0.3.0

Download

Platform	File	Requirements
macOS, Apple Silicon	Houston-0.3.0-arm64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
macOS, Intel	Houston-0.3.0-x64.dmg	macOS 13 Ventura or newer. Open the .dmg and drag Houston to Applications.
Windows, x64	Houston-0.3.0-x64-setup.exe	Windows 10 or newer. Per-user install, no admin needed. Not code-signed yet: in the SmartScreen prompt choose More info, then Run anyway.
Linux, x64	Houston-0.3.0-x86_64.AppImage Houston-0.3.0-amd64.deb	glibc 2.35 or newer (Ubuntu 22.04+). The AppImage shows a banner when a new version is out. The .deb does not check, so download new versions yourself.
Terminal CLI, any OS	houston-cli.cjs	Node 22 or newer. Run node houston-cli.cjs --help to start.

To check a download, compare it against SHA256SUMS, which is signed with GPG and cosign. Verifying downloads has the steps.

The other files below are the auto-update feeds, signatures, build provenance and SBOMs. You do not need them to install Houston.

What's changed

This is Houston's first public release, published from github.com/houston-code/houston. Since 0.2.0, the terminal client has grown into a full interactive REPL (a raw-mode composer with vim keys, a real command menu, reviewable diffs, queued follow-ups, /undo and /redo, and a /login wizard). Both clients can now steer a running turn. The agent gains scheduled and resumable subagents, GitHub review and merge tools, and notebook editing. There are new Azure OpenAI, Microsoft Foundry, Bedrock, and Vertex providers, plus fallback-model chains, and MCP servers can now use OAuth sign-in and elicitation. Security work bounds what a full-auto run can send off the machine and closes several shell-approval and SSRF gaps.

Breaking changes

None.

Required steps

None.

Added

• Contributing: the repository includes contributor guidelines.
• Steer a running turn from the desktop composer or the terminal instead of stopping it. If you decline a steer, it is queued as its own message.
• Desktop slash commands: /doctor health view, /agent <name> <task> to dispatch a workspace agent, /clear, /skills, /agents, and # to save a standing instruction to the instructions file Houston already reads.
• Per-model cost breakdown with the prompt-cache split, in the desktop control bar and in /cost. Cache usage is now reported for OpenAI-compatible, Gemini, and hosted providers, not just Anthropic, and host-listed per-model pricing is used when available.
• Terminal REPL:
  • A raw-mode composer with multi-line editing, bracketed paste, Ctrl-R history search, and vim keys.
  • A live command menu that includes project and user commands.
  • /login wizard for provider API keys (including a cloud provider's setup fields) and a /settings hub with /hooks and /mcp editing.
  • Reviewable diffs with line numbers, word-level marks, and highlighting.
  • Type while it works: follow-ups are queued, and Esc stops the run.
  • Shift-Tab cycles the approval mode, even mid-run.
  • /undo, /redo, and /changes over the existing file snapshots.
  • /agent to run one of your own subagents, and /spawned to open background sessions the agent started.
  • /reasoning, /mcp tools, /verbose, /output, /compact, /review, /plan, and custom commands.
  • ! runs a command in your own shell, and /image pastes your latest screenshot.
  • The agent's todo list is drawn in full, and you get a bell, title, or notification when a run needs you.
  • Light and colorblind-safe themes that are remembered.
  • --continue and --resume at launch, plus a version indicator, a daily update check, and /doctor.
• Bare houston command. The standalone CLI installs to ~/.local/bin. A new houston providers command adds and removes model hosts and stores their keys, and a missing key now gives a clear error that names the environment variable to set.
• --on-approval <allow|deny|fail> for headless runs decides what a gated tool call gets when there is no one to ask. It defaults to deny, so --approval auto-edit or the read-only default can't run shell commands or reach the network unattended; under --full-auto it defaults to allow. Use fail to exit non-zero when a run hits a permission wall.
• Providers: Azure OpenAI and Microsoft Foundry, native Amazon Bedrock and Google Vertex provider kinds, and fallback-model chains for when the selected model can't serve a turn. OpenAI Responses reasoning state is kept across tool calls. Gemini context windows come from the live model list, and explicit prompt caching is used on OpenAI-compatible routes that support it.
• Subagents and automation: scheduled runs, a model choice per dispatch, live progress, resumable and nested subagents, and a spawn_session tool for background sessions. Dispatched agents can get network access, but only with your consent.
• GitHub tools: gh_pr_review and gh_pr_merge.
• MCP: OAuth sign-in for remote servers, interactive elicitation (desktop, terminal, and headless), prompts, env and cwd settings, and clearer server status.
• Notebooks: .ipynb files are read as cells and edited cell by cell. Binary files are detected by their content.
• Editing: apply_patch accepts plain unified and git diff patches. The approval card shows line numbers and word-level diffs, and you can deny a request with a reason.
• Permissions: trusted folders (project config can be elevated only with your consent, and you can review those decisions in Settings or with /trust). There is also an admin-locked managed-policy tier that can only tighten rules, and a redesigned Permissions panel that generalizes and deduplicates run_shell rules.
• Skills and commands: skills can expose their bundled resource files. Custom commands can be user-scoped and support frontmatter and positional arguments, and @-completion now searches your files.
• Checkpoints are saved to disk and cover apply_patch. Context compaction uses a window-relative threshold and its state survives restarts.
• Built-in guide skill that lets Houston answer questions about its own features.
• Updater: shows download progress and offers restart-to-install.

