v1.4.157

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• The built-in terminal is the default on macOS and Linux: quitting Coral now ends its agents, which is what people expect (Windows always had only this). tmux stays available and keeps agents running across a quit, a restart and an update. Who is affected: new installs and installs with no saved choice; an explicit choice in Settings or --backend is always kept; an upgrade that still has agents running in Coral's private tmux server runs tmux for that one start so no running agent is hidden. An install that ran on the old default sees one line, once: "Agents now stop when you quit Coral. To keep them running, choose tmux in Settings > Terminal." On the built-in terminal the tray has one exit that stops the agents ("Quit and stop all agents"); with tmux it keeps its two exits ("Quit and stop all agents" and "Quit Coral"). Agents on the built-in terminal wake again after a restart through the "Wake agents after a restart" setting, which is now shown there.
• A first run that says what is wrong:
  • tmux missing (only when tmux is the chosen backend): one line under the launch dialog with the operating system's install command and "Check again"; Launch is off with that as its reason; a remote server chosen in the dialog is not checked against this computer's tmux; a failed start on the built-in terminal is no longer blamed on tmux.
  • An agent that is installed but not signed in (Claude and Codex): one plain card, " is not signed in", with a way to sign in and "Check again", read from the CLI's own status command at once (before, up to five minutes late, and nothing for Codex); the "Claude is not signed in: background jobs are waiting" line shows only on a Claude agent's page.
  • The first reply: a quiet "Working · 12 s" from 5 seconds, "Still working. Open the terminal to see what it is doing." from 30 seconds, " stopped before answering" with Restart when the CLI exits, and "Waiting for to start" in the agent's first 25 seconds.
  • The create-a-password page says what the password is for, in one sentence.
  • The Changes panel in a folder that is not a git repository says "Not a git folder" instead of "0 files changed vs HEAD~1".
• Hover a message to see when it was sent: in agent chat and on the board, a message's local sent time is shown next to its actions (always on a touch screen, on hover or focus with a mouse or keyboard), with the full date in the tooltip.
• History and Search work on a phone, and Clear filters works: the chat history list and Search are reachable on a phone, clearing a search brings the list back and ignores a stale result, and the return control is named "Back to chats".
• Chat History no longer lists Codex's own auto-review messages: Codex's guardian review rollouts are excluded from History and search, and Codex 0.163 chats are checked once and remembered, so later passes skip unchanged rollout files.

Changes

• Less text, screen by screen (visible words before and after, as each task measured them): Cost dashboard, empty period 84 to 66; History search desktop 10 to 9 (filters open 34 to 32, a partial-result example 49 to 47); Scheduled jobs: no workflows 20 to 15, a new prompt job 74 to 70, a new workflow job 56 to 53, a job's detail with the example prompt folded 63 to 38 (the full prompt is one click away); Create Task with its optional workflow section closed 86 to 28; notifications: agent input 13 to 12, the received-files limit 23 to 20; Git, empty changed-files panel 10 to 8; Notes, empty prompt 4 to 2.
  • The agent bar, its menus and the right-hand panels: the command box no longer prints the board's generated id ("Message , or paste an image"; "Type a command in " for a terminal), the Files panel draws its comparison choice once, the Team view's legend is behind a "?", empty chat, Tasks, Artifacts, Saved and agent panels say less, the board shows its message count only while messages are hidden and the date only when it is not today, and the artifact viewer loses its "Who can read this" line.
  • The tray menu: "Open in App" is "Open Coral", the exits are "Quit and stop all agents" and "Quit Coral" (Windows has the first only), and an update notice is one line, "Update available: vX (you have vY)". The Coral Hub enroll page keeps "Only approve a machine you control." with the rest behind a "?", and the sign-in page loses its tagline.
  • The launch chooser, New Agent, Team launch and Add agent lose their sub-titles and restated defaults, Team settings > Messaging and Workflow get shorter labels with their notes behind an (i), and the Working mode list names its four modes the same way (no "built in" on one).
  • A new Home makes "Launch agent" the obvious start and quiets the Coral Hub cards; Save is the primary button in Team settings; the persona buttons are rectangles, not pills; the (i) is one shape everywhere; Settings shows the four default models two by two; a Team launch's three top fields are one style and every disclosure keeps its arrow on a phone.
• Keyboard and touch: a dock tab the keyboard reaches shows its name; Enter or Space on the Settings button moves the focus into the menu and Escape closes it; the empty-folder refusal is said once; the Create Task checkboxes are 44 px on a touch screen; an agent called by its folder carries its CLI in the list.
• The updater is switched off in this release too: the tray's "Update to vX available" item and the dashboard's Updates pane exist, and with the feature off (the status route answers 404) or no newer approved release there is no item.
• Coral Hub: GET /api/system/cli-check accepts signin (rate limited, a boolean reply); the changes list and refresh answers carry an optional is_git; the live-session list rows carry a start time, created_at; POST /api/system/terminal-backend/notice-seen is never carried through the Hub.

