Agent V 1.4.0 is outSee what shipped →github.com/vyotiqai
Agent VSourceDownload

Changelog

What changed

Every release and what it changed, from the same notes the app shows when it offers you an update.

1.4.0

On GitHub →

Agent V 1.4.0 reworks Home and makes voice mode easier to talk to. Home now opens on the day and one sentence of what needs you, with the brief for your next task right under it. Voice mode answers faster, keeps to one voice at a time, and hears what you say while the agent is busy.

Added

  • Home opens on the day and one sentence. The weekday and one sentence of what Home already knows: what needs you, what failed, what is running, what is ready for review, the next scheduled run and any uncommitted files. Each fact opens its rows in place under the sentence. Your workspaces and the week open the same way from a quiet line at the foot, so everything Home showed before is still one click away.
  • Start your next task from Home. The New task brief sits on Home under the day sentence. It is the same brief as in the task's pane, so text, checks, folders and attachments are shared between the two, and Start opens the task in its pane exactly as the pane's own Start does. A workspace row's New task points the brief at that workspace and puts the cursor in it.
  • A backdrop and a greeting for Home. Settings, Appearance, Home: a backdrop band (none, pixels, field, or a picture you pick) and Your name for the greeting. A picture is copied into the app's own data folder and toned toward the page colour; the band hides under More contrast and forced colours.
  • The agent can set and read Home. By voice or in a typed task, the agent can change Home's backdrop and greeting name, and read the day sentence as Home would draw it, without opening Home.
  • Voice questions you can type into. When the agent asks something a yes or no can't answer, the task's own question form appears in the voice view and the mini window, so exact details can be typed rather than spelled out.
  • Voice can tell you about spend and other tasks. Asked how things stand, the agent can now say this task's, today's and this month's spend, list the latest other tasks, and read another task.

Improved

  • Spoken replies start sooner. Spoken turns are meant to run with the model's thinking off, but on Claude Haiku 5.5 it never was, so it thought before every answer. Measured against the model directly, ten calls each, the first word came at about 1.3 seconds with thinking and 0.8 seconds without. Spoken turns now really turn thinking off on Claude Haiku 5.5 and Claude Sonnet 5.5, and turn it down to low on Gemini 3 and later.
  • What you say while the agent works reaches it at once. A question such as "Is it working?" asked during a long command could sit queued for minutes and then get stale answers. Spoken follow-ups now always go into the live run, back-to-back ones go as one message with one answer, and if the agent stays silent on a command the voice says what it is running and for how long.
  • Approvals are said short. The voice names what it wants to do, such as running git push in a workspace, rather than reading out the whole command line.
  • Restart and install is quiet. An in-app update no longer shows the installer's scope page, progress bar and Finish page; it installs silently and reopens the app. A first install still shows the installer.

Fixed

  • Two voices no longer talk over each other. "One moment." and the answer could play at the same time and cut into each other. Voice mode now plays one line at a time, and drops a "One moment." you haven't heard yet once the real answer is ready.
  • A yes is heard. "Yes, yes. Oh." and yes or no in Hindi and Punjabi now count as answers to an approval.
  • Talking during an approval doesn't lose it. Words that aren't a yes or no are held while an approval waits: "what does that do?" is answered from the approval, and the rest goes to the agent once you've answered. Saying it again sends it and cancels the approval.
  • The agent no longer claims app actions it didn't take. Part of the voice instructions was being cut for space, so the agent could say a new session had started, or agree to keep quiet, without doing it. Those instructions are now never cut.
  • Written answers are no longer read aloud by mistake. A spoken part the agent didn't close made the whole written answer get read out and hidden on screen. A blank line now ends it, and a piece with no letters or digits, like an ellipsis, is never said.
  • "Wait" and "shut up" don't get a "One moment." in reply.

1.3.0

On GitHub →

Agent V 1.3.0 is the release where you can talk to the agent, the app keeps working when you look away, and the work around a task stops sending you to a terminal or to GitHub. Voice mode is a spoken conversation with the agent on a task, with your own listening and speaking providers. New task and the instruction line are redesigned. Tasks keep running in the tray when the window closes, approvals say what an edit will change and can be answered with a note, spend has a daily and a monthly budget, and the agent reads the web without driving a browser. The Changes and Pull request tabs cover checks, issues, reviewers, auto-merge, hunks and branches. Delegation is now a judgment call. Windows gets a sandbox for the agent's commands, and Windows and Linux get Arm builds. On top of that, the brief can now be written for you before anything runs, you can open anything in your own editor, hear what your tasks do, and set a model's limits by hand.

