What's shipping.

Every fix here came from a bug report, and three of them shared a habit: they failed quietly. Model fallback didn't fire, embeddings never reached your provider, and syntax colours ignored your theme — none of it announced itself. This release fixes all four, and makes the remaining failure paths say what went wrong.

• Model fallback now fires on a rate limit, however the provider words it. Failures were classified by reading the error *message*, and the HTTP status never made it into that text. So a textbook 429 whose body said something like *"Prepaid credit balance is exhausted"* — naming no status and no rate limit — was treated as permanent, and the turn died instead of swapping to your fallback model. The status now decides: 408, 429 and any 5xx always retry and fail over. Auth rejections still never burn the retry budget. The same rule now covers the terminal, the desktop app and subagents, which each had their own copy of the old one.
• Memory embeddings actually use your provider now. Setting memory.embeddingModel did nothing: the model id was handed to the AI SDK as a plain string, and a bare string always resolves through the Vercel AI Gateway — so every embedding call went there, wanted a gateway key you don't have, failed, and fell back to the offline embedder without a word. Embeddings are now built from your own provider and your own key. Local embedders (Ollama, LM Studio) work too, with no key at all. If one still can't be wired, /memory → Settings tells you exactly why instead of just reading offline.
• Reasoning models work on strict backends. We sent reasoning_effort and reasoning: { effort } in the same request, on the theory that an API ignores keys it doesn't recognise. Strict ones don't — they reject the whole request ("pass either, not both"), making those providers unusable. Empryo now sends the single flat OpenAI field. Custom providers that genuinely need the nested shape can ask for it with reasoning.effortStyle.
• `/theme` finally reaches your code. Syntax highlighting in code blocks, diffs and tool results used a fixed dark palette that was built once and never rebuilt, so changing themes did nothing to it — and on a light theme, comments and ordinary text were close to invisible. Colours are now drawn from the active theme and follow it when you switch.

• `/grok login`, `status`, `logout` and `switch` exist now. The commands were missing entirely, even though the model picker told you to run /grok login — and there was no way to sign out of Grok on any surface.
• The desktop app can find the Grok CLI. It installs to ~/.grok/bin, which only reaches your PATH through your shell profile — so an app launched from the Dock reported "grok CLI not found" and greyed out sign-in even when it was installed.

• The reported problems came with source-level diagnoses. Thanks to the people who wrote them up that carefully.

Three fixes in this release reach every surface — the terminal, headless runs and the desktop app all share the same tool belt, and all three had a way of quietly doing the wrong thing. Stop could leave a runaway process alive, a diff could report "no changes" when there were changes, and resuming a session could crash the next turn. On top of that, the desktop app gets its largest upgrade yet.

• Stop now kills the whole process tree. Shell commands were started without their own process group, so stopping a turn only killed the shell wrapper — anything it had spawned kept running. A hung grandchild could survive indefinitely and Stop appeared to do nothing. Commands now run detached and are reaped as a group (Windows kills the tree via taskkill /T).
• `git diff` no longer hides real changes. A dedup cache suppressed any diff identical to the previous one, so asking twice reported "No changes since last diff" even when the working tree was clearly dirty. The cache is gone — a diff now always shows what's actually there.
• Resuming a session no longer crashes the next turn. If a session was saved while a tool call was still in flight — or you stopped mid-turn — the restored history contained a tool call with no result, and the next request failed outright. Those gaps are now repaired on load.

• Kill one tool without ending the turn. A single running tool can be stopped by itself now; the agent keeps going with everything else.
• A real desktop app. The chat is virtualized and stays anchored while it streams, with syntax-highlighted markdown and a shared diff renderer used by both the transcript and the inspector. There's a live file tree that follows changes on disk, tabs that show cost and edits at a glance, a model picker that opens on first launch if no model is set, subagent detail views, and a Stop button that is a genuine hard cancel — the turn, its subagents and any background agents, all at once.