Fixes

• Themes from Coral Hub are checked: a theme answer that is empty or malformed can no longer empty the page's colours, and with no theme chosen the page follows the system's light or dark setting. A theme from Coral Hub also no longer replaces your own saved light or dark choice when the page loads.
• Windows, the first-time walk: the MSI is a real x64 package built the same way everywhere, so the install moves from Program Files (x86) to Program Files (an update changes shortcuts and scripts that name the old folder); a refused installer launch (an installer run as administrator) says why in a message box; the Coral window opens inside the screen's work area.
• Windows, the Windows team's fixes: every console child Coral starts gets no window; a working folder of 259 characters or more starts through its short path or is refused with a plain reason; a subagent id that is not a plain id is refused and the Tasks table escapes the label; Coral's listeners hold their port exclusively, so no other program can bind a more specific address on Coral's port while it runs; hooks wait 0.8 seconds for Coral when nothing reads their post (a created task keeps 3 seconds); agy's slash command Enter goes through agy's own completion menu and only when the highlighted command is the typed one.
• Codex and agy agents: the input gate never types into a working Codex, recognises its own text left in the box and says when sends wait behind it, does not take a past prompt in Codex's history for its input box, and forgets its own text once its Enter has emptied the box; a typed send is remembered as Coral's for two minutes only.
• The command-line tools: unknown options and unknown commands are refused (exit 2), post and send read options before the message and treat anything after it that is not an option as text (a misspelt --to or --file after it is refused), task list has --json, task current --json prints JSON in both tools, each way a request fails has its own exit code with plain "cannot reach" text and CORAL_TIMEOUT (capped at 10 minutes; coral-board wait keeps its own timing), coral-board read and check give up on a server that never answers, artifact download --output copies the verified bytes where the file system has no hard links, and help topics windows, exit-codes, json and timeouts explain them. A task that does not exist answers 404 "Task not found" from complete, submit-review, approve, reject and the merge-queue routes.
• The agent token is guarded better: it is never sent over plain http to an address that is not this computer; on Windows it is sent to a Coral on this computer only after the listener's executable and account are checked to be Coral's (verified again after 30 seconds, 2 after a refusal), and a refusal says in whole sentences what was refused, why and what to do (exit code 5, "refused").
• Board and diffs: completing or cancelling a task answers once it is committed and its changes.diff is written after the reply, one at a time; the diff lists tracked changes first and then new files whole while they fit, and says how many it left out and where they are; the Health "held draft" line says whose messages wait and that Coral never sends the text.

Privacy and security

• Logs hide more: your home folder is written as ~, your user name and computer name are hidden (also in their short forms and after :, |, > or file://), project folders appear b...

v1.4.156

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• Settings says less, one group at a time: the long explanations moved behind each row's (i), the sub-titles that repeated the tab name went, and the visible words of each group came down: Network and Hub 413 to 74, Agents 200 to 73 (the four per-provider Custom models groups are now one list with one "Add a model" form that has a Provider box, and its hint sits behind the row's (i)), Storage and cleanup 118 to 47 (the breakdown behind a disclosure), Terminal 122 to 53 (the security notes behind Learn more), General 53 to 38, Notifications 10 to 4, Files and Git 19 to 15, Security and privacy 86 to 31. In Network and Hub an empty status line takes no room, "Run as a hub" is label left and switch right like every other row, and Disconnect lines up with the row's left edge. A test now holds each group to a word budget.
• Team settings > Health check says less: 118 visible words down to about 50 (354 with its folded rules open down to about 190, the explanations behind (i) buttons). One short label per control and at most one hint line; while the check is off, Every, Send it to and Post when all is well are dimmed and disabled; ranges and units sit in the control ("Every [10] min"); "Only the Operator on this computer can change these." is said once, in the Team settings header; opened from the health icon, the first focus is on that tab.
• Prompt inspection and the template browser say less: the controls around Prompt inspection went from 95 visible words to 28, with the full prompts folded until asked (copying a whole role still works); a template's source attribution went from 10 words to 3.
• The Inbox and the Hub Servers page say less: the Inbox headings and empty states are shorter (an empty Inbox's Needs you 27 words down to 13, Tasks 29 to 12, All saved 50 to 27), and the optional Hub Servers setup and the access detail are disclosed on request instead of always shown (a computer's expanded row on the Servers page 164 words down to 35, an empty account's page with setup open 114 to 90).
• A first Launch Team works the way a first agent does: after Launch Team the team opens (its board with the Team view beside it); an optional "First task" field posts your first message to the Orchestrator (or the first member), and an empty board says "Tell @ what to build" with the compose box focused; clicking a team's name or pressing Enter on its header opens it, and the chevron before the name is the one control that collapses it; the dialog opens on the template choice with no members picked for you; the folder is above the sections on every tab, required, and empty unless Settings has a default folder.
• A first single agent starts without surprises: New Agent no longer starts on your home folder (the folder box says "Choose a folder" and Launch asks for one; choosing the home folder shows one line that the agent can change any file in it); a missing CLI, or a configured path that cannot run, is said once under the folder (the vendor's install page first, the terminal command second), with Launch off and that message as its reason, and Check again turns it back on; an unnamed agent is called by its folder or its CLI ("my-app", "Claude") instead of "Agent"; the create-a-password page offers one primary path (the Coral Hub way is a quiet link); a phone's Home with nothing running says what Coral is for and offers the same Launch agent and Launch team cards as the desktop.
• Custom models through Coral Hub, for the account that owns the machine only: the account a computer is linked to can read and replace the custom models list through the Hub; any other Hub account is refused (403), a computer with no recorded owner refuses everyone, this computer's own requests are unchanged, and "Add a model…" is hidden from a person the machine refuses.

