Changelog

What shipped to Girl and LuaXE

Every deploy that changes Girl or LuaXE is a patch release. A minor release gathers the patches since the last one into a single set of notes. Girl writes the notes from the commits that shipped.

  1. Girl 0.22.0

    Redesigned permission prompts and panel, and a vim-style message box

    The app's approval prompts and Permissions panel are rebuilt: patterns can be created, edited, deleted and overridden inline or with new /permissions subcommands, and the remember step is a single panel. The TUI message box and the app composer gain a vim-style key binding preset with registers, macros and search motions, chat retries transient transport errors, and fleet coordinators default to memory-tree context. Many fixes cover fleet claims, the supervisor, settings gates, providers and the app's serve loop, alongside a large internal cleanup.

    33 changes

    • New permissions The app shows approval prompts in a new menu: a limit notice with its diff, and a proposal card with Review and edit to adjust the proposed pattern before approving.
    • New permissions The Permissions panel has a new table with recent decisions and an inline New pattern / Edit editor (chips, Kind, Access, How long, Delete pattern). Pattern numbers stay stable and /permissions delete <n> removes a pattern.
    • New permissions /permissions override <limit> and the Permissions panel's Override... action let you override a limit.
    • New permissions Remembering a decision in the app is one panel step, answered as remember:<scope>:<what>. Only your own prompt remembers; remember: text written by an agent grants nothing. The permissions docs describe this in section 9.
    • New tui The TUI message box and the app composer gain a vim-style key binding preset, with the same behaviour in both and touch handling in the app.
    • New tui The vim-style preset supports named registers and macros ("a-"z, q, @) in the message box.
    • New tui The vim-style preset accepts search as an operator motion in the message box, such as d/foo or c?bar.
    • New chat Chat retries transient transport errors automatically, and the TUI shows the retry and its completion.
    • New fleet Fleet coordinator sessions default to memory-tree context. Unrecorded memory-tree switches are reported, and the startup prepare step is guarded.
    • Improved app The app resolves key presses through the key binding settings and sends the resulting actions to the server instead of using its own hard-coded hotkey map.
    • Improved webui The web UI's uploads, entry snapshot and client prompts are updated.
    • Improved webui The web UI command interface's styling and mode handling are updated.
    • Improved doctor Doctor counts a closure factory's own statements and stops treating a part's wrapper closure as one huge function, which removes false high function_length findings.
    • Fixed permissions After an always rule is removed, the check for the same rule in another settings layer compares the whole rule, including folder, reads-only flag and rule shape, and reports a rule kept in another layer.
    • Fixed fleet The fleet supervisor's sweep handles a worker's death, with related fixes to the select bridge, event store and approval prompts.
    • Fixed fleet The fleet supervisor's announce logic is corrected.
    • Fixed fleet The fleet claim store and client handling are hardened to check process identity rather than trusting a PID alone, and they respect host holds.
    • Fixed fleet Fixes the fleet store view, the coordinator and the app's upgrade handling, including the store view used for OAuth lending.
    • Fixed fleet A task worker's prompt reaches its lead and the board instead of waiting on a prompt nobody could see.
    • Fixed fleet Messaging an agent id that was never spawned prompts as expected. Before, every agent-NNNN id was treated as owned.
    • Fixed settings A project settings gate keeps your earlier false for the fleet's auto_spawn, auto_fill and split_orchestrator instead of turning them back on. The app gate no longer restores a room_agents_autostart value it never saved.
    • Fixed app The app's serve loop no longer scans the whole settings-ack directory or reads the whole board for the watchdog's pause check. Old ack records are pruned in bounded passes, so server queries stay fast.
    • Fixed providers DeepSeek thinking-mode requests that fail with 400 "reasoning_content must be passed back" are recovered.
    • Fixed agent Tool results from sequentially run tools carry their permission decision again.
    • Fixed agent After a cooldown round restart, the agent keeps its model instead of losing it.
    • Fixed subagents A subagent role's resolved reasoning effort is applied. A misspelt field caused it to be ignored.
    • Fixed skills run_skill calls with sparse arguments get the proper refusal instead of crashing the permission policy.
    • Fixed community Answering a community question with an item that has no choices returns a 400 error instead of raising.
    • Fixed tui Leaving interactive chat takes two Ctrl+C presses, as intended.
    • Fixed docview Docview fingerprint and sidecar handling is hardened, and the docview design notes and related READMEs are updated.
    • Fixed webui Fixes on the web UI's messages page.
    2 internal changes
    • Internal refactor Large refactors across the codebase: oversized functions and modules are split into stages, positional parameters become option tables, in-tree pcall calls are removed, and duplicated helpers get a single owner.
    • Internal tests Test suite work: oversized test files are split, a shared seam helper replaces copied ones, slow tests are made fast or moved to the heavy tier, flaky deadlines are fixed, the pcall budget gate reads the sharded budget, and new suites are added.
    Summarized by Girl · claude-opus-5-5 · 108 commits
  2. Girl 0.21.0

    Permissions v2: new permission engine, pattern editor and agent proposals

    Girl moves to the permissions v2 engine and removes the old one. It adds editable command and path patterns, limit notices with Run once, Add to the plan and Hand off, agent proposals you accept or reject, and proposal cards in the app. Across the span, lending a provider becomes much more reliable, fleets keep retrying through outages, regex search runs on a linear-time engine, peers can come from other accounts, and many fleet, MCP, web UI and agent-activity bugs are fixed.