Added

  • Voice mode: talk with the agent. Press the waveform button on a task's instruction line, or Ctrl+Shift+M (Cmd+Shift+M on macOS), and talk. Every spoken turn goes to the task as said, and the agent answers out loud itself — there is no second model in between guessing at what was done. It says a thing is done only once a tool result shows it. Talk over it at any time: its voice dips first, and stops if you keep talking, so a cough or its own echo doesn't cut it off. "Stop" or "Never mind" on their own stop the run.
  • Your own voice providers. Listening: Deepgram Flux, AssemblyAI, ElevenLabs Scribe, OpenAI, OpenRouter, or This PC, which keeps your audio on your computer. Speaking: ElevenLabs, Cartesia, OpenAI or OpenRouter, with a voice picker and Preview. Keys are checked with the provider before they are saved and stored encrypted. Automatic uses the first provider you have a key for. With no listening key, the voice button opens a short setup instead of starting a session that can only fail.
  • Approvals and questions by voice. When the agent needs your OK it asks out loud; yes allows it once, no denies it, and "always allow" works where the card offers it. In voice mode a commit or a push always waits for a spoken yes, whatever your approval settings say. A destructive action — deleting a task, quitting, installing an update — is asked once, by the app, not twice.
  • Voice mode where you want it. Settings, Voice: over the task, a column beside it, the whole window, a small pill that grows into a card, or a mini window that stays on top of your other apps. Pick a layout and an orb, and Quiet or Ambient. Hold Space or the orb to talk, M to mute, Esc to stop it speaking. End leaves a summary of the work handed over, with Talk again.
  • The agent can drive the app. By voice or in a typed task, the agent can open views and panels, switch tasks in any open workspace, change a task's model, the theme or the approval mode, open files and URLs, fork, split and close panes, and check for updates. It reads the app's state instead of guessing at it. Deleting, installing an update and quitting always stop at an approval.
  • Voice conversations are kept. Each session is saved on your computer beside the workspace's tasks — what you said, what was said back, and what became of each request — with anything shaped like a key removed. Audio is never saved. View, Voice conversations opens them, and the last conversation stays on screen after End until you close it.
  • Read aloud. Every finished answer has a speaker button beside Copy.
  • Mic-on indicator. The taskbar overlay, the macOS dock badge and the tray show when voice mode has the microphone, even with the window hidden.
  • A redesigned New task. It reads as one sentence — in this workspace, on this branch — over one box holding the brief, its attachments and folders, and a numbered Done when list. Start is a split button whose menu holds Save as draft (Ctrl+S), Schedule… and Also run on. Permissions sit beside the model. This workspace's drafts are listed under the box, and What the agent will see refreshes live.
  • Queue or send now on a live run. While a task works, the instruction line's action is Queue, with Send now beside it, and a strip above the line carries the run's step, time, cost and Stop (Esc). Alt+Enter makes a new line.
  • Keep running in the tray. Settings, General: with Keep running in the tray on, closing the window leaves your tasks, loops and schedules running. Quitting while a task is live names the tasks first. The tray menu lists running tasks, marks the ones waiting on you, and offers New task and Stop all tasks.
  • Schedules from the start. New task has Schedule…, which runs the brief on a schedule, a new task each time. Home shows the runs Coming up, and Repeat… is on the task's own menu as well as the navigator's.
  • Write the brief for you. In New task — or with Ctrl+Shift+Enter in the instruction line — Structure reads what you wrote and rewrites it as a brief: goal, scope, constraints and how to verify. Nothing is sent from here. When the model needs to know something to write a useful brief it asks up to three questions first, with choices and a free-text answer; Skip writes it anyway and lists what it assumed. A row above the box says what it is doing, names the kind of brief it wrote, warns when a path it named is not in this workspace, and offers Undo (Ctrl+Z) to get your words back and Try again for a different brief. Esc stops it while it works.
  • Turn the brief's Done when bullets into checks. When Structure writes a brief with a Done when section, one button moves those bullets out of the brief and onto the task's checks, so the run is judged against them. Undo takes them back out of the checks again.
  • Open anything in your own editor. Settings, General, Open files in picks an editor — auto, the OS default, or VS Code, Cursor, Windsurf, Zed, Sublime Text, WebStorm, PyCharm or IntelliJ. The picker only lists the ones actually installed on this machine. From then on Open in editor works from the Files and Changes tabs, a file in an answer (Ctrl+click), a task's menu and an instance's worktree, and a file can be opened at the line you were looking at. A file's editor opens at that line; a folder opens the folder.
  • Move and rename files with your words. The agent can move or rename a file or folder inside the workspace, and it no longer rewrites the whole file just to rename it. It asks before it runs in the default approval mode, the card says where the file is going, and the change is undoable: Changes shows the file gone from its old place and added at the new one. It stays inside the workspace — a path outside it, the workspace folder itself, or a folder moved into itself is refused.
  • Errors your edit caused, straight into the edit's result. When a language server is already running for a file you edit, the errors it now reports are listed on the edit — up to eight, each with its line and column, with a count of the rest — instead of the agent being reminded to go and run diagnostics and hoping it remembers. Nothing new is started for this: with no server running for the language, the edit result is unchanged, and only errors that were not there before are called new.
  • Set a model's limits yourself. For a local server or a custom endpoint that does not report them, Settings, provider, Models lets you type a model's context window and output limit by hand, per model. Before this, an unknown model was assumed to have 128k and a prompt sized for 128k was sent to an 8k one. A limit you set is labelled as yours; one the server reports is labelled as its.
  • Notifications that follow you to your phone. Settings, Notifications, Send to your phone sends the same events the inbox sees — a task finished, failed, or needs you — to an ntfy topic or to any webhook (Slack, Discord, Teams, your own script). You choose whether that happens only while the window is in the background, or for every notification, and quiet hours still apply. A test button tells you now whether the address works, with the server's own answer when it does not. The address is a secret — anyone holding it can post to you — so it is kept in the key vault, never in the settings file.
  • See what the agent left running. Processes the agent started and left running when its turn ended (a dev server it said is up) are listed in the record and above the terminal, each with its command, how long it has been up and a Stop button. They live until you stop them, the agent stops them, or the task is deleted.
  • Run the same brief on two models. New task has Also run on: pick a second model and Start creates two tasks, each in its own worktree, so you can compare them side by side. The list offers your favourites first, then recent models, then each ready provider's suggestions, and never the model you already picked.
  • Approvals show the change. An edit's approval card shows the change as −/+ rows with a count, and a whole-file write is compared with the file on disk. The card also offers Always allow edits under the edit's top folder (src/, say), saved as permission rules, beside allowing the tool everywhere.
  • Answer an approval with words. Deny with a note tells the agent why and what to do instead. A command can be edited, then run once in place of the agent's. How long a request waits before it is denied is a setting, and 0 means it waits for you.
  • Budgets across tasks. Settings, Agent: a daily and a monthly budget in US dollars, counted over every workspace, closed ones too. You get a notice at 80% and another past 100%. Running tasks are never stopped, but with Hold new work at the budget on, new tasks, follow-ups, schedules and loops wait once a budget is spent. Usage shows a Budget line with today and this month against each budget.
  • Prices for every model. Models the built-in table doesn't know are priced from models.dev, and you can set your own input, output and cached-input prices for any model or endpoint. Commit-message drafts and other side calls show in Usage instead of only in the log.
  • The agent reads the web without the browser. web_fetch reads a page as text, and PDFs too, paging through long ones with an offset. web_search asks DuckDuckGo, Brave, Tavily or SearXNG, chosen in Settings, Tools. Neither drives the agent's browser, so neither trips a CAPTCHA.
  • More for the agent. browser_console reads the page's errors and failed requests. memory_delete and a memory browser let the agent and you remove a single note. github_pr_checks reads a pull request's checks, and github_issue can open one issue. MCP servers can ask the model for a completion (sampling) and send you to a URL (URL elicitation).
  • Open Agent V from anywhere. Vyotiq.exe C:\code\api, or . for the folder you are in, opens that folder as a workspace. On Windows, Explorer's right-click menu has Open in Agent V, and Settings, General, Command line can put a vyotiq command on your PATH: vyotiq . opens a folder and vyotiq --prompt "…" runs a task with no window. On macOS, drop a folder on the Dock icon. Other tools can link to vyotiq://open?ws=… to open a folder, or vyotiq://new?ws=…&brief=… to open New task with the brief filled in, never sent. A link to a folder you have never opened asks first.
  • Files other agents use, read as they are. Skills from .claude/skills, .agents/skills and ~/.claude/skills; commands from .claude/commands, .github/prompts/*.prompt.md, ~/.vyotiq/commands and ~/.claude/commands, with $ARGUMENTS, $1…$9, and the model: and mode: a command asks for; instructions from CLAUDE.local.md, GEMINI.md and .github/copilot-instructions.md, and the files a CLAUDE.md pulls in with @path.
  • An ignore file for the agent. .vyotiqignore, .aiignore or .cursorignore at the workspace root lists paths the agent's tools may not read, edit or find, in the shape of a .gitignore. The agent can't change them.
  • Math in replies. $$…$$, $$ blocks, ``` `math `` and the \(…\) other models write are typeset. A single $ stays text, so prices and $HOME` read as written.
  • Earlier briefs. ↑ in an empty New task brief brings back the last one you started, across tasks and workspaces, and ↓ goes the other way.
  • Six more @-mentions terminal output, the uncommitted diff, a commit, a URL, a pull request or issue, and a code symbol.
  • In the record. A command card can copy the command or its output, or run it again in your terminal, and Find searches command output too. Alt+← and Alt+→ move back and forward through views and tasks. Fork from here starts a new task from any instruction.
  • Recently deleted. A deleted task waits 30 days and can be restored. The navigator row also gains Open beside, Mark unread and Reveal worktree folder.
  • Checks, issues and conversation in the Pull request tab. A failed GitHub Actions check shows the failing step's log, can be re-run, and Hand to the agent carries the log. Issues open in the app with Start a task, and a brief that says "Fixes #N" carries it into the drafted pull request. The tab shows the conversation, takes a comment, and edits the description, with a preview. It requests and withdraws reviewers, turns on Merge when ready where the repository allows it, leaves a merge queue, and lists every comment rather than the latest 50. A merged branch offers Clean up.
  • More git in Changes. Discard your own changes, with a copy kept in the OS trash and an undo. Stage or unstage one hunk, amend the last unpushed commit, and switch branches with your changes stashed on the branch they belong to. Manage branches and stashes, revert or branch from a commit, and pull with rebase. Changes fetches every few minutes while it's open, so ahead and behind stay true, and lists every changed file past the first 200 on request.
  • Batched review comments. Comments on lines and line ranges, across files, collect into one instruction you send when you're done.
  • A fuller terminal. Find, Clear, Copy all and Rename on each tab. Each tab can take its own shell, WSL included, and Settings takes a shell program path. Ask the agent sends a selection to the task. Draw with the GPU renders heavy output faster.
  • Extensions keep up. Packages installed from npm, git or a registry check for updates, and Discover searches the official MCP Registry beside the bundled catalog. The catalog gains four servers. Packages that repeat a built-in tool say "built in already". Workspace rules can be switched off. Agent-built tools can be viewed and deleted in the app. Hooks have a page in Settings, with the files they come from, their trust, and a log of their runs.
  • Setup meets you where you are. It notices keys in your environment and local servers that are running, and takes a key in place. Common OpenAI-compatible hosts are presets, so nobody needs a base URL. The proxy takes a user name and password. Vertex AI runs its open models too.
  • A sandbox on Windows. Settings, Tools, Sandbox: on Windows, Workspace only runs the agent's commands at low integrity, so they can write the workspace and temp folders and little else. It cannot block reads or the network, and bash cannot start under it, so commands run in PowerShell or cmd.
  • Arm builds. Windows ships x64 and arm64 installers, Linux ships arm64, and the Download page lists both.
  • Local dictation in other languages , with a multilingual model to download.
  • Sound and quiet hours for notifications.
  • Instances survive a restart. When an interrupted task resumes, its interrupted instances get their checkout back from their kept branch and carry on, and the task is told which came back.
  • Four more servers in the bundled catalog. Brave Search (web, news, image and local search, with your Brave API key), Postgres (schemas, queries, explain plans and index advice, starting in read-only mode and needing a connection string), Docker MCP Toolkit (the servers you enabled in Docker Desktop, through its gateway) and GitLab (issues, merge requests and pipelines on GitLab.com, signing in with GitLab). GitLab and Brave are in Discover.

