Ember v1.22.0

Ember 1.22.0 collects everything since 1.20.6 — the two releases published in this batch. The highlights are below; the full list is in CHANGELOG.md.

Download

Platform	App	Standalone Kiln (Tinder)	Checksums
macOS (Apple silicon)	Ember-1.22.0-arm64.dmg · zip	tinder-macos-arm64	SHA256SUMS-macos.txt
Windows (x64)	Ember-1.22.0-windows-x64-setup.exe · zip	tinder-cli-windows-x64.exe	SHA256SUMS-linux.txt (covers Windows too)
Linux (x64)	Ember-1.22.0.AppImage · tar.gz	tinder-cli-linux-x64	SHA256SUMS-linux.txt

The desktop app starts and stops its own bundled Kiln. Tinder is the standalone backend for a headless machine or a Kiln that should outlive the app — seen docs/instances.md.

The Windows installer is not code-signed, so SmartScreen will warn on first run (“More info → Run anyway”). The macOS build is signed and notarized.

New providers

• DeepInfra — paste a key in Settings → Providers and its chat models appear in the picker, with context windows and per-million-token prices read from DeepInfra's own catalogue. A refresh that fails keeps the last known list, and Ember never waits on the network to start.
• OpenRouter — now verified end to end: key, provider row, catalogue refresh, and models reaching the picker.

Scheduling, for bots as well as for you

Bots get a schedule tool — list, create, update, remove, run — with daily, weekly and one-off times in a real timezone. Ask for “every weekday at 9” and the bot sets it up, says when it will next run in plain words, and can change it later. Tasks belong to the Hearth, the Scheduled view shows the same list, and a run uses its own session, so a scheduled prompt never interrupts the chat that created it.

Appearance

• Customise a new bot before it exists — click the draft's blob to pick its colour, style and shape; the choice follows it through creation and retries without touching other bots.
• Bots look distinct — automatic colours and shapes are chosen to stand apart from the bots already on screen, so new sessions no longer arrive as a run of near-identical purples. Existing identities and your own choices are never rewritten.
• Mosaic bodies are smooth multicolour gradients with no abrupt neighbouring tiles, while keeping their pixel eyes and bold range.
• Crystal stays perfectly still while working or thinking: its facets light up, nothing else moves.
• Buddy eases between working, thinking and resting instead of snapping poses.
• Every eyed bot follows a nearby pointer — rail, composer, groups, settings, appearance picker and setup — and a leader waiting on its crew reads as busy.
• Scribble is temporarily retired from the appearance choices. Saved Scribble preferences render as Buddy without being rewritten; the renderer stays in the source.
• Preview matches reality — the Customize appearance preview uses your configured bot size, live.

Reading and composing

• Three text sizes — Interface, Chat and Composer, each Small / Medium / Large and applied immediately.
• Composer trays redesigned — quiet underline tabs, fine separators and two-line previews with the actions still reachable by hover, keyboard and touch. The whole tab bar folds the shelf.
• Threads tab reads 3 / 8 — running over total — and a thread waiting on you still shows its dot.
• “Mark as unread” on a bot reply (right-click) makes that reply and everything after it unread again.
• The read confirmation is quicker — about a second, held up to five while you hover it or focus Undo.
• Jump marker is a hairline that fades out, instead of a tinted box that looked like a selection.
• Settings moved to the top bar beside Sessions, and the rail's New bot button uses the accent colour.
• Rail rows are readable — names and descriptions wrap to two lines with the timestamp beside the last line.

Hiding, threads and setup

• Hide / Hidden sessions / Unhide, with eye icons instead of trash cans. Hiding also stops the programs the bot left running — and those of every worker under it.
• Thread questions arrive in the leader's chat, labelled by thread, so you can answer without opening the thread.
• Threads open in a live dialog over your workspace instead of replacing it. Promoted threads are now called persistent bots.
• Threads have no unread management — a thread is something its leader reads.
• Setup asks you to choose a default model (with an OpenCode sign-up tip if you need an account), and ends with a short note about what Ember does and does not send anywhere.