Changes

• The updater (A, B and C) ships built and switched off: the real relaunch, the install classifier (a Homebrew cask is never checked, staged or applied), the automatic check job, the local relaunch route and the dashboard's update UI are in this release, and every switch is off on every platform. What you can see today: nothing. The new routes answer 404 on this computer, and Coral Hub refuses them; the dashboard's update UI stays off (it turns on only when the server says so). coral-update status --json now reports what this install is and whether the updater could replace it.
• Update telemetry, exactly three things: upgrade now carries from_version (the release that last ran on this install; a release number only, left out otherwise); update_notice_shown (the dashboard's update toast or the tray's notification showed that a newer release exists; once per install, release and place, only for the release this server's own update check offered); and update_offer_opened (the person opened the release page the notice offers, which includes the tray's Check for Updates opening it; once per install, release and place). The schema version is 4, all values are closed sets, an install keeps at most 20 update keys, and nothing is sent when usage analytics are off.
• A node folder that is group-writable is judged more carefully on a Mac: a group with a nested group, or with more members than the names accepted, is refused, and so is any system account other than root and the Setup Assistant's own.
• A bare artifact link reads as its visible words to a screen reader ("artifact 81b837f8"); the full id stays in the tooltip.

Internal

• Windows: the updater's install answer is one object on every platform (status.Install) and trigger.Preflight reads it; a signature can be required on a Windows package and the signer pinned to the whole certificate, switched off until the first signed release; a Linuxbrew path test no longer depends on the machine's separator.
• Docs: the cross-team documentation tells linked-team defaults from explicit local opt-ins.
• Tests: the startup request golden gains the updater's one status read; a suite pins the server's answer that turns the update UI on; the static budget for the embedded front end is 6 MiB + 128 KiB; the feed-reconnect stability suite takes its node baseline after the page's one-time interface is built, and the first-time agent suite waits for the New Agent dialog's template to exist (both failed now and then under load).

v1.4.155

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• The Mode button reads Claude's own modes: an agent started in Auto used to be told "Accept Edits" (the footer's "auto mode on" was not read, and the button's "auto" was Accept Edits). The button now names each state as Claude does (Manual, Accept Edits, Plan, Auto, Bypass Permissions, Don't Ask) from the CLI's current mode line, and cycles in Claude's own order (checked on Claude Code 2.1.307). The mode the agent reports is only a label: presses are counted from the screen. A permission mode that says "auto" is labelled "Auto" everywhere, and Manual's tooltip says it is the Default in Settings.
• @mentions on the board are highlighted: a mention of a current board member ("@Security Reviewer Windows": names can have spaces), or of the Operator, the Orchestrator or all, is shown with weight and a tint (not colour alone, 4.5:1 in both themes, a border and an underline in forced-colors mode); the viewer's own name is stronger. Nothing inside code, a code block or a link, and an email address is not a mention. A bare coral://artifacts/<id> in a post is a link to that artifact.
• "Add a model…" where you pick a model: the model menu, and the model field in the launch and restart forms, end with "Add a model…": a small form (the model id, an optional display name) writes it to your custom models, so you do not have to go to Settings. An empty, flag-shaped or existing id is refused in words.
• The artifact viewer's Comments panel is closed unless you ask for it: the document has the full width; a "Comments (N)" button in the header opens it (a column beside the document on a desktop, a sheet on a phone), and selecting text still offers Comment. A desktop remembers open or closed.
• The Windows updater is built, and still switched off: the install route, the updater copy, the one-time install marker, the verified MSI major upgrade (a click for exactly the staged version, the whole chain re-verified, Authenticode pinned) and the verified rollback package are in this release, and a real-Windows-Installer test passes on a GitHub runner. The apply switch stays off on every platform: nothing updates a Coral yet, and the install route refuses before it quits anything. Windows packages are not Authenticode-signed yet; until they are, an update is accepted on its checksums and Sigstore signature.
• Windows: opening Coral again shows the running tray's window (before, a second start did not hand over), through an event only this user can set.

