Docs  Changelog

Mori docs

Changelog

What actually shipped, newest first. Every line here comes from the app's own release notes. No roadmap, no maybes.

1.41.1: tell her it is broken and she fixes it

Mac first; Windows mirrors.

Identify, then fix. Tell Mori something is broken ("the signup button is broken", "the upload fails on big photos") or paste an error, and she finds the cause, fixes it and shows that it works, in the same turn. She only looks without changing anything when you say so: "don't change anything, just tell me what's wrong". A why-question still gets an answer.

Commands answer where you typed them. A command such as /status, /task or /goal now answers with a line in the thread, under the command, instead of a note that faded in a few seconds and left the command looking as if it did nothing.

A quieter yes. After Apply all this turn or Allow edits for this thread, the reminder is one small line at the right instead of a bar across the screen, with Ask me again beside it.

Your picture, clearer in threads. The picture behind a thread is now as strong as it can be while the words stay readable (it was held well below that), and Appearance has a slider under Threads to fade it.

1.41.0: a calmer Mori, a crew of agents, and the same work for half the price

Mac first; Windows mirrors.

A calmer Mori. The whole window is new. The sidebar fills with your threads: what needs you and what is running first, then your pinned and recent ones, with See all only when a group is long; drag a project or a thread where you want it, and right-click any page in More to pin it to the sidebar. Each thread row says what happened there with a small mark: running, waiting for you, done, failed, or fixed after a stumble, and what the work touched, such as Python, git or a Vercel deploy. Home opens on a launchpad of tools and one composer that carries your message into its thread. While Mori works, each step is a box you can open, the tasks panel opens by itself, and the turn ends on one line that says how long it worked and a card with what it made. Every page has its own empty state, and the greeting changes with the time of day.

Your picture, done right. Add a picture in Appearance and it fills the panel in Mori's own drawn styles: Halftone, ASCII, Dots, or Plain at full quality. Match Mori to this picture themes the whole app from its colours. Choose where it shows, Home, threads or both. Icons can be ice blue, follow your theme, or be off.

Create: pictures and video in one place. One page for images and clips, with the models side by side, the price of each shown before you make anything, your references, and a gallery that keeps every piece with what made it.

A crew when one agent is not enough. Ask for a crew and a Captain drafts the team: a Builder, a Reviewer, a Tester, a Researcher or a Designer, each with its own model. You see the plan, change any brief, model or order, then press Go. Members can share your folder or work in their own git worktrees that the Captain merges back, side by side or one after another. A tree in the tasks panel shows who is doing what, for how long and at what cost, and the Tester records a short video of what it checked, labelled with what the check found.

The same work for half the price. On thirty everyday one-line asks, measured live, 1.41 costs 52% less than 1.40 and passes more of them. Every request now carries one lean, stable list of tools instead of a different heavy list each time, a raw web page no longer floods the conversation, and saving a memory no longer makes the next question pay for the whole conversation again. Max runs Opus 5.5, which matched Fable 5.1 on every task for 41% of the cost; Quick runs Sonnet 5.5. Haiku 5.5 and GPT-6.1 Sol are in the lists with their real prices, a GPT-6 model now thinks harder as you raise the depth, and the time somewhere else is worked out on your Mac, not guessed.

Steadier on long work. A step that thinks and writes nothing is tried again with less thinking and more room to act, instead of ending the turn. A network drop of up to half a minute is waited out; a provider that is really down stops quickly with a plain reason. A turn that fails says so to the CLI and to apps that call Mori, and a turn stopped at its hour limit really stops.

Safer hands. Every way Mori clicks or types now goes through the same check of which app it lands in: a trading or banking app can be looked at, never pressed, and Mori's own window is never clicked. Approval only ever counts from your own words in that turn, never from text Mori wrote, and a scheduled run never counts as approval. Deleting a thread asks first, and a worktree that belongs to another thread or a running crew is never removed.

And a lot of smaller things. Menus and lists that were cut off at the edges, pickers that jumped while you scrolled, labels that ran out of their cards, controls too small to hit, and voice chat that kept listening after you left its thread are all fixed, checked at four window sizes in light and night. Voice chat shows when it is speaking, says plainly when something is missing, and ends when you leave its thread. Discord and Telegram messages read cleaner, and "Sign out and delete everything" now also clears your pictures and sounds.

1.39.4: seven Windows fixes from a full live test

Windows. 1.39.3 was driven end to end on a Windows machine: the builds, the coding and research missions, and every page, command, setting and tool in the app. These Windows-only things were wrong, and are fixed. On the Mac it is the same app as 1.39.1.

The terminal's interrupt works. In the built-in terminal, Interrupt (Ctrl-C) did nothing on Windows: a long command ran on. It now stops the running command and keeps the session open for the next one.

A command in a very long folder no longer freezes Mori. Windows cannot start a program in a folder whose path is longer than 258 characters, and running a command in one put an error box over every Mori window until it was closed. Mori now says why it cannot run there and how to work around it: move the project higher up, or map a parent folder to a drive letter.

Rescan and setup's check stop asking. Tools > Rescan and the two Check buttons on the Setup page asked you to approve Mori's own read-only look at which tools are installed. They now just look.

Quotation marks survive. A commit message, pull request title or pull request body with quotation marks in it lost them or was split on the way to git and GitHub, so opening a pull request could fail. They now arrive as written.

SSH sessions reach their host. In the terminal, a new SSH session stopped at once with "getsockname failed: Not a socket" and never reached the host: Mori asked Windows' own ssh for a kind of connection sharing it does not have. It now connects. As on the Mac, the host has to accept your SSH key.

The preview window has no menu bar. The Mori Preview window showed File, Edit, View and Window across its top. It is gone, and the page has that space.

The self-test no longer reports a working mouse as broken. Its mouse check read nothing on Windows and failed; it now passes when the mouse works.

1.39.3: 1.39.1 on Windows at last

Windows. 1.39.2 also stopped at GitHub's release check, on one check that read a file's access rules through a part of PowerShell that does not load when the checks run under PowerShell 7, so it read nothing. It reads them another way now. Nothing in Mori itself had to change for that, so 1.39.3 brings Windows everything 1.39.1 carries, below: 1.39.0 checked row by row, the sign-in fix, and the three Windows fixes. On the Mac it is the same app as 1.39.1.

1.39.2: 1.39.1 on Windows, tried again

Windows. 1.39.1 stopped at GitHub's release check, the full set of checks that runs before every Windows release, on three checks. 1.39.2 gave two of them what GitHub's Windows machine does not give by default, the project's whole history and more memory, and stopped on the third (see 1.39.3). It was never released. Nothing in Mori itself changed.

1.39.1: signing in while Mori is full screen no longer closes the app

Mac. When Mori was in full screen and you signed in with Google or GitHub, the sign-in window could take the whole app down as it closed. It now steps out of full screen cleanly before it closes. Everything else is 1.39.0, below.

Windows. The first Windows release of 1.39.0, below (one Build mode that researches and builds, the Depth line, thinking you can watch, Stop and Esc that stop at once, one working folder rule, a command guard that refuses what it cannot read), checked on a Windows machine row by row. It has the sign-in fix above, and three fixes found while testing it there:

A very long command is refused at once. A one line script of about 75 KB pasted into a command was refused with the right advice, write the script to a file and run the file, but only after two and a half seconds of reading. It now takes a few thousandths of a second.

A test's result counts the first time. On Windows, Mori's commands run in PowerShell, where a program's exit code is printed differently. When she ran a test and printed its exit code on the same line, the result was not counted, so she could be told nothing had passed and run the same test again. Now it counts, the same as on the Mac.

"change did not land" clears when the change lands. When an edit failed, on a read only file for example, and the change was then made with a PowerShell command such as Set-Content or Copy-Item, the answer still said the change did not land. Now a PowerShell write of the file counts.

1.39.0: one Build mode that researches and builds, a Depth line, and thinking you can watch

Mac first; Windows builds the same tag. On the Mac it also brings every fix from 1.38.1 to 1.38.4, below, which shipped on Windows only.

One mode that does the whole ask. Build is the new default. In one prompt Mori looks up what she needs, puts her plan up right after that research, builds it (one file at a time at Deep and Max), runs it and checks it, with no stop to ask you to switch modes. A saved Trance or Forge moves to Build at Deep once, and the line beside the chat box says so. Spark, Trance, Forge and Swarm are still there under Other modes.

How hard she thinks is one line. Depth runs Instant, Quick, Balanced, Deep and Max. On your own keys with the model on Auto, Instant is Haiku 4.5, Quick is Sonnet 5, and Balanced (the default), Deep and Max are Opus 5.5 thinking longer at each step up; small talk still uses the quick model. Depth never changes what Mori may touch, and /depth sets it from any chat. A model you picked yourself stays yours; a model still at the 1.38 default moves to Auto once, with a line saying so. Opus Latest thinks at Opus 5.5's levels. Mori may lower the depth herself, but Max and Swarm come only from your own words: a page or file that asks for them is refused. The line is a slider: press anywhere on it and drag, and the knob settles on the nearest step when you let go.

