v0.4.0

Worth checking after you update

• MultiEdit is gone: Edit takes several changes to one file in one call. A
  permission rule or a skill's allowed-tools naming MultiEdit no longer matches
  anything.
• The Brave API key setting is gone. A key still in your settings file is ignored,
  and web search works without it.
• --mode is now refused where it used to be accepted and ignored, so
  waibee --mode … <subcommand> exits instead of running.
• waibee run --json reports one origin on a user message in place of the
  steered, injected and synthetic flags.

Faster on real work

• Long jobs take fewer steps. Independent tool calls go out together, several
  changes to one file go in one edit, and changes to several files go out at once.
• Less of a file you did not ask about lands in the conversation: waibee searches
  before reading a long file whole, and goes straight to the line it found.
• waibee checks which interpreters are on your PATH at the start, so it stops
  trying python on a machine that has only python3.

It finishes, or tells you why

• A dropped connection no longer costs you the answer: a reply cut off partway is
  carried on from where it stopped instead of arriving empty or twice.
• A long chat no longer breaks when it fills up. waibee shortens it and carries on,
  including on a chat you came back to and while it is working, and the gauge shows
  what is left.
• A run that cannot finish hands back what it has: waibee spends its last turn
  writing up what it found and where it stopped.
• A reply blocked by the provider's content filter says so, instead of looking like
  the model went quiet.
• An edit with a quoting mistake comes back pointing at the exact spot, and a failed
  edit no longer drags the next ones down with it.
• The closing summary says what changed, what was checked and how, and anything left
  open, without replaying the steps.

Permissions

• waibee no longer asks permission to look. ls, cat, grep, git status and
  the like run straight away in every mode.
• What waibee asks about is judged by what a command does, not how it is typed.
  Spelling out a program's full path no longer skips the question, and a file in
  your project named after a common command is not that command.
• waibee leaves your unfinished work alone: files you changed and never committed
  are never reverted, stashed or cleaned up.

Web search, built in

• Web search needs no key and no setup. waibee can search several things at once,
  and the pages it used are listed under the answer: in the browser with each site's
  icon, in the terminal as a numbered list. The Brave API key and its setup step are
  gone.

The terminal

• A quieter screen: one accent colour, one rule above the input, and overlays that
  share one frame and size themselves to what they hold.
• The approval screens read properly again. Whole changed words are highlighted
  instead of scattered letters, and nothing pops up over a question you owe an
  answer to.
• Ctrl+B sends every running helper to the background at once, so waibee carries
  on while they finish.
• Ctrl+Y walks the side panel and then hides it (it used to be Alt+Y, which a
  Mac cannot type). /memory, /export and /new open while waibee is working.
• A screenshot pasted while waibee is working goes with the message you queued. It
  used to be dropped without a word.
• Coming back to a chat brings its helpers back with it.
• A file name in a tool card opens in your editor wherever the file lives.
• Allowed and blocked hosts in /settings are a list: type one, Enter adds it, the
  arrow keys pick one and Backspace removes it.

The browser

• A chat opened on one project now uses that project's own skills, hooks and
  permissions. It was using the setup of the folder the server was started in, so
  every skill it offered came back "not found" and another project's hooks ran. The
  same applies to a chat opened from an editor.
• Answers no longer break apart while they are written: tables came out as rows of
  bars, and words split down the middle.
• Helpers behave: each shows its own model and running time, a card shows two lines
  of what it found rather than the whole thing, and stopping one stops it on screen.
• A queued message appears the moment you send it, opens for editing on click, and
  goes away with the cross beside it.
• Links an answer mentions are gathered under it, each with the site's icon.
• Restarting the server no longer leaves a tool spinning for ever: work that died
  with the old process is shown as interrupted.
• A link shared as "watch only" can no longer make the server fetch anything from
  the network on its behalf.

Models

• A new model appears without restarting waibee, and one your account no longer has
  disappears the same way. /doctor says how old the list is.
• An image a tool hands back reaches every model that reads images.

