint between snapshots started together. (#351)
• Approval prompts no longer race their answer, and show the full change for large files, notebooks and moves. (#312, #376)
• MCP: negotiate the protocol version, read a stdio server's stderr so it can't deadlock, reconnect a dropped notification stream, clear the SSE handshake timer, and open OAuth sign-in on Windows without cmd.exe. (#309, #317, #338, #339, #349)
• view_localhost cancels file pickers and dismisses page dialogs that would otherwise hang a step. (#397, #398)
• A macOS sandbox write denial is reported as a denied write. (#400)
• The update notice keeps the last known update through a failed check. (#429)
• Every unfinished run is logged and unanswered turns are recorded. (#409)
• Strip markdown links from generated chat titles. (#336)
• The transcript stays at the latest message when you send, switch chats, or a bar opens below it. (#449)
• The command palette and find bar get your first keystrokes, and the find bar refocuses on ⌘F. (#465, #479)
• Mermaid diagrams show at their natural size, and very wide ones scroll sideways. (#387, #390)
• Keyboard and screen reader fixes: focus stays in Connect a model, the composer's + menu works from the keyboard, the message field and its menus are named, and the sidebar's ⋯ menus have proper roles. (#318, #330, #46...

0.9.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.9.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.9.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.9.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.9.0-x86_64.AppImage Houston-0.9.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Guided setup, side chat, turn receipts, inline visuals, new models, and many safety and reliability fixes.

This release also changes some defaults: reasoning now starts at High, and Enter steers a running turn.

Breaking changes

• Reasoning effort now defaults to High. Installs that still had the old default of Off are moved to High once, so each step uses more output tokens and time. Lower it from the reasoning menu next to the model picker or with /reasoning. (#241)
• In the desktop app, pressing Enter while a turn runs now steers it (the agent reads your message before its next step). ⌘+Enter (Ctrl+Enter on Windows and Linux) queues the message for after the run instead. (#250)
• Slash commands typed mid-turn now run as commands instead of being sent to the model as text. /compact waits until the turn ends. In the terminal, a known command typed mid-turn runs once the turn ends. (#203)
• Shell commands that can discard work (for example git reset --hard, forced git push, git clean -f, rm -r src, find … -delete) now ask for approval in every mode, including full-auto. (#246)
• Writing to a credential file (.env and .env.<name>, private keys, credential stores) now asks for approval in every mode, including full-auto, whether a file tool or a shell command does it. Templates like .env.example don't ask. An allow rule or Allow for run still skips the prompt. (#177)
• Shell allow rules now match quoting and whitespace exactly as bash reads them. A quoted * no longer matches a bare *. Rules saved by earlier versions mean exactly what their text says, so you may be asked once more for some commands. A saved shell allow ending in a lone backslash now matches nothing. (#206, #214)
• Headless runs (-p) now report how they ended through their exit code, so a run that stops at its step cap no longer exits 0 like a finished task. An invalid flag value exits 2 before any model call. (#220)

Required steps

• If you want reasoning off, set it back to Off after updating (reasoning menu or /reasoning). (#241)
• If you script headless runs, check that your scripts handle the new exit codes. (#220)
• Optional: run Clean up rules in Settings to remove shell allow rules that no longer match anything. (#214)