Improved

  • Runs lose far less time to polling and waits. After three identical rounds of checking a command, the app re-runs the check itself and wakes the model only when the output changes. Replayed over a week of real runs, that removes about 267 steps and 2.4 hours of generation. A provider's usage-limit answer now comes back at once instead of being slept on inside one attempt for about 130 seconds a time; waiting for the quota to reset still works as before.
  • Prose edits don't ask for a full check. A task that only wrote documentation was being sent to run two whole-repository lints before it could finish; one spoken "log these issues" ran for 10.5 minutes that way.
  • Fewer cache misses. Tool results are trimmed with a margin, so the trim point stops moving every step and missing the provider's prompt cache. The system prompt is no longer re-encoded every step just because the clock moved.
  • Very long tasks stay quick to open in full. A run's work shows its latest 200 rows, with "Show 200 more" above them for the rest. On a 5,000-call task with every page loaded, unfolding the work went from 11 seconds to under one, and typing stays responsive while it is open. Find still reaches the earlier rows.
  • Handing work to another agent is now a judgment call. The agent starts a sub-agent when your request splits into two or more independent pieces that can run in parallel, or when one piece is large enough that an agent given a narrow brief would finish it faster. A single small, tightly coupled edit, a straight answer and a read-only lookup are done in the main task, because doing them there is quicker and clearer, and nothing is spawned just to look thorough.
  • Steps that depend on each other stay together. When the agent does hand work over, it never splits steps that need one another. Each delegated step still goes to its own agent with a complete brief: what to deliver, what is in scope, how it will be checked and which parts of your workspace it touches. A child never has to guess at a conversation it cannot see.
  • A plan is published only when the work touches your workspace. Work that changes files, runs commands or otherwise acts on your project gets a plan, with each step carrying a check you can watch run. A direct answer or a read-only lookup gets none.
  • Fewer wasted turns. A run that had not published a plan is no longer asked where its plan is, which cost two extra model round trips on an ordinary request. A run whose checks are all met is not sent back to decorate a finished plan.
  • Smaller prompts. A step no longer carries tools that cannot work in the workspace: the MCP server tools with no server enabled, the GitHub tools with no remote, and the notebook editor with no notebook. Process advice names only your operating system's commands, and a task with no Done-when no longer carries a boilerplate one.
  • Approvals start at Edits and commands , the choice Setup recommends, for new installs and for anyone who never chose. "Unattended" no longer names two things: Setup's choice is Nothing, as in Settings, and the switch is Approve low-risk tools on their own. When the agent asks a question is a setting of its own.
  • Commit drafts follow the repository. Conventional Commits only where the history uses them, and "Fix x" becomes "fix: x", not "fix: Fix x".
  • Checks count. Running a test file directly, node test.js or python test_x.py, counts as a check for the receipt and the verification gate.
  • Setup starts on the key form when no local server answers, with OpenCode Go first in the list.
  • The inspector fits a narrow window. Tabs that don't fit move into a menu at the end of the strip, marked when one of them has something waiting, instead of scrolling out of sight.
  • Keyboard and screen-reader support across the app. Every dropdown menu now takes a typed letter — type "p" to jump to a row beginning with p, and press it again to cycle the others, so a menu of dozens of rows is reachable without the mouse. A menu's focus is held inside it while it is open and goes back where it came from when it closes. Settings search walks its results with the arrow keys, Home and End. Panels and dialogs keep focus inside them, and focus goes back to where you were when they close.
  • Your screen reader hears what your tasks do. A task finishing, failing, or asking for you is spoken, from the same events the bell and the OS notification use — so the Notifications settings decide what is spoken. It speaks for the task in front of you and while the window is in the background. Items that arrive together are spoken as one line, so one does not cut the other off. Settings, Appearance, Screen reader announcements sets how much: nothing, only failures and questions, or everything.
  • Your appearance settings survive the first paint. Text size, skin, reduced motion, contrast, the always-on focus ring and the announcement setting are applied by the app before any of its code has loaded, so a window that opens and immediately closes no longer flashes the default look and size. Text size can now take any value between 85% and 200% as well as the small/default/large presets, with a slider, and Ctrl+ and Ctrl− change it from anywhere in the window.
  • Long strips of tabs cut at the edges, not the words. When a row of items is wider than the space it has — the inspector's tabs, an instance's siblings — the ends that hide content fade out instead of clipping a label in half, and the item you are on is kept in view as the pane resizes.
  • A work line, not a wall of steps. A run's work now sits behind one line: it stays open while the agent works so you can watch it, and folds itself once the answer is being written or the run settles, so the answer sits under the brief instead of under every row of how. A run that failed or was stopped stays open, because its work is then all there is to read. Folded, the line keeps any error in view under it, and your own toggle holds until the run moves to another phase.
  • Settings rows that find your eye. A setting you have changed away from its default carries a mark at its edge, its title in the strong weight, and a Reset on hover — so defaults read quiet and a change finds you on its own. Settings search moves you to the row and highlights it, and a group of rows can be reset together.
  • Lighter installers, one per chip. Each Windows installer now carries only its own architecture's pieces, so the x64 app no longer ships the arm64 voice model and terminal library (about 150 MB of it), and Linux does the same. There is one installer per architecture rather than one carrying both, and the updater takes the one whose name holds its own arch.
  • Smaller things. The slash menu lists ready commands before skills to install. The command palette offers task commands only in a task. Commit opens its box directly when there is nothing else to choose. The Pull request tab asks before it creates a GitHub repository. A closed folder in Files marks that it holds a changed file. The index counts "source files". Usage shows "—" when nothing was priced, not "$0". Home shows the home workspace as not a repository, not as an error.

Removed

  • The product is called Agent V. What you read changed: the app's name in Settings, About, the release and update notifications, the Windows Start menu and desktop shortcuts, and the app's label in the Linux application menu. What you install did not. The app data folder, the auto-update feed and its file names all keep the old name, so an update from an older build finds the new one, and upgrading renames your old shortcuts and carries on. The company behind it stays Vyotiq.

Fixed

  • Approvals check the arguments that actually run. The approval and the command guard read the tool's arguments before they were normalised, so an alias such as cmd in place of command could slip past the dangerous-command check. Both now read exactly what will execute.
  • Edits stay faithful to the file. An edit keeps the file's line endings, byte-order mark and permissions; a replacement containing $$ is written as $$; a refused edit leaves no new folders behind; deleting a symlink removes only the link; and a second write to the same file waits for the first snapshot, so Undo restores what was really there.
  • Finished work is no longer lost. A transcript that failed to read is no longer written back empty. A streamed answer that only reached a snapshot is recovered at startup. A reply cut off mid-stream is continued a limited number of times whatever the stop reason, instead of without limit. Send now during a provider retry ends the wait, not the run, so the message you just sent is no longer cleared.
  • Anthropic thinking survives a resume. Thinking blocks keep their signature and replay it; an unsigned block is left out for Anthropic, which rejected it with an error. A stream that closes before the end of the message counts as a network failure rather than a finished turn.
  • Requests that cannot succeed are not retried. Error frames carry their HTTP status, so an overload is retried and a permanent rejection is not. A request that could not even be built is never retried.
  • MCP servers with many tools connect fully. Tool, resource and prompt lists are read past the first page, a server with no tools connects instead of failing, and tool schemas written in the older draft-07 dialect are validated instead of being let through unchecked. Servers connect side by side, six at a time.
  • Context folds keep the newest facts. When a summary must cut, it keeps the newest folds and facts instead of the oldest, and open to-dos are this fold's, not a union that kept finished ones.
  • Long lines no longer scroll the whole record sideways. One long command on a row could widen the record to about 7,800 pixels.
  • Run numbers count from the task's first run , and a single ~ no longer strikes text through.
  • /help and /loop mistakes stay local. They used to be sent to the model as your instruction, which started a paid run to print a list.
  • A sandboxed command that starts a program whose path has no spaces in it now runs. The Windows sandbox hands cmd one command line, and the program's name was quoted only when its path carried a space: a shorter, unbroken path came through as a single bare token inside that line, and cmd refused it with "The filename, directory name, or volume label syntax is incorrect." The program is quoted whatever its path looks like, so the same line runs under either shape.
  • Closing the window no longer stops your tasks without asking. See Keep running in the tray.
  • Files, Delete moves to the OS trash instead of deleting for good.
  • The Pull request tab no longer offers a pull request for a task that changed nothing.
  • Commit is no longer the primary button while this task has changed nothing.
  • Closing Extensions returns to where you were , as Settings does.
  • Opening the app during a headless run no longer marks that run interrupted.
  • New task's "What the agent will see" lines up with the brief.
  • Both Delete dialogs say the same thing , that the task goes to Recently deleted for 30 days, and warn when helper-instance branches will be lost for good.
  • Offline follow-up previews no longer replace every letter "s" with a space.