• Goal-loop runs report the phase they're actually in (no more bars stuck on "planning"), and the reviewer's tokens and cost are folded into the tab total.
• Every macOS and Linux build is still executed before it ships — empryo doctor must load the native runtime and parse real code inside a Linux container and, for Intel macOS, under Rosetta.

If you used the TUI and then installed the desktop app, the TUI could stop launching entirely — dying with opentui is not supported on the current platform, even though nothing about your platform had changed. This release fixes that, adds a one-command way to check your install, and makes every Linux and macOS build prove it actually runs before it ships.

• The TUI no longer breaks after you use the desktop app. Both apps share ~/.empryo, and the desktop's startup refresh was deleting native libraries it doesn't ship but the TUI depends on. The desktop is now fully self-contained — it reads its runtime from inside its own app bundle and never writes to the shared directory. Each surface now owns only the files it installs.
• Installs repair themselves. The installer keeps a pristine copy of the native runtime, so a TUI whose libraries were already wiped restores them on the next launch instead of staying broken. This also protects you if you're still running an older desktop build.
• A missing runtime finally says so. Instead of the misleading "not supported on the current platform", you get the exact file that's missing and how to fix it — and the crash report keeps the full message rather than a bare Error.

• `empryo doctor` — checks that the native runtime loads and that tree-sitter parses, then prints OK or the precise failure. Run it any time an install misbehaves; it's also what our release now runs against every build.

• Every macOS and Linux build is now executed before release — Linux inside a container, Intel macOS under Rosetta — and must load its native library and parse real code, not merely print a version number. A stale or mismatched native library can no longer reach a download link.

The desktop app now surfaces code-intelligence the way the TUI does, the genome understands more languages, and empryo.com is out of coming-soon — anyone can download.

• Code-intelligence surfaces live. A late-ready genome rebuilds one agent mid-session instead of degrading the whole session; toggling genome, instructions, or skills rebuilds running lanes; and project-scoped cache / token-budget settings now apply on every host.
• `/genome` and `/context` are in the command palette.

• Wider language coverage — TSX/JSX, PHP, and C++ headers/includes parse cleanly, with sharper TSX signatures and known gaps closed.

• empryo.com is public. The coming-soon gate is gone — downloads for macOS, Windows, and Linux are open to everyone, and there's a new /benchmarks page with a console-verified head-to-head.

3.4.2 adds a small anonymous usage beacon so we can see which platforms, surfaces, and models to prioritise — and gives the desktop terminal real shell profiles. The telemetry is privacy-first and easy to turn off.

• Anonymous usage telemetry. On session start Empryo sends one tiny beacon — version, OS, surface (TUI / headless / hearth / desktop), install method, provider + public model name, agent mode, terminal, runtime, theme, and a random install id used only to count distinct installs. Never prompts, file paths, code, keys, IPs, or anything that could identify you. Turn it off any time: set "telemetry": false in your config, or DO_NOT_TRACK=1 / EMPRYO_TELEMETRY=0 in the environment. A one-time notice explains this on first run.
• Desktop terminal shell profiles. The embedded terminal now supports VS Code-style shell profiles — pick your shell and args per platform instead of being stuck with the default login shell.

• The desktop terminal failed to spawn in packaged builds — the bundled app now resolves the shell correctly, so the terminal opens in the shipped DMG / installer as it does in dev.

A quick follow-up to 3.4.0 with a reworked task router, a live view into what the agent's doing, and a first-boot freeze fixed at the root.

• Task router redesign. Grouped lanes, icons, effective-model hints, and segmented concurrency controls; targets a single tab's session override when more than one tab is open; changing the topbar model now keeps the router's default slot in sync, and the model dropdown scrolls correctly inside the drawer.
• See what the agent's doing, live. A tasks panel above the composer streams the agent's task list as it updates; the goal reviewer's report text now reaches the desktop instead of being dropped; GoalBar gets a toggle for the reviewer's live steps and past verdicts.
• Maze choreography. Agent hops read as a fast swim instead of a teleport, dispatch and background workers hatch from and return to the organism instead of orbiting as static dots, the main agent perches while a swarm or the reviewer works nearby, and the camera eases in during review.