Added

• Getting started checklist for new users: connect a model, open a folder, send a first task. API keys are tested before they're saved, and finished steps can be changed. Existing users see no checklist or banner. Take the tour in the command palette and the Help menu replays the tips. (#159, #232, #234, #250, #251)
• Side chat: a docked panel for quick, read-only questions about the open chat, even while a turn runs. Send an exchange to the main chat or continue it in a new chat. Each chat keeps its side chat through plan reviews, chat switches, and restarts. Terminal: /btw. (#179, #224, #229)
• The agent can propose parallel sessions as a card (Start session, Do it here, Dismiss). Spawned sessions can start with a copy of the chat and report back when they finish. Sessions you start from a proposal don't count toward the background session limit. (#179, #208)
• Spawned sessions nest under the chat that started them in the sidebar, with foldable parents that stay folded across restarts. (#228, #230)
• Turn receipts: a "Recorded by Houston" row under each reply lists what actually ran: tests, builds, installs, browser checks, background servers, subagent work, the verify command, and files changed. It flags todo items marked done with nothing run behind them, and tracks progress on an accepted plan across turns. (#252, #261, #263, #264)
• Plan review shows whether the plan's checks can run on this machine (network, runtimes, dependencies) before you accept it. (#262)
• Inline visuals in replies: SVG and Mermaid diagrams render in the chat. Sandboxed interactive HTML is off by default (Settings > Appearance). (#269)
• The agent can show workspace images in a gallery, render HTML mockups at desktop, tablet, or mobile sizes, and capture the running app at several viewports and color schemes. The image viewer has a before/after compare slider plus Copy, Save, Show in Files, and Open file. (#267, #268)
• view_localhost supports double-click, key presses, and text checks in one multi-step call. (#227)
• Searchable model picker with per-model prices, a New mark, providers ready to use listed first, and badges read aloud by screen readers. (#163)
• Fetching a provider's models now summarizes what changed: new models, models no longer listed, and new models this build doesn't fully recognize. (#167)
• Claude Haiku 5.5 with its 1M context window and prompt-length pricing, added to existing installs. (#175)
• Gemini 4 Argon, added to existing installs. Announced price changes now take effect on their date without an update. (#176)
• A Help menu on every platform, with Houston Guide and Report an Issue (and the menu search field on macOS). (#173)
• File menu items: New Chat, New Chat in Another Folder (⇧⌘N, rebindable), Open Recent, Import Chat, and Export Chat. (#218)
• Import chats from HTML exports. Older HTML exports bring back their text only. (#196)
• Background tasks moved to a Tasks tab in the right-hand dock, with readable command names, folders, port chips, and running work listed first. (#278)
• The Preview dock tracks every local URL a dev script prints and shows the full URL. The agent is told which address a server actually bound, and is warned when a port belongs to another project's server. (#245)
• The agent can close, reopen, and toggle draft on pull requests, and close or reopen issues, with an approval each time. (#219)
• Headless flags: --effort, --max-turns, --max-cost, --verify, and --allow-shell-network, a prompt from stdin, and a final --json result line. (#220, #233)
• Slash commands and ship buttons (Create PR, /review, /agent) now show as a compact chip instead of the long prompt Houston sent, with the full instructions behind a disclosure. (#174)
• The Steered label on a message is kept when the chat is reopened. (#253)

Fixed

• Denying the macOS Keychain prompt no longer leaves key saves failing with no way out. Settings explains the fix and offers a Restart Houston button. (#158)
• .env values with secret-like names (SECRET, TOKEN, PASSWORD, …) are now redacted from output, and the agent can't write a redaction marker over a real secret. (#177)
• Closed several ways the agent could bypass approval prompts or permission rules: credential-file reads in parallel batches, subagent tool calls, apply_patch file rules, and respelled or quoted shell commands. Also fixed shell paths outside the project that went undetected, including Windows-style paths when Houston runs on macOS or Linux, and rule cleanup splitting chained commands into broader allows. (#182, #193, #206, #212, #213, #215, #226, #271)
• Closed symlink escapes: a repo's rules file or skill pointing outside the workspace is no longer read, and reverting a turn can no longer write outside the workspace. (#186, #194)
• The interactive Preview pane now blocks downloads and denies camera, microphone, location, and notification requests. (#185)
• Text from GitHub tool output (titles, branch names, error messages) is now marked as untrusted for the agent. (#222, #225)
• Reverting a turn no longer corrupts binary files, and the Revert bar now appears after every file-writing tool. (#197)
• Long single prompts are now compacted before they exceed the context window, and prompt caching stays effective across turns. (#181)
• A reply cut off at the output limit is continued automatically instead of ending the run, and a cut-off tool call is never run with empty arguments. (#189)
• A connection drop mid-reply now retries the turn instead of ending the run. (#239)
• A model the provider doesn't serve now gives a plain message, moves to your fallback model if one is set, and is flagged in the picker. (#242)
• Resending a message whose turn failed no longer sends it twice. (#243)
• Fixed conversations that became ...

0.8.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.8.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.8.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.8.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.8.0-x86_64.AppImage Houston-0.8.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Windows and Linux fixes, a host-aware system prompt, cheaper prompt caching, and defenses against injected text.

