Chat On Steroids 2.0.2

Chat On Steroids 2.0.2 is the first release candidate from the native Windows/macOS/Linux
packaging matrix. The app and standalone companion extension are versioned together, so reload
the browser extension after updating the app.

Choose the artifact for your operating system and CPU:

• Chat-On-Steroids-Setup-x64.exe — Windows x64 (Intel/AMD)
• Chat-On-Steroids-Setup-arm64.exe — Windows on Arm
• Chat-On-Steroids-macOS-x64.dmg — macOS Intel disk image
• Chat-On-Steroids-macOS-x64.zip — macOS Intel app archive
• Chat-On-Steroids-macOS-arm64.dmg — macOS Apple silicon disk image
• Chat-On-Steroids-macOS-arm64.zip — macOS Apple silicon app archive
• Chat-On-Steroids-Linux-x64.AppImage — Linux x64 portable AppImage
• Chat-On-Steroids-Linux-x64.deb — Linux x64 Debian/Ubuntu package
• Chat-On-Steroids-Linux-arm64.AppImage — Linux ARM64 portable AppImage
• Chat-On-Steroids-Linux-arm64.deb — Linux ARM64 Debian/Ubuntu package
• Chat-On-Steroids-Extension.zip — standalone Chrome companion extension
• SHA256SUMS.txt — SHA-256 checksums for every release artifact above

macOS caveat: the 2.0.2 DMG and ZIP builds are currently publisher-unsigned (no Apple
Developer ID) and unnotarized. Apple-silicon Mach-O executables may still contain platform-required
ad-hoc signatures; those do not establish a publisher identity or satisfy Gatekeeper trust. The
builds are smoke-tested on native macOS runners, but Developer ID signing/notarization is not
configured yet, so Gatekeeper may warn when opening them. The macOS builds require macOS 12
Monterey or newer.

2.0.2

2.0.2 carries the cross-platform port and release hardening completed after the already-published
2.0.1 Windows release. It keeps the 2.0.1 runtime/worker/session fixes and adds native packaging,
runtime payloads and validation for macOS and Linux without trying to overwrite the historical
v2.0.1 release.

Cross-platform desktop runtime

• Native host/platform behavior now covers Windows, macOS and Linux while keeping Windows-only
  Desktop automation gated to Windows.
• Shell, environment, process cleanup, tray/window lifecycle and secure-storage startup paths were
  audited for POSIX hosts, with deterministic coverage for host-specific decisions where possible.
• Platform-specific tunnel-client and ripgrep binaries plus Sharp/libvips, node-pty and tree-sitter
  native payloads are staged for each OS/CPU pair instead of relying on the install host's native
  modules.

Packaging and release matrix

• The release candidate workflow builds six native jobs: Windows x64/ARM64, macOS Intel/Apple
  silicon and Linux x64/ARM64. Artifact names are stable across architectures and packaging formats.
• macOS produces both DMG and ZIP artifacts. CI verifies ZIP integrity, verifies/mounts each DMG,
  checks the normal Applications drag target, verifies bundle identifiers/version/category/minimum
  macOS metadata and thin native Mach-O architectures, and then performs both native-module and
  normal BrowserWindow startup smoke tests on the matching Mac runner.
• Linux produces AppImage and DEB artifacts. Ubuntu 24.04-compatible DEB dependencies include the
  time64 GTK/AT-SPI package alternatives; the generated DEB is installed and executed on its build
  runner before upload.
• AppImage uses electron-builder's static runtime 1.0.3 rather than legacy FUSE2. CI first launches
  the artifact with the runner's normal namespace environment, then launches it again with the
  namespace probe forced unavailable to exercise the documented fallback. Each isolated first-run
  profile must reach app-started, BrowserWindow-loaded and renderer-state-ready evidence under Xvfb
  instead of merely keeping a process alive. The static launcher can add --no-sandbox when
  unprivileged user namespaces are unavailable; on Debian/Ubuntu, prefer the DEB on such restrictive
  hosts if you do not want that AppImage fallback.
• Linux desktop metadata now uses com.chatonsteroids.app.desktop consistently so the generated
  launcher and Electron StartupWMClass can associate the running window correctly.
• The packaging icon source is generated at 1024×1024 for macOS Retina/ICNS conversion while the
  Chrome extension retains the dedicated 16/32/48/128 icon sizes.