    70 changes

    • New permissions Permissions v2 replaces the old engine, which is removed. Limits, overrides, grants and defaults run through one pipeline, existing rules are migrated, and auto mode is judged by System One with safety providers. A confident deny is final, and the model is told not to retry or work around it.
    • New permissions You can keep your own permission patterns for commands and paths. The CLI and TUI permission prompts offer pattern choices through a new prompt menu when you approve a call.
    • New permissions Command patterns accept double-quoted words that hold spaces and always match literally; legacy single quotes still parse. Each piece of a spaced argument is checked against the danger list, so npm * no longer lets a quoted -g install through.
    • New permissions A limit's notice offers Apply/Run this once, which runs exactly the call shown and keeps the mode on. Add to the plan puts the change on the session task list under Blocked changes, and Hand off asks the model to delegate it. Only a person can pick these, and notices go only to the user.
    • New permissions A fleet coordinator answering a worker's permission prompt can propose keeping a command pattern for the workspace or always. A proposal grants nothing until you accept it (optionally edited) or reject it with /permissions accept|reject, and an accept is refused if the file changed since.
    • New app The app shows waiting permission proposals as cards above the message box, with a pending count in the session header and Accept, Review and edit… and Reject buttons. A card names the board card it came from and says nothing is allowed until you accept.
    • New permissions Every permission decision is written to the session journal. A resumed session refills Recent decisions from its own entries, never from another session's.
    • New app In the app, Edit as text… shows a command's words as chips. A click cycles a word from exact to * and, for the last word, to …, rewriting the text box the server checks. Words that cannot be split safely get no chips or fewer options.
    • New app For a file, the pattern editor shows path parts as chips over a locked base folder. Each part cycles exact, * and **, or opens forms such as any one name or everything below. A Covers n of m files here line counts matches inside the workspace.
    • New permissions Hand off gives a child agent a one-call override for exactly the blocked change, and a subagent's parent can raise proposals for you. The hand-off file lives in the board's fleet folder outside the repository, and a call's hash covers all its arguments.
    • New subagents Subagent workers get an inbox.
    • New webui In browser mode, the web UI can load shared artifacts and runs integrity checks on them as it loads them.
    • New remote Foreign peers can come from other accounts, so Girl instances owned by different accounts can reach each other. Peer messaging, remote co-owners, server settings and peer configuration are updated to match, and the settings docs describe the new options.
    • New remote Global actions are available alongside cross-account peer support.
    • Improved permissions /permissions list shows one table of limits, overrides, grants, proposals, guards and fast paths, with match counts. Your patterns are numbered with edit <n> as their action, and defaults are folded by source (/permissions list defaults lists each). Allow and deny come only from you.
    • Improved docs docs/configuration.md describes Hand off's one-call child override, parent-agent proposals, the app's proposal cards and the chip editor.
    • Improved tools apply_patch matches hunks the way Codex does, with @@ anchors and whole-line matching.
    • Improved config The default context window is now 272000 tokens.
    • Improved skills A failed skill migration is rolled back by one owner instead of by hand at eight separate places.
    • Improved doctor The doctor's orphan check no longer counts entry points such as tests as orphans; they were 663 of 690 findings and pulled the structure score down. It also understands requires that build module names from parts, which removed 144 false findings.
    • Improved doctor A doctor's visit that left no summary shows its log and how long it ran on its card.
    • Improved docs The docs give the right cmd spelling for an isolated home: on the same line, quoted, with the literal path twice. cmd expands %USERPROFILE% at parse time, and an unquoted value keeps a trailing space, so a run could read your real ~/.girl.
    • Improved providers Chat attachments are handled the same way across all providers and the relay.
    • Improved docs The system README names the providers.share.native_body setting, and the CLI and model resolution docs are updated.
    • Improved fs Filesystem version pinning is handled in one place, and Girl detects when the build has drifted from the pinned version.
    • Improved search Search runs complex regular expressions on a linear-time VM, so matching time grows linearly with the size of the searched text. The VM and the search tools built on it are refined further.
    • Improved regex Lua patterns with overlapping unbounded quantifiers are rejected, which avoids the very slow matching they can cause.
    • Improved fleet Fleets keep track of their state when the fleet host restarts.
    • Improved tools The shell tool's PowerShell module analysis cache is updated.
    • Fixed permissions A workspace approval rule now reaches sessions that are already running. Before, approved.lua was read only when the permission spec was rebuilt, and nothing watched the file.
    • Fixed fleet A fleet worker hit by a temporary failure or capacity wall no longer goes idle once its 60/300/900 s retry ladder runs out. It keeps retrying at the last delay until a turn answers, a message arrives or it is interrupted, and the supervisor announces the hold only once.
    • Fixed app girl app restart --all no longer aborts itself with not safely down because of a one-tick race between the checkpointed and joined states.
    • Fixed fleet A merge confirmation that restarts the app no longer leaves its runner record stuck as running forever, which refused any reconfirm.
    • Fixed fleet Reconfirming an old merge no longer runs that merge's old confirmation setup. That setup lacked the stall watchdog, so it could park forever.