• A first-boot freeze. Migrating settings into place could hang the TUI on a fresh install when the filesystem couldn't clone files in place — regenerable data now skips cleanly instead of blocking, runtime files like a stale pid or lock never migrate, and a corrupt memory database is quarantined and recreated instead of bricking startup.
• The boot sequence stopped teleporting. Brand, picker, and version text now hand off on one shared clock instead of racing separate entrance animations; the workspace no longer replays its entrance after indexing; the logo no longer flashes when the halo settles.
• The genome popup showing 0 files after the map format overhaul — the parser now follows the directory-folded layout and groups files under their directory with a blast-radius heat bar.
• A loading state instead of a blank flash on the maze, browser, setup wizard, and full genome view while they lazily mount.

A big minor: a resident file-search engine now powers the app end to end, your Claude Code and Codex history can move in with you, and the machinery behind long sessions — compaction, memory, the code graph — got a serious upgrade.

• @-mentions are instant and get smarter as you use them. The picker (TUI and desktop) runs on a resident native index: results are frecency-ranked, every pick teaches it, and a bare @ now surfaces your hot files — the ones you've been touching — instead of an alphabetical wall.
• The agent's search tools ride the same engine. Warm greps for "does X exist" answer in well under a millisecond, glob matches skip the process spawn, and everything still falls back to ripgrep/fd when it must — complex regexes, scoped paths, or the first seconds while the index warms.
• It ships in every install. macOS, Linux, and Windows binaries (both architectures) carry the engine and set it up on first launch — nothing to install. On by default; /fff off (TUI) or Settings → General (desktop) turns it off per project or globally.

• Import from Claude Code and Codex. The desktop wizard gained an Import step (also /import) that scans ~/.claude and ~/.codex, shows what it found, and migrates transcripts into Empryo's session store — each session imported individually with live status, so one odd file never sinks the batch.

• Compaction keeps more of what matters. Summaries are genome-aware (files the map already covers collapse to one line), subagent work survives into the parent's working state, aged edit results fold down to their status line, and truncated lists say so — the model knows when it's seeing a tail.
• Compaction no longer torches your prompt cache. Prior summaries are carried byte-identically and the genome snapshot is preserved when the head survives, so compacting mid-session stops guaranteeing a full-price re-read.
• Memory learns from being ignored. Recalled-but-never-used memories decay and eventually archive themselves; the ones you act on rise. Near-duplicate writes auto-supersede the older note instead of piling up.
• The code map leans toward your question. Identifiers in your prompt pull their defining files up the map, LSP call-hierarchy now corrects the call graph for the hottest symbols, and standalone-LSP enrichment runs itself after every scan — no more "LSP off" until you poked settings.

• A proper hello and goodbye. A brand splash plays on launch (click to skip, respects reduced motion), the workspace selector is a redesigned two-column instrument with a manageable recent list, and quitting masks the teardown instead of flashing it.
• Live turn timing where you're looking. The active tab shows a ticking timer from the instant you hit send; durations across the app read as humane 5m 12s instead of 312.0s.
• Wizard polish. Model search matches across separators, the mode step breathes, and the first Keys panel opens fast — the keychain probes warm in the background during the splash.

• Nested `app/` directories were invisible. An unanchored .gitignore pattern hid every nested app/ dir from git and the code graph.
• fff grep matches ripgrep line-for-line. Multiple hits on one line no longer produce duplicate rows.
• Docked maze clears the right-side panels, and the titlebar divider sits where it should.

A quick follow-up to 3.3.6 with the small fixes that make the desktop app feel right — the version you're actually running, control over your recent list, and a quit that doesn't flash.

