Limboo v1.20.0

Limboo 1.20.0 (2026-08-31)

Changes since v1.19.0.

Limboo 1.20.0 makes the agent harness actually run. 1.19.0 repaired its
packaging; this release fixes the three separate reasons a run still could not
start, gives harness conversations memory between prompts, and moves the
harness runtime somewhere it belongs.

Fixed

• The harness could not start a run at all — for three independent reasons.
  Its one-time setup was refused by Limboo's own path guard on its very first
  command, so the install could never begin. No network port was ever handed to
  the agent bridge, which the harness requires and refuses to start without. And
  the method the adapter uses to reach that bridge was missing, so a run that got
  past the first two failed the moment the bridge came up. Each of these was
  enough on its own; all three are fixed, and the setup now completes.
• Setup failures were retried forever instead of being reported. A refusal
  that mentioned the network — such as the sandbox network policy blocking the
  download — was mistaken for a dropped connection and retried, though the same
  setting would produce it again immediately. Refusals are now recognised for
  what they are and reported once, with the reason.
• A failed setup command said nothing useful. If one of the approved commands
  ran and failed — a large download timing out is enough — it surfaced as a
  generic failed run. It now reports what failed and what the tool itself said to
  do about it, and is not retried: the package manager records the install as
  complete even when part of it failed, so re-running it fails identically.
• Every prompt started a new conversation, and left a process behind. Each
  turn opened a fresh harness session without ending the previous one, so the
  agent forgot the turn before and one background process accumulated per prompt.
• Non-Anthropic harnesses could never authenticate. They were handed
  Anthropic's credential variable names instead of their own, because the
  credential lookup read the configured harness rather than the one the selected
  model actually runs on.

Changed

• The harness keeps its runtime inside Limboo's own data directory. It used
  to be placed next to your worktree, which is Limboo-owned for a session with a
  worktree — but a session without one is rooted at your repository, so its
  runtime landed beside your project folder. It now always lives under Limboo's
  application data, never in your repository and never next to it. Existing
  installs will re-run the one-time setup once, in the new location.
• The setup panel says where the commands run. It listed the two commands and
  nothing else, so copying them into a terminal was the obvious thing to try —
  and it fails, because the lockfile they install from is written into the setup
  directory first. The panel now names that directory and the files placed in it.
  Your existing approval still stands: the commands themselves have not changed.
• The agent harness packages were updated (@ai-sdk/harness 1.0.91,
  @ai-sdk/harness-claude-code 1.0.94). Every assumption Limboo makes about
  their internals — where the runtime is installed, how the bridge binds, which
  harnesses can be permission-gated — was re-checked against the new versions.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

2 commit(s) in this release.

Limboo v1.19.0

Limboo 1.19.0 (2026-08-30)

Changes since v1.18.2.

Limboo 1.19.0 repairs the agent harness, which could not install itself in any
packaged build, and gives workspaces a way out of the app.

Fixed

• The harness could never complete its one-time setup. Packaging stripped
  every pnpm-lock.yaml in the tree — a rule meant for the project's own
  lockfile that also removed one the harness adapter reads at runtime. Without
  it the adapter could not describe its setup step, so runs died with
  ENOENT … not found in app.asar and Settings reported the harness needed no
  setup at all. The adapters' bridge assets now ship, and the project's own
  lockfiles are still excluded.
• A harness that could not describe its setup ran anyway, ungated. "This
  adapter installs nothing" and "this adapter could not say what it installs"
  were the same value internally, and the second silently skipped the approval
  gate, the sandbox network check and the prerequisite check along with it. They
  are now different states: the run is refused, and Settings says why instead of
  claiming there is nothing to approve.
• The setup panel contradicted itself. It described an install that needed
  your approval and, immediately below, said no setup was needed. Five different
  conditions — including a request still in flight and an outright failure —
  collapsed into that one sentence. Each now reports itself, and a failed request
  no longer reads as an absence of work.
• Removing a workspace left almost everything behind. Only the workspace's
  own record was deleted; its sessions, memories, search index, checkpoints,
  work-graph nodes and MCP entries stayed in the database permanently, since a
  re-added folder is issued a new id and can never reclaim them. Removal now
  clears all of it in one transaction, after tearing down each session's
  worktree, services and terminals — which is what the confirmation dialog had
  been promising all along. Global, non-workspace data is untouched.

