aico 0.5.0

Mini Apps, sub-agent supervision, and a run of corrections that only surfaced by using the thing.

Requires Node 22.5 or newer (was 20). node:sqlite ships from 22.5 and Mini Apps are built on it, so an older install stops rather than degrades. That is the only breaking change.

npx github:suhail-akhtar/aico#v0.5.0 serve

Mini Apps

Ask for an invoice ledger or a habit tracker and get a real application with a database behind it, at its own local URL, still there tomorrow. Two kinds:

• A page — one HTML file with Alpine over a shared server that runs no code the model wrote. Nothing to install; serving the moment it is saved. Apps never send SQL: the page names a table and passes values, and the server builds the statement.
• A Next.js app — its own server, routing, dependencies and process, for when the job needs server-side logic or a database that is not SQLite. Its own port makes it its own origin, and its environment is stripped of every key, token and password by pattern. What is not contained is written down too: it runs Node as you.

Each app gets its own conversation. Open it and ask for a change; its identity, schema and file list sit in the cached prefix rather than being re-sent each turn. Off by default — Settings → Mini Apps, effective immediately, no restart.

Sub-agents you can see and steer

A delegated turn used to go blank: the parent made one Task call and everything interesting happened where the page could not see it. There is now a panel showing each child, the tool it is inside, its elapsed time and cost — and you can correct one mid-run without losing what it has learned, or stop one without taking down its siblings.

Fixed

• GLM priced from its published list rather than its name. glm-5.3 and glm-5.3-flash both matched the glm-5 prefix and were billed identically, for models that differ ninefold. z-ai/glm-5.3-flash matched nothing at all and fell through to an invented rate.
• GLM no longer capped at 8K output. A ceiling below what a model can write truncates the tool call, and a half-emitted call does nothing at all.
• A routed model id no longer goes to a direct vendor — deepseek/… was being sent to api.openai.com, which answers "invalid model ID".
• Memory and goals are followed. Memory sat above the safety rules and was never restated; a standing goal appeared once at the top of the prompt and, on a twenty-step turn, thousands of tokens behind every decision after the first.
• Sessions nobody used are no longer saved. Opening the workspace against a folder used to leave a placeholder conversation behind permanently.
• A Mini App schema can change. CREATE TABLE IF NOT EXISTS cannot add a column, and the open handle never re-read the file — so an agent asked to add one saw its change vanish, decided the app was broken, and deleted it.
• Sub-agents ran in the wrong directory on a multi-workspace server.

Verified

2,122 offline assertions, 190 web-client checks, 35 Mini Apps checks over real HTTP, plus live runs against a real model: a sub-agent corrected mid-flight, a bound section changing an app in place, and one app of each kind built from scratch and then opened and used.

Full detail in CHANGELOG.md.