• The "can't click anything" freeze. Confirming a delete (file tree, storage) could leave the whole app unclickable — the modal's focus-return target had just been deleted, wedging an invisible pointer lock. A global safety net now releases it the moment no modal is actually open, across every dialog, drawer, and menu.
• Sending while indexing works. Sending a message during the initial codebase scan errored with "Agent not initialized"; now your message shows immediately with a live status and sends itself the moment indexing finishes.
• Composer hints stop colliding. Squeeze the center column and the keyboard hints now shed their labels, then hide entirely — instead of being clipped under the buttons.
• Tab chips drop the redundant model label when a tab uses the workspace default model.
• About shows the version you're actually running. It reported Electron's version in development builds; it now bakes in the real Empryo version at build time and shows it as a badge next to the title.
• Manage your recent workspaces. The picker now has a per-item remove (hover a row) and a Clear-all — no more permanent list of folders you opened once.
• No flash when you quit. On Linux especially, closing the window briefly flashed the app content before it vanished; the window now hides instantly, so the shutdown animation is the last thing you see.

• The file tree keeps up. When the agent creates a file it now appears in the sidebar automatically, and the tree header gains three buttons — New file, New folder, and a manual Refresh — right beside the hide control.

Syntax highlighting grew from a handful of languages to the entire grammar registry — lazily, so the app doesn't get heavier — and the Errors panel stopped shouting stack dumps.

• 332 languages highlight now. Chat code blocks and the editor share one highlighter: core languages preload, everything else (Astro, Svelte, Vue, Zig, Prisma, GraphQL, Haskell, Nix, …) loads the first time it appears — nothing to install, works offline. The editor gains real TextMate grammars for languages it never had, themed to match the app.
• Languages panel. /languages (or More tools → Languages): every language with live status — core, loaded this session, on-demand, or off — per-language toggles that persist, and a hand-off to the Language-servers panel for completions and diagnostics.
• `/about`, with the version, lineage, support links — and the titlebar wordmark opens it on click.

• The random TUI freeze. The terminal renderer could lock up mid-session — opening a picker, moving a cursor, sometimes for no visible reason — with the process still alive underneath. The rendering engine is upgraded to a release that guards against exactly this (destroyed-renderable lifecycle loops, FFI pointer lifetimes, render-tree corruption). If you ever see a freeze again, please report it — we're watching this one closely.
• The Errors panel reads like a log you'd want. One failure used to land three times wrapped in minified stack dumps; entries now dedupe, titles are readable, embedded JSON pretty-prints on expand, and a copy-all button sits beside clear. Raw text is preserved — nothing is paraphrased away.
• Grok (subscription CLI). Failures surface the CLI's own message instead of a source-code dump, and the model list now comes from grok models live — so ids that vanished from your plan (looking at you, grok-4.3) stop being offered.
• File preview crash on the second open ("Theme forge not found") — the editor and the highlighter now agree on theme names, and highlighting failures degrade gracefully instead of reaching the error screen.
• Linux: windows associate with their launcher entry properly (taskbar icon, pinning) via WM_CLASS alignment.
• Genome view panels stopped blending into the modal backdrop; the Settings button tooltip says Settings.

The desktop app gains a real self-updater, the update feed that silently froze is fixed for good, and the macOS first-launch fix is now impossible to miss.

• Self-updating desktop app. When a new version ships, Empryo tells you — a dialog on launch (once per version, Skip respected), /update on demand, a light 4-hourly background check, and an OS notification if the window is in the background. On Windows and Linux (AppImage) one click downloads, verifies, installs silently, and restarts. On macOS (unsigned builds can't self-install) it downloads and opens the verified DMG — and because the download never touches a browser, there's no quarantine flag and no "damaged app" dance on updates.
• Trust before bits. Every update is checked against the release's RSA-4096-signed checksum manifest with a key pinned inside the app — the same chain the install scripts use. A tampered or spoofed feed can't get a single unverified byte executed.
• Support Empryo. The About dialog now says the quiet part: the app ships unsigned because certificates are a recurring cost. If Empryo helps you, GitHub Sponsors and PayPal links live there — appreciated, never expected.