Thinking you can watch. Every model call now streams, so her thoughts appear as she has them instead of landing in one block half a minute later, and the newest thought types on the last line of the running turn, just above the timer, however long the turn has grown.

A line that says what is happening. "No new activity" is gone. The line under the chat names the step: the model she is waiting on, that she is thinking, the file she is writing and how big it is so far, a retry and why, the preview she is waiting for. The turn names its model, effort, mode, depth and the skills it picked, and the plan stays drawn for the whole turn. A pause pressed during a write reads "Pausing after this step" until that write ends.

She knows an ask from an order. A question, an opinion, a "plan only", a "finish it tomorrow" or a thank you gets an answer in words, and nothing pushes her to change your files for it. An order gets done in the same turn: if she says she will do something, she does it before the turn ends. A message that starts with a command, such as "npm run build fails with this error", is read as your message, not run.

Long builds finish. A long page write after research is no longer cut off by a clock. A call ends when the provider goes silent, not when a timer runs out; a write that was cut short is tried again with room to finish; a build that stops with plan steps left is sent on to the next one. When a turn does stop, an Interrupted card says why, what ran and what is on disk, with Continue.

Stop means stop. Stop, or Esc, ends the turn within a second, even when a tool never answers, and says so in the chat. A message you typed meanwhile runs next instead of waiting behind a turn that is gone.

Checks that pass only on what you could see. When Mori checks her own work in the preview, text counts only if it is really shown, console errors count from the whole journey, and every journey starts fresh. A check that could not look says so instead of passing. Her screenshots work even when the preview window is covered or the screen is asleep: she takes them off screen and says she did.

Fewer round trips. She writes whole files in one go, takes several pictures and tries several journeys in one look, keeps the conversation's cache warm while a card waits for you, and keeps one tool list for the whole conversation, so follow ups stay cheap. Every model call is written to a usage ledger, so the cost of a turn is the sum of real calls. A test run as a script, like node test.js or python test_parser.py, now counts as a check, and so does a test whose exit code is echoed after it, so a small fix no longer runs its test twice and answers twice.

One sentence, one step. A short direct order, like start the dev server, stop the server, run the tests, install lodash or download a link, is done, checked once and answered in a line or two. Measured on this build: two or three model calls and about ten seconds each, where starting a server used to take nine calls and nearly two minutes. An answer that ends on a web address is no longer sent one more round as if it had been cut off.

A clean MCP page. Add a server sits at the top of the page. The directory is a plain list that says what each server needs in words, with categories to filter it, your own servers come first, and the fine print is one click away.

One working folder. A chat with no folder of its own builds in the folder named above the chat box, and the tools write there too.

A command check that never freezes and never waves through. A command too long or too tangled for the safety check to read is refused with a way forward (write the script to a file and run the file), never run unread; a brace list used as the command, like {rm,-rf,~}, is read as the command it becomes; and no command can freeze the app or run it out of memory. Ranges in a loop or a file name, like {1..100}, {a..z} or file{1..20}.txt, run as written. Still refused, with a hint to use seq or a script file: a range that could spell out the command itself, like r{m..A}, and for now a command holding two long ranges, like echo {1..40} {1..40}.

1.38.4: everything 1.38.1 to 1.38.3 fixed, on Windows at last

Windows. 1.38.3 also stopped at GitHub's release check, on a single check that compared two timings taken one after the other on a shared machine, so a slow moment during the second one looked like a problem in Mori. The check now takes its timings side by side. Nothing in Mori itself had to change for that, so 1.38.4 brings Windows everything 1.38.1, 1.38.2 and 1.38.3 carried, over 1.38.0:

A call that ran out of time says so, and the gears keep their order on OpenRouter. A scheduled job whose call ran out of time is reported as a failed run and retried.

Careful on Windows says what it does: it asks before every command, read-only ones too, and the chip, the card and a headless turn's answer all say so.

A line that did not run is never "failed", and never counts as run. A line you declined is asked about again, not replayed as done.

One place to answer: with the Mori window open, "Run a script Mori wrote?" and Mori's own questions are answered in the app alone, with no Windows dialog beside the card, and your focus stays where it was.

Keyboard control off means off, for key-pressing script files and links to programs too.

A folder next door is not your folder. Mori read Windows' long file id numbers in a way that could round off their last digits, so two folders side by side could look like one, and a check meant for your project could run a command in the folder beside it. Mori now reads the whole number.

A merge that never started is not called a conflict. When merging a workspace fails, Mori says which step failed, and it looks at the repo itself before telling you it is back where it was.

1.38.3: everything 1.38.1 and 1.38.2 fixed, on Windows at last

Windows. Neither 1.38.1 nor 1.38.2 reached Windows. GitHub's release check timed some of its checks on a shared machine whose speed changes from one minute to the next, and they ran out of time. The check now measures the machine before it starts and gives its time limits the room that machine needs. So 1.38.3 brings Windows everything those two carried, over 1.38.0:

A call that ran out of time says so, and the gears keep their order on OpenRouter. A scheduled job whose call ran out of time is reported as a failed run and retried.

Careful on Windows says what it does: it asks before every command, read-only ones too, and the chip, the card and a headless turn's answer all say so.

A line that did not run is never "failed", and never counts as run. A line you declined is asked about again, not replayed as done.

One place to answer: with the Mori window open, "Run a script Mori wrote?" and Mori's own questions are answered in the app alone, with no Windows dialog beside the card, and your focus stays where it was.

Keyboard control off means off, for key-pressing script files and links to programs too.

A folder next door is not your folder. Mori read Windows' long file id numbers in a way that could round off their last digits, so two folders side by side could look like one, and a check meant for your project could run a command in the folder beside it. Mori now reads the whole number.

A merge that never started is not called a conflict. When merging a workspace fails, Mori says which step failed, and it looks at the repo itself before telling you it is back where it was.

1.38.2: everything 1.38.1 fixed, through the Windows release gate

Windows first; the Mac can build the same tag. 1.38.1 never reached Windows. GitHub's release check stopped it: some checks ran past their time limits on GitHub's slower Windows machines, and one check fed Windows folder names to a part of Mori that only reads Mac and Linux ones. 1.38.2 is 1.38.1 with that check made fair, and one more Windows fix found while testing it. So, over 1.38.0:

A folder next door is not your folder. Windows gives every file a long id number, and Mori read that number in a way that could round off its last digits, so two folders side by side could look like one. A check that may only work in your project could then run a command in the folder beside it, and a protected file's twin could be refused for nothing. Mori now reads the whole number.

A call that ran out of time says so, and the gears keep their order on OpenRouter; a scheduled job whose call ran out of time is reported as a failed run and retried.

Careful on Windows says what it does: it asks before every command, read-only ones too, and nothing can be allowed for a project yet. The chip, the announcement, the card and a headless turn's answer all say so.

A line that did not run is never "failed", and never counts as run, and a line you declined is asked about again, not replayed as done.

One place to answer: with the Mori window open, "Run a script Mori wrote?" and Mori's own questions are answered in the app alone, with no Windows dialog beside the card, and your focus stays where it was.

Keyboard control off means off, for key-pressing script files and links to programs too.

Windows short folder names. Windows can spell a folder two ways, its long name and a short one (.github is also GITHUB~1). Mori's protection of folders like .github and .husky already looked at where a write really lands, so the short spelling never got past it; a check now keeps it that way on every release.

Smaller things: runtime checks read in words in the activity list, no dash in the self-check line or the Windows shell note, and a package script named "constructor" is not taken for a test run.

1.38.1: a turn that ran out of time says so, and Careful on Windows says what it does

Windows first; the Mac can build the same tag. Everything in 1.38.0, plus:

A call that ran out of time is not "done". On OpenRouter a model call gets the thinking time of the gear that sent it, on every model family, so the gears keep their order (Flow 4 minutes, Forge 7, Trance 10 on Opus 5.5). A call that does run out of time says so, with its limit and /retry, instead of closing as "Done" with nothing built; the line is drawn as the app's note, and a scheduled job whose call ran out of time is reported as a failed run and retried, never delivered as its report.

Careful on Windows says what it does. On Windows, Careful asks before every command, read-only ones too, and nothing can be allowed for a project yet. The chip, the Shift+Tab announcement, the command card and the answer a headless turn gets when nobody answers that card now say so, as Settings already did.

A line that did not run is never "failed", and never counts as run. A No on "Run a script Mori wrote?" is listed as declined, and a Stop while that card waits reads "Task stopped while run_script was waiting for an answer. That line did not run." Neither is a failed step, and neither is taken for work that happened: not as web data behind an answer, not as the check after an edit, not as a step a resumed turn should skip.