Added

• Workspaces can be removed from the title-bar switcher. Removal existed only
  in the launcher, which appears when no workspace is open — so once you opened
  one there was no way to remove any. Each row in the dropdown now has a remove
  control, with the same confirmation dialog and the same guarantee that your
  project folder on disk is never touched.
• Missing setup prerequisites are named before you approve, not after a run
  fails. The check also stopped assuming pnpm: it reads whichever tools the
  adapter's own commands invoke, so an adapter that bootstraps with yarn, bun or
  corepack is checked just as precisely. Limboo still never substitutes one tool
  for another — the commands you approve are the commands that run.
• Tools installed in a user directory are found again. An app started from a
  desktop launcher inherits a much smaller PATH than a shell, so an installed
  pnpm, bun or nvm-managed Node could be reported missing. Setup now also looks
  where those install themselves.

Changed

• The title bar shows the workspace name alone. The initials badge in front
  of it repeated what the name already said. It remains in the launcher and the
  remove dialog, where a workspace has to be picked out of a set at a glance.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

8 commit(s) in this release.

Limboo v1.18.2

Limboo 1.18.2 (2026-08-13)

Changes since v1.18.1.

Fixed

• Agent settings now show the selected harness correctly. Choosing a Cursor
  Composer model marks Cursor as active and Claude Code as available but not
  selected, instead of showing Claude Code copy as though it were the running
  agent. Unknown model ids now display as unknown and stay blocked rather than
  falling back to Claude labels.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

2 commit(s) in this release.

Limboo v1.18.1

Limboo 1.18.1 (2026-08-13)

Changes since v1.18.0.

Fixed

• Settings workspace tabs crashed on open. The tab strip rendered the shared
  Settings icon without importing it, so opening Settings as a workspace document
  threw ReferenceError: Settings2 is not defined. The icon is now wired through
  the same lucide import as the rest of the tab strip.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

2 commit(s) in this release.

Limboo v1.18.0

Limboo 1.18.0 (2026-08-13)

Changes since v1.17.0.

Limboo 1.18.0 stabilizes the Cursor fixes from the beta, adds the swappable
harness layer, opens Settings as a workspace tab, and ships the beta update
channel as an opt-in path for future prereleases.

Fixed

• Cursor sessions denied every tool call. The hook runner read the event name
  from a single payload key that the CLI does not always send. With no event name
  it could not identify what was being asked, so it failed closed — which is the
  correct posture, but it meant every read, search, shell command and edit was
  refused, and nothing on screen said why. The event name now travels in the
  runner's own arguments, where Limboo writes it, with five payload spellings as
  fallbacks, and a genuine failure now names the missing key in the timeline
  instead of denying silently.
• Four more ways a Cursor run could stall. The permission helper could boot as
  a GUI process instead of a script and then hang for the full ten-minute hook
  timeout on every single tool call; nothing timed out while it waited for input;
  a successful approval could be truncated on its way out and be read as a
  refusal; and the sandbox denied the helper access to its own communication
  socket. Each is fixed, and each failure now reports what happened.
• "Prompt me for everything" meant "deny everything". Tightening the approval
  policy withdrew the rule that let Cursor read files at all. Because the only way
  to ask for permission on that path is the hook bridge, a session with hooks
  unavailable was left unable to read or to ask. Reads and inspection commands
  now keep their floor regardless of the policy; the permission gate still runs
  on top of it.
• A Cursor session could stream as Claude Code. The model was checked for
  character shape rather than for which provider serves it, and every Cursor
  model id passes that check — so a mis-routed model was handed to the Claude
  integration and ran there, with no error anywhere. Routing now has an explicit
  "unknown" answer, dispatch is exhaustive, and a model nothing claims fails by
  name instead of quietly running somewhere.
• Commit-message generation always used Claude. A Cursor-only user pressing
  the button started a Claude run and, with Claude not installed, was told to sign
  in to a product they were not using. It now follows the agent you selected, and
  the button is no longer disabled for Cursor users.
• Searching Settings missed several controls. Some settings were never
  registered in the search index, so typing their name found nothing. Fixed for
  the Agent and Runtime categories, with a check that fails the build if it
  happens again.
• Absolute paths inside your project were treated as escapes. Cursor's CLI
  writes full paths by default, and a full path to a file inside your own worktree
  was classified as leaving it — so ordinary reads were refused during planning.