    • Fixed fleet A large merge confirmation no longer freezes silently, with no CPU use, no child processes and no heartbeat, until the board kills it.
    • Fixed fleet Stale manager escalations no longer pile up. Escalations without a modal are deduplicated, and an escalation is resolved when its condition clears.
    • Fixed fleet Task workers on extraction tasks no longer give up within minutes and report blocked after only reading code.
    • Fixed git Git app reads clean up the job's scratch folder when a read raises an error or yields something malformed.
    • Fixed community A 200-card community channel page no longer exceeds the one-frame reply size cap.
    • Fixed skills A skill from a git source that ships .girl-skill.json can now be installed. Before, the clone was cleaned up before it was read.
    • Fixed providers The provider cooldown park store keeps saving when provider-cooldowns.json is unreadable, such as a file full of NUL bytes. Before, it saved nothing.
    • Fixed providers OpenAI-style providers no longer fail with attempt to index field 'network' when a profile's spec has no network field. A send-only network module no longer requests a returned response.
    • Fixed webui When you claim an offered provider, the web UI identifies it by the location of its card, so the claim goes to the provider you picked.
    • Fixed webui In browser mode, the web UI no longer tries to apply or claim offered providers.
    • Fixed webui In browser mode, cards no longer call reader-app routes that do not exist there. The lender's own card says it is managed in girl on their PC, the Lent out list shows as empty instead of an error, and the Claimed toast is corrected.
    • Fixed community Relay downloads and log verification remove capabilities from file tokens with one shared rule set. Before, their two copies of the rules no longer matched.
    • Fixed models Provider specs lent to a worker have their share wire stripped before the handoff.
    • Fixed providers A lent profile with several accounts tries the lender's other logins in turn, so the borrower is served by an account that is not rate limited. A request whose account has a short Retry-After moves to a free account instead of waiting.
    • Fixed providers When the lender's account is rate limited, the borrower gets an HTTP 429 instead of a 502 that wraps it. Its model chain treats this as a rate limit, not as the provider being down.
    • Fixed providers Lending a Codex (ChatGPT OAuth) login no longer fails with 400 System messages are not allowed. The relay converts a lent call into the Codex CLI's request shape and sends the system prompt as instructions.
    • Fixed providers When a lent account fails, the relay moves to the next account only if no output has reached the borrower yet. A second account no longer streams the answer again.
    • Fixed providers When one pull to the borrower's own app fails, Girl requests it again instead of failing the call with a 502. A lent reply that streamed completely is no longer printed twice with an error between the copies.
    • Fixed providers A timed-out call to the local app no longer reports girl app is not running here while the app runs. It now says this machine's girl app did not answer, with the reason.
    • Fixed fs When pinning a filesystem version fails partway, the partial writes are rolled back.
    • Fixed host Agent activity keeps an agent's idle=false state, so an agent running a turn no longer reads as unknown, and the turn running diagnosis fires as intended.
    • Fixed host An agent that has exited no longer shows the CPU usage or HOT marker from its last activity window.
    • Fixed regex The regex engine handles empty character sets and limits how deeply groups can nest.
    • Fixed mcp An idle stdio MCP worker whose server exited or wrote to stdout between requests no longer spins at about 98% of a CPU core per server per chat.
    • Fixed mcp The MCP stdio client no longer starts new workers after it has been closed.
    • Fixed board The board event tail no longer stalls for good when event numbering restarts at 1 while the saved cursor is ahead. Reports, messages and answers keep arriving.
    • Fixed platform A stopped worker thread no longer keeps its whole state in memory. Every thread handle is released, and the thread_stats and mem_log docs no longer describe a draining counter as a leak.
    9 internal changes
    • Internal permissions Script grant, script digest and the shell gate move into the permissions layer, and the approval, proposal and script grant modules are split. The permissions v2 design document and its security review notes are published.
    • Internal harness Large harness, agent, host, update, interpreter, tool-thread, TUI and facade functions and modules are split into smaller parts. The console loops share one implementation, and lazy require cycles are removed.
    • Internal fleet The fleet supervisor, merge-confirm poller, restart recovery, worktree code and state modules are split into smaller units.
    • Internal platform Shared rules have one owner each: the state directory, constant-time compare, the path-glob matcher, the pipe contract, the native-module loader and option tables. Duplicate code is removed, and the fs module is split.
    • Internal providers The provider wires, the key-pool parking rules and the failover and guest wire handling are split and unified.
    • Internal server The community facades, roles migration, serve peers, remote activity log, server request path and git app modules are split into smaller units.
    • Internal webui Oversized web UI part files are split, and the web UI servers, chat server and app server harness are maintained.
    • Internal build Stray UTF-16 text artifacts at the repository root are kept out of commits. Test runs pin native module versions, and build configuration is maintained.
    • Internal tests Giant test suites are split, and flaky or always-failing tests are fixed: the stack-restart race, a lingering thread, the moved permissions report, the theme guard and System One helpers. Subagent force-stop coverage and pcall budget entries are added, and layout gates are restored.
    Includes 0.20.1 – 0.20.14 · 14 patch releases