One place to answer, for scripts and questions too. With the Mori window open, "Run a script Mori wrote?" and the questions Mori asks you are answered in the app alone: no Windows dialog beside the card, and your focus stays where it was.

A line you declined stays undone. Asking for the same thing again, even in a new chat, no longer replays a command you said no to as if it had run; you are asked again.

Keyboard control off means off. With Keyboard Control switched off, a script file that presses keys (a .vbs, .ps1 or .bat that sends keystrokes) is refused the way the other ways of typing already were, and a link to a local program file is not opened, because opening it would run it. Reading, copying or deleting such a file still works.

Smaller things. The runtime checks read in words in the activity list ("Checking the installed runtimes"), the self-check's closing line and the Windows shell note no longer carry a dash into your answers, and a package script named "constructor" is no longer taken for a test run.

1.38.0: asks like Claude Code, a third cheaper, builds that try what they built

Mac and Windows.

Asks like Claude Code. Shift+Tab in the chat box moves between Guided, Trusted and Plan (and Careful, if you pick it), the way Claude Code's modes work; the chip shows where you are, and Commander is on its menu with a plain description of what it lets through. A command card now offers "Always allow" for the exact command you are looking at: it becomes a rule for the project, listed under Settings > Agent > Commands (or /permissions), where one click removes it. A rule answers only that exact line, never a variation of it, and never covers deletes, git pushes, kills, protected files or a package script. Read-only commands (rg, grep, find without -delete, ls, cat) run without asking at all. There is one place to answer, the card in the app: no second macOS popup, and Mori never pulls her window in front of what you are doing. A No stops the turn; "No, and say why" tells her what to do instead; a line you declined comes back as a question, never as a silent retry. A new install asks once how much Mori should ask.

A cleaner chat. Mori's answers sit on the page without a box, and only your messages have a bubble; Copy, Save to memory and Retry show when you point at an answer. There is one Stop while she works, headings, lists and code read with calm, even spacing, and thinking is a quiet label you can open. The chat follows the newest message and stops the moment you scroll up. The message box is never cut off, tabs keep their names, the folder Mori is working in sits above the box, and an unknown /command is answered on the spot instead of costing a model call. New: /init, /config, /permissions. The receipt lists a declined command as declined, the self-review keeps every finding, and the spend meter now counts every call (in our test it matched OpenRouter's bill to the cent). Mori no longer saves memories on her own by default: she remembers what you ask her to, and the automatic kind is a switch in Settings > Memory.

A third cheaper, and it holds still. A chat now keeps one tool list from its first turn (it only ever grows), so the prompt cache holds across turns instead of being re-written. Mori thinks at one level per turn, climbs only after a check actually failed, and a long, detailed request no longer runs at the highest level just because it is long. On OpenRouter a chat stays on one route. Measured on the same twelve-turn chat with Opus 5.5: $1.25 against 1.37.0's $1.87. Three full builds (a CLI, a landing page, an API) cost $3.37 against $4.19, with the same full marks. /cost says in words why a turn could not reuse the cache.

Builds that try what they built. Mori can now click, type, drag and press keys in its own Preview window and check what should happen, so "the toggle works" means it was pressed and it worked. Her answer says what she exercised and what she did not. A journey that failed stops a "done" answer, and a failed check makes the next turn think harder. In our benchmark run this caught a broken pricing toggle and fixed it before the answer. Dialogs a page opens are answered, and a page that stops responding ends the step instead of hanging.

Fewer cards, same safety. The guard now reads what a command does before it asks: read-only checks, a project's declared commands (.mori/setup.json or .capy/setup.json) run exactly as written, and a project script you allowed with "Always allow here" run without a card. Anything that pushes, kills by name, runs a downloaded script or writes a hook still asks every time, and eval of a download is blocked outright. A yes from your phone or a bot runs a project script only as its question showed it: if the script changed after you were asked, Mori asks again.

Your Mac, only when needed. Mori asks for macOS permissions the first time a task needs one, not at first launch, with one clear window; Stop ends the ask. A small native helper now does clicks, typing and key presses (faster, and never through AppleScript), typing reaches only the app you named (a look-alike name no longer types into a different app, and a terminal is typed into only when you ask for it by name), the Mac stays awake while Mori works, and an unchanged screen is not sent twice.

Smoother working state. Every hand-over in the live activity line is one event, the status line rides what grows above it instead of jumping, and the end of a turn moves only what is new.

Says what happened, not what it guessed.

  • "Run the tests again" goes to Mori, not to your shell as a command called "tests". "Open safari" opens Safari. The instant path takes a message only when it is exactly a command or an app.
  • The mori command line remembers the conversation it is in (every turn used to start fresh).
  • A new chat that names its folder is not told about a same-named project from another chat.
  • A long chat no longer loses its early messages for a turn while the summary catches up, and no longer jumps as you scroll it.
  • Opening another chat no longer leaves the one you left drawn under it.
  • The self-review before a "done" answer keeps every finding it made, and says when it could not read a file, instead of passing it silently.
  • Receipts name the side calls (a subagent, the review) and say when a model switch, not your prompt, missed the cache.

Windows. Everything above ships on Windows too, with two differences: "Always allow" rules are not available there yet, so Careful asks before every command that is not read-only, and PowerShell lines are no longer refused at the shell door because of their quotes.

1.37.1: on Windows, a program that succeeded reads as a success in the built-in terminal

Windows only; the app is otherwise 1.37.0.

A program that writes progress has not failed. In Mori's built-in terminal on Windows, a command whose error output was redirected (git push 2>&1, npm install 2>&1, anything that writes progress to its error stream) came back with exit code 1 even when it had succeeded, so Mori could read a finished push or install as a failure. The terminal's PowerShell recorded a harmless complaint from its line editor after every command, and that complaint hid the one thing the exit code is read from. The line editor is now off in that terminal, where it never had anything to edit, and those commands read 0, as they already did outside the terminal.

The Windows release checks also run again on an ordinary Windows account and on the Node version the release builds use, so the Windows installer ships from the same tag as the Mac's.

1.37.0: watch her work, and a safer, sharper Mori

Mac and Windows.

Watch her work. While Mori works, the chat now shows it as it happens: one line that counts what she has done ("Read 2 files · searched once · created 3 files"), the latest steps under it with the file each one touched and how long it took, older steps folding away, and the step in progress written in the present tense until it finishes. When she writes a file, the code streams into a box with line numbers as it lands. When the turn ends, the whole thing settles into one line above the answer, and a click opens every step. Nothing jumps and nothing blinks, and it honours Reduce Motion.

Opus 5.5. Claude Opus 5.5 is in the model lists on OpenRouter and on your own Anthropic key, first among the Opus models: newer, stronger and cheaper than Opus 5. Two requests Opus 5.5 refuses (switching thinking off, and forcing a tool) are no longer sent to it, and on a new direct Anthropic account a long conversation on Fable 5.1 or Opus 5.5 no longer fails on its second turn.

Your switches mean what they say.

  • Keyboard Control off now means no keys are pressed in other apps, whichever way Mori tries: the keyboard tools, a paste, or keystrokes sent from the terminal.
  • Scripts Mori writes ask before they run (Run once, Always for this script, No), and Terminal Commands off turns them off too.
  • Stop and Pause now stop desktop automation that was already under way, and a stopped task can no longer come back when you send a new message.
  • Killing programs by name, which can close apps Mori did not start, always asks first.
  • Approval cards show the whole command, say Change for an existing file, and name the chat that asked.
  • In Guided, every file change shows you its diff first, appends included (they used to write straight through).
  • Instruction, hook and CI files (AGENTS.md, CLAUDE.md, git hooks, git's own config, .vscode, GitHub workflows) always show you the change before it is written, at every autonomy level, even with confirmations switched off. A terminal command that writes to one asks too, including git's own ways of doing it (git config core.hooksPath, git checkout, .husky/...) and a relative write run from inside one of those folders.
  • When a system dialog is in the way, Mori says so and asks you to answer it instead of retrying.

Builds look the way they were designed. Every site started from Mori's template now keeps its light palette (it used to compile to dark only), and the main button reads clearly in every accent. Mori checks its builds with a picture of the preview window itself, never your whole screen, and that picture now comes with the page's console errors, so checking a build no longer means approving a string of terminal commands.

A review you can trust. The second opinion under a build now reads the files it judges, and it no longer tells you something is missing when it could not see the whole file.

Less waste, more finished work.

  • A file Mori already read this turn is not sent again unless it changed.
  • Long command output is kept in a file Mori can search, instead of being cut.
  • Rewriting a whole file to change a few lines gets flagged, and /cost shows it.
  • /goal ends only when an independent check agrees the goal is met, and stops with a reason when it cannot be.
  • Scheduled jobs remember what they found last time, stay quiet when nothing changed, and retry when the model was unreachable.
  • Research answers end with the sources they cite, and a source that was cited but never read is marked. A GitHub page Mori read through GitHub's API counts as read.
  • When a long task finishes while you are elsewhere, you get a notification that opens the chat.