Added

• Agents can run through a harness layer. Limboo now drives agents through
  Vercel AI SDK 7's harness abstraction as well as its own integrations, so a new
  agent runtime becomes an adapter rather than a new code path. Pi is available;
  Claude Code runs through it behind an opt-in switch. Everything above the
  adapter — the conversation, permissions, memory, search, the work graph, the
  runtime panel — is unchanged, because they all sit on one seam.
• A sandbox that runs on your own worktree. Every shipped sandbox for that
  abstraction is either a cloud service or a private filesystem, and neither
  fits: your repository must not leave the machine, and the agent has to edit the
  actual files that git, the diff viewer and checkpoints are watching. Limboo has
  its own, rooted at the session's worktree, with the same containment rules the
  rest of the app enforces — nothing outside the worktree, and never the app's own
  database, settings or secrets.
• Settings opens as a workspace tab. An icon beside the close button promotes
  the dialog into an editor tab, the way a diff opens. Both surfaces render the
  same panels, so nothing drifts. The tab has no Cancel: settings apply as you
  change them, exactly as they already did.
• An update channel you can choose. Settings › Updates now offers Stable or
  Beta. A beta is never downloaded in the background — you are shown its release
  notes and decide.

Changed

• Settings panels are flat rows. The Agent and MCP categories wrapped groups
  of settings in bordered panels while every other category used plain labelled
  rows, which made them look like a different application. The boxes are gone.
  Every input, button and select now uses one corner radius.
• The Agent panel is reorganised. Providers became Harnesses and now reads as
  one list instead of two hand-built cards. Connection and reliability moved to
  Runtime, where the rest of the supervision settings live. A section that
  contained no settings at all was removed, and the remainder is ordered by the
  decision you are making: which agent, which model, what it may do, what
  contains it.
• The model hint stopped being wrong. It named a default the app had not used
  for several versions, because the text was typed by hand next to the value it
  described. It is now derived from that value.

Security

• Built-in tools on the harness path are gated by Limboo. The harness
  abstraction has two separate approval surfaces, and the one Limboo had wired
  covers only tools the host supplies — built-in file writes and shell commands
  are governed by a different setting that defaults to allowing everything. On
  that path an agent could have written files and run commands without Limboo's
  permission gate. Every built-in tool call now suspends the turn and asks, using
  the same authority, the same risk labels, the same dialogs and the same audit
  trail as every other agent.
• A harness that cannot ask for permission is refused. Rather than run it with
  weaker enforcement, Limboo declines to start it and says so. This is not
  theoretical: the Codex adapter reports that it cannot request approval for its
  shell tool, so it is registered as unavailable with the reason shown rather than
  offered and then failing.
• The harness setup step asks first. Preparing a harness for its first run
  downloads its agent CLI, which is the only time Limboo reaches the network
  outside talking to your agent and fetching contributor avatars. The exact
  commands are read from the adapter and shown to you for approval once, and the
  approval is tied to those commands — if a later version changes them, you are
  asked again. Without approval the run does not start.
• Credentials are passed through, never stored. A harness receives an API key
  only if your own environment already has one, from an explicitly named list.
  Nothing is written to settings, accepted over the app's internal channels, put
  on a command line, or logged. A gap in log redaction that could have printed
  those variables is closed.
• Reads on the harness path cannot be gated, and the setting says so. The
  underlying runtime allows built-in file reads unconditionally, so
  "auto-approve reads" has no effect there. Rather than leave a control that looks
  like it works, the setting explains the limitation.

Known limitations

• The harness path is off by default. Claude Code and Cursor continue to run
  through their own integrations. Turn the harness on in Settings › Agent ›
  Harnesses if you want to try it; you will be asked to approve its setup step
  first.
• A harness conversation does not resume. Each message starts a fresh
  conversation with the underlying runtime. The alternative failed on every second
  message, so this is deliberate until the resume format is handled properly.
• Codex is unavailable. Its adapter cannot ask for permission before running
  shell commands. It is listed with that reason rather than hidden.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

3 commit(s) in this release.

Limboo v1.18.0-beta.2

Limboo 1.18.0-beta.2 (2026-08-12)

Changes since v1.18.0-beta.1.

The first beta. Two bugs that made Cursor sessions unusable are fixed, agents can
now run through a swappable harness layer instead of one hardcoded integration,
and Settings opens as a workspace tab. This build is published for testing ahead
of a stable release — read the warning at the top of these notes before
installing it over a working copy.