    0.20.14

    Agent run loop restructured into named phases, plus web UI server upkeep

    2 internal changes
    • Internal agent The agent's run loop and its call preparation, previously very large and deeply nested functions, are split into named phases that are easier to maintain. Agent behaviour is meant to stay the same.
    • Internal webui The web UI servers, the web UI chat server and the app server harness receive maintenance updates. The commits name no specific user-facing change.

    0.20.13

    Cross-account foreign peers, global actions and fleet restart handling

    • New remote Foreign peers can come from other accounts, so Girl instances owned by different accounts can reach each other as peers. Peer messaging, remote co-owners, server settings and remote peer configuration are updated to match, and the settings docs describe the new options.
    • New remote Global actions are available alongside the cross-account peer support.
    • Improved fleet Fleets handle a restart instead of losing track of their state when the fleet host comes back.
    • Improved search The regex engine's VM and the search tooling built on it are updated across a series of changes.
    • Improved tools The shell tool's PowerShell module analysis cache is updated.
    • Improved doctor The doctor's orphan check understands requires that build the module name from parts. Modules loaded this way are no longer reported as orphans; this removed 144 false findings in Girl's own source.
    • Fixed platform A stopped worker thread no longer keeps its whole state in memory. Every thread handle Girl creates is released, so the state is freed on a later collection, and the thread_stats and mem_log docs no longer describe a draining counter as a leak.
    • Fixed mcp The MCP stdio client no longer starts new workers after it has been closed.
    6 internal changes
    • Internal harness Harness and tool modules are split into smaller parts, and deeply nested functions are flattened. Affected: settings, session, skills, design, tools/process and its command safety analyser, renderers, provider review scope, fleet process configuration, quota-park previews, installer staging cleanup and permission script digest rules.
    • Internal fleet The fleet state modules are split into smaller parts: store, roster, coordinators, tasks and fleet owner.
    • Internal platform Shared rules move into the platform layer: absolute-path resolution, the child-environment delete set, module spellings, the worker frame and URL query decoding. Log generations are split into parts, and the last require cycle in the code-intelligence outline parser is removed.
    • Internal server The server request path, the git app read ops and executor, and the automation, remote worktree and sync modules are split into smaller units.
    • Internal tests Large test files are split so the health scanner can analyse them, including app_tests, app_lifecycle and app_supervisor_progress. The foreign peers and shell tool tests are updated.
    • Internal docs A design document for permissions v2 is added. It covers pattern grants, a notice with choices for limits, the prompt UI and a decision log.

    0.20.12

    Board event tail recovers when its event numbering restarts

    • Fixed board The board event tail no longer stalls for good when the event sequence counter is lost and numbering restarts at 1 while the saved cursor is still ahead. Reports, messages and answers keep arriving.
    • Fixed regex The regex engine handles empty character sets and limits how deeply groups can nest in a pattern.
    1 internal change
    • Internal git The git app's write service splits its large mutate and expected-state check functions into smaller pieces, with no change in behaviour.

    0.20.11

    Idle MCP stdio workers no longer spin a CPU core after their server exits

    • Improved regex Lua patterns with overlapping unbounded quantifiers are now rejected, avoiding the very slow matching they can cause.
    • Fixed mcp An idle stdio MCP worker whose server exited, or wrote to stdout between requests, no longer loops at about 98% of a CPU core per server per chat. It now waits quietly until output or a close actually arrives.
    2 internal changes
    • Internal refactor The fleet supervisor hooks are split into one part per supervisor check, the coordinator text is split out of the fleet tool texts, and the voice echo-metrics verdict ladder is rewritten as data instead of one long function.
    • Internal mcp The MCP stdio tooling is updated.

    0.20.10

    Search runs complex regex patterns on a linear-time engine

    • Improved search Search runs complex regular expression patterns on a linear-time VM, so matching time grows linearly with the size of the searched text.
    1 internal change
    • Internal tests Updates the test suite for the platform utilities and the job pool.

    0.20.9

    Permissions v2 design published, with internal module restructuring

    5 internal changes
    • Internal permissions A design document for permissions v2 specifies a rewrite of the permission engine: guards, limits, overrides, grants and defaults run through one traced pipeline. Auto mode judges actions against the current mode's intent and a per-mode maximum tier. This release does not change the engine.
    • Internal update The update harness is split into separate modules along its numbered stages, with no change in behaviour.
    • Internal host The host API route families each get their own reply and failure helpers, which breaks a dependency cycle between five modules. The CLI and activity suite are updated.
    • Internal fleet The fleet's git worktree code is split into four modules: ref guard, worktree provisioning, merge and push plumbing, and scratch holder scans.
    • Internal build The regex platform modules are updated.

    0.20.8

    Agent activity reports running turns correctly and hides ended agents

    • Fixed host Agent activity keeps an agent's idle=false state, so an agent that is running a turn no longer reads as unknown. The "turn running" diagnosis now fires as intended.
    • Fixed host An agent that has exited no longer shows the CPU usage or HOT marker from its last activity window.
    5 internal changes
    • Internal permissions Permission authorization is split from one long routine into named override steps that run in a fixed order.
    • Internal providers The provider key pool uses one set of parking rules for model parking and route parking, replacing five near-duplicate copies.
    • Internal fs The platform filesystem module is split into separate modules for the pager, the ignore matcher, the git tracked-file cache and tree walking. Shell command running moves out of it.
    • Internal build Test runs pin the versions of native modules.
    • Internal tests The pcall budget test suite is updated. Process CPU sampling now reuses the already loaded process module instead of an extra pcall, so it passes the pcall budget check.

