Locus 1.13.0

Notarized by Apple and stapled. Download it, move Locus to Applications, and open it — no Gatekeeper detour.

This release rolls up everything since 1.10.0 — the 1.11.0, 1.12.0, and 1.13.0 changelog entries ship together here.

Included ChatGPT-plan access, no API key required

A separate, single-identity ChatGPT account opens OpenAI's managed browser sign-in, discovers available models, routes solo chats, teams, and evaluations, and shows plan rate limits and token activity separately from API cost estimates. The managed route never falls back to a billable API key, and there is no dependency on an installed ChatGPT or Codex app: Locus builds and signs OpenAI Codex rust-v0.147.0 and its code-mode companion from checksum-pinned source, isolates their OAuth state, and exposes only Locus's own tools through its existing permission system. The stored codex account keeps working and is now labelled OpenAI API.

A browser the agent can drive — and you can watch

The model gains browser tools over a native broker: open a page, read it as a tree of addressable elements, click and type, capture screenshots, wait for a single-page app to settle, inspect console and network activity, manage tabs, and evaluate JavaScript for debugging. Reading is permission-free; running page JavaScript asks every time, Bypass included. Navigation is http/https only, typed credentials are refused on both sides, and page content is always labelled untrusted. The Preview tab is now the Browser tab — address bar, back/forward, stop/reload, tab chips, a console and network drawer, and an emulated-viewport picker — and pages keep rendering off-screen while the panel shows something else.

Teams, run history, and evaluations

Locus can dispatch bounded work to configured local and hosted specialists, run eligible read-only jobs concurrently, reserve mutations for one fixed writer, and reproduce the current Git state in an isolated managed worktree. Team activity persists before it reaches the interface: a Run Inspector offers ordered timelines, evidence, routing explanations, checkpoints, pause/resume, retry, reassignment, replay, and repair guidance. Evaluation suites compare Solo and team configurations in immutable fixtures without touching the source workspace. Hosted routing requires explicit consent, and membership, capabilities, cost, and concurrency stay visible and bounded.

Plus: workspace-grouped chats with recoverable deletion, conversation search, attachments everywhere, usage costs, git publishing, hunk-level review controls, a right rail with in-place expand, and first-use choices for send keys and automatic panel opening. Full details in the CHANGELOG.

---

Requires macOS 14 or later, Apple silicon. Ollama (or a remote endpoint) supplies the models; ChatGPT-plan access needs only a plan sign-in. Everything else, including a self-contained Python, is inside the app.

Locus-macOS.zip — SHA-256 d7937d5380e617ca325a273e5ffde211b7b48bb35c915127311be1847154773c

Locus 1.10.0

Notarized by Apple and stapled. Download it, move Locus to Applications, and open it — no Gatekeeper detour.

Read this before upgrading

API keys and MCP credentials have moved out of the macOS login keychain into ~/.locus/auth.json, mode 0600 inside a 0700 directory — the way Codex keeps ~/.codex/auth.json. In the sandboxed App Store build it lives in the app container instead.

You will need to re-enter each account's API key once, and re-supply every MCP server credential — re-authorizing OAuth servers and re-entering any bearer token, header value, or environment secret you typed by hand. Nothing is migrated. Your old keychain entries are left where they are; nothing reads them any more, and you can delete them from Keychain Access if you want them gone.

This is a real reduction in protection, and it is worth understanding rather than skipping. The keychain enforced per-application access: a program that was not the one that stored your key triggered an authorization prompt. File permissions do not. They keep your keys away from other user accounts on the Mac and from nothing else — anything running as you can read that file.

What you get for it: Locus stops asking for your keychain password when you run a build signed differently from the one that stored the key.

What that change had to get right

Three guarantees the operating system used to provide are now the app's own, and each has a test:

• The file is created already 0600 rather than written wide and narrowed, so the secret never exists at a broader mode, and a failed write cannot strand a plaintext copy of every credential.
• A file that cannot be fully read never looks like an empty one. A single unreadable value degrades the whole file rather than silently dropping its neighbours.
• While a file is degraded, the orphan sweeps are suppressed — the entries that failed to read are exactly the ones a sweep would mistake for garbage — and the unreadable file is moved aside under a name no earlier salvage owns before anything replaces it.