Fixed

• Cursor sessions denied every tool call. The hook runner read the event name
  from a single payload key that the CLI does not always send. With no event name
  it could not identify what was being asked, so it failed closed — which is the
  correct posture, but it meant every read, search, shell command and edit was
  refused, and nothing on screen said why. The event name now travels in the
  runner's own arguments, where Limboo writes it, with five payload spellings as
  fallbacks, and a genuine failure now names the missing key in the timeline
  instead of denying silently.
• Four more ways a Cursor run could stall. The permission helper could boot as
  a GUI process instead of a script and then hang for the full ten-minute hook
  timeout on every single tool call; nothing timed out while it waited for input;
  a successful approval could be truncated on its way out and be read as a
  refusal; and the sandbox denied the helper access to its own communication
  socket. Each is fixed, and each failure now reports what happened.
• "Prompt me for everything" meant "deny everything". Tightening the approval
  policy withdrew the rule that let Cursor read files at all. Because the only way
  to ask for permission on that path is the hook bridge, a session with hooks
  unavailable was left unable to read or to ask. Reads and inspection commands
  now keep their floor regardless of the policy; the permission gate still runs
  on top of it.
• A Cursor session could stream as Claude Code. The model was checked for
  character shape rather than for which provider serves it, and every Cursor
  model id passes that check — so a mis-routed model was handed to the Claude
  integration and ran there, with no error anywhere. Routing now has an explicit
  "unknown" answer, dispatch is exhaustive, and a model nothing claims fails by
  name instead of quietly running somewhere.
• Commit-message generation always used Claude. A Cursor-only user pressing
  the button started a Claude run and, with Claude not installed, was told to sign
  in to a product they were not using. It now follows the agent you selected, and
  the button is no longer disabled for Cursor users.
• Searching Settings missed several controls. Some settings were never
  registered in the search index, so typing their name found nothing. Fixed for
  the Agent and Runtime categories, with a check that fails the build if it
  happens again.
• Absolute paths inside your project were treated as escapes. Cursor's CLI
  writes full paths by default, and a full path to a file inside your own worktree
  was classified as leaving it — so ordinary reads were refused during planning.

Added

• Agents can run through a harness layer. Limboo now drives agents through
  Vercel AI SDK 7's harness abstraction as well as its own integrations, so a new
  agent runtime becomes an adapter rather than a new code path. Pi is available;
  Claude Code runs through it behind an opt-in switch. Everything above the
  adapter — the conversation, permissions, memory, search, the work graph, the
  runtime panel — is unchanged, because they all sit on one seam.
• A sandbox that runs on your own worktree. Every shipped sandbox for that
  abstraction is either a cloud service or a private filesystem, and neither
  fits: your repository must not leave the machine, and the agent has to edit the
  actual files that git, the diff viewer and checkpoints are watching. Limboo has
  its own, rooted at the session's worktree, with the same containment rules the
  rest of the app enforces — nothing outside the worktree, and never the app's own
  database, settings or secrets.
• Settings opens as a workspace tab. An icon beside the close button promotes
  the dialog into an editor tab, the way a diff opens. Both surfaces render the
  same panels, so nothing drifts. The tab has no Cancel: settings apply as you
  change them, exactly as they already did.
• An update channel you can choose. Settings › Updates now offers Stable or
  Beta. A beta is never downloaded in the background — you are shown its release
  notes and decide.

Changed

• Settings panels are flat rows. The Agent and MCP categories wrapped groups
  of settings in bordered panels while every other category used plain labelled
  rows, which made them look like a different application. The boxes are gone.
  Every input, button and select now uses one corner radius.
• The Agent panel is reorganised. Providers became Harnesses and now reads as
  one list instead of two hand-built cards. Connection and reliability moved to
  Runtime, where the rest of the supervision settings live. A section that
  contained no settings at all was removed, and the remainder is ordered by the
  decision you are making: which agent, which model, what it may do, what
  contains it.
• The model hint stopped being wrong. It named a default the app had not used
  for several versions, because the text was typed by hand next to the value it
  described. It is now derived from that value.