Release safety

• Publish preflight rejects a non-tag ref, tag/package version mismatch, missing reviewed release
  notes, public-history privacy failure, or an already-existing GitHub release before allocating the
  six native packaging runners.
• The assembled candidate carries explicit SHA-256 checksums, and the publish job verifies those
  checksums again before attaching any artifact to a release.
• Candidate artifacts use a run-id-based name, avoiding invalid GitHub artifact names when a direct
  candidate build comes from a branch whose ref contains /.

Beta despite the version number. Behaviour may still change between releases.

Chat On Steroids 2.0.1

Windows installers for both architectures are attached below. Download the one that matches your
PC, then reload the browser extension because the app and extension are versioned together.

• Chat-On-Steroids-Setup-x64.exe — Intel/AMD Windows PCs
• Chat-On-Steroids-Setup-arm64.exe — Windows on Arm
• Chat-On-Steroids-Extension.zip — standalone companion extension
• SHA256SUMS.txt — SHA-256 checksums for all release artifacts

2.0.1

2.0.1 is a hardening release after 2.0.0. The main changes are reusable worker conversations,
stronger crash/restart recovery, more reliable browser turn completion, faster bounded Computer Use
paths, and a large set of session, renderer, command and lifecycle fixes found during adversarial
testing.

Workers and browser recovery

• Workers now sleep and can be revived in the same ChatGPT conversation instead of being treated as
  disposable one-shot chats. Sleeping frees the worker slot; waking requires a free slot and reuses
  the exact existing tab when possible or reopens the stored conversation when necessary.
• Worker revival is durable across app/browser restarts and uses explicit claim/lease/ACK ownership so
  browser delivery and MCP liveness cannot duplicate or steal the same wake.
• Bridge recovery is fenced until durable command state is reconstructed. Restore now plans locally,
  reconciles broker state, performs the durable rewrite, and only then publishes commands and timers.
• Stale worker inbox rows, detached-worker cleanup and final-report delivery were tightened so a later
  wake cannot reinject already-finished work or lose the worker's terminal report.

Recording, Goal and session recovery

• Final assistant responses are detected more reliably in throttled/background tabs, including the
  conservative fallback used when ChatGPT's Fiber data omits a terminal marker.
• Session metadata is reconciled against newer durable event/message history after crashes, including
  read-only history/listing paths that must not accidentally mark an old session live.
• Retention runs throughout a long-lived app process and scans the complete process catalog rather than
  an arbitrary first 5,000 session folders.
• A transient sessions-directory EBUSY, EACCES or I/O failure no longer gets cached as an
  authoritative empty catalog for the rest of the process.

Commands and Computer Use

• exec_command supports related cmds batches in one shell session with bounded output and labeled
  per-command results. Batch framing now carries a fresh random id, so command output cannot imitate
  the wrapper's own exit markers and corrupt failure classification.
• Windows command startup honors explicit short yields, avoids loading the PowerShell profile by
  default, and caches stable shell/toolchain discovery work.
• Desktop automation keeps immutable recent frames/UIA snapshots, bounds large outputs and batches,
  improves helper lifecycle/retirement, and removes several fixed waits from common paths.

UI, setup and lifecycle

• Browser authorization and current browser presence are shown separately. Explicit app-side browser
  Disconnect can no longer be silently undone by the extension.
• Setup requires an approved filesystem root only when the enabled Core capabilities actually need one.
• The main window now fits smaller/DPI-scaled Windows work areas and can be resized/maximized.
• Session history is paged, live detail refresh uses bounded deltas, and root rename/settings fields no
  longer lose in-progress user edits to unrelated state pushes.
• Final application shutdown always reaches quit, and accepted MCP mutations are drained gracefully on
  ordinary disconnect rather than being force-cut by the final-shutdown deadline.

The detailed 2026-08-25 engineering log is in docs/bughunt-2026-08-25.md.

Beta despite the version number. Behaviour may still change between releases.

Chat On Steroids 2.0.0

Windows installers for both architectures are attached below. Download the one that matches your
PC, then reload the browser extension — the app and the extension are versioned together and
the app refuses a mismatched copy.

• Chat-On-Steroids-Setup-x64.exe — Intel/AMD
• Chat-On-Steroids-Setup-arm64.exe — Arm (Snapdragon, Surface Pro X)
• Chat-On-Steroids-Extension.zip — the extension on its own, for loading unpacked
• SHA256SUMS.txt — checksums for all three

This is the first published release to carry the goal loop. It supersedes 1.9.9, which was tagged
in the repository but never published.