Security

  • GitHub sign-in no longer asks for the gist scope , which nothing used.
  • The Windows sandbox labels come off when you remove the workspace or uninstall Agent V, not only when you turn the sandbox off.
  • Your notification address never touches the settings file. An ntfy topic or webhook address is a secret — anyone holding it can post to you — so it lives in the key vault beside your API keys rather than in the settings file you export, sync or back up.

Known issues

  • Windows on Arm browsers offer the x64 installer. A browser on a Windows on Arm PC reports itself as x64, so the Download page's detected button offers the x64 build first; the Arm installer is listed below it. The in-app updater picks the right one either way.

1.2.0

On GitHub →

Agent V 1.2.0 is the release where the app can hold the agent to rules you wrote, and where the surfaces around a task grow into real work surfaces. Permission rules can allow, ask or deny a tool, a command or a path, and an operating-system sandbox can confine the commands the agent runs; the file editor, the task's git bar and the pull request tab gain find and replace, hunk undo, fetch and pull, and inline review threads; a task can repeat itself on a schedule and can be exported and brought back as a file. Underneath, storage settings stop holding on to work they should have let go of, and the log, the terminal and the browser keep less of your data than before.

Added

  • Permission rules that allow, ask or deny. Settings, Agent: write a rule against a tool, the first words of a terminal command, or a path given from the workspace root, absolutely, or from your home folder. They answer before Ask before and Always allowed get a say, deny beats ask and ask beats allow, and the field says which rules reach the prompt. A workspace can ship its own deny and ask rules in its permissions file; its allow rules are ignored. The app's data folder and that file itself are denied whatever you write, and the files that usually hold a secret — an environment file, your SSH keys, your personal skills — ask, unless one of your own allow rules covers them.
  • A sandbox for the commands the agent runs. Settings, Tools, Sandbox: Workspace only lets the agent's terminal, its test runs and its diagnostics read the disk but write only the workspace, that workspace's git folder with its hooks and config excepted, the temp folders, and the package caches that already exist; Network then cuts it off the internet. It uses the operating system's own sandbox on macOS and Linux, it is off by default, and it never covers the terminal you type into. Every confined command says in the record which confinement it ran under, and a command that failed because it was refused gets a one-line reason so the agent stops retrying it.
  • Find and replace across the workspace. The Files search row gains Match case, Whole word and Regular expression, with the query still read as a regular expression as it always was, and a second row that replaces every match in the workspace once you confirm how many matches in how many files. A file with unsaved edits in an open tab is left alone and named, as is one that is binary or too large to read back, and a search that stopped early says so instead of pretending it was complete.
  • Undo one hunk instead of the whole file. Every block of a modified file in Changes carries its own undo: that change is taken back out of the file as it is now and nothing else in it moves, with a toast that puts it back while nothing has changed where it was. A file the task created or deleted is still undone whole.
  • Fetch, pull and push from the task's git bar. A muted count each way sits beside the branch, and a menu beside them fetches, pulls, pushes, or publishes a branch that has no upstream yet; a new branch is named in an inline field beside it. A branch that has diverged asks whether to merge or rebase and says what each does to your commits. Pull and New branch wait while a task is working in that checkout.
  • Review threads on a pull request, inside the app. The Pull request tab lists the inline review comments by file, with the line each sits on, whether it is resolved or outdated, and how many replies it has; reply to one, resolve or unresolve it, or hand one comment — or every unresolved comment — to the task as an instruction. Resolved threads fold behind a count, and a thread's line opens the file there.
  • Check out an open pull request. When the branch has no pull request of its own, the tab lists the repository's recent open ones and checks one out here, refused while a task is working in that checkout or while your tracked files have changes.
  • A task can repeat. Repeat… on a task's menu gives it a schedule — daily, weekly on chosen days, every so many minutes, or a cron expression — and Scheduled tasks collects them all, across every workspace, with what each runs, when it next runs, and how its last run went. On or off, Run now, Edit and Delete sit on the row, and the last run opens like any task. Schedules run while the app is open, and a time missed while it was closed runs once when it opens. Each run is a new task, marked with a repeat glyph in the navigator and marked again when it is catching up a missed time.
  • Helper types you write once. A markdown file defines a helper: a name, one line saying when to use it, the tools it may use, and the model it runs on. Put it in a workspace's agent-types folder, in its Claude agents folder read as it is, or in your data folder for every workspace; the first file to claim a name wins. The tool list narrows what the helper's mode already allows and never widens it, a named model falls back to the helper model when it cannot run here, and the type's name shows on the instance row in the task and the navigator.
  • Fallback models. Settings, Providers: up to three models, in order, that a step moves to when the provider is down — a server error, an overloaded model, a refused or reset connection, a DNS failure, a timeout. Usage and rate limits keep waiting on the task's own model rather than switching, a bad key is still reported to you, the task's own model is tried again ten minutes into a long turn, and the next turn starts on it anyway.
  • Export a task as a file, and bring one back. Export as JSON writes the whole task — the brief, the record, the checks and the pictures the tools stored — with anything shaped like a key replaced; Import task… reads one into a workspace as a finished, read-only task with a new identity, which you fork to carry on from. A task too large to write, a file that is not a task, and one from a newer build are each refused in words you can act on.
  • Usage says where the money went. The range is 7, 30 or 90 days or two dates you pick, a long range labels its bars by date instead of every day, and a breakdown gives each workspace its share of the spend or the tokens with its tasks under it, costliest first, each row opening the task. Export CSV writes one row per task per day, with cells that cannot be read as formulas when the file is opened in a spreadsheet.
  • The keyboard list and the documentation are in the app. ?, or Ctrl or Command with /, opens every shortcut grouped by what it acts on, showing the keys you rebound rather than the defaults. The command palette gains Keyboard shortcuts, Open documentation, Inbox, Scheduled tasks, Import task… and Show or hide reasoning.
  • A diagnostics bundle to send with a bug report. Settings, Diagnostics exports the logs, the crash history, memory figures and your settings as one zip, with keys, tokens, environment and header values taken out and your home folder and username replaced. Nothing is sent from there; you attach it yourself.
  • Run a task with no window. Vyotiq can run one task from a script or a build with your saved settings, keys, rules, skills and servers, and answers its approval prompts by policy: deny everything, allow only reads, browsing and file edits, or allow all. The result comes back as the answer alone, one JSON object, or a stream of them as things happen, with exit codes that say whether the run finished, ran out of steps or spend, was refused, timed out, or was interrupted.

