v0.1.63

Arslan 0.1.63 — change course mid-reply, answers as they are written, undo a turn

Arslan does more of a task in one reply, shows its answer as it writes it, lets you add a message while it works, and can take a turn back. Two safety changes come first, because they change what you see.

Arslan asks before every new command, for now. Every terminal command shows you a card first, unless you choose otherwise. This applies to everyone, including anyone who had chosen "Ask only for risky commands" before: on the first start of 0.1.63 that choice is switched once, and a choice you make afterwards is kept. The reason: Arslan's judgement of which commands are harmless enough to run without asking has known gaps, which 0.1.64 closes. A command you allowed "In this conversation" runs again in that conversation without asking, so the setting reads "every new command". The cost is more cards: in our pre-release test (27 runs on DeepSeek), asking before every new command showed 51 command cards, against 4 with "Ask only for risky commands". To switch back: Settings › What Arslan may do › Terminal › When to ask › "Ask only for risky commands". Choosing it first tells you what it misses in this version (see Known limits) and asks you to confirm. Beside it, a note says its judgement is completed in 0.1.64, and one sentence says where to undo a turn; the chat shows one line while it is on. If you were on "Ask only for risky commands" before 0.1.63, by your choice or because it was the default, Arslan tells you once, the first time you open it after the upgrade: that it now asks before every command, why, and how to switch back.

Scheduled tasks don't run commands in this version. A step that needs a command is skipped and listed in your Inbox, whatever you allowed before ("Always", "In this conversation", "Ask only for risky commands"). A scheduled task is told this before it starts. It can still look things up, save files in Arslan's own folder, and call MCP tools the server marks read-only.

Change course while Arslan works. Type a message while a reply is running (in the Mac window, on the iPhone, or with hold-to-talk) and it reaches that reply at its next step, instead of waiting for the reply to end. The steps not started yet are skipped and the reply reads your message first; the window says it was added. A reply already writing its final answer has no step left, so your message runs right after it.

Answers appear as they are written. With DeepSeek and other OpenAI-compatible providers, Claude and Gemini, the reply streams in as the model writes it. Checks that used to hold the answer back now add a correction after it when needed. If a stream fails halfway, Arslan keeps what you already saw and says the reply was interrupted, rather than starting again.

Several reads at once. When the model asks for several reads in a row (web pages, searches and MCP reads), up to four run at the same time. Each result stays paired with the call that asked for it.

Undo this turn. Before a turn first changes your working folder, Arslan saves a checkpoint. "Undo this turn" puts the files back and takes the turn out of the conversation. It saves the working folder only when the folder has at most 20,000 files and 5 GB, not counting the folders it leaves out, which undo never puts back: Python environments (any folder holding a pyvenv.cfg, whatever its name, even with your own files inside; conda environments have no such file and are counted), node_modules, build output (build, dist, target and the like) and Python caches (__pycache__). When it can't save, for example a bigger folder, a folder on another disk than Arslan's data, or too little free space, the undo window says "Not saved".

Files reach you, not just their path. When you ask for a file (a screenshot, chart, export or document), Arslan attaches it to its answer: a file card in the Mac window, and the file itself on your iPhone.

Search uses your model's own search first. A Claude conversation searches with Anthropic's own web search; a conversation with a local model uses no cloud search. Tavily or SearXNG can be the only search or a backup. When a search service blocks Arslan, it says so instead of returning nothing.

Fewer tools in every request. Tools you rarely use, and MCP tools, are no longer sent with every request; Arslan finds and uses them when a task needs them.

MCP tools are asked about according to what they do. A tool its server marks read-only runs without a card; one marked destructive asks every time; the rest ask once per conversation. A call whose arguments are too long to show on a card is refused, never cut.

A dollar limit per task, on by default. Each chat reply and each background task stops at $2 of model spend (it starts wrapping up at about two thirds). Change it in Settings › Background › Dollar limit per task. Only models with a known price count.

Long work stays in the chat. Arslan no longer pushes long work into the background or answers with a single sentence; background work is the same work done elsewhere, when you or the model choose it. After ten minutes a reply tells you it is still working.