This release focuses on cross-platform parity, agent prompt quality, and hardening the agent against attacker-written content from GitHub, the web, and MCP servers.

Breaking changes

• None.

Added

• New system prompt guidance: the agent now verifies web apps by exercising real flows (log in, submit a form, call an endpoint) instead of just loading a page, reads values back from files or output rather than from what it meant to write, and never changes your local config (.env, credentials, tool or editor settings) to run a check. (#133)

Fixed

• Windows: format-on-save and post-edit diagnostics now run, so formatters and checkers like ruff, gofmt, prettier, and eslint are found and executed correctly. (#147)
• Windows: run_shell commands after the first in a session no longer fail to start. (#146)
• Windows: a deny permission rule on a directory now correctly covers the files inside it. (#146)
• Windows: routine commands using 2>/dev/null are no longer wrongly flagged as escaping the workspace and forced through approval. (#146)
• Windows: new git worktrees no longer show up as untracked. (#146)
• Windows: @-mentions now give correct directory suggestions and filename ranking in non-git folders. (#146)
• Linux: the agent is now told that view_localhost and the Preview panel usually cannot reach a dev server started by a separate run_shell command, and what to do instead, preventing wasted steps. (#143)
• Prompt caching: the system prompt now stays stable for the life of a conversation, so editing files no longer re-writes the whole history to cache on every turn (a significant cost reduction on coding sessions). (#134)
• Deleting a chat with "Delete & remove worktree" now shows a readable message when the worktree has uncommitted or untracked files, naming the branch and telling you the work was kept. (#127)
• Plan mode's refused-tools notice now names every tool it actually refuses, instead of an outdated short list. (#149)

Changed

• The system prompt is now host-aware: it names the actual OS and states whether shell commands run confined, with Git Bash / cmd.exe notes on Windows and BSD-tools notes on macOS, and gives clearer guidance on tool choice, scope, and verification. (#128)
• GitHub CI tools (gh_run_view, gh_run_list, gh_pr_checks) now isolate attacker-controllable text (job, step, check, and workflow names, and logs) behind a safety fence, so a fork's workflow cannot pose as trusted instructions to the agent. (#150)
• GitHub issue and pull request text, web_search results, and MCP tool results are now fenced as untrusted content, closing a path for injected text to steer the agent. (#139)
• Tool results, agent notices, tool descriptions, and prompts now use plain punctuation and wording, which read more cleanly in transcripts. (#131, #129)

0.7.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.7.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.7.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.7.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.7.0-x86_64.AppImage Houston-0.7.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Houston runs smoothly in new repos, picks dependencies that fit your toolchain, and runs longer on productive turns.

This release focuses on fresh git init projects, runtime detection, and smarter dependency choices by the agent.

Breaking changes

• None.

Added

• Houston now detects runtimes installed via nvm, fnm, Volta, mise, asdf, pyenv, rbenv, rustup, Go, Bun and Deno, and offers a one-click Install when a needed runtime is missing (#122)
• Productive turns can now run past the step cap automatically while they keep making progress, with a new Loop control setting (editing the step count pins the switch) (#116)
• The ship button now adapts to your repo state: Publish to GitHub, Push first commit, or Commit & push when there is no remote or no commits yet (#100)

Fixed

• macOS sandboxed commands can now signal their own child and grandchild processes, fixing kill EPERM failures in tools like next build, webpack and jest (#115)
• Git context, diffs and the Changes panel now work in a fresh repo with no commits, including staged files (#113)
• Starting a chat with a worktree in a repo that has no commits no longer fails silently (#111)
• The model picker now reads "No models configured" for a provider with no models (#124)

Changed

• Before scaffolding a project or adding a dependency, the agent now checks your installed toolchain and looks up current package versions instead of pinning versions from memory, and prefers packages without a native compile step (#125)

0.6.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.6.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.6.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.6.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.6.0-x86_64.AppImage Houston-0.6.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Refreshed the Claude, GPT-6, and Gemini model defaults with corrected pricing, plus faster chat titles.

New installs seed the latest model lineups, and existing installs have the new models appended automatically with nothing removed, so your current default and any models you still use keep working.