---

Requires macOS 14 or later, Apple silicon. Ollama (or a remote endpoint) supplies the models; everything else, including a self-contained Python, is inside the app.

Locus-macOS.zip — SHA-256 8655f637c853bc892d97ded900c5c9b201b06056bd0f97ac013690c84dbe5c30

Locus 1.9.0

This build is notarized by Apple and stapled — the first Locus release that is. Download it, move Locus to Applications, and open it. No Open Anyway trip through System Settings, no Gatekeeper warning: it opens normally on a Mac that has never seen it.

There was no 1.7.x → 1.8.0 release here, so this one carries both versions' work.

Provider accounts — Claude, Codex, and Kimi alongside local models

Settings ▸ Model providers ▸ Add Account… signs Locus in to Anthropic, OpenAI, or Moonshot with an API key, or to any other OpenAI-compatible endpoint. Several accounts per provider are supported: two Claude keys become "Claude — Work" and "Claude — Personal", each with its own section in the model picker. Kimi Code accounts spend a Kimi membership instead of per-token credit.

Local Ollama remains the default. Hosted providers are used only after you explicitly add and select an account.

Extensions — plugins, skills, and MCP servers

Install plugins and skills from a marketplace catalog, and connect to Model Context Protocol servers whose tools then appear to the model alongside the built-in ones. Remote servers support OAuth, with tokens held in the macOS Keychain and handed to the local agent only through a transient credential endpoint. Each server carries its own default tool-approval policy. Managed under Settings ▸ Extensions.

Image attachments in Just Chat

Paste or attach PNG, JPEG, GIF, or WebP images — up to 10 per message, 15 MB each — and they go to any model that accepts them. Attachments count toward the context meter and the compaction budget like any other content, because they stay in the conversation and are re-sent on every following turn.

Local runtimes are supervised instead of assumed

Locus starts the shared Ollama application when it is installed, falls back when it is not, and carries an explicit runtime phase — starting, online, recovering, unavailable — through the UI. A local model whose runtime is not actually up now says so, and says which state it is in, rather than accepting a prompt and failing at the first message.

The context meter now tells the truth

It never worked for a hosted account and could not have: nothing in the app could set a context window, and a hosted endpoint advertises none, so every Claude, Codex and Kimi account had a dead meter and no automatic compaction at all. Accounts now carry a window, defaulting to the provider's published figure for the selected model.

Alongside that: switching models no longer keeps the previous model's window; the meter divides by the same usable figure compaction budgets against, so it reaches 100% exactly when compaction acts, instead of firing at a displayed 55–73%; it no longer freezes mid-turn while tool output fills the window; and it no longer jumps backwards when you change permission mode during a run.

Also in this release

• The window opens at 1200×760 rather than 1420×860, so first launch fits a smaller display. Frames you have already moved or resized are left alone.
• The permission panel is drawn on the inspector's own background, so it no longer reads as a separate surface.
• The bundled agent runtime was fixed so it starts in a locally built app.

---

Requires macOS 14 or later, Apple silicon. Ollama (or a remote endpoint) supplies the models; everything else, including a self-contained Python, is inside the app.

Locus-macOS.zip — SHA-256 7302798aaa8d4bc97956b68219d107451f0ad097b2edb171dde3d0089254bee3

Locus 1.6.0

Locus is now a single self-contained download — no Python install required. The app embeds a relocatable CPython 3.14.6 (python-build-standalone) and the agent service with all its dependencies. This is also the first release from the combined repository: the app and the ollama-code agent now live together, with the agent in agent/.