Why 2.0

Not because of what is on screen. Three modules that production no longer reached were deleted
outright, exec_command began refusing shell text it used to run against the wrong filesystem
dialect, and two process launchers stopped handing connector credentials to their children.
Anything built against the removed internals, or against the old pass-through behaviour, will
notice. The user-facing surface is the same one 1.9.9 described.

The goal loop

A second model reads each finished ChatGPT answer and writes your next message for you, until it
decides the thing you asked for is done — at which point it writes nothing at all. Off by default,
and it needs an OpenRouter API key, which is the one credential in this app a model can cause to
be spent.

The trust boundary is where the work splits. The page owns the one judgement only a browser can
make — that the turn is really over — using the same four-signal barrier a compaction brief waits
on: the stop control gone, the answer no longer growing, the tool rail still, and the app
reporting no local call open, held for eight seconds. A reply that fires early types "what about
the tests" into a chat that is still writing them, and the model then answers it as if it were a
correction. Everything after the barrier is the app's: the context, the key, the request, and one
draft per generation.

What leaves this machine is only your messages and ChatGPT's final answers — not tool calls, not
their results, not the interim commentary a turn produces while it works. A recorded session holds
file contents and command output, and none of that is anybody's next chat message.

The compaction button on the composer is a gear now, opening a small settings sheet in ChatGPT's
own type and hairline: a switch each for automatic compaction and the goal loop, and Compact &
resume now as its single action. The panel above the composer says what the loop is doing, and a
failure shows its code rather than going quiet.

What was fixed

The full write-up is in docs/bughunt-follow-up-2026-08-24.md. Credible leads that were reviewed
but not reproducible enough to fix are tracked privately rather than published — see SECURITY.md.

• A patch that moved a file onto itself deleted it. apply_patch writes the destination then
  removes the source, so source.txt and ./source.txt wrote the new contents and immediately
  unlinked them. Move verification now compares resolved identities and refuses before anything is
  mutated.
• A glob starting with * searched a virtual root instead of your workspace. With no literal
  prefix before the first wildcard, *.ts and **/*.ts quietly asked a different question — and
  answered it successfully, which is the worse half.
• A malformed Goal stream record could be typed into the composer as a finished reply. A
  truncated sentence was promoted to a message at EOF. A malformed record is now a protocol
  failure: the stream is cancelled and no draft is exposed.
• Compact & Resume, automatic compaction and Goal startup used the capped UI list as an
  ownership index, so a valid older conversation came back session_not_recorded. All three now
  use the durable catalog.
• Editing a Chat setting could be undone by a background status push. Home controls had a
  focused-dirty guard; the Chat sheet did not, so a half-typed threshold or worker count could be
  wiped mid-edit.
• Virtual app paths inside shell text ran against the wrong filesystem dialect. PowerShell
  reads /workspace/file as a drive-root path, not this app's approved virtual root. exec_command
  now refuses that and names the two fallbacks that work.
• A broken desktop helper could keep input authority while its replacement started, because
  its post-start error path skipped the retirement barrier that every other failure waits on.
• "Extension folder opened" was shown when it had not. Electron reports shell.openPath
  failure as a resolved error string, and the handler discarded it.
• Renderer redirects are vetoed as well as navigations; swarm:clearAgent validates its id at the
  IPC boundary; read charges the base64 it actually emits against its output budget; Fiber no
  longer skips assistant turns without a data-turn-id, nor swallows a message on a second id
  collision; and recovery hints stopped suggesting fixes for causes the command did not contain.

Security

Tunnel children inherited ambient connector credentials. The OpenAI tunnel client spread raw
process.env and cloudflared inherited the environment implicitly, so starting the app from a
credential-bearing terminal passed unrelated provider secrets into both children. Both launch
paths now use the shared environment scrubber, and the OpenAI path adds back only its own
control-plane key, the local MCP URL and its discovery headers.

Build

Built and smoke-tested on native Windows x64 and ARM64 runners, with the full typecheck-and-test
gate — 49 suites, 1,411 tests — green on both. noUnusedLocals and noUnusedParameters are now
permanently on; they are what surfaced most of the dead code this release removes.

Beta despite the version number. Behaviour may still change between releases.