Memory

• waibee remembers less, and less of the same thing: a correction replaces what it
  corrects, and a full memory is tidied before anything is dropped. What it keeps is
  what you insisted on, corrected, or said about how you want work done here.
• /memory add <fact>, or add user for something about you; the browser's Memory
  page has the same field.
• A memory file you edited by hand keeps every line you wrote.

Privacy and the audit log

• An error from the provider could carry your API key into the log file. It cannot
  now, and the rules your organisation sets for what to hide are honoured.
• Private mode leaves no trace in the log, and waibee audit status reports the
  real state.
• More is recorded: background commands, notebook edits, goals that ended on their
  own, and setting changes (which setting, never its value).

Also

• A server whose MCP sign-in has expired says so in one line at startup.
• A rule in a file next to the code outranks one at the root of the repository, and
  anything you say outranks both.

v0.3.1

Keyboard

• Shortcuts work on any keyboard layout. On a Russian, German, French or Dvorak board they used to do nothing.
• Cmd/Ctrl+S saves the open file from anywhere on the page.
• Ctrl/Cmd+P opens a file by name, and the shortcut sheet has a button in the sidebar.

Files

• Files show line numbers, and selecting lines offers to quote them into the message box as file:12-18. Selecting terminal output does the same. Neither sends anything.
• Selecting text in a large file is smooth.
• Markdown opens as a document, with diagrams drawn and links clickable. The header switch shows the source.
• A file path in an answer opens it in a tab.
• One click previews a file and the next click replaces the preview, so browsing a folder leaves one tab. A double click keeps it.
• Right-click for new file, new folder, rename, copy path and delete.
• Drag a file or a folder into the message box, from the panel or from your desktop.
• .. goes up from anywhere, including outside the project, where the panel reads but never writes.
• The panel remembers your folder, tabs and open file across sessions and reloads, and follows changes on disk.
• A deleted or renamed file closes its tab, and a new file shows how many lines it added.

Terminal

• A terminal keeps running while you look at another chat, survives closing the tab and reloading the page, and comes back showing what it printed.
• It follows your theme.
• Right-click copies a selection, or pastes when there is none, as in Windows Terminal and PuTTY.
• Copying works, including inside tmux, over ssh and under WSL, and tells you honestly when it could not.
• /help and waibee doctor explain your machine's clipboard route when something goes wrong.

Sessions

• Every chat gets a name. Tabs are wider, and the session name lives in the list, where a double click renames it.
• Model, thinking effort and permissions open in one panel, with a searchable model list and each permission mode explained where you pick it.
• Reopening a chat brings back your images, an answer that was cut off, and what each turn cost.
• A session picked up after a restart is usable immediately.
• Answers stream on a phone over a shared link, and the whole interface reads at phone width.
• Right-click works in every list.
• A review says which files the agent wrote.
• "Try again" appears only where trying again can help.
• A message sent with inject is marked as a fact handed to the agent.
• /web opens the browser on a session list you can add to.

The agent

• Edits report their compiler errors again, so a change that breaks the build says so.
• Waibee starts faster and uses far less memory until you edit something. lsp.prewarm in settings buys the old behaviour.
• A language server that cannot start says so and names the fix, instead of reporting that it is still starting.
• A command that succeeded is reported as succeeded, with its output kept.
• Command output keeps its columns and alignment.
• Files referred to as ~/... are found.
• Waibee waits out a rate limit once instead of twice.
• A note typed with /compact reaches the compaction you meant, and /compact takes the one fact you cannot lose.
• A compacted conversation says where the replaced turns still live.
• Asked for open-ended work, waibee answers in one pass instead of inventing a finish line. A goal you set with /goal is unchanged.
• Long work is interrupted less often, and when it is, waibee says what it saw.
• A command that starts something and returns no longer holds the session. One that goes quiet for two minutes moves to the background and hands you its job id.
• A finished background job reports itself in a few lines.
• Waibee offers to open what it made: a chart, a page, a report, a PDF, or a server it just started.
• Everyday shell commands stop asking for approval they never needed.