Improved

  • The file editor is an editor. Files highlights 39 languages instead of ten, finds and replaces inside the open file, offers your language server's completions as you type, and keeps several cursors at once. Its find panel and completion list wear the app's own controls instead of the library's, and a file nothing can write — one you are only reading — keeps find and drops editing.
  • Hooks follow Claude Code more closely. Two events are new: one when a task starts and one when you send an instruction, and either can stop what follows, with the reason handed back. A hook's JSON output is read where Claude Code reads it — a decision to block, a permission denied, extra context — and a file naming an event or a shape this app does not have now keeps its other hooks and logs what was skipped, instead of being ignored whole.
  • The record reads as one column. The brief, the steps and the instruction line share one measure and one edge, so the composer's box lands on the record's card instead of inside it, and the goal banner above it stacks at the same width. Inline code loses its grey tile for a hairline under the text, headings take one vertical rhythm with a rule under a section name, tables drop their vertical lines so the rows read as rows, a wrapped heading balances itself, and a paragraph no longer ends on one short word.
  • Stop sits where you send. The task header's row is gone: Stop, the task's menu and the pane's own buttons sit at the top of the record and hold their corner on a long task, and the plan bar moved to the Plan panel, where the steps it counts are the ones listed below it. A task that has started but has streamed nothing yet says what it is doing instead of showing an empty column.
  • The commit box says where its words came from. It is a real field you can edit freely, it says whether the message is still the agent's draft, typing your own no longer waits behind that draft, and once nothing is waiting on review a line says how the edits were settled — committed to which branch, undone, kept, or some kept and some undone — with a way through to the pull request.
  • Commit and create a pull request keeps the task's work. The button commits as a plain commit does, marks the task's files as taken, and writes the pull request the way the Pull request tab drafts it: the task's title, its result, and its done-when checks.
  • An undone file can come back. Bring back puts the agent's version of a file on disk again and puts it back on review, offered while the run is stopped and nothing else has changed the file since.
  • A task you stopped can be picked up again. Resume is on a stopped task's menu alongside Retry, and Archive is now offered on a running task with the reason it cannot be used yet, instead of being absent.
  • A pasted link names the task it points at. A task whose instruction is nothing but a link is titled by its target — the site and its path — instead of eighty characters of percent-encoded query string, so a deep link pasted into the composer still reads as something.
  • Background shells are bounded, and quieter. At most twenty-four background terminal sessions run at once across the whole app, where the limit counted per turn and one task could hold more than a hundred; a command over the limit says so and explains what to wait for. Their output now reaches the Terminal panel in one message per frame rather than one per read from the shell, so a chatty command no longer asks the panel to redraw hundreds of times a second, and a stream that ends flushes what it owed.
  • A listed server is no longer a running server. Servers that talk over standard input keep one warm session per workspace that is doing work, rather than one per folder you have ever opened; a server in a workspace you come back to connects on its first tool call. Closing the last workspace now releases the processes it was holding, and Refresh or Retry still warms everything.
  • Storage settings do what they say. Delete old tasks now deletes a task once it is past the kept count or past the age limit — either one is enough — where both had to be true at once, so the setting read "keep 30" but meant "keep everything for 60 days". The size cap frees space by dropping a workspace's code index, which is rebuilt on demand, when undo points alone cannot cover the overage; before, most of the managed disk had no eviction path behind it at all. Storage left behind by a workspace nobody has opened for longer than the grace period is now collected, not only the folders holding no run records, and never for a workspace with a task running in it.
  • Helper branches stop piling up. The branches a helper instance leaves behind are pruned by a count as well as by age and reachability, so a backlog of recent branches that carry their own commits — and so fail both older rules — can no longer grow without limit.
  • The log keeps what support needs. Rotations are numbered and five generations are kept; before, a second rotation overwrote the only archive, and yesterday-and-before was unrecoverable. A support bundle and the crash panel both read every generation, so a crash is still reported after its own log file has rolled over, and a log line cut by the length cap says how much was cut.
  • A recovered blip is no longer logged as a failure. One dropped frame inside an open stream — a reset connection or an upstream error partway through an answer — is a warning now, with the retry still doing its work, and a plan limit worded like throttling waits on the task's own model instead of being retried as if the server were busy.

Removed

  • The task header row. The 40px bar above a task, carrying its title, state, branch, added folders and plan bar, is gone. Its controls sit at the top of the record instead, the plan bar moved to the Plan panel, and the title, the branch and the added folders are read where they are needed rather than repeated above everything.

Fixed

  • Closing a terminal tab no longer quits the app on Windows. The packaged build refuses a helper the terminal library started for that, and the refusal ended the whole app when you closed a tab.
  • A task no longer keeps a stale inbox row. Resuming, retrying or continuing a task withdraws the Finished or Failed notice its last stop published, so the inbox cannot describe a run that is going again. A pending question still outlives its run's stop.
  • Sending is refused while an attachment failed. The send button used to offer to fix a bad image, file or recording and then send anyway; it now refuses until the attachment is resolved or removed.
  • Attachments and dictation no longer collide. The attach control closes while a recording is being taken, and the mic greys out while the composer cannot take input, rather than looking live and doing nothing.
  • A send from a split lands in the pane you typed in. With two tasks side by side, the shortcut that focuses the composer used to land in the left pane's instead.
  • Revealing a search result no longer takes the keyboard. Finding a file in the tree and waiting for its folders to load stole focus from the editor you had already clicked into; focus moves only when the tree holds it or nothing does.
  • A put-back hunk says so when it cannot be. Restoring an undone hunk finds it where it was left, or at the nearest place it still matches; a file that changed under it is left as it is rather than patched roughly.
  • A headless run that wrote nothing is a failure. A run whose whole output is its transcript now fails when neither of its files holds a row, instead of reporting success with nothing behind it for a caller to read.
  • A server a workspace needs stays reachable. A server configured for a workspace that was deliberately left cold connects the first time a tool call, resource or prompt reaches for it, rather than answering that it is not connected.
  • Settings says which rules are in force. The Rules row names the instruction and rule files that will reach the prompt for the open workspace, or says plainly that the generic list is standing in while that is read.

Security

  • A repository's own git programs are covered further out. Fetch, push and signed commits reach much further than a status or a diff, and the guard now covers what a repository can set for them: the SSH command, the git proxy, credential helpers, the askpass program, a remote's upload and receive programs, the signing program, the alternate-refs command, a hooks path that leads out of the repository, and a remote address that is a shell command. Your own global settings are put back where a repository overrode one, a plain program name with no path or arguments still counts as installed software, and the repository's own hooks inside it still run, as git runs them.
  • A web page the agent opened cannot reach your network. A public page in the agent's browser can no longer fetch your router, a dev server on localhost or a cloud metadata address by riding the tab's allowance; only a page that is already local may reach local addresses, and a public page redirected back into your network is cancelled. The agent is told what was refused and how to open a local page itself.
  • The packaged app refuses to run as Node and ignores injected startup options. Two Electron safeguards left on because turning them off broke something are now off, with their causes fixed first: the terminal's process listing no longer needs a forked helper, and the certificate store a proxying TLS setup depends on no longer needs the environment to pass it through. The refusal to start under a debugger, and the check that the app archive has not changed, are unchanged.
  • Output the agent fetched is marked as untrusted. A curl, wget or GitHub API result in the terminal is wrapped in the same envelope a browsed page gets, so instructions inside a server's response read as data rather than as orders. A build, a test run or a directory listing is left exactly as it was.
  • Deleting all your data reaches the copies. The pass removes whole top-level entries, which is what takes a backup folder holding its own copy of your keys and settings with it, and it does so by position rather than by name.
  • A helper confined to some folders is not offered tools it cannot use. Instead of spending a turn on a refusal, a helper capped to a shared tree is offered only the tools that stay inside it, is told why, and keeps the check and test runners it needs to verify its own work.

Known issues

  • Windows has no sandbox. Confining one process's writes and its network there needs native calls this app has no dependency for, so the control is disabled with that reason rather than pretending to confine anything.
  • While the sandbox is on, a tool the agent wrote for itself is refused with an explanation instead of running unconfined behind a setting that says commands are confined: it runs in a process the app starts, which cannot be wrapped.
  • A package cache that does not exist yet is not writable inside the sandbox, so a first install into a new cache fails there; run that one install outside it.
  • The sandbox confines files and network, not everything: on macOS a confined command can still talk to system services, and on both systems it can read every file you can except the app's data folder and your SSH folder.
  • Headless runs refuse rather than answer: a command held for a person — the risky-command guard, or a permission rule that says ask — is refused, and no headless run ever writes an "always allow" or "allow for this task".
  • Starting the app while a headless run is going, with that run's workspace open in it, marks the run interrupted.
  • Headless on Windows: from an interactive prompt use the launcher in a checkout, or start the program and wait for it, because a windowed program there does not report its exit code. Writing the result to a file always works.
  • The private-network rule refuses a flow that leaves a local page for a public one and is redirected back — an OAuth callback to localhost, for instance. Ask the agent to open the callback address itself.
  • Permission rules and the risky-command guard read a command as written and know a fixed list of programs: a delete hidden inside a script or an inline interpreter line is not flagged.
  • Putting an undone hunk back only works while nothing has changed where it was, and only until the app quits.
  • Windows and macOS builds are unsigned. Windows SmartScreen warns on first run, and macOS Gatekeeper refuses a double-click — open it from the right-click menu once.

1.1.0

On GitHub →

Agent V 1.1.0 widens where the agent can run and tightens what it may do without asking. It adds Amazon Bedrock, Google Vertex AI and Azure OpenAI, hooks that can check or stop a tool call and a proxy setting; asks before a risky command, before a repository's own git programs run and before a folder opens from a link; keeps API keys out of task records; and can delete all of your data. The task list, the record and the inspector are reworked around what you do next, and a task that changed code must show a real check passed before it calls itself done.