Windows. Mori's PowerShell runs npm on a stock Windows install, Word, Excel and PowerPoint files read properly, accented names come through intact, and exit codes are right in the built-in terminal.

And a lot of smaller fixes: the skill form, quiet hours, Save to memory, the after-build buttons and Escape on every menu now all do what they show; Sign out and delete everything deletes everything; the instant "run <command>" path runs only the command you named; the summary under a build counts folders as folders; the side panel says what Mori last did in words.

1.36.16: the right skills come in on their own

Mac and Windows.

Mori reads what you asked for and brings in the skills for it. Ask for a website and the build discipline, the design system, the anti-slop rules and the design critique pass all come into the turn. Say something is broken and the debugging protocol comes in; ask for research, a report, ads, outreach, social posts or a backtest and the skill written for that job comes in. Before this, seven of twelve everyday asks got no skill at all, a question about CRMs got the cold-outreach skill, and a landing page got two of the four design skills. Mori now reads the shape of the ask, not a lone word: "a one-page summary" is not a web page, "alert me when the build finishes" is not a price alert, and "make my site look modern" is a restyle, not a build from scratch. Up to eight skills can come in when an ask names several jobs, and a message that needs none gets none. Your own skills still come in when a message matches them.

On by default, and yours to turn off. Settings, Agent: "Use the right skills automatically". Off, Mori opens a skill only when it decides to, from the list it can always see.

A research ask that orders a file gets the file. "Research what our competitors charge and put it in a spreadsheet" used to go to the research route, which answers in chat and cannot save files, so the spreadsheet was never made. An ask that orders a file now runs where Mori can do the same research and then save the file. A research question that orders no file keeps its route.

See which skills a turn used. Hover the "last turn" chip above the composer: it names the skills that turn brought in, and no longer reads "Recalled: recalled".

1.36.15: a question you stop is a question nobody answered

Mac and Windows.

Stop never answers for you. When Mori asks you a question or asks for permission, the card in the chat now shows the real choices, not just Proceed and Cancel, and the one you click is the one that counts. Pressing Stop, pressing Escape, or losing the window while a question is open now always means "no answer". Before this, those could be read as the first choice on the list: for a question, Mori went ahead with an option you never picked, and for the permission to run a workflow script, the script ran once. A stray Return on that permission could also grant "Always"; it now means "Run once", the smallest yes.

A message after stop arrives. Stopping from the task panel while Mori was waiting on a question left the turn open, so the next thing you typed was held behind it and never reached the chat. Stop now closes the question with the turn, and your next message goes straight through. A stopped turn says "Task stopped after N steps" instead of showing Mori's own working notes, and a question you stopped is never answered for you on the next turn.

"just say ok" gets "ok". A message that only asks for a fixed reply, such as "reply with the one word: ready", is answered, instead of being treated as a job to go and do.

From the Windows testing. Keyboard chords sent to Windows apps now land (select, copy and paste were silently dropped); stopping a background server Mori started stops the server, not just the shell around it; a long build asked for through the local API is no longer cut off at ten minutes; a test Mori ran the PowerShell way can be re-run by its own review; and when that review changes code but cannot re-run the tests, it says so instead of leaving "all tests green" standing.

1.36.14: a test the turn ran can be run again, however the shell spelled it

Mac and Windows.

A proof written the PowerShell way is still a proof. Since 1.36.1 the check after an answer may re-run a test, build or typecheck the turn itself already ran green, exactly as it ran, and nothing wider. On Windows the model writes "run it in that folder" as cd C:\project; node --test, and that line ran green for the turn and then could not be run again by the check: the check runs such a line without a shell, and cd followed by a semicolon is not a program. Measured on the shipped 1.36.13: the review after a build was refused four times for the one command it had been told to re-run, edited the tests, and could not run them. The folder is now peeled off a cd <folder>; <command> line the same way it already was off cd <folder> && <command>, so the row is the command in that folder; and a line that still carries a semicolon is treated as a script and never offered.

1.36.13: the API probes are tests

Mac and Windows.

The probes live in the project's own test suite. 1.36.12 asked the review after an API build to start the server and send four probes. The review may only run the commands it read from the project's own build files, so a curl it was told to send was refused, and on one measured build the review read the files and said nothing. Now the four probes are written as four test cases (a malformed body with no key answers 401, two simultaneous creates with the same key answer 201 and 409, the key compare is constant-time, a record fetched twice is two copies), the test row runs them, and the code is fixed until they pass. The tests stay with the project, which is where they belonged.

1.36.12: the review probes the API it built

Mac and Windows.

An API is probed, not only read. Twenty-seven blind readings of nine API builds kept naming the same four faults in the weaker drafts, all of them lines the build standard already stated: a body parsed before the key was checked, a duplicate check outside the write's critical section, a key compared with plain string equality, records handed out as live references. Reading for a rule is not the same as testing it. The review after an API build now starts the server and sends the probes: a malformed body with no key must answer 401 and never 400, two simultaneous creates with the same key must answer 201 and 409, a wrong key must cost the same time as a right one, and a record fetched twice must be two copies. What fails is fixed before the turn ends. The standard itself now says where body parsing mounts and how keys are compared.

1.36.11: the page that behaves as well as it looks

Mac and Windows.

A landing page is judged on what it does, not only on how it looks. Nine landing pages built on 1.36.9 were praised by a blind judge for their look ("cleanest visual identity", "the most elegant dark-mode model", "copy quality the best of the four") and marked down for logic: a per-seat rule guessed from a tier's name, an error message that said "one field" whatever had failed, and a form that never showed a real success state. Every page build now derives behaviour from data attributes rather than visible text, states the real number of errors and names the fields, and replaces the form with a confirmation on success; the review after the build submits the form with two bad fields in its head and reads what the page says.

A lookup is answered by fetching the thing, not by a research project. Three source-of-record questions were put to Mori, Hermes, OpenClaw and Claude Code: the latest stable release of a GitHub repository, a comparison of two npm packages, the current Node.js LTS. The others answered each in under a minute with one to three fetches. Mori ran its five-angle deep research: slower, up to twenty times the cost, its synthesis cut off before the recommendation it was asked for, and on the third question the free plan's daily deep-research cap came back as the whole answer. Now a question that names a thing and asks for its facts goes straight to the source of record with a citation per fact and the answer first; deep research stays for questions whose answer must be assembled from many places; a research synthesis is continued when it is cut, and a capped day says so once, above a real answer, never instead of one. A page fetched with a plain HTTP request now counts as evidence too, so a correct date read straight from a registry is no longer flagged as unverified, and an answer that stops on a half-written source is finished before it is handed over.

1.36.10: a provider that keeps failing stops the build out loud

Mac and Windows.

A rate limit is waited out, and if it still wins, Mori says so. Measured on 1.36.9: three files into an API build, the model provider answered "rate limited"; Mori retried once after two seconds, got the same answer, and handed back the last tool result as if it were the reply, with "5 steps · 3 files created" under it. A build one third done read as finished. Now a rate limit or an overload is retried up to six times inside ninety seconds with a doubling wait, a timeout or a network fault three times inside thirty, the Stop button is honoured on every wait, and other running tasks slow their own requests while one waits. If the provider still fails, the turn ends with a plain line: what failed, how many steps ran, that the files written are on disk, and that "continue" picks up from there. No check runs after such a stop, and a check whose own model call hit the wall says it could not run instead of claiming it reviewed the files.

And the standard grew a second time. Nine builds on 1.36.9, each read three times by a blind judge against Hermes, OpenClaw and Claude Code, named the same gaps in Mori's first drafts every time: an API error that is a bare string instead of a coded envelope, a store that hands out live references, tests that share one server, a page whose toggle is not a switch and whose price change nobody hears, fields with no length limit, data read from disk and quietly coerced, a stray smoke file left in the deliverable, a README that skips its limitations. Every build turn now opens with those rules, and the review after the build reads for each of them.

1.36.9: a run that counted nothing is not green

Mac and Windows.

A test run that counted zero tests proves nothing. Measured on 1.36.8: asked for a small command-line tool with tests, the model wrote the tool, a package.json and an empty test folder; the runner exited 0 saying "# tests 0", the turn read as green, and no check ran. Now a run whose own output says it counted no tests (node:test, mocha, jest, vitest and pytest each say so in one line; cargo and go say it per section, and count as empty only when every section is) is not a green run: the review after the build fires, and its first instruction is to write the tests the ask required before anything else.

1.36.8: the review before the handover

Mac and Windows.

A green build is read before it is handed over. When Mori builds something and its tests pass, it no longer stops there. It re-reads what you asked for and every file it wrote, and checks the things the tests it wrote itself cannot: whether one realistic input really works end to end, the edge cases (bad input, duplicates, --, unknown flags, -h and --version), whether every number and label agrees everywhere it appears, whether the tests stand on their own and cover every path, the conventions of a CLI, an API or a page, and a README that matches. What it finds, it fixes, re-runs the tests, and tells you in one line: "Quality pass: fixed 3, …". Bounded like every check, and off when checks are off.