Changes

• Board posts are short and scannable: the agents' prompts and the coral-board help teach a one-line summary first, a numbered list, and long evidence as a linked artifact; the help fits 80 columns.
• The tunnel tells Coral Hub of a mode change with one message at a time, and a failed message does not reconnect on a connection record that is gone.
• Auto-accept holds more Git commands: a Git setting that runs a program (core.hooksPath, core.fsmonitor, core.sshCommand, credential.helper, the pager and protocol settings, and more), and a write into a place Git runs programs from (.git/hooks, .git/config, hook folders, archive and sync destinations), are held even after the shell's quote removal. A Coral Hub account at Launch can still run a program that is simply run; the documentation says what is left.
• A file relayed to a board that does not exist is refused with the same 403 as every other refusal (before, an unknown board got its own 404).
• An agent CLI installed with Homebrew's node runs on a Mac: a group-writable folder that is yours (the group is admin or your own, and no one else is in it) passes; the refusal names the folder and group and gives the chmod, or says to start Coral from a shell whose PATH has node's folder.
• A Google API key with a low entropy is masked in what Coral Hub sees: the redactor's rule has no entropy filter (the library's placeholder filter could let a rare real key through) and still skips documented example keys.
• Settings is clearer for a computer that never chose a Hub access: "Not chosen yet (View)" with an explanation, a sentence when the Hub cannot be reached ("Coral could not reach Coral Hub. Check your connection and try again.") with the seconds until Connect may ask again, and no "until you connect" wording for a computer connected from the command line. The Messaging tab says what its box covers: "Message teams on other computers (through Coral Hub links)" and "Share files with teams on other computers (through Coral Hub links)", with "Message teams on this computer: on/off" as its own line (the refusal text for files names the new label), and the team settings dialog opens on its first tab, not on Rename board. The seconds until Connect may ask again count down in plain text (not announced every second), and Connect is off meanwhile.

Fixes

• Auto-accept no longer panics on an empty argument on Windows, and -DestinationPath (Expand-Archive, Compress-Archive) is judged as a path parameter, so an extract to an outside folder is not let through.
• Windows: a fixture build of Coral refuses to start, saying why.

Internal

• Tests: the sign-in probe tests find a hold against a signed-in control, not by seconds; the Codex timeline, the testguard PID, the CLI-help and the Coral burst-debounce tests no longer depend on timing or on a reused PID; a browser test pins that a send between two teams on one computer needs an explicit on; the first-launch editions_browser step waits for the screen to be shown; the redactor's miss-rate harness is seeded and can be rerun from its seed.

v1.4.154

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• Coral Hub asks one question when you connect: the Connect screen asks "What may Coral Hub do on this computer?" (View, Interact or Launch; Launch is preselected, or what an install already saved), with the auto-accept switch shown beside Launch, and says once that nothing is sent until you connect. The first focus is on the question, so Enter cannot connect before it was reached. Settings > Network and Hub asks the same question in the same words. The answer goes with the connect call (it is saved before the enrollment starts, and nothing is saved when any part is invalid); the command line's plain connect is unchanged.
• Coral Hub's Servers page (in the shared front end) is a table: sortable, with rows that open, "Add a machine" on top with the download page, one lower-only "Hub access" control (View, Interact, Launch) that follows the computer, Rename and Revoke in the row, and an online computer with no health reading yet says "Waiting for a health reading" (never "not connected"). Revoke asks in the words Coral Hub wants, and Cancel and Escape give the keyboard back.
• Coral Hub is told when this computer's access mode changes: to a hub that advertises it, the change is a short message on a new control stream instead of a reconnect (a reconnect drops every stream and looks like a network failure, and an open terminal a viewer of Interact could type into stayed open until its first keystroke); a hub without it still gets the reconnect.
• A new agent's terminal starts quiet: it no longer shows the long launch command; it stays empty until the agent draws (the command is in the server log; CORAL_KEEP_LAUNCH_SCRIPTS keeps the script for debugging).

Changes

• Cross-team relay is on by default: a board's cross-team messaging and file switches are now on for a board that never set them (an owner's explicit off stays off), and the two switches are kill switches: the Coral Hub team link is the permission. Teams on one computer still need an explicit on to reach each other, and the Messaging tab now says so, with the two reaches told apart ("Teams on other computers: on (needs a Coral Hub link)" and "Teams on this computer: on or off", with a button, Turn on for teams on this computer).
• Codex starts in the workspace-write sandbox, with no approval prompts and tool networking on (before: it bypassed the sandbox); a default mode saved in Settings wins, and -c sandbox_workspace_write.network_access=false turns networking off.

Fixes

• In Coral Hub mode the Settings dialog keeps its layout: the hub note sits inside the content column; before, the dialog collapsed to a sliver at every width.
• An agent CLI installed with npm runs from the macOS app: claude, codex and pi installed with npm are scripts that start with #!/usr/bin/env node, and the app started from Finder has a PATH with no node, so every run of the CLI failed (the launch, the version probe, the sign-in check, the model list). Coral now finds the node that installed the CLI and adds its folder to the end of the PATH for that one child only, and only from a folder no other user can write (each link and parent checked, macOS access lists included) (the process PATH is never changed, and nothing is put first).
• Windows: every program Coral starts itself runs without the current-folder search, so a claude.cmd shim started in a repository does not run a planted node.exe from that folder; and Coral's window marker no longer follows a link.