Hands in a chat reply. A chat reply can now take as many Hands steps as the task needs, in more than one app, and Stop stops it; a risky step still asks every time. An app named with .app or a full path is judged as the same app, so one you never allowed stays refused however it is written.

The desktop app's server is locked down. It always needs its access token, accepts no other website as a caller, and ignores settings inherited from the environment that launched it. The access token no longer appears in the server log.

Smaller changes.

• Conversation titles come from your first message, written by the conversation's own model.
• A task whose check could not run no longer ends as "needs your check" when the work is done.
• A step that cannot be written to a background task's record is refused on its own; the task goes on.
• Arslan ships two skills of its own (a designed HTML report and the skill creator); skills you imported with the same names as retired ones are no longer removed.
• Tasks started by the old experts, before 0.1.44, are continued by Arslan when you resume them.
• An attachment's text is kept up to 40,000 characters (was 12,000). When it is longer, Arslan is told how long it was and, when the message says where the file is saved, to read the rest there.

Removed. The expert-era code that no reply could reach any more (creating experts, their templates and engine), the evolution and curation machinery, the research review, and the conversation menu's "Distill". Arslan's product code is 12,514 lines smaller than in 0.1.62 (11,586 added, 24,100 removed in server/, arslan/ and web/src/, tests and translations not counted).

For developers (source runs only). ARSLAN_ALLOWED_HOSTS and ARSLAN_ALLOWED_ORIGINS refuse to start with any entry containing * (including *.example.com and localhost:*), and the origins refuse null. Name each host and origin in full. The desktop app ignores both variables.

Moved to 0.1.64.

• "Fewer command cards", planned for 0.1.62 and then 0.1.63, is not in 0.1.63: the fix to how commands are judged (S2a-3) moved to 0.1.64, and until then every new command asks, as above.
• The page that lists and undoes your remembered answers (S6), the allowed-folders setting (S4b) and the one mode setting (S5, with "Full access") move to 0.1.64. When "Full access" comes, it still asks before: a payment; installing a capability; sending or submitting anything outward (mail, messages, uploads, git push, forms); a deletion outside what checkpoints can undo. Commands Arslan never runs stay refused, and "this time only" answers are never remembered, in any mode.

Known limits.

• With "Ask only for risky commands" on, a delete written after changing folder in the same command (for example cd folder && rm file) is treated as inside the working folder, so it can run without a card even when that folder is somewhere else, and "Undo this turn" only brings back files in the working folder. 0.1.64 fixes this. Under the default, every new command asks first.
• After deleting files in your working folder, Arslan may say they can't be recovered. Usually they can: open ⋯ under that reply, choose "Undo this turn…", then "Undo files", and the files come back as they were before the turn. The undo box says when a file was left out of the copy, or when nothing was saved (for example, a working folder over 20,000 files or 5 GB, not counting the folders it leaves out).
• A message you add in the Mac window during a reply shows on your iPhone from the next reply on, and the iPhone keeps saying "Queued behind the current turn" after its own message was added.
• A scheduled task that needs a command skips that step every time in this version.
• While several reads run together, the window shows their steps only when the group finishes; Stop works throughout.

Where our pre-release test fell short. Before release we run the same nine tasks three times each, on DeepSeek and on Claude, with "Ask only for risky commands" on, as in earlier rounds. Two of our own bars were missed:

• T11 (find another way after a refused delete), on Claude: 0 of 3, down from 3 of 3 in 0.1.62. Under "Ask only for risky commands", a delete inside the working folder runs without a card on purpose, because "Undo this turn" can bring the files back; the task expects a card. Claude changed into the working folder and deleted by name, so no card came and the files were deleted. DeepSeek deleted by full path, got a card, was refused and moved the files to the Trash: 3 of 3. Under the default, every new command asks first.
• T8 (three follow-up edits to one document): DeepSeek 1 of 3, Claude 0 of 3. ...

v0.1.62

Arslan 0.1.62 — long commands finish, fewer "needs your check", MCP tools can't break a chat

A fix release on top of 0.1.61. Nothing new to learn; things that went wrong stop going wrong.