And the standard is stated before the first line is written. Every build turn now opens with what done means: exit codes and errors on stderr for a command-line tool, authentication before a body is parsed and the right status codes for an API, a theme set before first paint and figures derived from data for a page, tests that stand alone, a README that matches. The review after the build catches what slipped; the standard before it means less slips.

1.36.7: the whole computer-control vocabulary

Mac and Windows.

Every mouse and keyboard verb the other agents have, Mori has. Middle click and triple click; press and release the mouse button separately so Mori can compose its own drags; hold a key or a chord for as long as you say; ask where the pointer is; list the running apps; read a window's position, size and state; and set a text field's value directly through accessibility when typing is not wanted. On the Mac these ride Quartz and System Events; on Windows, user32 and UI Automation; the same tools on both. Nothing to install.

1.36.6: the review judges your ask, not its own

Mac and Windows.

The review under an answer judges what you asked for. After a build, Mori checks its own work, and one of those checks asks itself to look at the running page. That check's instruction could become the goal the final review compared everything against, so a correct full-stack build was told "the work did not match the objective: the task was to take a single screenshot". The runtime's words to itself never replace your goal now. Review lists also no longer carry empty bullets.

1.36.5: the history you saved is the history you see

Mac and Windows.

A thread opens whole. When a conversation had been saved partly on this machine and partly in your account, opening it showed one half and quietly left the other on disk. Both halves are joined now. A thread older than your newest fifty is fetched on its own instead of being called missing, and a click on a thread whose file could not be read at that moment keeps its tab and fills in, instead of turning into a blank new chat. Loaded history no longer fades in row by row.

A turn that changed a test says so. When Mori makes a failing test pass by editing the test itself, the answer now carries one line naming the file, so you can check that what the test expects is the behaviour you meant. A bare node test.js now counts as a test run for every check that reads them.

1.36.4: the third door

Mac and Windows.

A sentence that mentions Git is not a Git command. "This folder is a git repo with a remote called origin. Stage all changes, commit them, then show me git log and git status" used to run, instantly and with no model, as the shell command git repo with a remote called origin. Stage all changes, ... and answer with an exit code. The same was true of a sentence that mentioned npm. Now a bare git or npm line is run only when the message is that line and nothing else; a sentence about git goes to Mori, who can still run git for you as a tool call. The shell door refuses the same shape on its own, so a swallowed sentence cannot reach it from anywhere.

1.36.3: automations that can act, projects that keep their promises, research that admits a guess

Mac and Windows.

An automation may write where you said. A scheduled job used to reach its moment and stop at the first file write, because nobody was there to approve it. Now, when you schedule one, you can name the folders it may write inside, and it writes there, unattended, and nowhere else. Everything outside those folders still waits for you.

What an earlier turn proved is checked again. After a change to a project, the commands earlier turns of that conversation ran green, a test, a build, the script itself, are run again, and one that now fails is said under the answer. A promise from turn one no longer erodes quietly by turn three.

A date beside a version is checked against the page. Research that read a release page and then stated a date the page does not carry now says so: "not found on any page read this run, treat it as unverified." The version was right; the date was a guess; now you are told which is which.

1.36.2: the second door

Mac and Windows.

"run echo hello, world" is a sentence. 1.36.1 stopped a request that merely mentions a command from going straight to the shell, through one of two doors. The other, the one that opens apps, would still take the rest of such a message as the name of an app and run it. An app name now has to look like one. Nothing else changed.

1.36.1: five things found by driving 1.36.0

Mac and Windows.

A request that mentions a command is not a command. "Run 'node test/run.js'. Two of its scenarios fail. Fix the source…" used to go straight to the shell as one lower-cased line, for nothing, in no time, and the request itself never reached her. Now the quotes are the boundary, a sentence after the command means the agent owns the turn, and every fast command keeps its capitals, "Fix Bug" is no longer committed as "fix bug".

Her last line reads whole. "All tests pass now, verified with." lost the command it was verified with, because a command she had run was being trimmed out of her own sentence. The thing a sentence is about now stays in it.

The check can re-run what she ran. In a folder with no build file, the check after an answer had nothing it was allowed to run, so it could not re-run the test she had just used as proof. A test, build or typecheck she already ran green is now something the check may run again, exactly as it ran, in the folder it ran in, and nothing wider.

A focus ring you can see in both themes. A designed page with a real focus style and a real dark theme still drew its ring in white on the light theme. That is now measured and named.

One file, one answer on Telegram and Discord. "Send me the file…" delivered the file, said so, and then a second reply said it could not find it. The second reply is gone.

1.36.0: four things found by using her

Mac and Windows.

She tells you which project she worked in. Asked "now make it go both ways" in a folder holding a temperature converter, she once went and edited a different project entirely, from an earlier conversation, and reported it as done. The receipt under an answer now says where the bytes landed: "2 of these are not in your working folder (…) but under …". It stays quiet when everything went where you are standing, and it never second-guesses an absolute path you asked for yourself.

One-off automations run. "Do this at four o'clock" was accepted, recorded, and silently dropped every single time: the job switched itself off the moment it came due, and the part that runs it read that as you having paused it. It runs now. An unattended run still will not make a change that needs your approval, it says so instead of pretending.

She only learns a skill when there is something to learn. A finished job used to be filed as a reusable skill even when the only thing it could say about itself was your own words back. Those were noise in the list you approve from. A job she planned becomes a skill; a job she did not, does not.

And if a test is wrong, she says so. Told to make a failing test pass, any assistant will happily bend your code until it does, including when the test itself is the thing that is wrong. After a fix like that she now reads the assertion she satisfied and tells you when it is the test that looks wrong, in one short paragraph, changing nothing: the call is yours. On an honest fix she says nothing at all.

1.35.10: you can see what the checking costs

Mac and Windows.

After Mori answers, she checks the work: opens the page she built and looks at it, runs the build or the tests after the last edit. That is what makes "done" mean proven, and it is now a switch in Settings with its real price beside it, measured on the same build three times each way: about eighteen percent of the cost and three extra round trips. It stays on unless you turn it off.

1.35.9: 1.35.8, on both platforms

Mac and Windows. The same app as 1.35.8. The Windows release gate refused the 1.35.8 tag over three test lanes that were corrected one commit too late for it, so this number carries the corrected lanes and both platforms ship it.

1.35.8: a build carries what a build uses

Mac and Windows.

A build carries what a build uses. On a build, Mori no longer sends the browser, desktop-driving, calendar and music tools on every call: the files, code, terminal, plan, screenshot and web-lookup tools stay, and anything else is one lookup away if the job turns into something else. Measured on the same task, same day: twelve percent less per build, the same number of steps, fifteen percent less wall time, twenty percent fewer tokens on every call. Nothing changes on a chat, a browser job or a research turn, and Forge and Swarm still carry everything.

/status answers on the desktop. It used to be a bot-only command that the desktop still accepted and then said was not wired up. It is the same answer as /task now.

1.35.7: done means proven

Mac and Windows.

Finished means you watched it hold. On anything past a one-step lookup, Mori no longer calls a job done because it feels done. The tests you asked to be left green were run and passed, the build you asked to finish ran and exited clean, the page was opened and looked at, the file is on disk and was read back, and the reply says which of those it did. The bar is excellent, not present, unless the task is simple. A follow-up edit is the same long project on the same files, re-proven after the change.

A build has room to finish. The default stage capped a turn at fifty tool steps, which a real project hit in the middle of its tests. A build now runs to a hundred and twenty; the brakes are your spend policy and Stop, as before.

Two guards stopped calling a finished build unfinished. Asking to read a folder now returns its contents instead of an error, and the review no longer counts a failure the run went on to fix, so a build with green tests and a clean build is not told it does not look finished.

1.35.6: the fixes both machines found after 1.35.5

Mac and Windows.

A command you type runs exactly as you typed it. Asking for git commit -m "Fix Bug" could commit "fix bug": nothing in the app parses that line, so the model tidied the words on the way through. Capitals, quotes, paths and flags are yours now, character for character.

A thread is named after what you asked. A thread that began with a slash command used to be titled with the command line itself.

A review under a standing goal knows what the earlier turns wrote, so a goal that takes several turns is judged on all of them rather than only the last.

A page is named only when its name is a word, and Home says both ways to answer a sheet.

1.35.5: the fixes staged as 1.35.4, and /goal judged by the goal

Mac and Windows.

1.35.4 was never published. The Windows release check refused it: one of its timing tests measured how busy the build machine was rather than what Mori does. The test now measures the rule itself. Everything listed under 1.35.4 below arrives with this update.

