Onyx Code 2.4.1

A project you open approves nothing on your behalf until you trust it, .onyxnoai reads a leading slash as gitignore does, links that carry an ID reach your answers whole, and a second copy of Onyx Code leaves the first one's models running.

Downloading

If you're installing manually:

macOS

• Apple Silicon Mac (M1 or newer): download OnyxCode-darwin-arm64.dmg (smaller, native).
• Intel Mac, or unsure: download OnyxCode-darwin-universal.dmg (runs on both).

Open the .dmg and drag Onyx Code to /Applications/. Both macOS downloads are signed and notarized by Apple, so they pass Gatekeeper and open without security warnings.

Linux (x64)

• Debian / Ubuntu: download OnyxCode-linux-x64.deb and install it with sudo apt install ./OnyxCode-linux-x64.deb.
• Other distributions: download OnyxCode-linux-x64.AppImage, make it executable (chmod +x), and run it. On Ubuntu 24.04 (which lacks libfuse2) run it with --appimage-extract-and-run.

Windows (x64)

Install with winget: winget install OnyxCode (recommended). It runs through Microsoft's App Installer (a trusted Microsoft Store app) with a package listing reviewed in Microsoft's community winget repository, so it verifies the download and gives a smoother first-run experience. The same installer (OnyxCode-win32-x64-winget.exe) is also attached here for manual download; note it is not code-signed yet either way, so Windows may still show an "Unknown publisher" warning. A code-signed installer is planned for a later release.

The *-autoupdate.zip, darwin-*.json, linux-x64.json and win32-x64.json files are plumbing for Onyx Code's
built-in auto-updater. They are not designed for manual install and will give
you a worse first-run experience than the download above.

What's New

Changed

• A project's permission files approve nothing until you trust its folder. Allow rules in .onyx/permissions.json and .onyx/permissions.local.json apply once you trust the folder (the trust prompt when a folder first opens, or Workspaces: Manage Workspace Trust), so a repository you clone can't approve an MCP tool in advance to run without asking you. In a folder you haven't trusted, every tool that asks still asks, and the files' deny rules apply as always. Such a folder's .vscode/settings.json can't choose the agent mode, add tools that run without asking, or turn down secret redaction either: your own settings apply until you trust it.
• A .onyxnoai pattern that starts with a slash protects its file. As in gitignore, /private.md protects the private.md at the root of your project and /infra/private/ that folder, from chat, search, /file, MCP calls and everything else that reads your files; private.md without the slash still protects the name in any folder.
• The Air-Gap notice for an MCP server gives the right reason. When Air-Gap Mode stops an HTTP MCP server, the notice says the server is not on this machine, which covers a server on your local network too.
• Links that carry an ID stay readable. A link whose only random part is a GUID, such as each Azure DevOps project's URL in what an MCP server returns, reaches the model and your answer whole. A key in a link is still replaced with a placeholder, a GUID beside it included.
• The context indicator stays exact after the AI server restarts. The ring and /context go back to exact counts as soon as the server is back.
• A second Onyx Code leaves the first one's models running. Opening another copy of Onyx Code (a test build beside your installed one, or a second profile) keeps the AI servers of the one already open, so its chat carries on without restarting its model.

System Requirements

• macOS 11 (Big Sur) or later.
• Apple Silicon (M1 or newer) or an Intel Mac. The Universal download runs natively on both.

Installing

1. Download the .dmg that matches your Mac (see "Downloading" above).
2. Open it and drag Onyx Code into your Applications folder.
3. Launch it from Applications. Because the build is notarized, it opens without a security prompt.

Verification

This build is signed and notarized by Apple. macOS verifies it on first launch, so it opens as an app from an identified developer without security warnings.