Fixes worth knowing

• Code mode works in the packaged app. Kiln and Tinder embed the QuickJS sandbox and its worker, so scripts run with no checkout installed. Every packaged binary self-tests this before a build is accepted.
• Windows builds bundle a Windows Kiln. Packaging for Windows from a Linux host used to ship with no bundled harness at all.
• Composer glow blends into the theme (multiply on light, dodge on dark) instead of a grey wash.
• Consecutive tool-only steps share one “Used N tools” group; expanded tool calls show their full height instead of trapping content in nested scrolling.
• Unread dots stay at or below 10px at every avatar size, instance-colour underlines survive selecting a bot, mini-rail tooltips are readable, and the top bar no longer overflows on phone-width windows.

Ember v1.21.0

Ember 1.21.0.

Added

• DeepInfra provider (key only) — chat models, context windows and per-million-token prices read from DeepInfra's catalogue; OpenRouter verified end to end.
• Customize a new bot's appearance from its draft before sending; the choice follows it through creation.
• Setup ends with a private-by-default note and a way to reach Em, and asks for a default model instead of adopting a host fallback.
• Thread questions appear in the leader's chat; threads open in a live dialog without replacing the workspace.

Changed

• Three text sizes: Interface, Chat and Composer.
• Composer shelves use quiet underline tabs with two-line previews; Settings moved to the top bar.
• Session actions say Hide/Hidden/Unhide with eye icons; hiding stops the bot's programs and its crew's.
• Worker threads have no unread management; the Threads tab shows running over total.
• Mosaic bodies are smooth multicolour gradients; Crystal is reflection-only; Scribble is retired.

Fixed

• Windows packages bundle a Windows Kiln (cross-compiled here and verified under Wine); code mode works in the packaged app on all three platforms.
• Composer glow blends into light and dark themes; rail badges, tooltips, rail text, tool expansion, cost labels and read feedback all behave.

Linux and Windows assets are here. macOS assets are uploaded separately by the maintainer.

Ember v1.20.6

Ember 1.20.6 — desktop control room for Kiln / Hearth agents.

Changed

• The sidebar width control sits beside the app name in the top bar, following the macOS window buttons. The name uses a neutral, bolder treatment, and the rail no longer repeats the control.

Assets

Platform	Files
Linux x64	Ember-1.20.6.AppImage, ember-1.20.6.tar.gz, tinder-cli-linux-x64
Windows x64	Ember-1.20.6-windows-x64-setup.exe, Ember-1.20.6-windows-x64-setup.zip, tinder-cli-windows-x64.exe
macOS Apple Silicon	Ember-1.20.6-arm64.dmg, Ember-1.20.6-arm64-mac.zip

Verify downloads against SHA256SUMS.txt.

The macOS Apple Silicon packages are Developer ID signed, notarized by Apple, and stapled.

Windows packages are unsigned and may show a SmartScreen warning. Windows runtime testing has not been performed for this release.

Built from commit c20dc5f3b29d48fe823bc4f5471e52aaf1bcaca2 with Bun 1.4.2 and electron-builder 26.18.0.

Ember v1.6.9

Ember 1.6.9 improves first-time setup and reliably starts the included Kiln.

Changes

• Ember starts its bundled Kiln and waits for it to stop when Ember quits. Standalone Kilns started through Tinder keep running independently.
• Fresh installs show a guide explaining Ember, Kiln, multiple computers, containers, and optional Tailscale connections.
• Setup uses readable typography, a full-window layout, and a diagram showing how Ember connects to Kilns.
• Finishing or skipping setup opens a new-session draft. An empty Home also opens a draft; a conversation is created only when you send a message.
• Tinder includes the standalone backend through tinder serve, with improved service installation and custom-port handling.
• The composer can grow further and be resized manually.

Downloads

• macOS Apple Silicon: DMG and ZIP. The desktop app is Developer ID signed, notarized, and stapled.
• Linux x86_64: AppImage and tarball.
• Standalone Tinder downloads are platform-specific.

Known issue

OpenAI / ChatGPT Plus / Pro sign-in fails in the packaged build with a missing openai-codex.js module. This is tracked for a subsequent release along with setup copy, folder selection, and visual refinements: #2.