Long commands run to their own limit. A terminal command now runs as long as it asked for (2 minutes by default, at most 10), instead of being cut off after 20 seconds. It never runs past what the reply has left: near the end, a command gets the time that remains, minus a margin for the answer. When a time limit stops a command, Arslan still sees what it printed so far and is told the limit stopped it. A command that floods its output keeps its beginning and its end; the middle is dropped and Arslan is told how much.

"Needs your check" only when something may really have happened. A task now ends with "needs your check" only when an action may have left a trace outside your Mac and Arslan cannot tell whether it did.

• A command that only reads (ls, git status, grep, find without -delete or -exec) never asks you to check, even when it is stopped.
• An action that never ran no longer asks you to check: a card you declined, a Hands step refused before it reached an app, a command that had no time left to start.
• A command stopped by its own time limit inside the workspace sandbox counts as not done, and can be run again.
• A background task that saved its file, and whose check confirms the file, finishes as done even when it ran out of steps afterwards. Chat replies still pause in that case; that changes in 0.1.63.

An MCP tool can no longer break every chat. A server whose tool descriptions a provider refuses (0.1.61: Anthropic refused some and DeepSeek others, and then every message failed) now works.

• Arslan reshapes MCP tool descriptions into a form Anthropic, OpenAI-compatible providers and Gemini all accept, before sending them.
• If a provider still refuses one, that tool is left out for the rest of the reply and the reply goes on. If the refusal names no tool, or a second one is refused, all MCP tools are left out for that reply. Arslan remembers a refused tool for that model until it restarts.
• Built-in tools are sent exactly as before.

AppleScript and Shortcuts in the terminal ask every time in their common spellings. osascript and shortcuts run in a terminal command now ask every time, with only "This time" to choose, when written:

• directly, with a path (/usr/bin/osascript), or through command, exec or xargs; also with input or output redirected (osascript <<EOF, osascript >/dev/null);
• an earlier "Always" or "In this conversation" for them no longer applies.

Not yet asked (examples only, not a complete list): a variable set in front (FOO=1 osascript), nice osascript, a script that calls osascript itself (for example python3 script.py), $(which osascript), and open "shortcuts://…". 0.1.63 blocks these inside the sandbox.

Writing files never follows a link out of your working folder. Writing or editing through a link that points outside the working folder is refused. Writing to a file that has a second name elsewhere (a hard link) replaces the file in the working folder and leaves the other name as it was. New files are never executable; an existing file keeps its permissions. Writing a file now needs write permission on its folder, and the file's owner, access lists (ACLs) and Finder tags do not carry over to the rewritten file.

Corrections to 0.1.61's notes:

• 0.1.61 said "Every AppleScript still asks every time". That holds for Hands' AppleScript tool. In the terminal, which spellings ask is listed above (0.1.62).
• 0.1.61 planned "fewer command cards" for 0.1.62. They come in 0.1.63.

Known limits:

• Inside the sandbox, a command Arslan does not recognise as outbound and that is killed at its time limit may be run again.
• A reply's own time limit can still shorten a long command near its end.
• If every MCP tool is left out, MCP is unavailable for that reply; after a restart, the first message meets a refused tool once more before it is left out.
• Chat replies that ran out of steps after saving a file still pause.

How this is tested

Every sentence above, and the CI test that checks it:

• Long commands: tests/server/test_run_command_time_limit.py — test_a_long_command_outlives_the_tool_loops_default, test_a_request_of_700_s_runs_as_600, test_the_limit_never_outruns_the_turn, test_without_time_left_the_command_never_starts, test_a_background_job_gets_the_same_rule, test_a_timeout_hands_over_the_output_read_so_far, test_the_output_kept_in_memory_is_capped, test_the_loops_backstop_says_it_was_the_time_limit.
• Needs your check: tests/server/test_job_checks_0159.py — test_a_read_command_is_a_read, test_a_read_stopped_by_its_time_limit_does_not_ask_the_user_to_check, test_a_read_killed_by_a_signal_does_not_ask_the_user_to_check, test_a_hands_action_that_never_ran_does_not_ask_the_user_to_check, test_a_declined_command_card_does_not_ask_the_user_to_check, test_what_may_have_happened_still_asks_the_user_to_check, test_a_known_failure_can_run_again, test_an_unknown_outcome_is_not_repeated, test_a_saved_and_checked_deliverable_finishes_despite_a_work_limit, test_without_a_passing_file_check_the_limit_still_holds, test_a_write_snapshot_alone_is_not_a_checked_deliverable, test_stopping_before_saving_does_not_hold_the_task_once_it_saves, test_which_failures_are_known_and_local; tests/server/test_hands_not_executed.py — test_a_declined_card_did_not_run, test_hands_refusing_before_the_action_did_not_run, test_what_may_have_run_is_never_called_not_run.
• MCP tools: tests/server/test_mcp_schema_normalise.py — test_a_top_level_anyof_becomes_one_object, test_a_discriminator_keeps_every_value, test_pattern_is_dropped_for_openai_compatible_endpoints_only, test_anthropic_sends_mcp_schemas_reshaped_and_builtins_as_written, test_openai_compatible_sends_mcp_schemas_without_pattern_and_builtins_as_written, test_gemini_sends_mcp_schemas_reshaped_and_builtins_as_written, test_a_refused_tool_is_left_out_and_the_turn_finishes, test_a_second_refused_tool_leaves_every_mcp_tool_out, test_a_refusal_naming_no_tool_leaves_every_mcp_tool_out, test_a_left_out_tool_stays_out_for_the_rest_of_the_turn, test_the_same_model_skips_the_tool_next_turn_and_another_model_does_not, test_an_openai_compatible_refusal_on_the_native_protocol_leaves_the_tool_out, test_a_refusal_with_nothing_to_do_with_tools_is_not_retried.
• AppleScript and Shortcuts: tests/server/test_osascript_once.py — test_every_spelling_is_recognised, test_a_redirection_right_after_the_name_is_still_the_program, test_inside_a_shell_string_too, test_a_mention_is_not_a_run, test_the_card_is_for_this_time_only, test_a_remembered_rule_no_longer_lets_it_through, test_the_windows_card_offers_only_this_time_despite_a_rule_and_a_grant, test_a_jobs_card_offers_only_this_time.
• Writing files: tests/server/test_write_no_links.py — test_write_file_through_a_link_to_outside_is_refused, test_edit_file_through_a_link_to_outside_is_refused, test_write_file_through_a_dangling_link_creates_nothing_outside, test_write_file_splits_a_hard_link_instead_of_writing_through_it, test_edit_file_splits_a_hard_link_instead_of_writing_through_it, test_a_folder_swapped_for_a_link_while_it_is_made_is_caught, test_a_parent_swapped_for_a_link_at_the_open_is_refused_by_the_kernel (macOS job), test_a_new_file_is_not_executable, test_overwriting_keeps_the_files_mode.

v0.1.61

Arslan 0.1.61 — one approval card everywhere, MCP servers that start themselves, Claude works again

Claude works again. With Claude Opus 4.7 and later, including the default claude-sonnet-5 and claude-sonnet-5-5, Arslan no longer answers every request with a 400 error saying temperature is deprecated. The key was fine: Arslan sent a setting these models refuse, and now sends it only to the models that accept it. When a provider stops accepting an optional setting in future, Arslan removes it, sends the request again and remembers that for the model, so this does not need a new release. Not yet verified with a real key: the fix was tested against the providers' documented error replies, so the first real check is you pressing Test in Settings.

MCP servers start by themselves. Every server you switched on starts in the background when Arslan opens, at most four at a time, and a chat never waits for one. Each server has one state that the Capabilities page and the model both read, and the model is offered only servers that are ready right now; a call to any other answers with its state and why. A failure says why, with keys and tokens masked. A first start gets 120 seconds to download and launch; a failed server is tried again after 30 seconds, then less often. Connect is a fresh start.

One approval card everywhere — in the chat window, the Inbox, the island and on the iPhone.