• A missing API key can no longer brick the app. If your configured model's key isn't set (or no model is configured at all), the workspace now boots normally — genome, files, and the Keys panel all work, the Errors panel explains what's missing, and chat shows the same actionable message per send until you add a key or switch models. Previously this failed the whole bridge at the workspace picker.
• Linux gets its icon back. Installs shipped the icon only into an unregistered 1024px slot, so Mint/Cinnamon menus showed nothing — a full 16→1024 size set now lands in the right places, and the window/taskbar icon ships as a real resource instead of a path that only existed in dev.
• The update check told everyone they were current. The release feed gated on a changelog file nothing was updating, so it froze at 3.0.1 and every newer install compared against it and answered "up to date". The feed now includes every release no matter which pipeline wrote it — and empryo.com/changelog shows the full history again.
• Slash commands the composer forgot. Commands declared in the shared manifest (like /update and /usage) ran from the ⌘K palette but were invisible to the chat composer. The composer now reads the same manifest and runs them through the same bindings.
• macOS install hint you can actually see. The xattr -cr first-launch fix is now a bold amber callout with one-click copy, sitting directly under the download buttons — on the download page, the wizard, and the docs.
• Docs accordions were rendering empty. A markdown-renderer bug dropped content nested inside tabs and accordions — the "Other install methods" section on the installation page was blank on the live site. Fixed.
• Memory tab's scope controls are labeled, readable fields now; select dropdowns app-wide slimmed down with a consistent chevron; wizard download labels no longer vanish in light theme.

The biggest desktop UX pass since launch — the file tree became a file manager, the genome became a browsable interface, the titlebar got out of its own way, and transparency stopped turning menus into ghosts. Plus two real intelligence bugs fixed under the hood.

• File manager in the tree. Right-click (or keyboard) to create, rename, duplicate, copy/cut/paste, and delete files and folders — with drag-and-drop moves, inline rename, and a confirm dialog for deletes. The tree also stopped hiding things: dotfiles (.github, .env…) show, and deep folders load on expand instead of being silently truncated.
• Draggable panels. The sidebar, context pane, and inspector all resize by dragging, with sane min/max widths, double-click to reset, and the layout persists across restarts. Both side panels collapse and reopen from the titlebar.
• A genome you can actually read. The genome view now parses our own structure into a real interface — a stats bar, dependency pills, and a searchable grid of file cards showing blast-radius, exported signatures, and clickable :line links — with Structured / Markdown / Raw modes. Open it full-screen from the context pane.
• Sessions, reorganized. The sessions menu leads with search (focused on open) and a New-session button that names and starts a fresh conversation; saving is a secondary action.
• A calmer titlebar. Twelve occasional tools fold into one More tools menu, narrow windows collapse the rest into it, provider rows show live readiness dots with a Refresh button, and Zen mode has a one-click toggle.

• Transparency behaves on every theme. With transparency on, menus, pills, tabs, dialogs, and toasts now use a fixed-opacity frosted glass (blurred, but readable) instead of going see-through at low window opacity — and light themes no longer turn murky. Opaque mode is unchanged.
• Language servers stop dying. A second Empryo process (a TUI beside the desktop, a relaunch) was killing the first instance's language servers, which then showed as stuck "starting…" forever. The reaper now only touches genuinely orphaned servers, and dead servers are reported honestly.
• The genome stopped lying about itself. A fully enriched genome could display "semantic: off" if a background task hiccuped — the status now comes from the database, and the mislabeled lsp: line (actually symbol enrichment) reads enriched:.
• Creating a new file in a workspace behind a symlink (macOS /tmp, /var) no longer fails with "path escapes workspace".
• Scrollbar no longer overlaps toggles in drawer lists; the model picker's right-side reopen button no longer hugs the window edge.

One targeted fix, big visible difference: on desktop, gateway-style providers never showed their real catalogs.