Added

  • The agent checks its own work before it stops. In Agent mode, a turn that changed code with no passing test, typecheck or lint since the last edit gets one more turn, asking the agent to run a check or say plainly what it left unverified. It asks once each time the task runs, on a send or a resume, and helper instances are held to it too.
  • A risky-command guard. A terminal or test-run command that deletes outside the workspace, or the workspace itself or its .git folder, force-pushes, hard-resets, runs git clean with force, formats a disk or pipes a download into a shell now always asks: with approvals off, in unattended mode, and even for a command you allowed before. The card says what the command does and offers only Allow once or Deny, and nothing is remembered. If nobody answers in 15 minutes the command is denied, and with no window open it does not run.
  • A spend limit per task. Settings, Agent, Runs: a limit in whole dollars, off at 0. The task and its helper instances count towards it. When spend reaches the limit the task asks under Needs you, Allow another or Stop here, and a stop shows as Stopped, not Failed. The limit is checked before each model call, so one call can run past it, and a model with no known price counts as nothing.
  • Amazon Bedrock. Settings, Providers: choose an AWS region and sign in with a Bedrock API key or with AWS access keys. Claude models think the way they do elsewhere, and the model list shows the inference profiles and text models your account offers. The keys are kept with your other provider keys, in the operating system's secure storage.
  • Google Vertex AI. Settings, Providers: name a Google Cloud project and a location, then sign in with a service-account key file or with the gcloud login already on the computer, which is read when a call is made and never copied. Gemini and Claude models are offered; models from other publishers are refused with a message that says so.
  • Azure OpenAI. Add an endpoint of kind Azure OpenAI and paste the https address of your resource or deployment. You pick models by deployment name, and the key goes in the api-key header.
  • Extra headers, and a proxy. A custom endpoint takes extra headers, one per line, up to sixteen; headers that would break the request are refused. Settings, General, Network sets a proxy: System uses HTTPS_PROXY and NO_PROXY, then the operating system's setting; Manual takes an address and a bypass list; None connects directly. It applies at once to the app's own traffic, the updater and the browser, and to the commands the agent runs in the terminal. Localhost always connects directly.
  • Hooks. A hooks file can run a command before a tool call, after one, when the agent stops and when it needs you. Exit code 2 from a before-hook blocks the call and tells the agent why; from an after-hook it adds your message to the tool result; from a stop hook it keeps the agent going, up to three times each time the task runs. Put the file in your data folder as hooks.json, or in a workspace as .vyotiq/hooks.json, which runs only after you allow that exact file and asks again whenever it changes. A hook cannot change a tool's input or output.
  • Helper and Utility models. Settings, Agent: the helper model runs helper instances, and the utility model writes compaction summaries and commit messages. Both default to the task's own model, and only providers with a key are listed.
  • Find references and symbols. The agent's language-server tool can now list where a symbol is used, the symbols in a file and the symbols matching a name across the workspace, for the TypeScript, Python, Rust, Go and C and C++ servers it finds in your project or on your PATH. Results past one hundred are counted, not listed.
  • Folder rules where they apply. When the agent reads or edits a file, the AGENTS.md, CLAUDE.md and .cursorrules files in the folders above it, and the Cursor and Vyotiq rule files whose globs match it, join the result. Each is read once per run, at most six per result, and none can override the agent's own constraints or tool policy.
  • MCP servers can ask you a question. When a server needs input mid-call, a form card appears in the calling task: text, number, yes or no, single or multiple choice, up to eight fields. A bad answer asks again, and Skip declines. A server that adds or removes tools is picked up without reconnecting.
  • The agent can read a PDF. It gets the text, page by page and under a page header, in the same windows as any file. A scanned PDF reports that it has no text to read, since nothing recognises images, and files over 64 MB are refused.
  • Task rows say more, and take an answer. A running task shows its current step, a waiting one shows what it asks, a terminal command appears as the command with Allow once and Deny on the row, and a task in review shows how many lines changed and how many checks are met. A task's helper instances fold under it, its hover card gains a plan meter, and its menu adds Retry for a failure that can be retried and Fork.
  • Settling a task can be taken back. Keep all, Undo all and Commit each show a toast with Undo, and Undo all no longer asks first. A commit can be taken back, leaving its changes staged, while it is still the latest on its branch, has one parent and is on no remote branch. A kept file can be un-kept while the run is stopped. The result reads Committed, Kept, not committed or Undone, with Kept or Undone against each file.
  • Ask about an element on a page. In the Browser tab, Pick an element to ask about shows Chromium's inspect overlay; click, or step with the arrow keys and press Enter. Each pick becomes a chip in the instruction line, and the agent is given the page address, the element's name, role and selector, where it sits and up to 240 characters of its text. A pick ends when the page navigates, and elements inside frames cannot be picked.
  • Approvals and answers sit where they were asked. An approval or question appears inside the step that raised it, the record says You answered or Allowed by you, always for this task once a gated call has run, and a run notes Allowed by a rule once. Output lines that pass or fail are tinted, a folded stretch of steps reads like 6 lookups, 2 commands, 3 files edited, and helpers started together share one block. A Copy the summary button joins the result.
  • The result lists the files a run changed. Each file shows New, Deleted or its added and removed lines and opens in Changes, past eight files a line says how many more are there, and Kept and Undone marks follow the settling.
  • Open checks lead Review. In Changes and in Review for a task that has stopped, the done-when checks that were not met, or never checked, come first, each with a button that asks the agent to cover or check it. Met checks fold to a count.
  • A plan bar. A thin rule on the task header has one segment per step of the plan: done, running, needing you, failed.
  • Number keys answer questions. With an option focused, 1 to 9 pick it, and a question with one single-choice field is answered by the digit.
  • New files read as new files. A file the task created shows one number column and a plus gutter, with no old side to compare.
  • Alt Up and Alt Down open the previous and next task in the order the list shows.
  • Search your tasks. The magnifier in the navigator filters titles at once and, after a pause, searches the text of your messages, the agent's and its tool output in the open workspaces, archived tasks included. Each task gives one hit, newest first, with the matching line.
  • Archive or delete several tasks at once. Ctrl or Command click toggles a row, Shift click takes a range, and Space with Ctrl, Command or Shift selects the focused one; a bar offers Archive, with a toast to undo it, and Delete, which asks once. Running tasks and tasks waiting on you are left out, and the View menu adds Archive all done.
  • Rebind the shortcuts. Settings, Shortcuts: Change, then press the keys. A chord already in use, or one that is reserved for copy, paste and the like, is refused with the reason, and every row has a way back to its default.
  • Export, import and reset your settings. Settings, About, Settings file. Export leaves out keys, sign-ins, MCP servers, endpoint headers and pinned and archived tasks. Import shows each change before you confirm it, never brings in base addresses, the proxy or approval settings, and only adds endpoints. Reset all keeps your provider and model, endpoints, MCP servers, rules and pinned tasks.
  • Delete all my data. Settings, Storage, Retention. It measures first and lists what goes: tasks and undo points, worktree folders, Home files, and your keys, sign-ins, settings, extensions and logs. One confirmation, and the app restarts clean, as on a first run. Your projects, your branches and commits, and anything at your providers stay; keys are removed from this computer, not revoked.
  • New task is one brief. The brief, an always-ready Done when line (Enter adds a check; up to twenty), and the control row sit in one box, and Ctrl Enter starts it. Where it works, This folder or New worktree, sits at the header's edge. Settings, Agent adds New tasks start in a worktree, off by default.
  • Extensions can be switched on and off in the list. Installed servers, skills, plugins and your own rules have a switch on the row, and a hover menu to turn one off here or in every workspace. A Google server that uses your own client secret gains Reset Google sign-in.
  • Settings is one column with an index that follows where you are. Effort sits under Model, and the effort levels now say what they cost. Settings, Agent, Memory has Clear for a workspace's notes.
  • A folder can be mentioned. Pick a folder in the @ menu and the agent is given its listing, up to 40 entries with sub-folders marked, and told when the list was cut short. The @ menu lists files as soon as you type @, and a picture in your workspace attaches as an image.
  • Type in the page. The Browser tab has a button that moves the keyboard into the page, for a login or a form, when the agent is not driving it.
  • File links in the record open the file. A path such as src/a.ts or src/a.ts:42 in the agent's notes opens Files at that line, and a heading link scrolls inside its own note.
  • Shift Tab in an empty message box switches between Ask and Agent.
  • Usage shows what you kept. A Kept share beside the totals, and one chart by day, Spend, Tokens or Tasks.
  • Screen readers hear how a run ended. Failures and needing you are announced at once, finished runs politely, once per inbox item, following your Notifications settings.