Command line

• waibee run --format json streams the whole run, so a script can follow it live. waibee run - reads the prompt from standard input.
• An invocation mistake exits with code 2, separate from code 1, which means the run itself failed.
• waibee serve stops on Ctrl+C with the browser open.
• Bug reports from waibee bundle and /bug no longer carry credentials, and naming a crash id includes that crash.
• Costs in money are gone; waibee reports tokens.

MCP

• Servers that sign in through a browser can be added from the web interface, and one waiting on sign-in says so plainly.
• An agent naming a model without a provider prefix now starts.

v0.3.0

• Starts eleven times faster. 158 ms down to 14 ms. A launch used to read the
  system's certificate store and wait on the update check before it showed you
  anything; it now does neither. On a slow connection that wait could run into
  seconds, and it is capped at two.
• A smaller download. 63 MB down to 39 MB, and every update is a fresh
  download, so it is 24 MB off each one.
• waibee serve has a UI. Open the printed URL: every live session, its
  transcript, plan and sub-agents, in a browser. Nothing to install — the page
  ships inside the binary.
• Approve tools from the browser. Permission prompts reach the web UI and
  answer back; before this the web surface silently trusted everything.
• Review what the agent changed, in the browser. A Review tab per session:
  changed files with counts, the diff, and select-lines-and-comment sends your
  note straight to the running agent.
• Pick up a session where you left it. Past sessions are listed by folder
  and open with their transcript, plan and panel intact.
• See what the agent is doing while it works — the tool, the elapsed time,
  and a Stop button.
• A Setup tab: every instruction file, skill, command, agent, plugin, MCP
  server and tool this session is loaded with — with switches for plugins and
  MCP servers.
• Context fill sits next to the model, as a percentage of its window.
• Nine themes, five dark and four light.
• ⌘K searches everything: your sessions, the ones on disk, the actions, the
  themes.
• Type / to see what you can run — your slash commands and skills, with
  their descriptions.
• Rename a session by clicking its name.
• Drag any pane to resize it, or fold it away. A folded pane leaves a strip
  to click, and the layout is remembered.
• The agent's side panel works in the browser. Plans, dashboards and mermaid
  diagrams open beside the conversation, the way they do in the terminal.
• Sessions are named in the browser, and show what the agent is doing right
  now instead of just the folder they run in.
• Answer a permission with one key: y once, Y this run, p always, n deny, N never. Each button shows its own key.
• Files and a terminal in the browser. Browse the session's tree and open a
  real shell in it, from the same page.
• Switch model, permission mode or compact from the browser, mid-run.
• Sessions started on the web now run your hooks and skills.
• The agent sees the right filename again. The first file in its
  "uncommitted changes" list was missing a character.
• Skills load now. Waibee listed your skills but shipped without the tool that
  opens one.
• Sub-agents know the project: your CLAUDE.md, skills and environment,
  instead of a blank slate.
• Sub-agents reach your MCP servers, including a named agent that lists one in
  tools:.
• A sub-agent's plan stays its own. It no longer takes over your progress
  panel or returns after /resume as yours.
• Sub-agents stay out of your session: no side panel, no questions, no saved
  memories, no worktree switches.
• Task(capability_mode=…): read-only or read-write. execute and all
  are gone; omit the argument for the full toolset.
• Sub-agents also gained lsp, notebook edits, and reading or stopping their own
  background commands.
• The interface no longer freezes. A command the agent ran was handed your
  keyboard, so anything that read input swallowed your keystrokes. In PowerShell the
  console also started echoing its own mouse reports on screen as ^[[M.
• Copying works on macOS, and only says it worked when it did. A selection
  announced "copied" while the clipboard kept whatever it held.
• Open it on your phone. serve --host 0.0.0.0 prints a link and a QR code, and
  the browser shows the same code. From another network, one button opens a public
  address through cloudflared, tailscale or ngrok, whichever you have. A second
  link watches without acting.
• waibee storage clean asks before deleting, not after. Answering n used to
  print "Aborted." over an empty directory.
• Roughly thirty ways past the permission gate are closed, including a newline
  after an approved git status, and git reset --hard or git push --force read
  as the commands that merely list.
• Reading a file gives you the file. A 100 KB file came back in four pieces and
  was fetched again after every summarisation.
• Edits stop failing on invisible whitespace: a tab where spaces were sent, a
  trailing space, a different indent.
• A sub-agent cannot be given more than you have. An agent definition could set
  its sub-agent's permission mode without that being weighed against your session's,
  so a file in the repository asking for bypass got it from a session that never had
  it. It may now only narrow. Bypass needs a git repository, and that was checked only
  in the mode picker - the command-line flag and the settings file walked past it.
• waibee update --force reinstalls. It promised to install even when you are
  on the latest version, and did nothing but reword the reply.
• waibee plugin install <directory> works on a plain directory. It needed a
  git init first, because every source went to git clone, and the command's own
  help offered a local path. Updating one copies the directory again, so a plugin you
  are writing picks up its own changes.
• A command no longer fails with an error about a line you never wrote. Commands
  ran inside a wrapper of ours that restored the environment first, so a one-liner sat
  ninety lines into it, and anything printed by a backgrounded job could be taken for
  an environment variable and break the wrapper's quoting: unexpected EOF while looking for matching ', blamed on "line 90". Once that happened, every later
  command in the session failed the same way. On Windows with a shell other than Git
  Bash, the working directory is read correctly too.
• What the agent remembers about you stops piling up. The same fact came back
  every session in new words - one store held three things written eleven times, and
  all eleven went into the first message of every session. Before it writes, the agent
  is now shown what it already remembers, and asked for one fact per line. Your own
  notes outrank its wording of the same thing instead of being refused as a duplicate.
  Facts already saved are left as they are: guessing which of two similar ones to
  delete is not a risk worth taking with your memory.
• The REPL cannot hang a session, and its answers no longer carry the
  interpreter's own prompt: REPL(language="node") answered > 2 for 1+1.