Security

• Built-in tools on the harness path are gated by Limboo. The harness
  abstraction has two separate approval surfaces, and the one Limboo had wired
  covers only tools the host supplies — built-in file writes and shell commands
  are governed by a different setting that defaults to allowing everything. On
  that path an agent could have written files and run commands without Limboo's
  permission gate. Every built-in tool call now suspends the turn and asks, using
  the same authority, the same risk labels, the same dialogs and the same audit
  trail as every other agent.
• A harness that cannot ask for permission is refused. Rather than run it with
  weaker enforcement, Limboo declines to start it and says so. This is not
  theoretical: the Codex adapter reports that it cannot request approval for its
  shell tool, so it is registered as unavailable with the reason shown rather than
  offered and then failing.
• The harness setup step asks first. Preparing a harness for its first run
  downloads its agent CLI, which is the only time Limboo reaches the network
  outside talking to your agent and fetching contributor avatars. The exact
  commands are read from the adapter and shown to you for approval once, and the
  approval is tied to those commands — if a later version changes them, you are
  asked again. Without approval the run does not start.
• Credentials are passed through, never stored. A harness receives an API key
  only if your own environment already has one, from an explicitly named list.
  Nothing is written to settings, accepted over the app's internal channels, put
  on a command line, or logged. A gap in log redaction that could have printed
  those variables is closed.
• Reads on the harness path cannot be gated, and the setting says so. The
  underlying runtime allows built-in file reads unconditionally, so
  "auto-approve reads" has no effect there. Rather than leave a control that looks
  like it works, the setting explains the limitation.

Known limitations

• Beta builds are not released builds. Features may change or be removed
  before release. Settings and session data move forward but not back, so a build
  made after this one may not read data this one wrote. Keep a stable install for
  work you cannot repeat.
• The harness path is off by default. Claude Code and Cursor continue to run
  through their own integrations. Turn the harness on in Settings › Agent ›
  Harnesses if you want to try it; you will be asked to approve its setup step
  first.
• A harness conversation does not resume. Each message starts a fresh
  conversation with the underlying runtime. The alternative failed on every second
  message, so this is deliberate until the resume format is handled properly.
• Codex is unavailable. Its adapter cannot ask for permission before running
  shell commands. It is listed with that reason rather than hidden.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

3 commit(s) in this release.

Limboo v1.17.0

Limboo 1.17.0 (2026-08-01)

Changes since v1.16.0.

Plan Mode now stops. A plan waits for your decision instead of sliding into
implementation, and the plan you are shown is the plan the agent actually wrote —
which, until this release, it very often was not. Git also becomes a platform
service in its own right, so repository work reads as part of the conversation
rather than something that happened in a side panel.

Added

• Plan approval is a real stop, not a prompt. When the agent presents a plan,
  execution halts: no further model calls, no new prompts, no background work,
  and every tool is refused until you decide. Approving continues the same turn
  rather than starting a new one, so the agent keeps everything it had learned
  while planning. Approve, Approve & accept edits, Keep planning, Reject and
  Archive are the only things that move it forward.
• Keep planning now sends feedback. Instead of discarding the plan and
  starting over, it hands your notes to the agent, which revises and presents
  again — same conversation, same context.
• Plans are versioned. A session has one plan; refinements replace it and the
  previous text moves into History. Two windows on the same session can no longer
  approve different plans, and a plan that changed while you were reading it says
  so rather than acting on the stale copy.
• A pending plan survives a restart. Quit with a plan awaiting approval and it
  is still there on relaunch, with its buttons live and implementation still
  locked. Approving after a restart starts a fresh run carrying the plan text,
  because the paused conversation cannot outlive the process.
• Git is a platform service. Repository actions post structured entries into
  the conversation carrying the paths, commit and checkpoint behind them, with
  Open Diff, View Commit, Restore Checkpoint and Copy Command on each.
• Optional GitHub CLI integration. If gh is installed and signed in, a
  GitHub sub-tab lists pull requests and issues, and the agent can read them
  through the tools it already has. Limboo stores no GitHub credential —
  authentication stays the CLI's. Posting a comment is gated and shows the exact
  body first.
• Contributor avatars in history, fetched in the main process and embedded so
  no page ever requests a remote image. Behind git.avatars.enabled, which is
  off-limits by default in the sense that turning it on is the thing that tells
  GitHub which repository you are browsing — the setting says so.

Changed

• The integrated terminal is its own column between the conversation and the
  drawer, instead of competing for the drawer with Files and Changes.
• The Activity and Hooks drawer panels are gone. The Hook Engine, its audit
  log and every hook setting are untouched — only the two panels and the IPC they
  were the sole consumers of were removed.
• Switching sessions is now an ordered handover. Worktree, file watcher, git
  status, search index, memory scope, MCP and the agent are rebound in sequence,
  and a thin ribbon says so while it happens. Switching quickly between sessions
  cancels the stale work rather than letting it finish over the newer session.