    0.20.7

    Lent provider calls survive a timed-out pull instead of failing

    • Improved fs Filesystem version pinning is handled in one place, and Girl detects when the build has drifted from the pinned version.
    • Fixed providers When one pull to the borrower's own app fails, Girl asks for it again instead of failing the call with a 502. A lent reply that streamed completely is no longer printed a second time with an error between the two copies.
    • Fixed providers A timed-out call to the local app no longer reports "girl app is not running here" while the app is running. The message now says what failed: "this machine's girl app did not answer: <why>".
    • Fixed fs When pinning a filesystem version fails partway, the partial writes are rolled back instead of being left behind.
    5 internal changes
    • Internal tests Platform filesystem test suite updated.
    • Internal host Agent thread and activity handling in the host is refactored.
    • Internal webui Server model and its test harness updated in the web UI and servers layers.
    • Internal build Build configuration, native harness module and update module maintenance, with related CLI documentation updates.
    • Internal harness General maintenance of harness, model, provider, design and web UI files, documentation and tests.

    0.20.6

    Chat attachment handling updated across providers and the relay

    • Improved providers Chat attachment handling is updated across the providers and the relay, so attachments added to a chat are handled the same way whichever provider or relay path carries them.
    • Improved providers The system README now names the providers.share.native_body setting, so you can find it alongside the other provider settings.

    0.20.5

    Lending a Codex (ChatGPT OAuth) login to other profiles now works

    • Improved providers While another free account is available to take over, a lent request whose account is rate-limited with a short Retry-After now moves to that account instead of waiting.
    • Improved docs The CLI documentation and the documentation on model resolution are updated.
    • Fixed providers Lending a "Codex (ChatGPT OAuth)" login no longer fails with 400 "System messages are not allowed". The relay now converts a lent call into the Codex CLI's request shape and sends the system prompt as instructions.
    • Fixed providers When a lent account fails, the relay tries the next account only if the failure happened before any output reached the borrower. A second account no longer streams the answer again after it has started.
    1 internal change
    • Internal tests Maintenance of the harness update modules and model resolution, with updated restart and harness tests.

    0.20.4

    Lent providers use a free account and pass rate limits through as 429

    • Fixed providers A lent profile with several accounts now tries the lender's other logins in turn, like a failover chain. The borrower is served by an account that is not rate limited, instead of always reaching the default login and getting its 429.
    • Fixed providers When the lender's account is rate limited, the borrower now gets an HTTP 429 instead of a 502 that wraps the 429 text. Its model chain treats this as a rate limit, not as the provider being down.
    • Fixed webui In browser mode, cards no longer call reader-app routes that do not exist there. The lender's own card says it is managed in girl on their PC, and the Lent out list shows as empty instead of an error. The Claimed toast is also corrected.
    2 internal changes
    • Internal models Failover and guest wire provider handling in the models layer is reworked to support the lending fixes.
    • Internal platform The crypto and hash platform modules now share one native-module loader instead of two copies of the same code.

    0.20.3

    Provider specs lent to workers no longer carry their share wire

    • Fixed models Provider specs lent to a worker have their share wire stripped before the handoff, so the worker no longer receives that part of the spec.

    0.20.2

    Web UI claims offered providers by card and skips apply in browser mode

    • Fixed webui The web UI identifies an offered provider by the location of its card when you claim it, so the claim goes to the provider you picked.
    • Fixed webui In browser mode, the web UI no longer tries to apply or claim offered providers.
    • Fixed community Relay downloads and log verification now remove capabilities from file tokens using one shared rule set. Before, each had its own copy of the rules, and the two copies no longer matched.

    0.20.1

    Web UI loads shared artifacts in browser mode with integrity checks

    • New webui In browser mode, the web UI can load shared artifacts and runs integrity checks on them as part of loading.
    Summarized by Girl · claude-opus-5-5 · 197 commits
  3. Girl 0.20.0

    Chat attachments, subagent follow-ups and a WebRTC direct path to your app

    Community rooms gain chat attachments: members can share settings and artifacts, lend providers, and sign every card, with new pickers in the web UI's + menu. Finished subagents can take follow-ups, subagent_wait no longer blocks the turn, and a subagent's report no longer vanishes. The app.luaxe.dev page reaches your app over a WebRTC data channel or WebTransport streams from any network, and Settings gets a new model catalog, request parameter editors and the Providers panel's look everywhere.