v0.2.0

Worth a minute before you upgrade. A few things change behaviour rather than just
adding to it:

• Settings that Waibee used to read but never act on now take effect. If you tuned
  background.max_jobs or the network.* timeouts, your values start applying — on
  one real config that moved max_jobs from an effective 10 to the configured 16.
• In "Don't ask" mode, high-risk commands (sudo, curl, wget, nc) now pause for
  approval instead of running silently, and a handful of catastrophic ones are refused
  outright in every mode.
• The workspace sandbox profile is now workspace-write; the old name still loads.
• The UserPromptExpansion hook is gone — use UserPromptSubmit.
• --mode belongs before the command; waibee run … --mode … is rejected rather than
  silently ignored, which is what it was doing.
  Settings that never had any effect were deleted. Existing config files still load
  unchanged.
• Setup works on the first try. The API key you enter when you first start Waibee takes effect immediately — no restart. Text pasted while a dialog is open now goes to that dialog rather than into the message box behind it, so a key pasted a moment early is not lost.
• A flag before a subcommand no longer starts the agent by mistake. waibee -m haiku version, waibee --cwd . sessions and friends ran a real (billed) agent turn on the prompt "version" or "sessions" instead of the subcommand — exit code 0 and a plausible-looking answer, so it was easy to miss. A mistyped command is caught too: waibee versoin now answers "did you mean waibee version?" instead of quietly asking the model about it. To prompt a single word that happens to be a subcommand name, use waibee -- doctor.
• --cwd, --model and --no-audit work on either side of the command. waibee run "…" --model haiku used to be an error; only waibee --model haiku run "…" was accepted.
• waibee - takes the prompt from stdin. echo "fix the failing test" | waibee -, or pipe in a file. It used to ask the model about a hyphen.
• Status messages stay up long enough to read — they sit at the far right of the bottom bar and used to vanish after two seconds.
• Quitting no longer leaves your terminal in a strange state. If Waibee was stopped by a signal — kill, a closed tmux pane, a supervisor — it skipped its own cleanup and left mouse tracking on, so the shell started printing bursts of characters at you. It now restores the terminal on the way out.
• Editor integration: switching the permission mode works again. Waibee read a field name the protocol doesn't use, so the mode picker showed up in your editor but every switch came back as an error. Fixed, along with the rest of that sweep: your model choice no longer resets when you change mode, forking a session keeps the directory and MCP servers you asked for, the session list can be filtered by project and pages correctly, and your editor is now told about the session actions Waibee already supported (delete, resume, sign out).
• / finds plugin skills by their short name. /mocki now matches some-plugin:mocking — no need to remember the prefix. The grey preview follows the row you highlighted, so arrowing the list no longer shows one command while Tab inserts another.
• Long /changelog and /help text scrolls all the way now — the last lines used to be unreachable.
• Catastrophic commands are refused outright. Wiping the root or your home directory, mkfs, shred, dd if=…, fork bombs, and piping a download straight into a shell are turned down in every permission mode — including Bypass — and no allow-rule approves them. Deleting a specific folder still just asks, as before. The check no longer depends on how the command is spelled: quoting the target (rm -rf '/'), splitting the flags (rm -r -f /), hiding it behind another verb (bash -c, eval, timeout, find / | xargs rm -rf) or letting the shell fill it in (rm -rf $D) all reach the same verdict as the plain spelling. Writing to a file that runs code later has to ask — shell start-up files including ~/.zshenv, git hooks, and Waibee's own .claude/settings.json; the last two matter because they sit inside your project, where the sandbox permits writes. Reading any of them is untouched. In "Don't ask" mode Waibee now pauses for high-risk commands (sudo, curl, wget, nc) instead of running them silently; everything ordinary runs untouched.
• Secrets are hidden from the agent by default. .env files, *.pem, SSH keys, .netrc and .aws/credentials no longer show up through Read, Grep or Glob — including when the agent searches those folders directly — so an instruction hidden in a file or a web page cannot quietly harvest them through the agent's file tools. .env.example stays visible, and a ! line in .waibeeignore re-opens anything you do want read (e.g. !.env). This covers the file tools, not the shell: a command like cat .env still reads the file, so the sandbox and the approval prompt are what stand between a suspicious command and your secrets.