Internal

• Windows builds: every Windows test run now builds the package and runs the release's own smoke test (including the MSI when the installer changes), the Windows CI pins MinGW, and a census keeps the test build and the release build the same.
• Tests: the live-PTY restart tests count a real launch of the stand-in agent (a quiet launch erases the screen); an opt-in test checks the Codex hook-trust key against a real Codex 0.163.0; the PTY identity stress run works on Windows and with lower- and mixed-case Coral variable names; the release verifier allows 1.4.153's larger packages.

Approved: 2026-10-22T07:27:53Z

v1.4.153-rc1

Full Changelog: v1.4.152...v1.4.153-rc1

v1.4.153

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• The updater program ships in every package, switched off: coral-update is in the Linux and macOS packages, the Windows ZIP and the MSI (with its command-line link), and coral-update status says so (apply_enabled is false on every platform: nothing is updated by it yet). The release check that runs on every package now includes it. Its trust anchors (the Apple team and the promote repository) are pinned in the build. The packages are larger: the third-party licence texts of its new libraries add about 175 entries to each Linux tarball and about 110 to the Windows ZIP, plus the coral-update program itself.
• The first-run screens are finished off: a sign-in is said once (the card in the chat, or the pill when the card is not on screen, never both), the terminal tab is not covered, the toast names the agent, and the waiting pill over a long chat comes back when you scroll away from the card and goes when you scroll to it. The Shared Inbox keeps only the message body in an inset panel. The Hub setup screen answers Escape only while it is the topmost thing.
• Antigravity models in the launch dialog: the antigravity alias, and every agent type of one CLI family, now take that family's model list.
• Windows: Coral trusts its own hooks for each Codex it starts, when only an administrator can change them; and a person's send into Codex's hooks-review dialog is refused with 409 codex_hooks_review_pending instead of being typed into it (checked with Codex 0.161 and 0.163).

Changes

• Claude launches always carry a permission mode: an interactive Claude launch now passes --permission-mode explicitly (default where nothing chose a mode). This fixes the 1.4.152 known issue: with Claude Code 2.1.283 or later, a launch Coral meant to keep asking (a Hub launch with the auto-accept switch off, or an agent started by another agent) could start in Claude's own default, Auto. Claude's Plan mode no longer counts as keeping the prompts (it runs the commands its classifier approves): a Hub request for Plan needs the same owner switch, Launch mode and provenance as Auto or Bypass. Only default (also spelled manual) asks.
• Pi counts as skipping the prompts: Pi has no mode that asks, so a Pi launch through Coral Hub needs the owner's "Coral Hub can turn on auto-accept" switch, Launch access and the dashboard's provenance. An agent cannot start Pi (nor a team with a Pi member, nor a team type that takes Pi); you can.
• Antigravity and Gemini: the old --approval-mode spelling is translated to Antigravity's own --mode (an unknown value is refused with a message); the gemini type is Antigravity compatibility, so a path that is the real Gemini CLI is refused with a setup message naming the setting; Coral's help probe of the Gemini CLI now runs with a limited environment and output.
• Codex 0.163: the old --approval-mode and --ask-for-approval untrusted spellings are emitted in the form Codex 0.163 accepts (before, it refused to start).
• Updater switch per platform (internal to the switch): the apply's off switch is now one per platform; all three are still off.

Fixes

• The model picker loads instead of staying empty: a model list that is still refreshing is not kept as the answer; the menu says "Loading models…" and asks again.
• Install lines: the missing-CLI help gives Windows the vendor's PowerShell line for Antigravity (with a Windows note), and Coral looks for agy in %LOCALAPPDATA%\agy\bin; Pi's install command names its new package, @earendil-works/pi-coding-agent; the other install commands were checked against their vendors' pages.
• Accessibility: the first-run card's Open terminal link is underlined and full size, the missing-CLI dialog's link meets contrast in the light theme, Check again keeps focus, and a view-only message box is named "View only through Coral Hub" for screen readers.
• A person's message to an agent is not retyped by mistake (Windows round 5): it is retyped only when the screen is as it was before the typing, never as a slash command; it counts as taken only on evidence of its text; the echo is matched ignoring all whitespace, so a wrapped line or an indented continuation cannot hide it.
• The Windows installer's Launch Coral does nothing when the installer was run as administrator: coral-tray starts nothing when it is launched from the installer with an elevated token (a normal install is unchanged), so Coral does not start with the installer's rights.
• Workflow steps on Windows use only Git for Windows' own shell layouts, never a shell found above the install folder.