Fixed

• The plan you approved was usually empty. Current Claude releases write the
  plan to a file and pass no plan text to the tool Limboo was reading, so almost
  every captured plan was blank — and because the tool was blocked, no plan file
  was produced either. Approving then sent an empty plan, the agent re-derived
  the work from scratch, and the empty plan was filed as completed. Limboo now
  tells the agent where to write its plan and reads it from there, with the
  agent's own copy taking over once the plan is approved.
• Starting a new plan could silently destroy the one you were reviewing when
  plan history was turned off. A pending plan is never discarded without being
  filed first, and starting a second plan while one awaits approval is refused.
• A failed or cancelled planning run reported itself as "rejected", which is
  what the app says when a person declines a plan. Those now read as ended, with
  the reason recorded, so declining and crashing no longer look identical.
• An unrelated prompt could mark a stalled plan complete. Only the run that
  was actually released to implement a plan can finish it.
• Live planning progress replayed the previous attempt's steps after asking
  for a new plan, because it measured from when the plan first existed rather
  than when the current attempt started.
• Deleting a session left its plan revisions behind in the database.
• A machine without git looked like a folder without a repository, and the app
  offered to initialise one — an action that could never succeed. Limboo now
  detects the missing binary and names the install command for your platform.
• Settings could be hand-edited into a dead drawer tab or an unbounded panel
  width; both are now validated and clamped on load.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

3 commit(s) in this release.

Limboo v1.16.0

Limboo 1.16.0 (2026-07-30)

Changes since v1.15.0.

A tighter follow-up to the runtime ring. The panel it opens now answers one
question instead of four, and the conversation beneath it reads as one reply
again rather than a stack of cards.

Changed

• The runtime panel is the context window, and nothing else. It opened with
  four collapsible sections, and three of them earned their space only
  occasionally: request usage and long-term usage said "not reported" on any
  agent that does not publish quotas, and execution detail was a nineteen-row
  list behind a header that was folded shut by default. Together they pushed the
  panel past the height it is allowed inside the workspace, where the bottom of
  it was cut off rather than scrollable. The context breakdown is now the whole
  panel — no section headers, no folding, no order to remember, and nothing
  clipped.
• Settings match what the panel now shows. Show estimated cost, the quota
  warning threshold, show usage history and the section ordering controls are
  gone rather than left on screen doing nothing, and "Ring measures" now offers
  the two context options it can actually draw. If you had it set to quota, it
  falls back on its own.
• Nothing stopped being measured. Quota windows, usage samples and run
  rollups are still collected and still stored. The Work Graph's Stats tab and
  the JSON and CSV exports carry every field they did before — only the hover
  panel got smaller.

Fixed

• A reply broken up by tool calls sprouted a toolbar per fragment. Message
  actions rendered on every block of an answer rather than once for the
  exchange, so a reply interrupted three times showed three sets of buttons.
  Actions now sit with the message you sent, which is the one stable anchor a
  turn has.
• The conversation read as a stack of cards. Hidden toolbars still occupied
  their full height, and consecutive parts of a single answer sat about forty
  pixels apart. An answer now reads as one continuous reply, with the wider
  spacing kept for the boundary between exchanges.
• Exporting from a message gave you the question without the answer. Export
  now covers the whole exchange — what you asked, what came back, and what was
  run in between. Copy and Copy as Markdown are unchanged and still copy the one
  message, as their labels say.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

4 commit(s) in this release.

Limboo v1.15.0

Limboo 1.15.0 (2026-07-29)

Changes since v1.14.0.

You can now see what a long session is actually costing you. A small ring beside
the composer status fills as the conversation consumes the model's context
window, and hovering it opens a live breakdown of where that context went —
which is the difference between noticing you are running out and finding out
when the agent starts forgetting.