• Fetched pages and search results are treated as data, not orders. Web content comes back clearly marked as untrusted, and Waibee won't act on instructions hidden inside it — it tells you what the page tried instead.
• Gentler on your machine. Up to 8 shell commands run at once and the rest queue, instead of a dozen processes starting together.
• Sandbox: the write allowance is much tighter. workspace-write used to hand over whole trees that are not inert — ~/.cargo and ~/.rustup (which hold cargo's config.toml, bin/ and your toolchains), and all of ~/.cache and ~/Library/Caches (where pre-commit keeps hooks that run on every git commit, and app updaters stage executables). Any of those let a command arrange for something of yours to run later, outside the sandbox. Now only the individual build caches are writable — cargo's registry and package lock, ~/.npm/_cacache, ~/.gradle/caches, ~/.m2/repository, ~/go/pkg/mod, and the per-tool caches under ~/.cache for pip, uv, yarn, pnpm, ccache and friends. Builds are unaffected. Anything else gets a denial naming the path; add it to sandbox.allow_write if you need it — though the toolchain directories themselves stay refused there too, since granting one whole is the hole this closed.
• New: an optional OS sandbox. /sandbox shows the choices with what each one allows, and workspace-write limits where the commands the agent runs may write: your project, Waibee's own folder, temp folders and package caches. It is not a container — everything still runs on your machine, with your real files and git, and reading files and network access are unchanged. While it is on the bottom bar shows 🔒 write: project. Applies straight away, no restart. Also available as waibee --sandbox workspace-write or under /settings → Security. macOS and Linux enforce it in the kernel; Windows has no such mechanism, so run under WSL2 there — /doctor shows what your machine supports. Off unless you ask for it.
• opus, sonnet and haiku now point at the newest model in each family, and the /effort levels show up for all of them.
• Settings that were quietly ignored now work. Your proxy, connect and request timeouts, audit and cache retention, the tool-output budget and the background-job limits are all read properly — and the proxy now covers everything Waibee does, not just model requests. If you had set background.max_jobs or network.connect_timeout_secs, your values take effect where they previously didn't, so it's worth a quick look. Settings that never had any effect were removed; your existing config still loads unchanged.
• Fewer stalls. A wedged MCP server can no longer hang the agent (per-server timeout_ms, 5 minutes by default). A long command that hits its timeout keeps running in the background instead of being killed. Connections recover from HTTP/2 hiccups and back off sensibly when rate-limited.
• Ctrl+B backgrounds a sub-agent too, not just a shell command — the task keeps going while you carry on, and reports back on your next turn. Todos can be marked blocked, so the agent stops chasing work that's waiting on someone else.
• Hooks got real control. Hooks from .claude/settings.json block by default ("async": true opts out), run inside sub-agents, and tell you when a hook script is broken. A Stop hook now also fires when the agent gives up early — empty reply, repetition, turn limit — and can send it back to work, so "don't stop until the tests pass" setups behave. PostToolUse can rewrite a tool's output before the model sees it. New SubagentStart pairs with SubagentStop. UserPromptExpansion is gone — use UserPromptSubmit.
• Safer editing. Two edits to the same file in one step can't overwrite each other, edits still match when your file uses smart quotes or dashes, and notebook edits honour .waibeeignore and refuse to clobber a file that changed on disk. Commands the agent runs no longer receive your API keys.
• Long sessions keep more. Facts worth remembering are saved before the history gets summarised, and a summary that comes back empty is retried instead of replacing your conversation.
• Scripting. waibee run exits 130 on Ctrl-C and 143 on SIGTERM, and reports per-model token use with --output-format json. Sub-agents take a capability_mode — read-only, read-write or execute.
• /doctor now runs inside the app, /update installs a pending update and otherwise tells you which version you are on, ←/→ cycle a dropdown in /settings, and your /effort choice survives a restart.

