wisp 0.5.0

Fixed:

• An unanswered MCP approval now comes back at approval.timeoutSeconds as promised. The wait was
  decided at the deadline but not returned until the client eventually answered the dialog, which on
  2026-09-21 took 11 to 56 minutes for three refusals.

Changed:

• wisp chat shows its work: a status line above every prompt (model, directory, git branch and state,
  approval mode, context used), the model's tool calls and results live as one dim line each, a compact
  approval dialog with a one-line key, colour on a terminal (off when piped or with NO_COLOR), and
  new commands /inspect, /status, /last, plus --yes. Replies alone go to stdout, as before.

Install or upgrade with Homebrew: brew install pidster/tap/wisp. Downloading the tarball directly leaves it quarantined; use Homebrew.

wisp 0.4.0

Renamed: daimon is now wisp. The binary is wisp, the home directory ~/.wisp (WISP_HOME), the
environment variables WISP_*, the unified-logging subsystem com.pidster.wisp, the MCP server wisp
with wisp:// resources, and a new formula in the Homebrew tap (brew install pidster/tap/wisp).
Nothing carries over automatically: move ~/.daimon to ~/.wisp yourself if you want your approvals and
transcripts, and brew uninstall daimon. The daimon formula stays in the tap.

Added:

• summarise_diff, a new MCP tool: run a command that prints a diff (or read a diff file) and get back
  a headline, one line per file with its change kind and line counts, and flags for secrets, deleted or
  disabled tests, and binary or generated content. Paths and counts come from the diff itself; the diff
  never leaves the Mac.
• Measurements: scripts/check eval records what each delegated task achieved (triage,
  edit_file replace after read, schema-shaped replies, the risk classifier) into a resource embedded
  in the binary; wisp tools --markdown, wisp://tools, and the new wisp://measurements
  resource publish them so a caller knows what to trust.

Changed:

• Approvals for programs whose first word is the verb (git, cargo, swift, npm, brew, docker
  and others listed in multiplexers.txt) are remembered by verb: git commit * and git push * are
  separate, so a session answer for one no longer covers the other. A standing approval stored under
  the old git * still counts until it expires.
• edit_file replace takes line, the number read_file showed, with content as the whole new line
  and find as an optional check on that line; a drifted number changes nothing. The by-find form
  measured 3 of 5, because the model retyped the neighbouring line into content.
• Local runtimes that truncate silently no longer lose the instructions: Agent condenses the transcript
  ahead of the window when the usage the last reply reported, plus the new prompt, would pass 85% of it,
  audited as context.condensation with reason budget. Ollama is asked for an explicit window on every
  request (ollama.contextLength, default 8192, sent as num_ctx), and /tokens shows the reported
  usage for models that cannot count.

Install or upgrade with Homebrew: brew install pidster/tap/wisp. Downloading the tarball directly leaves it quarantined; use Homebrew.

daimon 0.3.0

Added:

• edit_file, a new model tool: write a whole text file, append to it, or replace one exact
  occurrence of a piece of text. Writes are atomic and confined to the directories the sandbox lets
  commands write under, every edit passes the risk classifier and approval as edit_file <mode> <path>, and
  each edit is audited as file.write and listed in the receipt's files.
• triage, a new MCP tool: run a build or test command on this Mac (or read an output file) and get
  back only the failures as kind, location, message, judged chunk by chunk by the on-device model.
  The raw output never leaves the Mac; the command runs under the same policy, sandbox, and approval
  as the model's own run_command.
• Structured output: respond takes a schema (a JSON Schema object in an accepted subset) and
  returns JSON of that shape, parsed into structuredContent.output; the CLI takes --schema <path>.
  A model that does not declare guided generation is refused before generation.
• respond results carry a receipt: the turn's tool calls with arguments and result sizes, commands
  with exit status, policy denials, approval decisions, and errors, folded from the thread's audit
  events so a calling harness can verify delegated work without reading the log.

Fixed:

• --model private-cloud failed after the request with an opaque ModelManagerError 1046. Private
  Cloud Compute needs the managed com.apple.developer.private-cloud-compute entitlement, which an
  ad-hoc signed command-line tool cannot carry; daimon now checks its own signature and refuses the
  model with a sentence before anything is sent. daimon models shows the same reason.