• The choices are Once or For this task (whichever the card offers first), In this conversation, Always, and No… with a note that goes to Arslan. A message you type in the chat while its card waits answers it No, with your message as the note, and runs next.
• "In this conversation" says what it covers: a kind of command, any scheduled task, any file in the folder.
• A card waits 30 minutes, and running out is not a no: Arslan is told nobody answered, not that you refused. Before, it was declined after 5 minutes.
• One click answers one card. For a moment after a card comes up, a second click or a held key cannot answer the next one.
• Hands asks once for looking at an app and acting in it, for this task first; deleting, sending, paying and submitting still ask every time. Every AppleScript still asks every time, with the whole script shown.
• What could not be asked while you were away (a card that never opened, and most of what a scheduled task was refused) is listed in the Inbox with exactly what "Always allow" would store, and it can be undone for 10 seconds.
• The island and the iPhone show the card's own question and say what their yes means; they answer once, or for this task where that is the card's first choice, and never "Always".

iPhone: files and live conversations. Files and photos you send from Arslan for iPhone are saved on the Mac in your working folder under Inbox/iPhone, and Arslan reads them with your message. The phone lists your live conversations, follows them while Arslan works, and can delete one. A history too long for one message loses its oldest messages and says so. The privacy page now says what travels, where it lands on the Mac and what the phone keeps. The Mac side works with Arslan for iPhone 1.0, which is coming to the App Store.

The web behind a fake-IP proxy, and page reads that name themselves. On a Mac whose proxy or VPN answers DNS with fake addresses, Arslan can read web pages and use its browser again: the proxy resolves the name, and Arslan still refuses local names, real private addresses and, in that setup, anything but https on port 443. A page read now says who is reading, so sites that turn away unnamed clients (Wikipedia answered 403) answer; when a site still refuses, Arslan is told the site blocks automated reading, not that a key was rejected.

Fixed:

• Stopping a task while it writes to the database no longer keeps the lock for seconds, so other writes no longer fail with "database is locked".
• Apps that share a name (WeChat and its helper, Claude and the Claude Code sessions) are told apart, so looking at an app no longer fails because the name is shared; a window title that does not exist falls back to the app's only window or lists the titles; table rows and fields no longer make a click "risky" because of what they contain.
• A "for this task" yes ends with its task, also after a restart or when the task is resumed.

Known limits:

• Commands still ask as in 0.1.60. Fewer command cards, and commands that stay in the sandbox first, are planned for 0.1.62, not in this version.
• Card titles are in English.
• "Always" for sites and Shortcuts is hidden for now: those cards offer For this task and In this conversation. It comes back with the Settings page that can list and remove such rules.
• "In this conversation" cannot be taken back yet: there is no list, and it lasts as long as the conversation. The Settings page that lists and removes it comes in a later version.
• Going back to 0.1.60 after upgrading needs the automatic backup in backups/. 0.1.60 will not open the new database.
• The island no longer answers AppleScript cards; they are answered in Arslan.

v0.1.60

Arslan 0.1.60 — Hands v2: your Mac apps, used more like you would

It sees the window. Besides a window's text, Arslan can look at a picture of the one window it is working in — never the whole screen, never saved. Turn it off in Settings → Hands, or list apps that are only ever read as text.

Fewer steps, fewer waits. Several steps in one app run as one batch, menu items are chosen directly (even when the app is not in front), and apps open in the background. A chat reply can act directly for up to five steps; longer work moves to the background.

Asking, once. One card can cover several apps for a piece of work, a background job started from a conversation inherits that conversation's yes, and apps you trust can be allowed for good in Settings → Hands. Deleting, sending, paying and submitting still ask every time.

Borrowing the front, only when needed. For things that only work with the app in front, such as a pop-up menu, Arslan waits until you pause typing, takes the front for about a second (the screen edge glows blue), keeps the keys you press meanwhile, then returns your app. If an app's window is on another desktop, Arslan goes there the same way, does the work and comes back. You can turn this off.

Taking over, with your yes. For longer work Arslan can ask to use the screen for up to 30 minutes. The edge glows the whole time, and the moment you touch the keyboard or mouse it stops and waits. "While I'm away" (off by default) lets it start after three minutes without your input. The island shows what Hands is doing, with time left, Stop and a thumbnail of the window.

A new first run. Setting up is now a short film with Arslan's own face: pick a language, connect a model (OpenRouter in one click, or your own key), choose which folders Arslan may read — nothing is chosen for you — and, if you like, let Hands use your apps. The first conversation then suggests a few things to try.