• Desktop model picker: live catalogs for grouped providers. LLM Gateway, OpenRouter, Copilot, GitHub Models, opencode-zen, the local proxy, and Vercel AI Gateway all listed only a short hardcoded fallback set on desktop — regardless of your key or login. The picker's probe asked these providers the wrong question (their flat model call intentionally returns nothing; the grouped catalog is the real one). It now fetches the grouped catalog: LLM Gateway shows its full ~232 models, OpenRouter ~347, and DevPass logins see everything their plan allows. The TUI was never affected.

The root cause of "the TUI keeps crashing" on Linux, Windows, and Intel Macs: builds since the OpenTUI 0.4.2 upgrade shipped a two-versions-old native render library next to new code, and on upgraded machines the old library could survive in ~/.empryo/native indefinitely. Both halves are fixed, and a set of production-hardening guards landed with them.

• TUI startup crash (`Symbol "dumpOutputBuffer" not found`). The build now verifies every platform's native OpenTUI library against the exact JS version and fetches the right one from the registry when the local copy is stale — a lockstep gate in the release pipeline makes shipping a skew impossible. If you hit this: reinstall, or rm -rf ~/.empryo/native and relaunch.
• Upgrades fully refresh the runtime. A version marker forces ~/.empryo/{native,wasm,opentui-assets} to be rebuilt whenever the binary version changes, files are swapped atomically (a running Empryo never sees a torn library), and dropped files can't linger.
• Addons survive upgrades. Installing a new version no longer wipes opt-in addons (proxy, Neovim) — they stay installed and linked.
• Installs verify themselves. The installer now runs the freshly installed binary before declaring success — wrong-CPU downloads (SIGILL) and corrupt archives fail loudly with the exact fix, and EMPRYO_ARCH=x64-baseline can force the no-AVX build explicitly.
• Updates behave. Beta users are offered the final release of the same version, and empryo update no longer times out at 60 seconds and orphans a half-finished installer.

• Build-time smoke tests run every host-compilable binary before packaging.
• TUI renderer-init failures now write a crash report and, when the cause is a stale native runtime, say exactly that instead of blaming your terminal.

A fast patch for Linux users hitting crashes on 3.3.0. If Empryo went black, invisible, or down in flames on your machine yesterday — this one's for you.

• Wayland black window / render-loop crash. Chromium 144's new wp_color_manager path is broken on KWin/Plasma-family compositors (endless "Unable to set image transfer function", invisible windows). The feature is now disabled — the desktop renders correctly on Wayland again. On an affected 3.3.0 build: --disable-features=WaylandWpColorManagerV1.
• GPU crash-loops self-heal. Three GPU-process crashes in a run and the desktop relaunches itself with hardware acceleration off and remembers the choice — a broken driver no longer reads as "the app keeps crashing".
• TUI crashes leave evidence. Fatal TUI/CLI errors now write a crash report to ~/.empryo/logs/crash-tui-*.txt (mirroring the desktop's ~/.config/@empryo/desktop/logs/), so "it crashed" comes with a file.
• Clean piped output. empryo … | jq and friends no longer risk truncated output or stray terminal escapes on exit.

• On Ubuntu 23.10+ prefer the .deb over the AppImage — Ubuntu's AppArmor blocks the AppImage's Chromium sandbox by design; the .deb installs a proper AppArmor profile. The new [Linux troubleshooting docs](/docs/troubleshooting) cover all of this.

The reliability release. The desktop app can no longer die silently — every early failure now surfaces with the logs you need to report it — Linux users finally get native packages, and a Chromium-generations Electron jump plus the React Compiler make the whole app quicker.