Download Locus-macOS.zip, move Locus to Applications, and open it. The build is signed with a development certificate and is not notarized, so macOS blocks the first open of a downloaded copy: try to open Locus once, then go to System Settings ▸ Privacy & Security and click Open Anyway — or run xattr -dr com.apple.quarantine /Applications/Locus.app in Terminal. You still need Ollama for local models.

If you downloaded this asset before it was replaced on 2026-07-28 evening and macOS called the file damaged, that was a packaging defect (the bundle's code-signature seal was broken after signing) — delete that copy and download again.

Added

• Permission approval moved into the composer, the way Claude Code and
  Codex ask. While a tool waits, the input is replaced by a prompt with the
  tool, a preview of what will run, and a keyboard-first option list —
  1 Yes, allow once · 2 Yes, and don't ask again for that tool this
  session · 3 No, and tell Locus what to do differently. ↑/↓ move,
  ↵ confirms, Esc denies, digits answer directly, and focus returns to
  the editor after any decision. The transcript's tool card keeps the status
  but no longer carries buttons.
• Git quick actions in Changes: stage, unstage, and discard per file
  (discard always confirms; untracked files move to the Trash instead of
  git clean), plus a commit area with Draft with AI — the staged diff
  goes to the local Ollama model, reasoning tags and fences are stripped,
  and the subject is capped at 72 characters; with no local model it falls
  back to a deterministic summary. Git runs directly in the workspace with
  literal pathspecs and a watchdog timeout; stderr surfaces in the toast.
• Find in conversation (⌘F): a search bar over the transcript with a
  live n of m count, ↵/⇧↵ navigation with wrap-around, Esc to close,
  and scroll-to-match with the current match outlined.
• A thinking view mode for the transcript — /thinking hidden|collapsed|expanded, also in the workspace … menu. Hidden shows
  answers only (with a minimal "Thinking…" line while a reply is still all
  reasoning), Collapsed keeps the expandable cards, Expanded pins every card
  open. Persisted with the other settings.
• Show/Hide Sidebar (⌘0), and the sidebar's state now persists across
  launches like the inspector's. Defaults follow Claude's layout: the session
  sidebar starts open, and the right-hand inspector starts collapsed — the
  conversation gets the room, and ⌘1–⌘5 or ⌘⌥I bring the panel back.
• Model recommendations now consider this Mac's memory. The Hugging Face
  library used to pre-select Q4_K_M no matter what — which put a 22 GB model
  on a 32 GB machine, where it starved the context window until tool calls
  were cut off mid-generation. The pre-selected quantization is now the best
  one that comfortably fits the machine's unified memory, every variant card
  carries an honest badge (RECOMMENDED / TIGHT FIT / TOO LARGE), the header
  states the Mac's memory, and the download panel warns — without blocking —
  before a tight or oversized download. The post-install toast repeats the
  warning, and Settings → Status now shows Ollama's own error text (a model
  too large to load, a dead server), which was captured and displayed
  nowhere. The ollama-code backend gained the matching resilience: old
  tool outputs are evicted in place when a single turn outgrows the window,
  and a tool call cut off mid-generation is retried once after making room
  instead of failing the turn.

Changed

• The app is now fully self-contained — no Python install required. The
  build embeds a relocatable CPython from python-build-standalone (3.14.6)
  together with the agent's dependencies, replacing the old copy of the
  build machine's Homebrew Python, which kept resolving its dylib and
  standard library from /opt/homebrew and made the shipped app require
  python@3.14. The first build downloads and checksum-verifies the
  interpreter (~26 MB) into a reusable .agent-runtime/ cache;
  LOCUS_BUNDLE_MODE=venv restores the old behavior, skip bundles
  nothing. The bundled runtime is pruned (tests, tkinter, pip, headers) and
  pre-compiled so first launch doesn't byte-compile from the read-only
  bundle.

• App and agent now live in one repository. The ollama-code service
  moved from the separate ollama-code-cli checkout into agent/, the
  bundling scripts default to it, and the default fallback backend folder is
  now ~/Documents/locus/agent. The product site is no longer nested in the
  checkout.