Fixed: an app that never finished launching no longer makes every app look "not running"; apps that jump forward after an action (Notes on New Note) are put back behind yours; unpairing on the iPhone now removes the phone on the Mac too.

Known limits:

• Clicking at a screen position and dragging are not offered yet.
• An app that brings itself forward is in front for about 50 ms before Arslan puts it back; a key typed in that moment goes to that app.

v0.1.59

Arslan 0.1.59 — a chat that keeps up, answers in your language, work that counts as done

A long answer is not "Interrupted", and a second message waits its turn.

• While Arslan works, the window hears from it at least every 15 seconds, even when the model spends minutes writing one long file. "Interrupted" now means the connection itself was lost, and it says what to do.
• A message sent while Arslan is still answering waits and is answered right after, instead of being refused and lost.
• The working line says what is true — "Thinking…", then after a quiet minute "Still working — a long answer can take a few minutes" — instead of rotating phrases.
• Approving or declining a Hands card in the window during a reply takes effect at once; before, the answer could go unread until the card expired.
• The model under the composer reads "OpenRouter · model", so the model name fits.

Arslan answers in the language you write in — an English request could come back in Chinese. Provider names are English too, and a job that ends early says why in words, never as a code.

Background work that did the job counts as done.

• A job that saves into a folder you named is checked on the disk; "read my notes and tell me…" counts the files Arslan read.
• A command that simply failed (a probe for a missing folder, a script that exited with an error) no longer sends the whole job to "needs your review", and Arslan may try it again after fixing something. Commands that send something off this Mac still ask you to check.

Desktop, Documents, Downloads: Off means off for commands too. Commands (ls, find, a script) cannot open these folders while the switch is off; your working folder and project folders kept inside them still work.

Arslan in the background keeps working. A long task that asks for your approval while Arslan is not in front waits in the Inbox, on the island, or in the window — no "Model error". After a reconnect a finished answer is not shown twice, and the island shows plain text.

Known limits:

• While the model writes one long file, the window shows that it is still working, not yet which file.
• A command you let run outside the sandbox (you are asked each time) is not confined by the folder switch.
• A local script that sends something over the network itself and then fails is treated as a local failure.
• A message that is only a short Latin-script word ("ok") follows the conversation's language.

v0.1.59-beta.4

Arslan 0.1.59 beta 4 — Desktop, Documents and Downloads stay closed when you say so

A preview of 0.1.59: Arslan 0.1.58 plus the fixes below. It is a pre-release, so Arslan's automatic update stays on 0.1.58; download it here to try it. When 0.1.59 comes out, this version updates to it.

Desktop, Documents, Downloads: Off now means off for commands too. Before, the switch kept Arslan's file tools out of these folders, but a command (ls, find, a script) could still read them — a question from the iPhone could make Arslan look through your real Downloads. Now commands cannot open them either while the switch is off; your working folder and project folders kept inside them still work. A command you let run outside the sandbox (you are asked each time) is not confined.

Background work that did the job counts as done.

• A job that saves into a folder you named — "copy this year's invoices into ~/Invoices" — is checked on the disk: the folder must hold files created or changed during the job. Before, only files Arslan wrote itself counted, so such a job could never finish as done.
• "Read my notes and tell me…" counts the files Arslan read, not only web pages.
• A command that simply failed — a probe for a missing folder, a script that exited with an error — no longer marks the whole job as "needs your review", and Arslan may try the same command again after fixing something. Commands that send something off this Mac (uploads, git push, ssh, mail, other apps), commands stopped by their time limit, and every other kind of failure still ask you to check.

Arslan in the background keeps working. A long task that asks for your approval while Arslan is not in front no longer ends with "Model error": the card waits in the Inbox, on the island, or in the window when you come back.

No ghost replies. After a reconnect, a finished answer is not shown a second time, and no "working" row is left with a timer running.

The island shows plain text — no stray asterisks or backticks in a job's result.

From beta 2: Arslan answers in the language you write in; provider names are English; a job that ends early says why in words.