• Crashes now show themselves. A global crash guard catches every fatal error — even before the window exists — and shows a dialog with the full story: copy the logs, save them to a file, open the log folder, restart, or close. No more blank-screen deaths on Linux (or anywhere).
• Persistent logging, finally. Main-process, bridge, and interface errors all land in a rotated log file (~/Library/Logs/Empryo on macOS, ~/.config/Empryo/logs on Linux), so a GUI-launched app no longer discards its own diagnostics. Fatal errors also write a standalone crash report.
• Linux gets .deb and .rpm. Alongside the AppImage, native packages for Debian/Ubuntu and Fedora-family distros — x64 and arm64 — built and checksum-signed by the same release pipeline, on the download page now.
• Electron 43 + React Compiler. Ten Chromium generations newer (and back in the security-support window), with the interface auto-memoized by the React Compiler — snappier long chats without a single hand-written memo.
• LLM Gateway, three ways in. Log in with your browser to account credits or straight into your DevPass subscription (/login llmgateway, /login llmgateway-devpass), or paste an API key — on desktop, in the TUI, and headless. Empryo now identifies itself as Empryo on the consent page.
• Know what you're spending. A new Usage view — desktop drawer and TUI /usage — with today/week/month spend, per-model breakdowns, a 30-day sparkline, and a DevPass budget ring showing exactly how much is left until reset. Powered by a local ledger, so it works offline and for every provider; it switches to live gateway numbers automatically once the gateway ships a key-scoped usage API.

• A stopped turn no longer waits out the full retry backoff before actually stopping, and a closed tab can no longer wedge itself mid-send.
• Checkpoint restore no longer corrupts binary files and no longer strips trailing newlines from text files; Windows paths restore correctly.
• --timeout in headless runs now also bounds background agents; piped --json output can no longer be truncated on exit; a failed --login exits non-zero; Ctrl+C keeps its documented exit code on Windows.
• The TUI no longer sprays escape sequences into pipes or logs when stdout isn't a terminal, and a clean quit can no longer terminate the shell wrapper that launched it.
• On Linux, bridge child processes (git and friends) now find per-user installs (~/.bun/bin, ~/.local/bin) when launched from the desktop.

• Conversation-history sanitizing now skips arrays it has already proven clean — per-turn cost stays flat instead of growing with session length.
• Renderer errors, unhandled rejections, and React error-boundary crashes are reported to the same log file over IPC, rate-limited so a hot loop can't flood it.

If Empryo ever breaks on your machine now, it will tell you — and hand you the logs to make it our problem instead of yours.

The biggest desktop update since launch. The app now remembers across turns, manages sessions the way the TUI does, and exposes the provider and task-router controls power users have been asking for — all running through one unified bridge instead of a growing pile of one-off wiring. Alongside it: a full provider pricing refresh and a run of composer polish.

• Real cross-turn memory + compaction. The desktop app now keeps genuine conversation memory across turns and compacts it automatically as context fills up, with a UI to watch it happen — no longer a TUI-only feature.
• Session management, for real. /continue, /new, rename, and a full diagnostic session export now work on desktop exactly like the TUI — pick up where you left off, or hand off a session for debugging.
• Provider Settings, deepened. Per-provider reasoning-effort overrides, context-management controls, capability toggles, key-priority ordering, and advanced request-shaping — desktop Settings now covers what the TUI's /provider-settings has for a while.
• Task router gets teeth. Per-model fallback chains, a dedicated goal-review model slot, and searchable model pickers make routing different work to different models something you configure, not just read about.
• One command palette, two hosts. TUI and desktop now share the same command manifest — a new slash command shows up in both automatically.
• Zen mode, and a redesigned composer. A focus mode that strips the chrome away, plus several rounds of composer polish — ToolTrace tool-call rendering and new Chat FX treatments — for a calmer conversation view.

• Every desktop feature that talks to the backend now goes through one unified bridge-invoke seam instead of a bespoke protocol case per feature — git, memory, skills, LSP, checkpoints, diagnostics, and more all moved onto it this release.
• Refreshed pricing, model catalogs, and reasoning/effort capabilities across every supported provider: new models (Grok 4.5, Gemini 3.5 Flash, and more), corrected context windows, and a couple of real capability bugs fixed — Claude Sonnet 5 was silently missing its full effort range.
• Fixed a genome-indexing freeze on large backends, clamped prompt-cache breakpoints to Anthropic's 4-block limit, and closed a race between a new turn starting and an in-flight compaction.