Internal

• Test fixes: Codex trust off-Windows reports the switch before the OS; human_send_test.go formatted; the settings golden gains the Codex trust-hooks control; perf_budgets pins "Fit pane width" off; first_run_card waits without raw animation-frame waits; a test that no XML comment in tools/coral.wxs has a double hyphen.

v1.4.152

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• A first run that guides you: after Launch the new agent opens (before, the page stayed on the home screen and the agent was a row to find in the list); a missing CLI is said under the working folder, with Check again (and the Not Found dialog has it too); an agent that has not started shows a readable card that says what to do, and "Claude is not signed in" when it is not (Coral checks Claude's sign-in once, in the background, after the first Claude launch). A launch whose CLI is installed nowhere answers 422 cli_not_found, naming the setting that points at an existing install.
• Claude agents start in Auto permission mode: where nothing chose a mode, a Claude launch is --permission-mode auto instead of skipping every prompt, so Coral does not scare new users. Codex, Antigravity and Pi keep the mode they always had (Codex's Auto cannot reach the board on localhost, Antigravity has no mode between edits-only and skip-permissions, Pi has none). A saved default, or a mode you pick, wins; Known issue: with Claude Code 2.1.283 or later, a Claude launch that Coral means to keep asking (a launch through Coral Hub with the auto-accept switch off, or an agent started by another agent) can start in Claude's own default, Auto mode. 1.4.153 passes an explicit mode to fix this. If you saved a default permission mode (for example Bypass) in Settings, it still wins; choose Auto there to switch.
• Idempotency-Key through Coral Hub: a launch, launch-team, resume, wake or task run that reaches Coral through the Hub with an Idempotency-Key (and a Hub user label) runs once per route, user and key: a repeat while the first runs is 409 request_in_progress, a repeat after it succeeded gets the first answer and starts nothing, the same key with a different body is 422. Coral's hello to the Hub now carries a boot id and a start time, so the Hub can tell a restart from a reconnect.
• The Windows installer offers Launch Coral: its last screen has a ticked "Launch Coral" box that starts Coral when you click Finish (a silent install does not start it).
• Settings shows who last changed "Coral Hub can turn on auto-accept": "Turned on from Coral Hub by , " or "Turned off on this computer, ", under the switch.

Changes

• Cross-team messages and files follow the Hub's link snapshot: from this release a relayed message or file is accepted only when Coral Hub's current links say so. With a stale or missing snapshot nothing is admitted, and the Messaging tab says "Waiting for Coral Hub: messages from other teams are refused until this computer reconnects" with when the Hub was last heard.
• A saved team template matches by the type the member will run as: a saved member with no agent type, sent unchanged to a team of another CLI, no longer matches its saved key, so its allow rules cannot translate into that CLI's bypass without the Hub auto-accept switch. A team saved under the Auto or Bypass default needs the switch through the Hub.
• The publisher is Subgentic LLC: the Windows installer's publisher, the four Windows programs' version information and the LICENSE copyright holder say Subgentic LLC (the installer's UpgradeCode is unchanged, so an installed Coral still upgrades).
• Workflows on Windows: local step files are served, steps run an absolute sh, Git's folders join a step's and a hook's PATH, and a step's children join the kill job before they run.
• Escape on the first-launch Coral Hub screen answers "Skip for now" wherever the focus is.
• A view-only agent keeps its words: the composer keeps "View only through Coral Hub" when you select the agent again and on every live update.

Fixes

• The Coral Dropbox edition ships no installer package: its release has no MSI, its checksums name none and its notes link none; a production release still builds, signs and links the MSI.

Internal

• A test names the stop gate's retry loop and leak checks print every goroutine when they fail; the first-run flow has a browser suite that walks a brand-new install; settings_switch_names waits for the Hub block's status read.

v1.4.151

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• The shared Inbox: the Inbox tab shows Tasks for you (expand one and reply) and "Read the whole message", drawn by the same Markdown renderer Coral Hub uses (vendored byte for byte and pinned by hash), so a message reads the same in both places. A refresh draws an open task again without a read or link lookups when it did not change.
• Working mode descriptions: Team settings explains the chosen working mode in one line under the list (None, Shared checkout, Worktrees and Merge queue each have a short description).
• Edited tasks record when: changing a task's body, title, priority or assignee records edited_at, so a client can tell an edit from a new task.
• Mac app: opening Coral.app again while it runs brings its window forward, and the relaunch after an update opens the window only if it was open when the update began (a tray-only Coral stays in the background).