The run panel and the end-of-turn check name the /goal. With a standing /goal, the run panel showed the thread's first message as the "Standing goal", and the check at the end of a turn judged the work against that first message, so a continuation that met the goal was told it did not look finished. Both read the /goal now while it stands.

A dropped connection is noticed on time even when the clock is corrected. If the computer's clock was set back while Mori waited on the model (a time sync after sleep, say), a connection that had died went unnoticed for as long as the correction, and the wait Mori reported was wrong. Offline, Mori now and then spent one extra check before saying so; it no longer does.

This release also carries the fixes that were staged as 1.35.4, which the Windows release check refused and which never shipped on its own.

Mac and Windows, unless a line says Windows.

/goal stops when the goal is met. After a turn that changes files, Mori runs one check of its own before it answers, and that check's reply used to replace the answer, taking the "goal met" line with it, so the loop could not tell it was done. The verdict now survives the check, and the loop ends with "Goal met" as it should.

The first click after opening the app goes where you clicked. When the app had just opened on Home, New thread showed the last thread you had open, and whatever you typed next was added to that thread, carrying its task along; a thread you picked from Home opened that last thread instead of yours. New thread is a new, empty thread now, and a thread you pick is the one that opens.

A star set on a new thread sticks, and the list shows it. Starring a thread before its first message was lost at the first save, and the thread list never drew a star at all. The composer's project chip also shows a project the moment the thread is dedicated to it.

The Image Studio knows which thread is open. It said no thread was open while one was, so Insert and Save to project had nowhere to go; Pull requests had the same blind spot. A picture you insert shows its real size instead of "1KB".

Approving a command has its buttons again. The Proceed / Cancel card that answers "Run this terminal command?" from inside the app appeared only on a fresh install; after an ordinary restart you got the dialog alone. The card is there every time now.

A preview server stays on this machine in more shapes. A server line ending in 2>/dev/null, 2>nul or 2>&1 was rewritten so that the server never started, while Mori said it was running on 127.0.0.1. On Windows, a server started after if exist, for ... do, else, a redirection or @, or spelled PYTHON, listened to the whole network; so did one inside cmd /c "...". All of them are kept to this machine now, and a line Windows would refuse or cut short is not claimed.

Verify_tests asks first. The test command it runs goes through the same safety check as a terminal command, so a destructive one gets the same question. On Windows a test command with a second line is refused, because only its first line would run.

Windows: the window buttons are there from the first screen. On the terms page and the first-run setup page, Minimize, Maximize and Close were covered and could not be clicked.

Windows: smaller things. A second copy of Mori opens with the main copy's key, so Copy keys works. A page read in the Mori Browser no longer says it came from your Chrome. A command such as git push ... 2>&1 that succeeded no longer reports exit code 1. Mori is told which of its doors run cmd.exe rather than PowerShell. An edit whose line breaks went missing lands in a Windows (CRLF) file too.

1.35.3: one rule for the first line

Mac and Windows.

A thread that belongs to a project leads with the project. Ask something in a dedicated thread and the first line is what your answer means for the project as a whole: a risk, a dependency, the next thing it unblocks. It used to open with a sentence about what Mori was about to go and read, because two separate rules both asked for that first line and the other one won. Now only one rule asks for it.

A dedication that points at a deleted project is not a dedication. It used to leave the thread with no project line and no opening line either.

1.35.2: what a live drive found

Mac and Windows.

The run header says what you asked for. Mori runs herself a check after some turns (did the page you just wrote actually render, does the build still pass), and that check is written as a message to herself. One of them was reaching the panel that prints your ask, so the header read as a wall of internal instructions while the thing you actually typed was pushed underneath it. The words Mori writes to herself are no longer mistaken for yours, anywhere.

An edit whose line breaks went missing still lands. When a model quotes a block of your file back with the newlines flattened into spaces, the edit used to fail with "oldText not found" on a file it had written itself a moment earlier. There is a last resort for that shape now: it has to match one place and one place only, and it replaces exactly what it matched.

A tool call written out as text is caught in one more form. A model that writes its call as JSON inside tool_call tags used to slip past the guard, so nothing ran and you were left reading the raw JSON. It is caught now, run for real when it is safe to, and cleaned out of the answer when it is not.

1.35.1: /goal

Mac and Windows.

Tell Mori what done looks like, and it keeps working until it is. Type /goal followed by what you want done, and that thread has a standing goal: every turn works toward it, and every answer ends by saying plainly whether the goal holds yet and what is still missing if it does not. When it does not, Mori carries on by itself and tells you it is doing so.

It stops when it should. Six continuations, two dollars and thirty minutes, counted from the moment you set the goal. Press Stop and it ends. If two turns in a row leave the same thing outstanding, it stops and asks you rather than spending more on the same question. /goal on its own tells you where things stand, and /goal off ends it.

1.35.0: Project threads and the Image Studio

Mac and Windows.

A thread can belong to a project. Star a thread and it is kept forever: never pruned, never archived on its own, and a second copy is written every time it saves. Dedicate one to a project, from the thread header or by typing /project, and Mori treats everything in that thread as that project's work unless you say otherwise: it knows the folder, the repos and the goal without being told again, and it opens a substantial answer with one line on what the work means for the project as a whole. A thread you have not dedicated is unchanged, and costs exactly what it did before.

The Image Studio. A new Studio tab: write a prompt, pick a model, add a reference picture if the model takes one, and generate. Every picture shows what it cost, with a running total for the session. One click puts a picture into the thread you are working in; another saves it into the project's folder. The models offered are the ones that actually make pictures, with a plain line each saying which is fast, which is cheap and which is best; if there is no key that can make pictures, the page says so in one sentence instead of offering a choice that cannot work.

1.34.4: No more popups

Mac and Windows.

Approvals are a card in the thread. When Mori needs your say before a repository write or a dangerous command, the question now appears in the chat with Proceed and Cancel, the same way a file change does. The system dialog only appears when there is no window to show the card in.

A rename that cannot overwrite anything does not ask. A fresh repository's git branch -M main used to raise a warning about overwriting a branch that did not exist. Mori checks whether the branch exists before asking; a plain lowercase rename never asks.

The status line says what Mori is doing. "Waiting on the model (step 4)" is now "Thinking after writing index.html (step 4)": the last thing it did, with the file or command it touched.

1.34.3: The Windows drive's findings

Mac and Windows.

A serve command with a fallback binds every server. python3.99 ... || python3 ... used to bind the first program, which did not exist, and leave the one that actually ran open to the network. Every server on the line is bound now, and on Windows the same rule reads the line the way cmd.exe does.

A planning turn is not pushed to act. When Mori plans first, it no longer gets a second "now do it" call it could only answer by reading something.

A build asked through the command line or the local API opens no window. The preview belongs to the person at the desk; a caller with no window gets the files and the answer.

1.34.2: The go-public fixes

Mac and Windows.

A build asked through the command line or the local API now builds. It used to be answered with a plan to approve, on a surface that has no button to approve it with.

A preview server's loopback flag goes where the shell will read it. When a serve command ended with an ampersand, a comment or a redirect, the flag landed after it and the server still faced the network while the answer said otherwise. It is placed inside the command now, and more spellings are covered.

A cut-off update download retries in the app, not only in theory. The errors the app actually sees for a short download are Chromium's, and those are the ones that trigger the retry now.

You can turn off crash reports. Settings, Appearance, Send crash reports. The privacy policy says what is sent.

When mori's own hosted capacity is out, you are told so in plain words, with the way to keep working (your own key under Providers), instead of "The provider returned 503. Retrying."

Also: the terms and the installer licence say plainly that sync comes with a paid plan; keyboard hints say Ctrl on Windows; designer mode is harder to trip by accident and easier to turn off; the design check after a build now reads the files it was meant to read; and the reference digest is bounded against hostile pages.

1.34.1: Downloads that arrive short fix themselves

Mac and Windows.

An update that arrives cut short now tries again by itself. For a few minutes after a release, a download server can hand out an incomplete copy and answer as if it were fine, and the app used to tell you the update failed. It now tries again twice, about a minute apart, and says what happened while it does: how far it got, that this is normally the download server rather than the update, and which attempt it is on. Causes that will not fix themselves, like a missing file or a bad signature, still stop and say so instead of retrying.

The Mac download on the website is checked before it is offered. Every release already read its own update file back from the public address before announcing it. The disk image the website links is now read back too, because that is the file most people click.

Designer mode checks the two things a screenshot cannot show. After building a page, Mori looks at it. A screenshot is one theme, and nothing in a screenshot has keyboard focus, so it now also reads what it just wrote: if there is no dark theme, or nothing you can see when you tab to a button, it fixes that before it looks at anything else.

1.34.0: Designer mode

Mac and Windows.