Breaking changes

• None.

Added

• Claude 5.x defaults: new installs seed Fable 5.1, Opus 5.5, Sonnet 5.5, and Haiku 4.5, with Opus 5.5 as the default. Existing installs get the three new models added (#108)
• GPT-6 line: new installs seed gpt-6-astra, gpt-6.1-sol (default), and gpt-6-luna, with the models added to existing installs too (#103)
• Gemini defaults: new installs seed Gemini 3.1 Pro Preview, 3.8 Flash (default), and 3.5 Flash Lite, with the models added to existing installs (#99)

Fixed

• Fresh installs no longer land on a broken Gemini default: the old 2.5 Pro seed could only fail for new accounts (#99)
• Claude 5.x models added via fetch from provider now show the reasoning toggle and R chip and send the correct thinking config, and keep working across long sessions (#98)
• Removed an em dash from the Changes panel scope line (#102)

Changed

• Chat titles now generate in parallel with the first turn, so they appear sooner instead of after a long turn finishes. Chats whose first turn errors or is aborted now also get a generated title (#95)
• Corrected per-model pricing for OpenAI, Gemini, and Claude models to match published rates (#103, #99, #98)

0.5.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.5.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.5.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.5.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.5.0-x86_64.AppImage Houston-0.5.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Share Houston from anywhere, smarter in-place updates, clearer connection errors, and live review findings.

This release also tightens shell permission matching and tidies saved rules.

Breaking changes

• None.

Required steps

• If you use shell permission rules, open Settings > Tools & Permissions and click "Clean up rules" to migrate saved rules: pure-scaffolding allows are dropped and keyword-prefixed allows (like do wc) unwrap to the real command. This closes a case where loop and subshell bodies could auto-approve or dodge a deny. (#85, #84)

Added

• Share Houston: a one-click share action in the sidebar footer, a "Share Houston…" menu item, a command palette entry, and /share in the terminal UI. macOS opens the native share menu; Windows and Linux copy the invite and offer email; the TUI copies over OSC 52 (works over SSH) and always prints the link. (#93)
• Automatic update checks every 6 hours while Houston is open, not just at launch. (#83)
• The "Check for Updates…" dialog now has an Update button that downloads and restarts into the new version on signed macOS. (#83)
• A "Check for Updates…" item in a new Help menu on Windows and Linux. (#88)
• Review findings now appear live under the review row as each reviewer reports, with verification status, skeptic votes, and a severity tally, instead of only in the final report. (#24)

Fixed

• Windows connection failures now trust the OS certificate store, so chats and title generation work behind TLS-inspecting proxies and endpoint security. (#87)
• Connection errors now include the real underlying cause (for example, an unresolved host or missing issuer certificate) instead of a bare "Connection error." (#87)
• "Clean up rules" now actually removes redundant and dead shell allow rules and shows a status line (removed N / already tidy / error). (#82)
• Count-only head/tail allow rules (like tail -60, head -c 4000) collapse to the bare program, so the Permissions panel no longer fills with near-duplicates. Rules naming a file or using tail -f stay exact. (#84)
• Replaced em dashes in retry, step-limit, output-limit, and verification notices in the chat transcript. (#89)

Changed

• Update downloads on Windows and Linux now go to the website instead of the GitHub Releases asset list. (#88)
• The Updates controls moved out of Settings > Appearance into their own Updates tab. (#88)
• "What's new" now appears as a non-modal card in the bottom-right corner that does not steal focus, instead of a centered modal. (#83)
• Restarting to install an update, and quitting with ⌘Q, now ask first when chats or background tasks (terminals, backgrounded shells) are still running. (#83)

0.4.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.4.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.4.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.4.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.4.0-x86_64.AppImage Houston-0.4.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI: macOS, Windows, Linux	houston-cli.cjs	Node 22 or newer, on x64 or Arm. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

Website redesign, plus more reliable shell handling and clearer update and download guidance.

This release reworks the marketing site and fixes several agent and shell behaviors.

Breaking changes

• None.