Added

• A live runtime ring beside the agent status. It fills as the context
  window fills, turns amber and then red as it runs low, and breathes while the
  agent is working. It is there from the moment a session opens — before
  anything has been measured it shows as unmeasured rather than as empty, which
  are different things.
• Hover it for the full picture. A floating panel shows how much of the
  context window is used and left, how much is reserved for the reply, roughly
  how many more exchanges fit before the conversation has to be compressed, and
  when compression last happened.
• See what filled the context. A single bar splits the window into who took
  what: your conversation, results from tools, answers from connected servers,
  recalled memories, retrieved project context, the repository delta, and staged
  attachments. Hovering any band names the part of Limboo responsible for it.
• Nothing is guessed at. The total, the window size and the reservation are
  measured by the provider. The split beneath them is Limboo counting what it
  composed, and is marked with a ~ everywhere it appears. When those estimates
  would exceed what was actually measured — after a compression, or on a resumed
  conversation — the split is dropped rather than quietly rescaled to fit.
• Rate limits before they stop you. Rolling usage windows now come from the
  provider's own updates as they arrive, with how much is consumed, when it
  resets, and whether you are drawing on overage. Until now Limboo learned about
  a limit by reading the error after you had already hit it.
• Usage over time. Long-running windows keep a local trend so you can see a
  week's consumption building rather than only today's number.
• Execution detail on demand. Active model, mode, time to first token,
  generation speed, run duration, cache reads, an estimated cost, retries, the
  worktree, connected servers, index status and attachment count.
• It says what a provider cannot tell it. Cursor's command-line interface
  reports no token counts and no quotas, so those sections say exactly that,
  naming the limitation instead of showing a zero that reads as "nothing used".
  Every metric is something the running agent declares it can measure, so a
  future agent lights up whatever it supports with no change to the interface.
• Run costs in the work graph. A new Stats tab lists each run with its shape
  and its cost side by side — nodes, tools, errors, duration, tokens, peak
  context and estimated spend.
• More ways to export a work graph. NDJSON, GraphML and PlantUML join the
  existing formats, you can export just the selected part of a graph rather than
  the whole session, optionally include run costs, and export every session at
  once into a folder you pick.
• Settings under Agent › Runtime Indicators. Turn the whole thing off, or
  tune the ring's size, thickness, position and what it measures; choose
  percentages or token counts; reorder or collapse panel sections; set the
  thresholds that turn it amber, red, or raise a notification; and control how
  long usage history is kept.

Security

• Nothing that identifies your machine leaves the main process. Worktree
  paths are reduced to a name rather than a full path to your home directory,
  the provider's conversation id is shown truncated with no way to reveal the
  rest, and the one place a raw error message is surfaced has secrets and paths
  stripped from it first.
• Stored usage cannot contain your work. The tables behind the history have
  no column that can hold a prompt, a message, a file path or a tool input, so
  an export cannot leak them — and exports are assembled field by field rather
  than dumped wholesale. Turning off "Store usage history" genuinely stops all
  writing, for deployments that forbid keeping it.
• No new network access. Every number comes from the stream Limboo already
  receives to display the conversation. Nothing is polled and nothing is sent.

Fixed

• The work graph panel crashed the drawer. Opening it threw immediately and
  took the surrounding panel down with it.
• Threshold sliders were unusable. Ring size, thickness and every warning
  threshold were squeezed into a sliver at the edge of their row, so touching
  one snapped it to its lowest value. They now use the same full-width slider as
  the rest of settings.
• The runtime panel could be cut off. It was allowed to grow taller than the
  workspace it opens inside, which clipped the bottom of it on shorter windows.
  It is now capped, with only the context section open by default.
• Injected memory and context counts were wrong. The panel reported the
  configured maximum rather than how many were actually recalled.
• Runtime updates could keep running after you closed the window. Closing or
  reloading a window while the panel was open left Limboo updating at full rate
  for a window that no longer existed.
• Negative values were mangled in exported spreadsheets. A guard against
  spreadsheet formula injection was also catching negative numbers and turning
  them into text.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

3 commit(s) in this release.

Limboo v1.14.0

Limboo 1.14.0 (2026-07-29)

Changes since v1.13.2.

When the agent hands work to a specialist, you can finally watch it happen.
Delegated work used to arrive as an anonymous pile of tool calls mixed into the
main reply; it now reads as one line you can open, follow live, and take apart
afterwards — without ever leaving the conversation.