    39 changes

    • New community Community chat messages can carry attachments beyond files: a member can share a setting card (settings, skill, tool and hook bundles, MCP servers), with every setting tiered safe, review or risky, and can lend a provider to the room for others to borrow.
    • New community Artifacts can be shared into a room as attachment cards. The upload, up to 20 MiB, must hash to the card's signed sha256 before anything is stored.
    • New community Every attachment card is signed with the sender's device key. The host refuses a card whose signature does not match when it holds the sender's key chain, and readers verify each card.
    • New community Three channel-scoped permissions control attachments: share settings, share artifacts and lend providers. On existing setups, sharing follows the attach permission and lending is limited to owners and admins. Uploads no longer drop the cards staged with them.
    • New webui The + menu has new lend and artifact pickers. Lending is two steps: a compact, searchable provider list showing API, model count, subscription and a 5-hour usage meter, then the offer under the chosen provider, with model chips and a Back button.
    • New subagents A finished subagent can take a follow-up in its own conversation, either with spawn_subagent(resume='agent-N', task=...) or with send_message. Only this session's own subagents are resumed this way; an unknown id is refused.
    • New webui The web UI's run tray tracks jobs owned by subagents and can stop them. A subagent can also be stopped from its own chat view.
    • New Edit diffs can show several hunks of one edit, up to a limit. Thread selection styling is refined.
    • New remote The app.luaxe.dev page reaches your app from any network over one WebRTC data channel, set up through the tunnel, instead of sending every request through the tunnel (about 350 ms each). The channel is set up again about a second after a failure and renews its grant over itself.
    • New remote Two apps can link to each other over WebTransport, trying a direct connection first, then the LAN, then the relay, and carrying their encrypted Noise link.
    • New settings Settings has editors for model request parameters and gateway presets, and providers take configurable request parameters.
    • New settings Settings › Models is a provider-grouped list beside a detail editor, with roles and sets that use the model, duplicate, remove and undo. A + button opens a picker to add several provider models at once, or one by id.
    • New community Native community server invites can grant roles by id or name, and the invite dialog has a role picker.
    • Improved webui The shared artifact card follows its design: an accent icon tile, a one-line title that opens the side panel, one muted meta line and three icon buttons. It no longer shows a glyph that looked like a checkbox or a wrapping verified pill.
    • Improved subagents subagent_wait no longer blocks: it ends the turn and parks on the jobs, so a steer lands at once. The agent wakes on the job's own report, or on one automatic wait notification if the timer runs out first.
    • Improved subagents A subagent is automatically continued only when its reply is actually unfinished. A finished report is no longer re-requested because of a System One vote or an open todo list.
    • Improved tui In the TUI, assistant texts the model stopped on are kept as their own unfolded rows.
    • Improved remote Direct WebTransport connections send each request on its own stream, without the 16 KiB cap, and are preferred where they are the better path. A replaced WebRTC channel finishes its in-flight requests, and one refused request no longer fails the whole channel.
    • Improved settings A model's API type and protocol override is one select with the provider form's pairs, headed by a From the provider option that names the profile's pair. It replaces two free-text boxes.
    • Improved settings Every Settings section uses the Providers panel's denser card look, with touch-sized inputs kept on phones.
    • Improved settings In Quick setup, the choice row fills the width of its card.
    • Improved webui Pictures on community servers display better: the compact channel banner follows the icons-only layout, text over a picture is white, and the picture canvas falls back to the theme's accent colour. The community roles UI is updated too.
    • Improved fleet The doctor's cards filed into Ready are labelled agent-ready, so the fleet starts them on its own once their blockers are done. Cards filed into backlog still wait for a person.
    • Improved docs The luaxe.dev docs fold finished tool calls into one-line summaries by default.
    • Improved docs docs/settings.md gives the correct default of 32768 for agent_host.memory_hard_mb.
    • Fixed webui The Share an artifact sheet no longer aborts with a timeout on machines with many projects, because finding a session no longer checks every project store. The lend sheet shows model names.
    • Fixed webui Picking something in a + sheet (settings, lend, artifact) no longer jumps the sheet back to the top. Focus and the text caret stay on the control you used.
    • Fixed subagents A subagent's report no longer vanishes when an automatic continuation follows it and the model answers that nothing was cut off. The run's answer keeps the earlier text and drops a piece only when a later reply restates it.
    • Fixed tui In the TUI, answered subagent permission requests and questions fold away with their run.
    • Fixed providers Claude logins honour their fixed sign-in end. Girl stops refreshing a token past that point instead of retrying it, warns in the inbox before the sign-in ends, and locks token refreshes more safely.
    • Fixed fleet A running doctor no longer appears in a server's Sessions column or the trajectory view's instance pick.
    • Fixed fleet Doctor visits no longer fail with unknown agent kind: doctor when the Girl host runs older code than the fleet snapshot.
    • Fixed providers Failover moves to the next entry instead of stopping when InferHub answers 400 because a model requires Global regions.
    • Fixed tools Shell-free commands accept ^ and ~ in their arguments, so git revision suffixes are allowed.
    • Fixed remote Query strings are decoded the same way everywhere. Remote worker API requests no longer decode + differently from the app.
    • Fixed The workbench no longer reports a raw app table as an entry's error when a tab's app has no main buffer yet.
    • Fixed MCP HTTP requests and the web client send Girl's real version in their User-Agent instead of Girl/0.16 or Girl/0.7.12. Provider headers and MCP client and server info use the same version.
    2 internal changes
    • Internal tests Test suites are fixed, split and share their fakes, covering chat attachment lending, fleet questions and the merge queue, role failover, voice and the WebTransport link. They no longer read the user's real stores or depend on where the checkout sits.
    • Internal refactor Large modules and long functions are split across config, the fleet supervisor and spawn, the TUI app, chat controllers, jobs, artifacts, compaction, stats, the community server, code intelligence tools and host entry points. A require cycle is broken.
    Summarized by Girl · claude-opus-5-5 · 127 commits
  4. Girl 0.19.0

    Delegated machine access, a board doctor, keymaps and settings sync

    This release adds delegated access, so co-owners and delegates can work with another machine's sessions and fleet. It also adds a board doctor fleet role, configurable keymaps, model onboarding, settings sync, a Files view and a much richer Git pane, and fleet state now survives restarts reliably.