Changes

• Coral Hub can turn on auto-accept stays on by default, and the Hub owner can change it: the switch now lives in Settings > Network and Hub, and the account this computer is linked to can turn it on or off from Coral Hub. Turning it off ends every auto-accept that was started through the Hub (local ones stay). With it on, an agent that skips permission prompts can be started from Coral Hub at Launch access: the Hub owner account is trusted as much as the person at this computer, so protect it with the Hub's own sign-in controls (the threat model page says so).
• Hub launches that skip permission prompts are checked everywhere: launch, launch team (each member, when its turn comes, with the settings read then), restart and task runs check the flags against an allowlist (anything unknown counts as skipping), and refuse with no_dashboard_provenance, hub_auto_accept_disabled, hub_mode_too_low or hub_settings_unreadable. A team member that is exactly one of the owner's saved templates keeps its allow rules, tools and hooks.
• Saved messages are for the Hub owner only: through Coral Hub the Saved list and its messages belong to the account this computer is linked to.
• The Saved list is fast with a large history: the server marks bookmarks that are gone or not reachable itself, within a time budget and from the bookmark's own agent store, and keeps a small cache; a first list with 10,000 Codex rollouts takes 1.5 s, the next 167 ms.
• Merge queue from the dashboard: attach, send-back and mark-landed take the verified actor when the body names nobody (in the default identity mode too), and mark-landed accepts a bare or sha256:-prefixed digest. A task reply from the dashboard works in the default identity mode.
• Windows: the updater's folders and staged files are private; a task run refuses a network repo_path before any stat; the tools folder joins PATH with the platform separator; Hub-visible paths hide the home folder's 8.3 form; Git Bash gets cygpath -u; and a configured CLI path that cannot be run is a setup problem. A team launch that started nobody keeps a board that something else used meanwhile.
• Accessibility: the Board and Team views (task rows are no longer buttons holding buttons; the message list is a list; Team cards are named), Create task and task detail (a spoken refusal, a keyboard dependency picker, a named dialog), the Inbox (focus after send, one announcement, a turning chevron, the selected tab in forced colors), the light theme (the warning toast's title holds 4.5:1; toasts, the hover card and pasted-image chips are held to it).
• Startup: the shared Inbox renderer and the Coral Hub connect screen load when first used, not at startup; if the connect screen cannot load after an update, a toast says to reload the page.
• Docs: user docs for the thinking level, comments and the agent line (with fresh screenshots), and the threat model refreshed for 146 to 151.

Internal

• The health check form's fields come from one shared field builder (no visible change).
• Watchdogs in the Windows stress runners signal only the process they started; tmux capture and four terminal tests wait for what the shell prints; CDP suites that look at the light theme clear the custom colour variables first, and the "really light" check runs in every gate.

v1.4.150

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• Merge queue (a working mode for teams that land through one person): choose Merge queue in Team settings and every agent is told how to work: in a worktree, with the patch attached to the task. coral-board task attach <id> --artifacts manifest.json adds the next revision of a patch while a task is in review; reviewers approve the exact patch (its digest), so a patch changed after approval, or after a reviewer read it, needs a new review; coral-board queue lists the approved patches that have not landed, oldest first; coral-board task send-back <id> --note "why" (orchestrator) returns an approved task to its author; coral-board task mark-landed (orchestrator or Operator) records what landed. Coral does not apply or push anything itself, and these routes never go through Coral Hub. The guide is agent_docs/merge-queue.md.
• Comments look like a document's comments: a thread is one card with avatars, a name and time line, a thin thread line, Resolve at the top right and a reply box at the foot; resolved threads are behind Show resolved. The Edit and Delete row takes no room until you hover or focus the card.
• Agents show their thinking level: a Thinking row in the hover card (the level the newest turn ran at, or "(as started)"), and the sidebar's agent line is built from Show provider, Show model and Show thinking level. Show thinking level is on by default, so the line reads like "Claude · Opus 4.1 · High".
• A pasted image is one compact chip: the thumbnail with its remove button on its right edge, no "Pasted image N" pill; several wrap as a row of equal chips. A screen reader hears "Remove image 2" and "Image 2" by the image's place, not a generated file name.

Changes

• A command Coral cannot run now refuses the launch (Windows and every OS): a configured CLI path that cannot be run refuses launch, restart, resume and wake with a 422 naming the setting (before, the CLI on PATH ran, or a bare 500). Through Coral Hub the message names the setting only, never the path.
• A team in which no member started is an error: launching a team now answers with each member's reason (422 when all are setup problems, otherwise 500) and takes back what the request made (the team record, the worktree, and the branch and board only when this request created them); before, it answered 200 over an empty team.
• Other accounts on this computer need a credential (loopback): every loopback connection is attributed to its operating-system user once; another user, or one Coral cannot attribute, needs a credential and gets no local-only power. An elevated browser or PowerShell of the owner counts as unattributed (the docs say so), as can WSL2 mirrored networking.
• The webview's system DLLs load from the system folder (Windows): the desktop app loads the DLLs the webview looks up by bare name from the system folder, and the agent docs now say that a command using coral api-key is a script you run yourself, never an agent.
• The terminal input path is one path: every sender of text or keys to an agent names who is typing (a person, Coral, or Coral's internal keys), one write function per backend records it, and the stop's Ctrl-C keys are recorded. A person's text sent through an answer prompt or /send and /keys is now logged by its length, as a typed line is; a character typed through /keys is hidden.
• Windows warnings: the security, firewall and database warnings no longer draw over each other, each × is a button named "Dismiss: ..." with a 24 px target, and the firewall and tools-folder messages are in plainer words.
• High contrast and forced colors (Windows): Settings switches, the selected tab and every agent status dot stay readable; count and status chips keep a border; a pressed toggle keeps its size; the other status dots (sidebar avatar, machine health, Hub server, live job) have their own shapes; a focused text field has an outline; and targets are 24 px at 125% and 150% scaling.
• macOS: Import Template and Import from Folder open the file chooser again.
• Stylesheet fixes: a cost-dashboard row colour the browser had silently dropped now applies (rows with no thinking level recorded are muted), and a broken welcome-page rule that never applied is removed.