Known limits:

• A local script that sends something over the network itself and then fails is treated as a local failure.
• A message that is only a short word in a Latin script ("ok") follows the conversation's language.

v0.1.59-beta.3

Arslan 0.1.59 beta 3 — background work that did the job counts as done

A preview of 0.1.59: Arslan 0.1.58 plus the fixes below. It is a pre-release, so Arslan's automatic update stays on 0.1.58; download it here to try it. When 0.1.59 comes out, this version updates to it.

Background work that did the job counts as done.

• A job that saves into a folder you named — "copy this year's invoices into ~/Invoices" — is checked on the disk: the folder must hold files created or changed during the job. Before, only files Arslan wrote itself counted, so such a job could never finish as done.
• "Read my notes and tell me…" counts the files Arslan read, not only web pages.
• A command that simply failed — a probe for a missing folder, a script that exited with an error — no longer marks the whole job as "needs your review", and Arslan may try the same command again after fixing something. Commands that send something off this Mac (uploads, git push, ssh, mail, other apps), commands stopped by their time limit, and every other kind of failure still ask you to check.

Arslan in the background keeps working. A long task that asks for your approval while Arslan is not in front no longer ends with "Model error": the card waits in the Inbox, on the island, or in the window when you come back.

No ghost replies. After a reconnect, a finished answer is not shown a second time, and no "working" row is left with a timer running.

The island shows plain text — no stray asterisks or backticks in a job's result.

From beta 2: Arslan answers in the language you write in; provider names are English; a job that ends early says why in words.

Known limits:

• A local script that sends something over the network itself and then fails is treated as a local failure.
• A message that is only a short word in a Latin script ("ok") follows the conversation's language.

v0.1.59-beta.2

Arslan 0.1.59 beta 2 — English answers to English requests

A preview of 0.1.59: Arslan 0.1.58 plus one fix. It is a pre-release, so Arslan's automatic update stays on 0.1.58; download it here to try it. When 0.1.59 comes out, this version updates to it.

Arslan answers in the language you write in.

• An English request could come back in Chinese, together with the background job's title, its checks and the "Learned" line after it. Now every message tells the model which language to answer in, taken from what you wrote; paths and file names do not count. A message with no words (just a path) follows the interface language.
• Text Arslan reads while it works (tool results, hints) is in English, and nothing in its fixed instructions is in Chinese any more.

No Chinese in the English interface.

• Provider names are English: "OpenRouter (Claude, Gemini and more)", "Qwen (Alibaba Cloud)", "Zhipu GLM", "Ollama (local)", "OpenAI-compatible (custom)". Providers you already added are renamed too, unless you gave them a name of your own.
• A background job that ends early says why in words, never as a code like "task_reconciliation_required".

Known limits:

• A message that is only a short word in a Latin script ("ok") follows the conversation; Arslan is told it is not Chinese.
• Chinese text written for a Chinese request (the "reply continue" note, findings headers) stays Chinese, as intended.

v0.1.58

Arslan 0.1.58 — replies you can read, files you can open, any model you like

Replies read like an answer, not a log.

• What Arslan did while working is one quiet line under the reply — "6 steps · 48s" — that opens into plain sentences ("searched the web for …", "wrote 报告/汇总.csv"), with the notes Arslan wrote between steps. The raw tool details are still there for those who want them: Settings → General → Show technical details.
• While it works you see the last few steps live, and how long it has been going.
• Copy, the model and the tokens sit in one small row under the reply; the model opens a card with the calls, tokens and cost of that turn. The "main assistant" badge is gone.
• All of it is still there after you reopen the conversation.

Files Arslan writes come back as files.

• A file written during a turn shows under the reply as a card: name, kind and size, with Preview and ⋯ (download, copy path). More than three are one click away.
• Paths in a reply are clickable: a file opens in Arslan, a folder in the file browser, anything Arslan may not read can still be shown in Finder. A path that does not exist says so.

One workbench on the right: Task, Files, Browser.