    89 changes

    • New remote Delegated access: a co-owner or delegate can open the running sessions of another machine and use a co-owned machine's fleet the way its owner does. A member can hold full access on one server, and browser-only luaxe.dev accounts forward to the host.
    • New remote Messages a co-owner or delegate types, including mid-turn steers, appear as '<name> · via <owner>'. Their answers to fleet questions reach the board under their own name instead of being marked as written by the user.
    • New settings Settings > My account lists this machine's co-owners, shows their activity (whether their machine connected and whether their app used this one) and offers a Revoke button. Co-owners must be members, and revoking ends their parked requests.
    • New roles Owner-delegated permissions can come from an owner-controlled role, and a work channel's deny never revokes a grant that comes from such a role.
    • New servers The roles editor is redesigned, with a Roles page and a Channel permissions page in Server settings and a Check & fix access action. A non-owner's impact preview covers only members it may manage, and existing roles migrate silently with member groups hoisted.
    • New servers Server settings open as one window with Overview and Members beside Roles and Channel permissions, also from the server rail's context menu. Re-rendering the window no longer scrolls it back to the top.
    • New webui Previews in surfaces and artifacts get zoom controls, and a setting chooses the preview zoom.
    • New fleet The board doctor is a new fleet role that visits a board on a schedule or every N commits. It checks the board with its own engine and external tools (SARIF), keeps a health chart and doctor files, and ends each visit with a Doctor's Visit card. Run now starts a visit from the app.
    • New webui Live tool and app panels can be pinned in the artifact tray.
    • New chat Sessions can be forked, and btw side questions run in a fork that reuses the session's prompt cache read-only.
    • New providers Subscription logins, including a ChatGPT account, can be signed in and managed from Settings > Providers and from the command line.
    • New providers A provider login that lives on another of your machines can be used from this one.
    • New app The Ctrl+K action 'Restart the fleet' now works in the app.
    • New app The server switcher's Ctrl+K palette offers catalog-driven global actions, including actions that take values, multi-step actions, machine routes and feature-gated entries.
    • New tui Keys can be rebound in the TUI and the app with live updates, sequences, presets, function keys and terminal key recording. Rebinding works through interactive keyboard editors, a shortcuts modal, standalone keyboard settings or the girl keymap command.
    • New tools Reading a file supports tail ranges.
    • New fleet Model rules can apply to a whole board, including catch-all rules.
    • New onboarding Model onboarding: Girl detects your models and logins and proposes a model setup in a TUI step, the app, the VS Code extension and girl setup models. You can accept or decline the proposal, or turn it off with the model_onboarding setting.
    • New settings Settings sync: account settings, including pinned tools, sync across your devices as signed data, and command-line controls manage the shared settings.
    • New webui Server menu items have pin toggles.
    • New git The app's Git pane has a Code tab with a repository header for browsing and reading files, and the app opens it with the route's selection. Browse errors no longer expose Git details.
    • New git Git History groups commits by day and gives each commit its own page. Branches panels fold, and the branch in use stays open.
    • New git Suggest writes a commit message line from the staged diff, running one job at a time.
    • New git Ask an agent about a file, a commit or a conflict from the Git view; requests are never dropped silently.
    • New git The Git view shows live marks on files agents are editing, based on their edit records, and the marks clear when their time window ends.
    • New git Diffs and commits work hunk by hunk on one unified diff model: a hunk can be staged with a one-click Stage mark, and quick previews show what changes.
    • New git Git automation makes its automatic commits even when HEAD has moved.
    • New app Each server has a permission-gated Files view that names the agent writing a file and keeps each agent edit's before and after in the file's History. History loads without blocking the server, and binary files are served directly.
    • New vscode The VS Code extension replaces its Sessions tree with an app-style webview sidebar.
    • New tools Anchored edits: read_file shows line anchors, and the edit_lines tool edits by those anchors. The agent.anchors.enabled setting controls the feature and is on by default, as the settings docs now say; edit_file stays available beside it.
    • New surfaces The surface tool lets the model read and drive panels and build HTML surfaces on the fly as app artifacts that may call allowlisted girl tools. It ships with an htop-style reference tool and a user guide in docs/surfaces.md.
    • Improved dms Direct messages keep active conversations apart from the history picker, filter sessions by activity and server ownership, enforce server ownership on the server side, and gain artifact routes.
    • Improved fleet The fleet settings page is redesigned and shows validation problems more clearly.
    • Improved sessions Session pickers and the session APIs filter the whole session list by a query, and session filtering takes fleets into account.
    • Improved webui The artifact tray is redesigned, and transcripts list artifacts as tray rows instead of standalone cards.
    • Improved permissions System One auto-approval reads the scripts a command runs, inside read_file's scope, and refuses drive-relative, device and stream paths. It then makes a second, staged decision with that evidence, and its rubric approves what can run without you.
    • Improved permissions System One auto-approval keeps truthful records and shows when it falls back to asking you. Permission prompts can optionally expire.
    • Improved runtime Girl does all its file I/O through LuaXE's fs 2.x and runs every child process through LuaXE's process module on osal 2.0.0. Its private win32 module is retired, and on Windows it holds files with share-mode locks.
    • Improved runtime Girl runs on an lxe that keeps Lua's io and os libraries, and removes them from every Lua state it builds for its own work.
    • Improved tools Lua that agents run reaches raw process functions only through a sandbox.
    • Improved providers An account that lost its subscription (HTTP 403) is parked and skipped indefinitely, with a single clear notice.