v0.1.16

• MCP login no longer crashes — configuring an OAuth MCP server (e.g. Atlassian) with wrong credentials now fails gracefully with "Authorization failed" instead of crashing the app.
• Multi-line paste stays intact — pasting several lines now arrives as one block instead of submitting line by line, including on Windows and other terminals without bracketed-paste support.
• JetBrains IDE terminals — mouse movement no longer types stray characters into the prompt.
• "Allow always" sticks — a permission you grant with "allow always" now persists across sessions.
• --mode flag works — waibee --mode accept-edits|trust|bypass-permissions sets the interactive session's starting permission mode.

v0.1.15

Bug fixes and improvements.

v0.1.14

• Connects on more systems — waibee now bundles its own TLS roots, so it works even where the OS certificate bundle is missing or misconfigured.
• No more cut-off replies — fixed a streaming bug that could truncate a response mid-sentence.
• Smarter loop detection — the agent notices and stops repetitive tool loops sooner.
• Prompts starting with - — waibee "-foo" and similar no longer fail to parse.
• Masked API keys — secret keys in Settings are now hidden behind dots.
• Deleting the open chat closes its tab — removing the current session no longer leaves it open.
• Cleaner Russian — reworded several clumsy UI strings.

v0.1.13

• Instant startup — waibee no longer waits on slow or unreachable MCP servers before showing the UI. Servers connect in the background and their tools appear as they come online.

v0.1.12

• Web search now uses Brave Search — add a free API key in /settings (or plug in a search MCP). The tool stays hidden until a key is set, and searches are faster with tighter timeouts.
• Waiting-for-input signals — the OS taskbar and the tab both flag when waibee needs you, and you can switch tabs while it waits (no more terminal bell).
• Keyboard text selection in the input (Ctrl/Shift + arrows); paste now lands in the focused field or modal, not the chat box.
• Cleaner editing — Ctrl+W always closes a tab (even while it's running), Alt+Backspace deletes a word, and letter hotkeys work on Cyrillic layouts.
• Reliable cancel — Esc now stops a stuck sub-agent or a hung tool.
• Tabs keep a stable order after restart and are told apart when their names match; permission prompts and replies stay with the tab that raised them.
• Resumed chats render their tool cards correctly; code blocks copy cleanly and long tool commands display in full.

v0.1.11

• Smoother, lighter TUI: faster scrolling and noticeably lower CPU while responses stream in.
• Cmd+Backspace (macOS) / Ctrl+Backspace now clears the whole input line.