Validation

Full checks passed on macOS and Linux. Native integration tests cover Kiln startup, retry, isolated profiles, shutdown, standalone operation, and onboarding-to-draft behavior.

Ember v1.5.3

Ember 1.5.3 — the macOS build notarizes itself, and a release can no longer quietly ship without it.

Fixed

Notarization used to be a list of notarytool commands a person pasted from a release checklist. The first time it was actually attempted, the build above it had failed, nothing stopped the release, and the commands ran against files that did not exist.

electron-builder's afterSign hook now submits the signed .app and staples the ticket to the bundle — that is what makes it validate offline, on a machine that has never seen it — using the same APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID variables the rest of the toolchain reads. A rejection fails the build instead of publishing.

• A release can no longer ship un-notarized. dist:mac sets EMBER_RELEASE=1; without credentials the hook refuses rather than warning. dist:mac:local keeps the warning-only behaviour for a local build.
• The bundled harness is recompiled, never reused. build:harness now clears its output first. The directory held a Linux ELF binary and is gitignored, so a Mac build that skipped or reordered that step would have shipped an app whose embedded Kiln cannot execute — and it would still have passed signing, which does not inspect architecture.
• electron-builder is pinned at 26.18.0 instead of resolved by bunx on every build.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.5.3-arm64.dmg
• App archive: Ember-1.5.3-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.5.3.AppImage
• Tarball: ember-1.5.3.tar.gz
• Tinder CLI: tinder-linux-x64

Ember v1.5.2

Ember 1.5.2 — "Mark as read" floats next to "Jump to latest" and shows you which message it will move.

Changed

It used to sit under the message. That only worked if you had already scrolled to it — but the moment you actually want it is the moment the message is not on screen, because you are scrolled up reading the middle of a long turn.

It now lives in the viewport's bottom corner beside Jump to latest, and acts on the newest unread turn. The mark is a watermark, so marking the latest one is what "I'm caught up" means; marking an older one would leave everything beneath it unread.

Pointing at it tints the message it would mark — a plain background change on that turn, nothing else on the page moving — so it is never a guess which message moves. After the press, that message flashes the accent twice: two pulses and it is over, long enough to catch your eye in a column you were not looking at, short enough to read as a receipt rather than a new state.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.5.2-arm64.dmg
• App archive: Ember-1.5.2-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.5.2.AppImage
• Tarball: ember-1.5.2.tar.gz
• Tinder CLI: tinder-linux-x64

Ember v1.5.1

Ember 1.5.1 — the "Mark as read" control was off screen, and a rotated harness could vanish from the rail.

Fixed — Mark as read

It was a 14px circle in the message's left margin, which sits outside the transcript's scroll area. On a narrow window the row's padding is the only thing between the text and the viewport edge, so it was clipped to a sliver; on a wide one it was a speck far from the text it described. A control nobody can press is not a control.

It is now a Mark as read row under the message, where reading ends and the decision happens. Pressing it turns the row into a tick, then it collapses and the turns below slide up over ~180ms — the gap closes gently instead of jumping. It shows on hover and on keyboard focus, and is always visible on a touch screen, where there is no pointer to hover with; twenty unread messages don't paint twenty buttons over the conversation.

Fixed — a rotated harness disappeared

The endpoint merge only adds the harness this launch started (a token read from settings might be stale), and the restart that installs a new token produced a state outside that set. So the token was fine and the row was gone until the next launch. A rotated harness is now its own state, kept in the list and still re-tokenable. Verified against a real harness: after rotation the new token answers 200 on /health, the old one 401, and one process owns the port.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.5.1-arm64.dmg
• App archive: Ember-1.5.1-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.5.1.AppImage
• Tarball: ember-1.5.1.tar.gz
• Tinder CLI: tinder-linux-x64

Ember v1.5.0

Ember 1.5.0 — the harness token is now something you can read, copy and replace from the app, and it looks like apple-venison-rainbow-copper instead of 64 hex characters.

Added — see and copy the token

Settings → Instances → This computer shows the token of the harness Ember runs for you. It was previously only reachable by opening ~/.ember/hearth.token in an editor or running tinder token — for a value whose whole purpose is being copied to another machine.