    • Improved host Restart records keep the wedge diagnostics that led to the restart.
    • Improved agent Background task IDs and task records persist across session restarts, and persistent IDs no longer collide.
    • Improved webui Long activity loads in pages: open transcript groups and activity pages have Show more, and stack snapshots and expansions are paginated.
    • Improved agent Interrupted subagents and resumable agent turns continue after a restart, and stop reasons are passed on. Bare peer messages are kept, and chat drafts and the peer display recover better after a restart.
    • Improved tools ast_search trims long result pages without re-encoding the whole page after every removed match, so large searches are much faster.
    • Improved vscode The VS Code session tab renders with the app's own markup and stylesheet, so it looks like the app.
    • Improved vscode Installing the VS Code extension takes fewer steps and works with Linux VS Code installs.
    • Improved fleet The task-plan check asks a task that touches refusals, cleanup, ownership or processes to name a verification of its failure path.
    • Improved fleet Worker and reviewer instructions include a short checklist of the problem classes reviews keep finding.
    • Improved app The app's Context drawer names the mode ('compact' or 'tree') and explains what happens at the threshold.
    • Improved fleet Fleet work survives a host and app restart exactly once. Paused boards stay frozen, and spend, budget limits and the paused setting hold. Queued spawns, in-flight permission prompts and the merge queue carry over, and coordinator and managers are re-adopted together without double starts.
    • Improved webui Queued messages show their payloads, and queued file messages appear in the held-steers dock.
    • Fixed security Saving persona settings now refuses cross-origin requests, like every other route that changes state.
    • Fixed chat Tool cards in a restored forked session work again instead of staying inert.
    • Fixed providers Girl restricts when it refreshes OAuth logins.
    • Fixed runtime A native crash (access violation) when a worker thread's Lua state closed during long runs is fixed.
    • Fixed tools A refused staged write no longer leaves a stray .new file behind.
    • Fixed build Installing with build.lua works across volumes again.
    • Fixed providers When a provider refuses a request with an input-filter error, such as DeepSeek's DataInspectionFailed, a worker's turn moves on to the next provider in the chain instead of failing.
    • Fixed app URL-encoded query parameter names are decoded, so scoped chat cursors work.
    • Fixed host The shutdown report 'N process(es) survived' counts processes that actually survived, not kill attempts.
    • Fixed fleet Fleet exit records are now accurate. A planned app relaunch no longer reads as an orchestrator that ended without recording an exit, a stop-ladder interrupt is recorded, a tick fault no longer shows as exit code 0, and planned restarts keep their reason.
    • Fixed host One worker's runaway memory no longer restarts the shared host again and again. Memory restarts are attributed to the thread that caused them and kept in a history, the culprit is not resumed into the same loop, and session-memory input is bounded.
    • Fixed tui A rebound interrupt key stops the subagent you are viewing instead of skipping it and interrupting the main turn behind it, in the TUI and the workbench.
    • Fixed fleet Each agent launch gets its own log generation under a short hashed ASCII folder, so deep or non-ASCII log paths work. A held log rolls over without losing its writer's output, and a permanently dead worker is no longer resumed.
    • Fixed fleet fleet_spawn no longer crashes on its reply after a successful spawn that produced a warning.
    • Fixed fleet Merge confirmation runs outside your home folder with its own home, so home-guarded tests neither fail spuriously nor pass vacuously, and sandbox cleanup works.
    • Fixed fleet Restart reasons in the fleet app stay on one line even when a reason contains a lone newline.
    • Fixed fleet Asking for /new while the orchestrator is already running no longer crashes the watchdog.
    • Fixed remote A direct remote connection no longer adopts a late, better-ranked answer whose session was already closed.
    • Fixed security A fleet worker's file writes through PowerShell or cmd/sh redirects now obey the rule against writing outside its checkout.
    • Fixed vscode The VS Code extension accepts VS Code's multi-source cspSource and shows the search picker.
    • Fixed vscode Tree menu commands in the VS Code extension act on the row they were invoked on, and the tree refreshes when its data changes.
    • Fixed automation A claimed schedule or webhook invocation is now delivered exactly once, even after an app restart. It used to end as uncertain and never be redelivered.
    • Fixed host During a host drain, a chat waiting on a permission prompt is no longer declared wedged, which forced a stack restart and left an orphaned successor host.
    • Fixed agent /reset and changing a subagents.* setting no longer freeze the session until every background subagent ends.
    • Fixed agent Graceful subagent shutdown no longer waits forever for a running job; after a deadline it forces the stop and reports it.
    • Fixed agent A session at 100% context now compacts automatically.
    • Fixed app The board view's '...' menu spacing and underlined Board title are fixed.
    • Fixed app The app's 'Needs you' block has proper spacing.
    • Fixed tui The TUI no longer freezes for minutes during very large edit_file or write_file calls.
    • Fixed fleet The fleet uses the newest live manager when several are recorded, and lost held steer messages are surfaced instead of vanishing.
    • Fixed webui Fleet worker rows in the web UI follow every fleet change, not just the first of a burst.
    • Fixed webui On touch devices, scripted focus no longer raises the on-screen keyboard, and open dialogs stay open.
    4 internal changes
    • Internal tests Tests: heavy tests are rewritten to use fakes, oversized suites are split by topic, red and flaky tests are fixed, and end-to-end delegated-access tests are added.
    • Internal refactor Code structure: long functions are split, positional parameters become option tables, Windows command-line quoting has a single owner, duplicated helpers are merged, and pcall(require) of in-tree modules is removed.
    • Internal build Build and repository gates: build.lua stages only released module versions and spawns through osal. Gates check file and shell API use and pcall budgets, including at fleet merge. Generated log files are ignored, and test-budget and review-churn report scripts are added.
    • Internal docs Design documents for the Continuum plan and the fs migration are added or updated.