Added

• Delegated work reads as one activity. When the agent hands a job to a
  specialist — exploring the repository, reviewing code, running tests — the
  conversation shows a single line naming the worker and what it was asked to do,
  with its progress underneath. The worker's own tool calls no longer scatter
  through the reply as if the main agent had run them. Opening the line shows how
  long it took, which model it used, what it read and changed, which tools and
  connected servers it reached, what it verified, and what it concluded.
• Live progress in the worker's own words. While a specialist works, it
  reports what it is doing in plain language — "Analyzing authentication module"
  — refreshed as it goes. When that is unavailable the progress is worked out
  from the tools it is using, so there is always something to read.
• Open a worker in its own tab. Maximize a delegation and it opens beside
  your files as a full-width tab: live progress, everything it ran, its notes and
  its conclusion, following along as it works. Minimizing returns it to the
  conversation exactly where you left it — same scroll position, same sections
  open. If the worker pauses for permission while you are watching, you can
  answer without going back.
• Actions on every delegation. Copy the conclusion or the worker's notes,
  export the whole record as Markdown, jump to it in the work graph, or open any
  file it changed straight into a diff. Copying while it is still working
  captures everything that has arrived.
• Delegated work in the task list. Specialists running right now appear under
  the task they belong to, with finished ones collected below it, so a long
  execution can be followed from the Tasks panel without reading the whole
  conversation.
• Settings for delegated work. Under Agent › Subagents you can turn the
  inline activity off, stop requesting live progress descriptions, or stop
  keeping a worker's notes.

Fixed

• The plan was dumped into the conversation as raw text. Approving a plan
  sent it to the agent, and everything sent to the agent is shown — so the whole
  plan appeared in a chat bubble as unformatted markup, tags and all, sometimes
  thousands of characters of it. The approval now reads as one line with the plan
  beneath it, properly formatted and collapsed by default. Nothing is hidden:
  viewing the message raw still shows exactly what the agent received.
• Checklists in plans rendered twice over. Every - [ ] item drew a tick box
  and a bullet, on plans that are almost entirely checklists. Ticked items are
  now also greyed, so a plan reads like a plan.
• The Tasks panel could go blank. A specialist that failed or was denied took
  the whole panel down with it.
• Long output was hard to read and hard to escape. A worker's notes and
  conclusion ran together with everything around them at a size that fought its
  surroundings, inside a small scrolling box that trapped the page. They are now
  properly separated, one consistent size, and clipped with a clear way to read
  the rest.
• A worker's tool list could bury everything below it. A specialist that
  reads thirty files pushed its own conclusion off the screen. Long lists now
  arrive folded, with the count and anything still running or failed still
  visible.
• Delegated work went unrecognized on current agent versions. The tool that
  starts a specialist was renamed upstream, and Limboo only recognized the old
  name — so on any recent version delegated work was recorded as ordinary tool
  calls and never appeared as delegation at all. Both names are now recognized.
• A specialist's work vanished when you sent the next message. A worker still
  running when you typed again had the rest of its work spill into the new turn
  as loose tool calls. Its record also now survives restarting the app.
• Sessions were named after approving a plan. An untitled session took its
  name from the approval instead of from what you had asked for.

Security

• "Always allow" no longer grants more than you agreed to. Allowing an action
  for the session applied to every later action, whatever its kind — approving a
  file read also pre-approved writing files and running commands, and satisfied
  the guard on secrets like .env files and private keys. It now applies only to
  the kind of action you were actually shown, and access to secrets always asks
  on its own.
• A specialist's notes are treated as untrusted. What a worker writes is
  stored and shown as text, with a size limit, and is never fed back to the agent
  as instructions.
• Approvals name the worker that asked. A permission request raised inside a
  delegation says so — and when it cannot be attributed with certainty, it says
  nothing rather than guessing.

Installing

Platform	File	Notes
Windows x64 / arm64	Limboo-Setup-*-<arch>.exe	If SmartScreen warns, choose More info → Run anyway.
macOS Apple silicon / Intel	Limboo-*-arm64.dmg / Limboo-*-x64.dmg	If Gatekeeper blocks it, right-click → Open, or xattr -dr com.apple.quarantine /Applications/Limboo.app.
Debian / Ubuntu	limboo-*-<arch>.deb
Fedora / RHEL / openSUSE	limboo-*-<arch>.rpm
Arch / Manjaro	limboo-*-<arch>.pacman	sudo pacman -U <file>
Any Linux	limboo-*-<arch>.AppImage	chmod +x first. On Ubuntu 24.04+ install libfuse2t64, or it fails with error loading libfuse.so.2.
Any Linux (no installer)	limboo-*-<arch>.tar.gz	Extract and run ./Limboo.

Once installed, Limboo updates itself from this feed — including the deb, rpm
and pacman builds, which apply updates through your package manager.

Verifying this release

Each artifact is listed in SHA256SUMS. Verify with sha256sum -c SHA256SUMS,
and verify build provenance with gh attestation verify <file> --repo limboo-ai/limboo.

1 commit(s) in this release.