Changed

• The bundled runtime is Electron 44.4.5 (Chromium 152), which includes upstream security fixes (#23).
• Default Gemini models moved to the 3.x line. Retired models and gemini-3.5-flash (which couldn't serve reliably) were removed from the defaults.
• The "no progress" stall stop is gone, so long read-only investigations are no longer cut short. Stall and budget nudges now appear as system notes instead of user turns.
• Provider defaults are chosen by capability order, and a model removed from Settings is dropped from the selection automatically.

Fixed

• Transient provider failures are retried, and the retry is reported. OpenAI, Responses, and Gemini now respect the requested max tokens. Gemini reports truncation and counts thinking tokens.
• Every write shows a true diff against the file on disk. An approval diff can no longer be empty, and the terminal no longer asks you to approve edits without showing them.
• apply_patch is all-or-nothing again: a failed patch is rolled back. Fuzzy edits re-adapt indentation, and several patch and edit data-loss gaps are closed.
• Cached reads are checked against disk before they are served. The JS search fallback now matches ripgrep, and real ripgrep errors are shown instead of a misleading message.
• Prompt-cache tokens are priced correctly, with one cost summary per turn.
• A steer that arrives during the final turn is no longer dropped or shown twice. Esc in /doctor no longer cancels a run.
• Terminal fixes: Ctrl-C interrupts a running turn, EOF no longer crashes a prompt, the /login key prompt no longer echoes the key, text is measured by Unicode width, and hook and MCP edits apply on the next message instead of after a restart.
• /model and /resume keep the saved model and conversation metadata in sync, including in headless resume.
• Windows gh.exe detection, and several MCP, markdown-rendering, and atomic-write (cross-process) reliability fixes.
• The website's Linux download buttons, the README install table, and the GPG example now use the real artifact names (#20).

Security

• Bounded exfiltration in full-auto: per-destination network consent, masking of credentials in outbound requests, a sandbox egress allowlist once shell network access is granted, and a prompt before reading credential or secret files.
• Untrusted web content: web_fetch output is fenced, screened for prompt injection, and read in isolation. DNS-name SSRF and DNS rebinding are blocked by pinning vetted IPs.
• Shell approvals: five fail-open gaps are closed. Permission-rule subjects are canonicalized so quoting and path tricks can't slip past a rule. Hook-rewritten arguments are re-checked, and a hook "approve" can't bypass a managed or project ask rule. A writable subagent's unconfined shell fails closed and prompts you.
• Secrets: subagent outputs are redacted before they reach the provider, and AWS temporary key IDs and Google OAuth tokens are now detected. Houston warns when key storage falls back to weak encryption.
• Files: credential files (the CLI credentials, MCP OAuth tokens, shell snapshots) are written owner-only (0600).
• Other: git-derived writable roots are validated. MCP refuses a cross-origin SSE endpoint before sending credentials. Exported conversations carry a Content-Security-Policy.
• Releases are gated on a scan of the bundled native runtime, and ship with SBOMs, cosign signatures, and SHA-256 checksums (see the README for how to verify a download).