• The context meter tells the truth. It measures against the same
  context_limit the agent budgets compaction with (falling back to the
  model list), estimates growth while a reply streams instead of freezing
  mid-turn, and no longer double-counts the context pack — included files
  are already inside the session count after each send. With no known
  window — remote endpoints do not advertise one — the chip shows the token
  count plainly instead of a percentage of an invented 32k window; the
  popover's pack row now reads "Context pack (next send)".

• Test Connection is side-effect free. It probes the endpoint directly
  with the values as typed. It used to save the settings draft, write the
  API key to the keychain, and switch the live agent's provider — all of
  which survived Cancel and made the following Save skip its reconnect.

• The agent now budgets against the window Ollama actually serves
  (fixed in the ollama-code backend): it reads the loaded window back
  from /api/ps, an optional context_window setting pins num_ctx
  explicitly, and /api/models reports the window in use separately from
  the trained maximum. The model picker's "ctx" figure now shows the
  trained window — the number to compare models by — while the meter keeps
  measuring against the window in use.

Fixed

• /compact crashed the app — it re-entered the slash-command matcher
  and recursed until the stack overflowed. Forwarded commands now bypass
  local matching.
• A permission request without a request id locked the app — send,
  Clear Chat, and New Session all disable while a request waits, and one
  that cannot be answered kept them disabled forever. Such requests now
  surface as errors instead of arming that state; turn_done sweeps any
  card still waiting; requests attach to the newest matching card; the
  in-place upgrade now triggers the auto-scroll that used to leave the
  prompt off-screen; and clearing the chat re-checks for a request that
  arrived while the confirmation alert was open.
• The console could be bricked by a disconnect — only a backend event
  cleared its running state, and after a drop none was coming. The command
  field now recovers, and cancelling against a dead socket says so.
• A transient git error emptied the Changes list and rendered "Nothing
  changed" over edits that still existed. The last known list is kept, with
  a stale-warning triangle in the header; a superseded refresh no longer
  clears the newer request's spinner.
• Diff requests broke on legal filenames — &, +, =, or ? in a
  path truncated or corrupted the query. Requests now build through
  URLComponents, and the two force-unwraps in the URL builder are gone.
• Draining the queue destroyed the draft: a queued message that failed
  to send was written into the composer over whatever had been typed since.
  It returns to the head of the queue instead.
• The slash popup could run a command you never saw — arrow keys walked
  the selection past the eight rendered rows. The list is now capped where
  the selection walks it.
• Stop reported success even when the interrupt never left the app; it
  now says the agent is unreachable and leaves cleanup to the reconnect
  path. Orphan tool results synthesize a card instead of vanishing.
• Quitting or changing the backend URL froze the app for up to four
  seconds waiting for the old backend child to exit. The restart path
  waits off the main thread; quitting waits half a second, then SIGKILLs.
• One missing field in session_info silently disabled workspace tracking,
  the file index, and permissions display at once — session, model, and
  history decoding is now tolerant, so a single absent field can no longer
  nil the whole struct (or fail an entire resume on one null tool message).
• The home directory can no longer be recorded as a recent workspace by
  typing before the agent connects.
• The preview's WKWebView no longer uses the private drawsBackground KVC
  key, which would crash uncatchably if WebKit renamed it.
• Dead code removed (changeBlocks, the unused provider verifier); the
  context-pack folder expansion reuses the shared file-type lists, fixing a
  drifted skip list that missed .venv.

Product site

• A site for Locus, in website/: one server-rendered page covering the
  workspace, the three work modes, the principles behind the app, the
  inspector, and model selection. Next 16 on vinext, served as a Cloudflare
  Worker. Its test renders the compiled worker in-process and checks the
  finished page — including that the starter template's placeholder copy is
  gone — rather than trusting the build to have succeeded.
• The site is a separate git repository nested inside this checkout, so none of
  it ships with the app and the release build never sees it.
  website/README.md covers running, testing, and deploying it; this
  repository's README gained a ...