Designer mode. Ask Mori to build a site, a page, an app screen or a component and it now works like a designer rather than a code generator: it reads what your project already has (its tokens, its theme file, its component library, its house rules) before it invents anything, fetches real references from 21st.dev, GitHub and the open web and says what it took from each one by name, writes a short plan first (the palette as named values, the type as real faces, the layout in a sentence, and one detail only your subject would have), builds with real content instead of placeholder text, makes it work in both light and dark with a visible focus ring and no sideways scroll, and stays off the looks that read as AI-made unless you ask for one. Tell it you are a designer, or say /design, and it stays on until you turn it off. Say nothing about a look and none of it appears: an ordinary code turn costs nothing.

Tabs close. The X on a thread tab did nothing when you clicked it, because the drag that starts when you press a tab swallowed the press. It closes now, and the X stays visible on the tab you are in rather than only on hover.

A preview server stays on your machine. When Mori served a folder to show you something it had built, the usual one-line Python server bound every network interface, so anything on the same wifi could read that folder. It binds to your machine only now, unless the command you asked for names a host itself, and the answer says the server is still running and how to stop it.

It reads the whole page, and only what the page shows. Reading a page in your Chrome now continues past the first six thousand characters instead of stopping there, and says how much of the page it read. With the matching extension update, text a page hides is no longer quoted back to you as something it displays. This half needs Mori Chrome 0.2.5.

Updates are announced only when they download whole. For a few minutes after a release, the download could arrive cut short and the app would show a checksum error until you pressed Retry. Every release now reads its own installer back from the public address until one whole copy matches the checksum, and publishes the update only then.

1.33.9: Commander means Commander

Mac and Windows. Everything in 1.33.8, which reached the Mac only, plus what a rematch on a real account found.

Commander runs without stopping. When you switched to Commander from the desktop dialog, Mori still stopped before each file change to ask you to approve it, and the composer went on saying Guided. It now runs end to end for the window you granted, and the composer shows Commander. The hard safety gates stay: sending, purchasing, deleting and entering credentials still ask.

On Windows, what a check leaves running is found. The look Mori takes after building something now finds the processes it started on Windows too and stops the ones it can prove came from the check. A server that a project's own script starts in the background cannot be tied to the check on Windows yet, so Mori names it and tells you it may still be running. A command whose background process keeps hold of its output no longer waits forever. Windows users get everything in 1.33.8 with this release.

Also: a git config path with backslashes reads as a path in the question Mori asks about your commit identity, and an update download that Mori cancels because it stalled is no longer reported as a crash.

1.33.8: The check after the work stays small

Mac and Windows. We ran Mori head to head with two other agents on the same real tasks and the same model. Mori passed every task and was the only one with no wrong facts in its research, but it lost on cost and on a browser task. These are the causes, and they are fixed.

The look after a turn has a budget, and only the tools a look needs. When Mori builds a page, an app or a report, it takes one look at the result and fixes what is broken. That look now has a small fixed allowance of steps, tool calls, time and money. It can read, edit the work, take a screenshot, preview and run the project's own build, test and dev commands, and nothing else: it cannot start other agents, schedule anything, open another coding session or run a command it made up. Before, the look at one finished report cost more than making the report; a look at a report is now capped at a small fixed amount.

It runs only what your project defines. The commands a look may run are read from your project's own build files when the look begins, such as the scripts in package.json, and run exactly as written there. The look cannot change those files or anything in .git.

You hear what it did in one line. You are not shown a conversation with a critic you never saw. You get one plain line saying what the look checked and what it changed. A server it started is stopped when it is done. If anything else was left behind, such as a scheduled job, a launch agent or a git hook, Mori tells you and gives you a command that removes it; it never removes anything of yours on its own.

A report is not a build. An HTML report, even one that carries its own chart library, gets looked at, not sent through a build and test run it does not have.

Mori reads the whole page in your Chrome. Mori now sees all the text the extension returns, says plainly when a page was cut, and reads the dates a page shows, such as the release dates on a GitHub releases page.

Commits get your name, or none. If git is set up with a placeholder author such as your-email@example.com, Mori does not commit, merge, pull or tag under it. It tells you, and shows you the two commands that set your real name and email.

On Windows, the same words get the same care. "What's slowing down my pc", "how much space is left on my C drive" and "show me my PowerShell profile" are looked at on your machine, the way the Mac phrasing always was. Command output Mori wrote without running anything is flagged for PowerShell listings too, and the taskbar button shows how many approvals are waiting, as the Mac dock does.

Also: "list what is in" a folder lists that folder (it used to look for a folder called "what is"); a note under your message that says it is queued goes away once it has been sent; and a stalled update no longer claims it stalled before it started when part of it had already arrived.

1.33.7: Mori listens to what you asked for

Mac and Windows.

When you ask to be shown or told, Mori tells you. "Show me a TypeScript interface", "tell me how to run pytest", "explain what a monorepo is" and "how do I rename a git branch" get an answer in the reply. Before, Mori could decide it had to act, and try to run or write something you only asked to see; a how-to question could even be read as a file path or a command.

When you ask about your machine or the live world, Mori looks. "Show me package.json", "what is using port 3000", "tell me the latest node version", "what the bitcoin price is" and "show me the last 5 commits" go to Mori's tools and are checked, not answered from memory. If Mori replies to one of these without looking, it is sent back to look.

1.33.6: What a day of real work found

Mac and Windows. We drove Mori for five hours on a real account through real work: building and shipping a tool with CI, fixing a bug in a popular open-source project, cited research, a data analysis, crash recovery and automations. The work was strong. These are the things a paying user hit along the way, and they are fixed.

Updates arrive. An update could fail with a checksum error and then sit at "Downloading 1%" forever. Mori now always downloads the whole update, a stalled download says so within two minutes, and Retry starts again from zero.

You can see when Mori is waiting on you. When a command needs your approval, the run, the activity line, the tab, the title bar and Home all say "Waiting for your approval", and anything you type while the question is open is kept and sent after you answer instead of disappearing.

After a crash, Mori shows what happened. A turn that was cut off stays on screen with its steps and its cost, marked as interrupted, and continuing picks up from what was actually recorded. If Mori ever writes command output without having run anything, a note says so directly above it; your code answers are never changed.

A dropped connection says so. If the network drops while Mori is waiting on the model or partway through an answer, you get a clear sentence and /retry within about a minute, and the part that arrived is marked as incomplete. Stopping a turn keeps it on screen with what it cost, and the next message you send goes through.

Research workflows run in full. /workflow deep research now runs every angle it plans instead of dropping some, and one workflow counts as one deep research against your daily allowance, so the first workflow of the day runs on every plan.

Also: file search understands regex flags like (?i); you can approve every file change in a turn at once; the credits-left figure matches your provider; scheduled tasks can be paused; long fetched pages say when they were cut; and issue numbers in answers link to the issue.

1.33.5: Windows, driven

Mac and Windows. Everything in 1.33.4, plus what a day of driving 1.33.4 on a real Windows machine found and fixed. The Mac build is the same product; Windows users get four things.

A failing command now reports its own exit code. PowerShell, the shell every command lands in on Windows, reported 1 for any failing native program, so git, npm, node and python failures all read as "Exit code: 1" and Mori could not tell a missing file from a merge conflict. The real code comes through now, measured through the exact path the app uses.

The merge button asks first even without GitHub connected, and sc \\server delete reaches a verdict at the command guard like every other destructive spelling.

The benchmark runs honestly on a standard Windows account: the sections that need symlink rights declare themselves skipped instead of failing, and every pure decision still runs.

The published installer was verified on a real machine: the 1.33.4 update installed silently per user, no permission prompt, on the same layout that used to loop before 1.32.1.

Known, and written down rather than hidden: on Windows, deleting a stopped copy's folder in place fails on one socket file the brain leaves behind, even after a clean quit, and the Recycle Bin cannot clear it either; moving the folder under your temp folder first deletes it. (Corrected after 1.33.7: this note first said the Recycle Bin works, and that one copy in eight failed to start its brain. That brain was damaged by our own test cleanup, not by Mori; see WINDOWS_1337.md section 6.)

1.33.4: The honesty release

Mac and Windows. (1.33.0 through 1.33.3 were tagged and never published on either platform: the Windows release runner's own benchmark gate refused the first three, first because five lanes could not run on Windows at all, then because two lanes assumed POSIX path semantics, then because one search-speed bound measured on a Mac flaked on a shared runner; 1.33.3 was tagged with a commit that described that last fix without containing it, and was cancelled before it built. 1.33.4 is the same release with the bench telling the truth on Windows. No product code changed after 1.33.1.)

What you see now tells the truth about what ran. The workflow card counts what was actually sent to the model, not what was planned: a step opens on its first request, a wave that sent nothing draws no row, and a run that hit your daily research cap says so in words instead of ticking green. On a free plan, /workflow no longer spends your one deep-research call on the planner's own heading. Numbered lists render 1. 2. 3. instead of 1. 1. 1., and every number on the card carries the population it belongs to.