It is masked until you ask (this panel is the most screenshot-prone surface in the app), Copy works without revealing, and the line under it says what the token is for: other machines and paired browsers use it to connect to this one.

Added — regenerate it

One button, one confirmation that names what breaks: every other machine and browser pointed at this host stops connecting until the new token is copied across. The agents themselves are untouched.

A token is read by the harness at startup, so this is one operation rather than two. Ember stops the harness it started, waits for the process to go, writes the new token to both filenames, and starts it again with the token already on disk. Writing the file under a running harness would have shown a fresh token while the process still accepted the old one.

Only offered for a harness Ember started. A host it merely attached to — Tinder's service, or one already running — keeps its token, because Ember does not own that restart.

Changed — four words instead of 64 hex characters

Hex was unreadable, untypable, and impossible to fix by looking at it, so it ended up pasted into notes and chat messages. Four words from a 1,933-word roster carry about 43.7 bits: still far beyond guessing over the network (roughly 700 years at 200 requests a second), and now easy to retype from one screen into another, which is the thing people actually do with it.

Existing tokens keep working. Nothing validates the shape — the harness compares the string it read with the string in the request — so a 64-character token from an earlier install stays valid and is never rewritten. Rotating is how you get a word-form token.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.5.0-arm64.dmg
• App archive: Ember-1.5.0-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.5.0.AppImage
• Tarball: ember-1.5.0.tar.gz
• Tinder CLI: tinder-linux-x64

Ember v1.4.1

Ember 1.4.1 — a one-line cause, found and fixed: the "New messages: Don't notify" toggle could not be switched on.

Fixed

The row saved the flag, and the stored copy that came back had lost it. parseReadMarks (the settings validator in main) rebuilds every read mark from a fixed list of fields — through, ids, readAt, comments — and quiet was not among them. Each click therefore wrote a value that was validated away; the optimistic row was replaced by the stored one a moment later, which is the flicker you saw, and the switch appeared stuck.

quiet now survives the round trip, and a quiet session with no read history at all keeps its key instead of being pruned as "a mark that says nothing". Three tests in transport.test.ts pin the round trip.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.4.1-arm64.dmg
• App archive: Ember-1.4.1-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.4.1.AppImage
• Tarball: ember-1.4.1.tar.gz
• Tinder CLI: tinder-linux-x64

Ember v1.4.0

Ember 1.4.0 — a fix for the first-launch failure in 1.3.0, one directory for everything Ember owns, and a way out of an empty model picker.

Fixed — the 401 on first launch

/health answering and the harness's token being readable were treated as one fact. They are not: the harness binds its port and starts answering, then writes hearth.token. The first poll to land in that window recorded an empty token, so Ember listed a connection that answered its health check and rejected everything else. Reload could not help — it re-uses the recorded token — and nothing logged it.

Ready now means both facts: it answers and Ember holds the credential it answers to. A host already running whose token cannot be read is not adopted either; that was the same 401 with a different label.

Changed — everything lives in ~/.ember

Settings, model stats and activity used to sit in ~/.config/ember while the harness kept its home in ~/.ember: one product, two data directories, two backup stories, two things to delete. Both are now in ~/.ember, so deleting that directory is a clean reset. A pre-1.4 ~/.config/ember is moved across once on the next launch, and token files are deliberately not carried over.

Added — an empty picker now says what to do

A host with no providers cannot offer a model, and refreshing changes nothing. The picker now says so, names the host, and offers Add providers…, which opens that host's Providers screen with the host already selected.

Downloads

macOS (Apple Silicon — Developer ID signed, hardened runtime, notarized & stapled)

• Installer: Ember-1.4.0-arm64.dmg
• App archive: Ember-1.4.0-arm64-mac.zip
• Tinder CLI: tinder-macos-arm64

Linux (x86_64)

• AppImage: Ember-1.4.0.AppImage
• Tarball: ember-1.4.0.tar.gz
• Tinder CLI: tinder-linux-x64

Checksums are attached per platform. See the CHANGELOG for the details.