Improved

  • Only a real check counts as one. A command used to count as verification if it exited cleanly, whatever it was; in recorded runs, 143 of 1,679 such commands were actually tests, typechecks or lints. Now only those count, whether the agent ran them as a test or in the terminal. A test run that failed counts as a failure, a lint that exits on a warning counts as a failure, and a check whose output was cut off proves nothing. A command chained with others never counts.
  • A check goes stale when anything changes the files after it. Writes from the terminal, from an MCP tool, from applying a patch or from a merge now all count, not only the agent's own edits. Editing the task's plan or its done-when list does not.
  • The plan panel says why a task is unverified: the last check failed, no check ran after the files changed, or files changed after the last check passed.
  • Diagnostics works on more projects, and reads more tools. A root tsconfig that only lists project references used to check zero files and report clean; it is now built as a whole. Output from Rust and Cargo, Python, mypy and ESLint is read, a check that timed out on Windows left its processes running and hung the step, and now stops them all.
  • Changes made by applying a patch show up in Changes and can be undone, like any other edit. A helper instance limited to some folders can no longer patch files outside them, and can now run diagnostics, which it was refused 22 times in recorded runs.
  • An edit card shows the real line numbers of a replacement in the file, not a count starting at 1. A whole-file write shows none.
  • The @ and / menus fit the composer. They follow its width, put a header over the list, and say when a search failed instead of showing an empty list that looks like no matches. The path tree beside the @ list is gone.
  • When the agent waits on a helper instance, the answer says whether that helper checked its work.
  • Models that write a tool call as text now have it run, for the tools the step offered, and the text is hidden from the record.
  • Claude through OpenRouter now uses prompt caching, and Gemini thinking carries across tool calls on the direct API as well.
  • MCP calls get more room while the server is working. The two-minute idle limit restarts whenever the server reports progress, a call is capped at ten minutes of work, and both pause while a form waits for you.
  • Home opens faster.
  • Run approvals follow the unattended setting. In unattended mode, asking to run a command that is not a check as a test, or running a script, now asks first, the same as the terminal.
  • One Set up. The What needs your OK? dialog that appeared on your first send is gone. Set up asks once, on first run or if you started tasks without ever choosing, holds an instruction you sent until you choose, and has Edits and commands preselected.
  • Day spend in Usage counts bills plus estimates, marked est., so a figure can differ from 1.0.0.
  • A narrow window keeps a rail. Under 1,024 pixels a thin rail shows a glyph for each task that needs you, is running or is in review, with Home, Inbox, Extensions, Usage and Settings. The inbox groups its items as Needs you, Ready for review and Earlier.
  • The same look across dialogs, radios and popovers, with one bar on every dialog, and the context meter says Record where it said Messages.
  • The app says task and instruction where it said chat and prompt, and a Markdown export is headed Instruction.

Removed

  • Thirty-nine skills are gone from Extensions. The twenty-six vendored from Matt Pocock's Skills for Real Engineers, and thirteen of our own: implement-feature, fix-bug, review-code, write-tests, explain-code, create-skill, goal, frontend-design, accessibility, api-design, persona-builder, refactor and analyze-api. A skill you already installed stays installed and keeps working; it just no longer receives updates. To write a new skill, the /create-skill command is still there.
  • The harness review and apply commands. They drafted and applied changes to the agent's own system prompt from past runs, and only worked inside the Agent V repository itself. Run ratings are kept.
  • The Density setting. The 1.0.0 notes listed it as removed, but that build still showed it. It only sized controls the redesign no longer draws.
  • Previous and Next file in Changes, which now scrolls as one column, and the confirmation before Undo all, which the toast replaces.

Fixed

  • Undo no longer loses its history when its index file is damaged. The index is rebuilt from the saved checkpoints and the damaged copy kept aside; before, every earlier undo point silently disappeared.
  • Undo after a crash no longer overwrites a file it cannot prove is untouched. If the app stopped mid-turn, a file changed since the agent's write is left alone.
  • A rewind that leaves a change of yours no longer marks that turn as fully undone.
  • When one tool in a batch fails, the results of the others are kept. They are saved with the step, where before they were thrown away.
  • A run can no longer loop forever. A run stops after 500 steps with a notice, counted each time you send or resume, and a model that repeats the same tool call in one reply is cut off the way a flood of calls already was; one run spent 33 minutes that way.
  • A run with an odd receipt no longer drops out of Home and Usage. A receipt with one malformed count used to fail as a whole; now only that field is set aside.
  • A run's receipt lists every file it wrote, across every time it was resumed, not only the last.
  • The line counts in Changes match the list for large rewrites, and a removed line that starts with two dashes is no longer dropped from an edit card.
  • Waiting on a helper instance after a restart no longer polls its status twice a second, and no longer leaks memory while it waits.
  • A damaged settings file is set aside, not overwritten. It is renamed with the time, the defaults load and the inbox says so; before, the next save replaced it with defaults. A settings file that cannot be read stops saves instead of writing over it.
  • A crash no longer drops the run's last writes. The app saves queued messages, events and status, for up to three seconds, before it exits; it used to wait a quarter of a second.
  • Quitting from Home, Settings, Extensions or Usage no longer waits and then asks whether you want to quit with run data still saving.
  • Helper instances use the task's model when no helper model is set, not the workspace's default.
  • A tool the agent wrote for itself asks even with approvals off. The approval gate was skipped when approvals and MCP protection were both off.
  • The diagnostics check no longer fails on pnpm projects because pnpm passed an extra flag on to the linter.

Security

  • A repository's own git programs no longer run unasked. Settings in a repository's git config can name programs that run on a plain status, diff or merge: a file-system monitor, clean and smudge filters, external diff and merge drivers. The app's git now skips them, Changes lists what it skipped, and Allow for this repo, once confirmed, runs them for exactly that set; a change to the set blocks them again.
  • Opening a folder from a link asks first. A vyotiq link to a folder that is not open and not among your twenty most recent now shows its path and asks before opening it.
  • Keys stay out of task records. Text shaped like an API key, a token, a private key or a Bearer or Basic credential is replaced with a marker in a task's messages, events and brief before it is written, and the agent is told never to write one. It recognises the formats of the common providers, so a key in an unusual format can still get through, and tasks recorded by earlier builds keep what they hold.
  • Agent-written tools run without the app's own environment variables.
  • The packaged app refuses a debugger switch and a changed app archive. It ignores the inspect switches, and on Windows and macOS refuses an app archive whose contents changed.
  • A helper limited to some folders is held tighter. It cannot apply a binary or headerless patch or write into the agent definitions folder, and the vyotiq link handler now checks the data it is given.
  • undici is updated past GHSA-rfgv-xxqx-mfg5 in the build tooling; it never ships in the app.

Known issues

  • Windows and macOS builds are unsigned. Windows SmartScreen warns on first run, and macOS Gatekeeper refuses a double-click — open it from the right-click menu once.
  • Crash reports are not sent from this build. Crashes are recorded on your own machine only.
  • Amazon Bedrock and Google Vertex AI were built from the providers' documentation and tested against stand-ins, not live accounts. Bedrock, Vertex AI and Azure OpenAI show tokens but no cost, so a spend limit cannot count them.
  • Allowing a command from a task's row or the inbox does not show the warning the task's own card shows for a risky command. Open the task to see why it is asking.
  • The risky-command guard reads the command as written and knows a fixed list. It does not flag git branch -D, git checkout . or git stash drop, or a delete hidden in a script or a python -c line.
  • A hooks file that names an event the app does not have is ignored as a whole, and the reason is only logged. Matchers use the app's own tool names, such as terminal and edit.
  • The models Vertex AI lists are the same for every project.

1.0.0

On GitHub →

Agent V 1.0.0 is the rebuilt app. The chat window is gone: you give the agent a task, and the app keeps a record of the work — each step it took, what it changed, the checks it was held to and whether they held — beside the files, terminal, browser and pull request it worked in. Tasks are sorted by what they need from you, not by when they were opened, so the question "what is waiting on me?" is answered before you look for it.