• Files browses the conversation's project folder (or your Arslan workspace) and lists what this conversation produced.
• The reader shows text and code, Markdown, CSV and Excel as tables, images, audio, video, PDF, Word and RTF, and HTML — HTML only in a sandbox where its scripts cannot run. From the reader you can copy, download, or add the file to the conversation — and, for a file on disk, open it in its app or show it in Finder.
• Arslan reads only where its own read tools may: your workspace, Desktop/Documents/Downloads when default read is on, active project folders and its own outputs. Hidden files and credential-like names are never shown.

Projects.

• Project conversations appear under their project in the sidebar; a conversation can be moved into a project from its menu.
• A level is no longer cleared past open work. Clearing a level with open checkpoints asks first: move them to the next level, or drop them — and either can be undone. Arslan's own automatic advance only happens when nothing is open.

Models: any model of any provider.

• The model under the composer picks any model your providers offer — OpenRouter's whole catalog included — for this conversation, from the next message on. Set as default makes it the model new conversations start with. A ring beside it shows how full the context is.
• The picker searches every provider at once, keeps ★ favourites on top, and shows context length, price per million tokens and what each model can do. A model a role cannot use (no tools, or cannot see images) is greyed out with the reason.
• Model roles in Settings starts with the main model, and every role can name one model of its provider.

Activity.

• The usage chart answers when you point at it (calls, tokens, cost, models, how long) and filters Recent work when you click a day.
• Recent work, Hands and the judgment log scroll in their own boxes, 20 at a time, with icons for where each run came from; coming back from an opened run returns to the same row.

Known limits:

• A reopened conversation shows the context ring again only after its next message.
• Model favourites are kept on this Mac only.
• Whether the packaged app's viewer shows every PDF inline is not yet checked on a real Mac; "show as images" is there as a fallback.
• Clicking the island still brings Arslan to the front.

v0.1.57

Arslan 0.1.57 — capabilities that grow: Arslan finds what it lacks, asks, installs it safely, tests it, and tries again

When a step needs something Arslan cannot do, it looks for it. It searches the official MCP Registry, GitHub and reviewed skill libraries for something that does the job — for example reading the formulas in an Excel file, not just the values.

Then it asks, in the conversation. One card shows what it would add, where it comes from, its license (read from the project's own license file, not from a package listing), how it would run, which folder it may use, and any key it needs. Add and retry or Not now. Only the Arslan window that asked can say yes; a key typed on the card goes to Arslan's encrypted store, never into the conversation.

Installed carefully, tested before it is switched on.

• Pinned: a fixed version with a lock file and checksums. Python servers need no Python of yours, and Node servers no Node of yours: Arslan downloads its own pinned uv or Node once.
• Nothing runs while installing: Python packages only as ready-built wheels, npm packages without install scripts.
• Scanned for known dangerous patterns: hidden instructions in a skill, code that fetches and runs more code, writes to where macOS starts programs, a script that reads keychains or SSH keys. A dangerous finding removes it again. A scan cannot prove something safe, which is why everything also runs in a sandbox.
• A sandbox that starts from no: an installed server can use its own folder and the folders you gave it — nothing else in your home folder, never your SSH keys or Arslan's own data — and no network unless it needs a key for an online service.
• Tested once: it must start and offer its tools. Only then is it switched on, and Arslan retries the step that failed, in the same reply.

Capabilities page.

• Discover searches by what you want done, across all three sources, with the license, activity and how each would run.
• Arslan found keeps what Arslan found for later: a card you said not now to, a background job that hit a wall, or a project level that may need something. There is a quiet count beside Capabilities; it is never a notification.
• Every added capability has a dossier: license and where it was read, pinned version and checksum, scan, first test, the folders it may use (changeable), and Check for a newer version. That shows what changed first, and installs the new version beside the old one, keeping the old one until the new one passes.
• Use in a project: as material (its description and README go into the project's materials), or as a dependency (a project conversation opens with the request typed, not sent).

Skills imported from GitHub are now pinned to one commit, with a checksum for each file. When Arslan reads one, it treats the text like a web page: it cannot give Arslan new permissions.

Hands: groundwork for a second engine, not switched on. The current engine stays.

Known limits:

• Python bundles in the MCP bundle format (mcpb) are not installed yet.
• Servers you added by hand are not moved into the sandbox in this version.
• Clicking the island still brings Arslan to the front.