Same graph engine, same workshop — now with a desktop app that remembers, and a TUI that isn't the only one with the good settings.

The v3 beta's biggest desktop update yet. Empryo's desktop app gains a real embedded browser, turns the agent's file references into things you can actually click, and learns to render Markdown — plus a long list of smaller refinements across chat, the maze, settings, and the workspace picker.

• An embedded browser, built in. Preview your dev server without leaving Empryo — a tabbed, local-only browser lives right inside the app, so the thing you're building and the agent building it share one window.
• Clickable file mentions. When Empryo names a file, it's now a link. Click to open it in place (desktop) or jump straight there from the terminal (CLI). Only real files in your indexed codebase light up, so a mention is never a dead end.
• Markdown, prettified. The file peek can render Markdown instead of only showing source — hit the prettify toggle to read a doc the way it's meant to look, headings, code, and all.
• Choose your prompt-cache window. Settings now expose the prompt cache TTL (5 minutes or 1 hour), so you can trade freshness for cost on your terms.

• The maze opens zoomed in with a clearer HUD, gives each agent a distinct color, and keeps links off by default so it reads at a glance.
• The workspace picker scrolls and filters your recent projects, so getting back into a codebase is one keystroke.
• Settings grew a dedicated Providers tab, a clearer workspace-scope toggle, and tabs that scroll when they need to.
• Resuming a session brings back the full transcript — agent messages and tool cards included — instead of a bare outline.
• Steadier chat streaming, reliable glass transparency, framed image lightboxes, sharper themes on dark backgrounds, and a tidier titlebar round it out.

• The download page now builds its links from a tracked manifest, and a release refuses to finish until empryo.com is actually serving the new version — no more dead download buttons.
• Every artifact here — CLI, TUI, and the desktop app for macOS, Windows, and Linux — is built, signed, and shipped straight from a Mac. No CI in the loop.

Same graph engine, same workshop — now with a window onto the web and fewer dead ends.

A focused follow-up to the v3 beta that makes the desktop app's first moments calmer and more predictable — and asks your OS for a lot less.

• Always start at the workspace picker. The desktop app no longer reopens your last project on its own. You choose the workspace on every launch — recent ones are one click away — so your codebase graph indexes exactly the folder you meant, and nothing else.
• Far fewer permission prompts. Empryo doesn't touch a single file or open the network until you pick a workspace, and it no longer asks macOS or Windows for local-network access it never used. It only ever asks for what it actually needs, when it needs it.
• The right theme from the first frame. The picker and loading screen now follow your system light/dark setting instead of briefly flashing the wrong palette.

• The bundled agent sidecar now ships with a stable, hardened identity instead of an anonymous one, so the file access you grant is attributed to Empryo cleanly.

Same graph engine, same workshop — just a gentler way in.

Meet Empryo — the coding agent that treats your codebase as code, not text. It's the successor to SoulForge v2: same graph-powered engine, a whole new form. SoulForge lived in your terminal. Empryo is the entire workshop — a polished TUI, a native desktop app, and empryo.com. Versioning continues where SoulForge left off, so we open at v3, and the whole line is a public beta.

• A real desktop app. Native on macOS, Windows, and Linux — multi-tab sessions, a live map of your codebase, and every tool a click away.
• A TUI that feels crafted. Rebuilt from the ground up: soft depth, fluid panels, an agent dock, an inspector, and a fast command palette.
• It understands your code. Empryo parses your whole repo into a dependency graph and edits by symbol and line — AST surgery and LSP rename, not find-and-replace.
• Your models, your way. Bring any provider, or sign in with the ChatGPT, Grok, or Copilot subscription you already pay for.
• Always current. A built-in changelog and one-command updates keep the CLI and desktop fresh.

• Cross-platform binaries — signed, checksum-verified, and installed by a single curl … | bash (or irm … | iex on Windows).

This is day one. Welcome to Empryo — let's forge.