Added

  • Tasks, sorted by what they need. The navigator groups every task in your open workspaces as Needs you, Running, Ready for review, Pinned and Earlier, with finished work split into Today, Yesterday, This week and Older, and Drafts kept apart. Home, Inbox, Extensions, Usage and Settings sit at its foot. Needs you means a tool call or a question is waiting on you right now; Ready for review means the agent finished and left edits you have not kept or undone. Ctrl J jumps to the next task that needs you.
  • A record of the work, not a chat transcript. A task reads as the instruction you gave, then the steps the agent took in order — each file it read or wrote, each command and its result, its plan and its progress through it — with terminal and diff output kept in bordered blocks so they stay easy to read. Find (Ctrl F) searches the record.
  • Done-when checks. A new task can carry the conditions that mean it is finished. The agent sees them, may add its own while planning, and before it stops must mark each one met or not met with the evidence — a command and its result, or a file and line. The record and the run's receipt show every check and its verdict.
  • The inspector. Changes, Files, Terminal, Browser, Pull request and Plan sit in one strip beside the task (Ctrl I to show or hide, Alt 1 to Alt 6 for each tab, Ctrl Shift I to expand). Changes counts what this task wrote from its own checkpoints, exactly or not at all, and the expanded view is a review: mark files viewed, keep or undo each, and ask about any line.
  • A New task page. Write the brief, list its done-when checks, choose Ask or Agent and see what the agent will be told about the workspace before it starts. Ctrl Enter starts it. A brief can be saved as a draft and picked up later from Drafts.
  • Start a task in a new worktree. A task can run on its own branch in its own folder, so your checkout is untouched while it works. When it is done, merge it back into the branch it came from or discard it; a merge that conflicts is stopped and names the files.
  • Rewind, and Redo. Rewinding to an earlier instruction removes the later steps from the record and takes each file back as far as it safely can. The dialog says ahead of time which files go back, which stop partway and why — a change you made since, or a write that kept no copy — and the rewind does exactly that. A rewind is kept, so Redo brings it back until you send a new instruction or change those files.
  • Home and Usage. Home is where work starts: a field to begin a task, what needs you across every workspace, and the week so far. Usage shows tasks, tokens and spend over the days you choose, for one workspace or all of them, with the model mix, the tools that failed, the edits no check followed, and the share of input served from the provider's cache wherever that was measured.
  • Instructions while it works. Anything you type while a task runs is queued for when its turn ends. Shift Enter sends it at once: the agent's current reply is cut short and your instruction is the next thing it reads.
  • Always allow a command, not the terminal. Allowing a terminal command for a workspace now allows that command — pnpm test, say — rather than every command the agent might run. A command chained with another, piped or redirected never matches an allowed one.
  • Instances at once. Settings caps how many helper instances a task may run in parallel, up to sixteen.
  • Pause indexing. A workspace's code index can be paused and resumed from Settings; paused, it stays paused through edits, and the agent is told the index is paused rather than that it is missing.
  • A commit message ready when you open Changes. The message is written once per set of changes and kept, so reopening Changes does not ask the model again.
  • Search and commands. Ctrl K finds tasks, files and commands in one list, and Settings rows too. File search reads a list kept per workspace, refreshed when files change, rather than walking the folder on every keystroke.
  • Notifications, an inbox and What's new. A finished task says how many files wait for review and how many checks were met; a waiting approval says what the agent wants to run. The inbox keeps them, and an update that is ready waits there instead of interrupting you.
  • Set up on first run. The first launch checks your provider key against the provider, asks how much the agent may do without asking, and opens the folder you choose.
  • The agent can write itself a tool. When a run keeps repeating a mechanical shape no built-in tool covers, it can write one as a small module that joins its catalog. Calling one asks you first, every time the file behind it has changed, and the approval shows the code.
  • Twenty-six engineering skills in Extensions. Matt Pocock's Skills for Real Engineers, vendored under his name and MIT licence. Installing one that calls others installs those too, and says which.
  • The agent can see screenshots. It can snip a window, a region or a whole display, read an image file in your project, and see the images an MCP server returns. A screen snip asks you first every time, even with approvals off. Only the three most recent images stay in its context.
  • Your own endpoints. Settings, Providers, Custom endpoints adds any OpenAI-compatible server by name and base URL, up to twenty, each with its own key and its own tab in the model picker. Removing the endpoint a task uses stops that task from starting rather than sending it somewhere else.
  • Voice input writes as you speak. A quick draft model shows words while you talk and the model you chose replaces them at each pause. Moonshine Base is a new local model that turns a phrase into text in well under a second, against three or four seconds for Whisper Small. Live words from OpenAI are there too, off by default: they use your OpenAI key and OpenAI bills them by the minute.
  • Design level-up in Extensions, installed by default: twenty-five techniques for making what the agent designs look finished, from real fonts and a design system to motion.
  • An empty folder offers to start a repository. Nothing runs git init for you; it is a button, and it refuses inside an existing repository.

Improved

  • Two modes, Ask and Agent. Plan mode is folded into Agent: the agent publishes its plan with its checks and carries on to implement it in the same task. A task saved in Plan mode opens in Agent.
  • Settings in three groups. App, Agent and System, with every value you changed from its default marked and a way back to the default beside it.
  • Extensions in one list. Skills, MCP servers, plugins and rules share one list, and each item says what it still needs before it works.
  • Compaction and commit-message spend is counted. Both are billed calls with no turn behind them; they are recorded against the task and the day they happened on.
  • A conversation the provider has lost no longer ends the task. When a provider's stored turn has expired, the step resends the full history once and carries on.
  • A rebuild does not take a running window down. Old parts of the interface are kept until nothing can still be using them, and a window caught mid-load is reloaded by the app.
  • One row of controls under every instruction field. Agent or Ask, the model and its effort, the context meter, attach and dictate, then a visible Send button, which reads Queue while the task runs. The New task page and Edit and rerun use the same row.
  • The record reads in the order it happened. Your instruction, then the work, then the result. The result used to jump to the top when a run ended, above the instruction it answered. A finished run with an answer folds its setup work to one line you can open.
  • Allow for this task means the whole task. It used to cover one run, so the next instruction you gave asked again. Other tasks still ask.
  • Instructions sent offline wait in the queue as Queued, offline, where you can edit or remove them before they go.
  • Helper instance branches are cleaned up. A finished helper's branch is deleted once its commits are in another branch, and an unmerged one once its last commit is fourteen days old. Nothing ever removed them before: one repository had collected 133.
  • Slow-starting MCP servers get two minutes to answer, not one. A server launched through npx on a cold cache used to be reported as not responding while it was still downloading.
  • Electron 44. The app runs on Chromium 152 and Node 24.

Removed

  • Teammates. Agent profiles, delegated tasks, the task scheduler, teammate memory and the Teammates view are gone, with their tools and the create-teammate skill. Helper instances inside a task remain.
  • The chat sidebar and side rail. The navigator and the inspector replace them.
  • The Density setting. It only sized controls the redesign no longer draws.

Fixed

  • The window no longer stops responding at launch. Reopening a task whose run had deleted a large folder re-read every file it touched, which took minutes on a cold disk, and the code index saved its database on the same thread as the window. Both now run in the background.
  • A space typed in the instruction field could press Allow. The approval card took focus back every time the page redrew, so the next key you typed answered it.
  • Saving in Files could fail with "Recovery session is stale" when the panel opened while the app was still preparing it.
  • A model that streamed thousands of tool calls at once no longer ends the task. One run repeated the same command 5,862 times in a single reply and never recovered. A reply with more than 64 calls is now cut off before any of them runs, and the agent is told why.
  • A rewind that cannot write one file changes nothing. A file locked by another program, a read-only file or a full disk used to leave the files before it rewound and the record as it was. Every file is put back and the message names the file and why.
  • A file two rewound runs changed is counted once. The dialog and the result both list each file once, by where the rewind leaves it.
  • A rewind no longer writes over a change you made. When a newer run's write is stopped by your edit, older runs leave the file alone too; before, a run that had crashed before saving its checkpoint could restore its copy over your change.
  • Undo could delete files the agent never touched, when a workspace held more files than one scan records. Only what is on disk now decides what the agent created.

Security

  • Applying a patch is approval-gated like any other write, and a tool the agent wrote for itself stays gated even with approvals off.
  • Your file paths and file contents stay out of the log. Paths relative to your project and the file text quoted in failed searches and edits used to be written out whole.
  • colord is updated past GHSA-2wm5-q62r-hmrv.
  • lodash-es is updated past GHSA-r5fr-rjxr-66jc, which reached the app through the diagram renderer.

Known issues

  • Windows and macOS builds are unsigned. Windows SmartScreen warns on first run, and macOS Gatekeeper refuses a double-click — open it from the right-click menu once.
  • Crash reports are not sent from this build. Crashes are recorded on your own machine only.