Install or upgrade with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

daimon 0.2.0

Added:

• Model backends are a registry: --model <backend>:<name> names a local runtime by scheme, daimon models lists every backend's models with their declared capabilities, and a backend this build lacks
  is a clear error. Ollama now reports each model's real capabilities from its /api/show, so an
  embedding model is refused for tool use before generation rather than failing during it.

• --no-tools on the CLI and tools: [] over MCP open a text-only conversation, which any model can
  run; a request that needs tool calling on a model that does not declare it is refused with a hint.

• The audit log records model.resolved when a conversation opens: backend, model, asset, declared
  capabilities and who declared them, and the tools in use.

• Core AI: --model coreai:<bundle> runs a model exported to Apple's Core AI format, in daimon's own
  process, through the bridge from apple/coreai-models. Bundles live under <home>/models/coreai
  (config.json coreai.modelsDirectory) or are named by path; daimon models lists them with kind,
  compression, source, and size; a missing bundle is refused with where daimon looked and the export
  command. Capabilities come from the bundle. See docs/backends.md.

• inspect, a read-only tool the model can call to see daimon's effective config, this conversation's
  status, the standing approvals, or recent audit events, bounded to 4 KiB.

• MCP resources daimon://config, daimon://status, daimon://approvals, daimon://audit, and the
  template daimon://audit/{session} for one thread's events, so a calling harness can read daimon's
  state without a model turn.

• daimon config prints the effective configuration as JSON.

• MLX Swift: --model mlx:<directory> runs a model in MLX or Hugging Face safetensors layout in
  daimon's process through mlx-swift-lm's bridge, in builds made with --traits MLX (the release
  is); a build without the trait refuses mlx: models with the reason. Capabilities are declared by the
  operator per model in config.json's mlx.models; an undeclared model is text only. Verified with
  mlx-community/Qwen3-1.7B-4bit: text replies in 2.5 s including load, and the tool loop 3 of 3 with
  toolCalling declared. The Homebrew release does not include MLX, because it needs a Metal library
  bundle beside the binary; build with --traits MLX yourself. See docs/backends.md.

• approval.classifier chooses what judges commands beside the rules: rules, system-model (the
  default, unchanged), or coreml, a Core ML text classifier you train from a text,label CSV with
  scripts/train-risk-classifier. The model must follow a versioned contract or it is rejected; every
  failure or low-confidence verdict is moderate with the reason; the audit records the model's
  identity, version, label, and confidence. Measured on 2026-09-20: a model trained on the 45-command
  eval set scores 45/45 on it (its own training data, so no evidence of judgement); trained on the 35
  non-held-out commands it got 5 of the 10 held-out ones right, and two dangerous commands it called
  safe were kept off safe only by the confidence guard. Not fit to judge alone; measure your own
  with DAIMON_COREML_MODEL=<path> scripts/check eval before relying on it.

Changed:

• The run_command sandbox also allows writes under the per-user cache directory
  (getconf DARWIN_USER_CACHE_DIR), where Clang keeps its module cache; a build that compiles a C
  module inside the sandbox (SwiftPM compiling a dependency's manifest, say) used to fail with "could
  not build Objective-C module 'Darwin'".
• daimon with no prompt on a terminal prints its help instead of waiting silently for stdin; a piped
  stdin is still read.

Install or upgrade with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

daimon 0.1.5

Fixed:

• Codex could not connect: its initialize carries capabilities.experimental with object values,
  which the MCP specification allows, and the Swift SDK rejected the whole request with -32603. daimon
  now normalises such messages before the SDK decodes them. daimon never reads the field; no client
  feature is enabled by it. The captured request is a regression test.

Install or upgrade with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

daimon 0.1.4

Install with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

Full Changelog: v0.1.3...v0.1.4

daimon 0.1.3

Install with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

Full Changelog: v0.1.2...v0.1.3

daimon 0.1.2

Install with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

Full Changelog: v0.1.1...v0.1.2

daimon 0.1.1

Install with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

Full Changelog: v0.1.0...v0.1.1

daimon 0.1.0

Install with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.

Full Changelog: https://github.com/pidster/daimon/commits/v0.1.0