Fixes

• Windows launch: a team launch's failure dialog lists each member's error and a button to Settings.

Internal

• A test parses every stylesheet; the Windows stress runners use Windows-safe paths and a watchdog; update-check tests use their own feed URLs; the wake test checks the launch command sent, not the screen; and 43 ptymanager tests run in parallel; the tmux lag test no longer starves its reading viewer.
• Windows branches added a note on agy under a folder with a space (8.3 names).

Added after publishing (the notes above are unchanged):

• Merge queue: tasks approved before 150 are not in the queue (their approval recorded no patch digests): land them the old way, or send them back for a fresh review.
• Thinking level: the agent line now shows by default for anyone who never turned the old Show agent type switch on.

v1.4.149

Download

macOS (.dmg) • Windows installer (.msi) • Windows portable (.zip) • Linux x86-64 • Linux ARM64

---

Features

• Windows Firewall warning: before Coral binds a network address on Windows, it reads the firewall rules (read-only, nothing is changed) and warns in the dashboard when an inbound rule allows Coral's programs on a Public network (or on no profile) and no block rule overrides it. The warning names the PowerShell command to narrow the rule. Private-only rules are not findings. It is checked again later while the server runs.
• A warning for a tools folder others can change: on a portable Windows install, Startup and Settings warn when the folder Coral's agent tools run from can be changed by any account other than SYSTEM, Administrators and TrustedInstaller.
• Windows polish: the Coral window has the Coral icon, the taskbar and Task Manager name the program by its version information ("Coral", "Coral server", "Coral tray", "Coral launcher"), and the installer has Coral's dialog art, links in Apps & features, and a product name that follows the build edition.

Changes

• The data folder must be Coral's own and private (Windows): when Coral's data folder is readable by another account, Coral tightens it to your account and refuses to start if it cannot (--allow-shared-data-dir overrides it). It acts only on a folder that looks like Coral's: empty, with a database, or with Coral's own files. A folder that is not Coral's is refused and left untouched. The folder holding agents' session tokens (session_tokens) gets the same private access list.
• Desktop app and tray hardening (Windows): the app opens only http and https links, opens a file only inside the data folder and only a regular .log or .txt file, calls rundll32 by its system path, and checks a per-launch token in Go on every native function the dashboard calls. DevTools are available only in a development build. The app no longer receives CORAL_DEBUG through its environment; --debug still works.
• Auto-accept on Windows, a fourth round: it waits on more commands it knows to be dangerous (a cd out of the folder, links, wsl, pipelines into a shell, archive extraction and clones written outside the folder, bash or sh by any path judged by its -c text). git clone with -b, --depth and the like no longer asks. As before, anything not recognised still passes, and the folder check reads the path text (junctions and mapped drives are not seen).
• The input debug log on the PTY backend now records the same entries the tmux backend does for the same input (the typed line, Enter and Ctrl-D as keys), and a person's text is still recorded by its length.
• Agents' temporary launch files are removed by their recorded paths when the agent stops, only inside a temp folder; the system temp folder itself is never read.
• Accessibility: "Who can read this" works by keyboard, the Messaging button fits at 200% text, Team settings has a Close button, close buttons are 44 px and folded sections work at 390 px, the Linked teams heading is a heading, and every dialog's Close and Escape go through one shared helper.
• Settings switches are named and described properly: every switch in Settings, Team settings, the health check, Coral Hub sign-in, the server form and the phone display menu is a labelled switch whose description is read with it by a screen reader; the server form's id, URL and API key fields are named by their label. The Settings wording says what each setting does before the explanation.
• The README links to Coral Hub (coralhub.dev) at the top.
• Telemetry: the tray follows a switch-off made while it runs, and its child's hook states the setting as it is now.

Internal

• 57 routes tests that share nothing run in parallel; ptymanager and tmux tests leave nothing behind, so a second run passes; the browser suites wait for what they need instead of fixed sleeps; several loaded-machine flakes (a signed-in call, a toast, a badge, a team launch deadline) are fixed. Windows tests use private per-binary temp folders.
• Two gate fixes of our own: the tray telemetry test clears CORAL_TELEMETRY_DISABLED (CI sets it), and the startup-sequence golden follows the new order in which the dashboard registers the same listeners.
• New tests: hostile-command matrices for Windows auto-accept, real Claude, Codex and agy screens pinned against an independent terminal emulator, and a stress runner for input fidelity.