Added

• A small Beta badge now sits next to the Houston name across the website (#72)

Changed

• Redesigned the marketing website on a small light/dark design system, with clearer page structure and copy (#60)
• Download cards now use generic device outlines instead of platform logos (#53)
• A step-capped turn now ends with a plain-text summary of what finished, what's left, and how to continue, instead of a dropped tool call (#68)
• In full-auto, shell commands that reference /dev/null, other content-free devices, or the temp directories no longer trigger an approval prompt (#64)
• Removed the "Not affiliated with NASA." footer line, and made the Beta badge tint read clearly as blue in light mode (#73, #72)

Fixed

• The website now recommends the correct download for Apple Silicon Macs browsing in Safari (#71)
• Website assets revalidate on each use, so a corrected download recommendation shows as soon as a deploy lands instead of up to a day later (#74)
• A failed update check no longer shows the raw network error: offline now reads "Check your internet connection and try again." (#59)
• The terminal update notice headline is now trimmed at the first sentence rather than cut at 120 characters (#56)
• Tool calls whose arguments carry leaked tool-call markup are rejected instead of reaching you or failing with a misleading error (#67)
• kill_shell now reports what actually happened and cleans up orphaned background server processes that previously lingered and held ports (#66)
• Shell commands with file-descriptor redirections (for example 2>&1) are no longer mis-split, preventing bogus "Always allow" permission rules (#65)
• Wrapped list items now render as proper lists on the privacy page (#61)

0.3.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.3.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.3.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.3.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.3.0-x86_64.AppImage Houston-0.3.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI, any OS	houston-cli.cjs	Node 22 or newer. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

This is Houston's first public release, published from github.com/houston-code/houston. Since 0.2.0, the terminal client has grown into a full interactive REPL (a raw-mode composer with vim keys, a real command menu, reviewable diffs, queued follow-ups, /undo and /redo, and a /login wizard). Both clients can now steer a running turn. The agent gains scheduled and resumable subagents, GitHub review and merge tools, and notebook editing. There are new Azure OpenAI, Microsoft Foundry, Bedrock, and Vertex providers, plus fallback-model chains, and MCP servers can now use OAuth sign-in and elicitation. Security work bounds what a full-auto run can send off the machine and closes several shell-approval and SSRF gaps.

Breaking changes

None.

Required steps

None.

Added

• Contributing: the repository includes contributor guidelines.
• Steer a running turn from the desktop composer or the terminal instead of stopping it. If you decline a steer, it is queued as its own message.
• Desktop slash commands: /doctor health view, /agent <name> <task> to dispatch a workspace agent, /clear, /skills, /agents, and # to save a standing instruction to the instructions file Houston already reads.
• Per-model cost breakdown with the prompt-cache split, in the desktop control bar and in /cost. Cache usage is now reported for OpenAI-compatible, Gemini, and hosted providers, not just Anthropic, and host-listed per-model pricing is used when available.
• Terminal REPL:
  • A raw-mode composer with multi-line editing, bracketed paste, Ctrl-R history search, and vim keys.
  • A live command menu that includes project and user commands.
  • /login wizard for provider API keys (including a cloud provider's setup fields) and a /settings hub with /hooks and /mcp editing.
  • Reviewable diffs with line numbers, word-level marks, and highlighting.
  • Type while it works: follow-ups are queued, and Esc stops the run.
  • Shift-Tab cycles the approval mode, even mid-run.
  • /undo, /redo, and /changes over the existing file snapshots.
  • /agent to run one of your own subagents, and /spawned to open background sessions the agent started.
  • /reasoning, /mcp tools, /verbose, /output, /compact, /review, /plan, and custom commands.
  • ! runs a command in your own shell, and /image pastes your latest screenshot.
  • The agent's todo list is drawn in full, and you get a bell, title, or notification when a run needs you.
  • Light and colorblind-safe themes that are remembered.
  • --continue and --resume at launch, plus a version indicator, a daily update check, and /doctor.
• Bare houston command. The standalone CLI installs to ~/.local/bin. A new houston providers command adds and removes model hosts and stores their keys, and a missing key now gives a clear error that names the environment variable to set.
• --on-approval <allow|deny|fail> for headless runs decides what a gated tool call gets when there is no one to ask. It defaults to deny, so --approval auto-edit or the read-only default can't run shell commands or reach the network unattended; under --full-auto it defaults to allow. Use fail to exit non-zero when a run hits a permission wall.
• Providers: Azure OpenAI and Microsoft Foundry, native Amazon Bedrock and Google Vertex provider kinds, and fallback-model chains for when the selected model can't serve a turn. OpenAI Responses reasoning state is kept across tool calls. Gemini context windows come from the live model list, and explicit prompt caching is used on OpenAI-compatible routes that support it.
• Subagents and automation: scheduled runs, a model choice per dispatch, live progress, resumable and nested subagents, and a spawn_session tool for background sessions. Dispatched agents can get network access, but only with your consent.
• GitHub tools: gh_pr_review and gh_pr_merge.
• MCP: OAuth sign-in for remote servers, interactive elicitation (desktop, terminal, and headless), prompts, env and cwd settings, and clearer server status.
• Notebooks: .ipynb files are read as cells and edited cell by cell. Binary files are detected by their content.
• Editing: apply_patch accepts plain unified and git diff patches. The approval card shows line numbers and word-level diffs, and you can deny a request with a reason.
• Permissions: trusted folders (project config can be elevated only with your consent, and you can review those decisions in Settings or with /trust). There is also an admin-locked managed-policy tier that can only tighten rules, and a redesigned Permissions panel that generalizes and deduplicates run_shell rules.
• Skills and commands: skills can expose their bundled resource files. Custom commands can be user-scoped and support frontmatter and positional arguments, and @-completion now searches your files.
• Checkpoints are saved to disk and cover apply_patch. Context compaction uses a window-relative threshold and its state survives restarts.
• Built-in guide skill that lets Houston answer questions about its own features.
• Updater: shows download progress and offers restart-to-install.

Changed

• The bundled runtime is Electron 44.4.5 (Chromium 152), which includes upstream security fixes (#23).
• Default Gemini models moved to the 3.x line. Retired models and gemini-3.5-flash (which couldn't serve reliably) were removed from the defaults.
• The "no progress" stall stop is gone, so long read-only investigations are no longer cut short. Stall and budget nudges now appear as system notes instead of user turns.
• Provider defaults are chosen by capability order, and a model removed from Settings is dropped from the selection automatically.

Fixed

• Transient provider failures are retried, and the retry is reported. OpenAI, Responses, and Gemini now respect the requested max tokens. Gemini reports truncation and counts thinking tokens.
• Every write shows a true diff against the file on disk. An approval diff can no longer be empty, and the terminal no longer asks you to approve edits without showing them.
• apply_patch is all-or-nothing again: a failed patch is rolled back. Fuzzy edits re-adapt indentation, and several patch and edit data-loss gaps are closed.
• Cached reads are checked against disk before they are served. The JS search fallback now matches ripgrep, and real ripgrep errors are shown instead of a misleading message.
• Prompt-cache tokens are priced correctly, with one cost summary per turn.
• A steer that arrives during the final turn is no longer dropped or shown twice. Esc in /doctor no longer cancels a run.
• Terminal fixes: Ctrl-C interrupts a running turn, EOF no longer crashes a prompt, the /login key prompt no longer echoes the key, text is measured by Unicode width, and hook and MCP edits apply on the next message instead of after a restart.
• /model and /resume keep the saved model and conversation metadata in sync, including in headless resume.
• Windows gh.exe detection, and several MCP, markdown-rendering, and atomic-write (cross-process) reliability fixes.
• The website's Linux download buttons, the README install table, and the GPG example now use the real artifact names (#20).

Security

• Bounded exfiltration in full-auto: per-destination network consent, masking of credentials in outbound requests, a sandbox egress allowlist once shell network access is granted, and a prompt before reading credential or secret files.
• Untrusted web content: web_fetch output is fenced, screened for prompt injection, and read in isolation. DNS-name SSRF and DNS rebinding are blocked by pinning vetted IPs.
• Shell approvals: five fail-open gaps are closed. Permission-rule subjects are canonicalized so quoting and path tricks can't slip past a rule. Hook-rewritten arguments are re-checked, and a hook "approve" can't bypass a managed or project ask rule. A writable subagent's unconfined shell fails closed and prompts you.
• Secrets: subagent outputs are redacted before they reach the provider, and AWS temporary ...