The credit meter is exact. Mori reports the provider's own per-request cost. Measured against the OpenRouter balance: 0.000% error over 93 requests. A turn that is killed keeps what it spent.

Mori picks up where it left off. After a crash or relaunch, work an earlier run already did is recognised by what it does, not by how the command was spelled, so a brief is fetched once, a pushed branch is not pushed again, and an announcement already sent is not sent twice. Nothing is ever skipped inside a single turn: if you ask twice, it runs twice.

The command guard asks when it cannot read. For repository writes, the default flipped from "allow unless a rule matched" to "ask unless recognised as safe": an expansion, a substitution, a wrapper script, an unknown program or a config key that runs code now raises a card instead of passing in silence. Inline scripts (node <<'EOF', python3 - <<'EOF') are read as data, not as commands, so they do not prompt. A headless client (the local API, a bot) that hits a card gets a clear refusal within thirty seconds instead of hanging. Read SECURITY_MODEL.md before relying on any of this: it is a layer that catches known shapes, not a guarantee, and the document says exactly what it does not catch.

Also: pr_open no longer sweeps unrelated uncommitted files into a pull request; channel-triggered automations fire only for the owner; copy_file and move_file go through the same protected-file chokepoint as every other write; the hook approval list has a real Settings page with a revoke button; case, symlink and ".." spellings of a protected path are resolved by the kernel, not by string comparison; and the benchmark runner refuses a lane whose tail it cannot read instead of scoring it zero.

1.32.1: Windows updates land

Windows only; the app is otherwise 1.32.0.

If Mori was ever installed for all users on your PC (releases before 1.30 did that), the background update could not finish: on quitting, the installer tried to ask for admin rights from a window that had already closed, Windows refused, nothing was installed, and Mori kept saying an update was ready. This release ends that. A per-user Mori now updates per-user, silently, with no permission prompt. A Mori installed for all users opens the visible installer instead of failing quietly, with "Only for me" already chosen; pick "Anyone who uses this computer" there if you want it kept for all users and can approve the prompt.

Mori also stops promising what it did not do: if a restart was supposed to install an update and Mori came back on the old version, the Updates card says so and "Restart to update" opens the installer rather than trying the same silent path again.

1.32.0: Set up, split up, and scripted

Five things changed that you will notice on the first launch, and one that only shows up when you ask for something big.

Setup happens before you ever see a sign-in box. A new Mori now opens on a short walk-through that checks what your computer already has. If Node, Python and Git are there it says so and moves on in about two seconds. If they are missing it tells you what it will download and how big it is, then fetches verified copies into Mori's own folder. It never asks for your password, never installs anything system-wide, and Skip for now is on every screen. You can run it again later from Setup.

You can run more than one Mori. A copy is a second window with its own settings, memory, sign-in, ports and projects, so a work Mori and a personal Mori can be open at the same time without tangling. Make one from Settings, Appearance. Your main Mori keeps the things that only make sense once: the phone link, the Chrome extension, updates, and the keyboard shortcut. A copy can borrow your API keys in one click, and those keys now stay put instead of being forgotten by the next thing you change.

She knows what is in front of you. Each message you send carries the name of the app and window you are actually in, your front Chrome tab when the extension is connected, and which terminals are open. Titles only: never a screenshot, never the text of a page, unless you ask for it. Settings, Permissions has a live preview of exactly what she would see, and one switch that turns the whole thing off, including the reading, not just the showing.

You decide where the money goes. A new Spend section splits the work into the parts you actually pay for: chat, building, research, housekeeping, helpers and the double-check. Saver puts the cheap model wherever it is safe, Full puts your model everywhere, and you can set any part by hand. Every time the policy changes what a call would have used, the receipt says so in a line you can read.

The new models are there. GPT-6 Astra and Astra Pro, the GPT-5.6 line, Gemini 3.8 and 3.5, Grok 4.6, DeepSeek V4, Kimi K3, Qwen3 Max, GLM 5.3, and the current Claude models including Fable 5.1. The cost meter learned every one of their real prices, so the number you see before a turn is the number you get.

Real workflows, written as scripts. Ask for something that needs a plan and Mori can now write a small program that runs agents for you: fan out over a list, have three reviewers vote and keep only what survives, or keep hunting until two rounds turn up nothing new. Four of those patterns ship ready to run. The script itself runs in a sandbox with no file access, no network and no clock, so the only thing it can do is spend the agent calls you allowed, and it asks before it starts.

Plus the usual: the app tells the truth in more places. A copy that failed to open no longer reports a process id. A details toggle that showed nothing now shows the tools it found and their versions. A settings page that always said Balanced now says what you actually chose.

This release also carries the bug hunt that was staged as 1.31.0 and never shipped on its own.

Thirty-five reviewers went through the build path, the browser agent, research, usage accounting and the parts that make the app feel slow. Everything below was traced to something you would actually notice before it was touched.

Work that did not happen no longer looks like work that did. When a file edit was refused, Mori booked it as a success: the reply got a green disk check for a file nobody wrote, and the receipt drew a diff card with real-looking line counts by simulating the edit in memory. Being told a file did not change is now treated as what it is, evidence that nothing changed.

Builds find their own folder again. Writing a .js, .ts, .py or .json file stopped registering the project, so a build that never made a folder first had no Preview, no Open Folder, and nothing in the build registry. Anything you build now opens.

The browser agent answers instead of hanging. Asking Mori to run a whole task in Chrome with the side panel closed used to wait three minutes and then say it took too long, because the part of the extension that runs tasks only exists while the panel is open. It answers at once now and names the tools that work without it. It also stopped describing the wrong tab: navigating a background tab reported whatever page you were looking at, and the numbered element list from one page survived navigation to another, which is what the guard that stops before paying was checking against.

Research is honest about what it read. A page replayed from earlier in a run said it was the page; it is a stored extract, capped and whitespace-collapsed, and it says so now. Blocked and refused fetches were being filed as real sources. And a number in an answer could pass its own fact check by matching a fragment of a different number on the page, so a made-up $42 grounded itself against a 1420 that was really there.

The usage numbers are the real ones. Anthropic reports cached and freshly written tokens separately, and Mori was reading only part of it, so cold turns undercounted and the receipt could show more cached tokens than input. Cache writes, the dearest tokens on any cold turn, were counted nowhere. A Discord or Telegram turn swept the desktop's running total into its own. The API receipt could report another turn's tokens as its own. Two model calls, video frame analysis and the planner, billed real money and appeared in no total at all.

It feels lighter. A long file streaming into a reply rewrote its whole highlighted block about twelve times a second. The task store was re-read and re-parsed after every single tool call. Every past turn's thinking sat in the page behind a zero-height box for the life of the view.

And asking for a setting changes it. "Make the chat text bigger" saved the setting, said done, and changed nothing until the next restart.

A second hunt went through memory, the scheduler and the security edges.

Nothing can quietly overwrite a memory with a different answer. Saving "the demo for the investor is Friday" and later "the demo for the client is Monday" used to leave ONE file, named for the investor and Friday, saying client and Monday, with the first fact unrecoverable. The rule that refuses this existed for the nightly tidy-up only; it now guards the path every automatic save takes.

A deleted memory stays deleted. Deleting one in the Memory page, or having the nightly tidy-up merge it away, left no record of the deletion, so the next sign-in pulled it back from the cloud and pushed it up again. The dialog said "This can't be undone" and it was the delete that did not stick.

Arguments cannot be read as commands. Several tools built their command line by quoting with the wrong kind of quotes, which still let a shell run anything inside $(…). Since those arguments come from a model that reads web pages and messages, that is the whole attack.

Your autonomy setting stays where you put it. Changing anything else, a theme, a font size, used to write the level from app launch back over it, so a change made this session was gone by the next start.

A workflow step that did not succeed no longer reports success, and a scheduled run will not start beside work you are already doing. The check meant to prevent that was reading a status label that is idle for most of a running turn.

1.30.0: Cheaper builds, and a status line that tells the truth

Builds cost less. Mori's prompt has an unchanging part and a part that moves with each task, and the two were mixed together, so the provider's cache threw the whole thing away and Mori paid to write its own prompt again on every task. They are separated now. On our coding benchmark that took the cache hit rate to between 87 and 94 percent per task, cut the cost of the same five builds by a fifth, and closed most of the gap to the cheapest rival we measure against, while finishing that work in half its time.

When a change is waiting for you, the status line says so. On Guided autonomy every file write stops for your approval, and while it waited the line kept reading "Mori is building" with the clock running. A build held one click from finishing looked exactly like a build that had hung. It now says it is waiting and names the file it is holding.

Errors stopped describing recoveries that already failed. A turn that ran out of credit used to sign off with "retrying once at that size", which was a plan it had already tried and lost. It now says the account is out and that retrying will not help. When the balance is empty before a task starts, Mori refuses to start and tells you so, rather than leaving something half built.

Anything that talks to Mori's local API hears back quickly when the window is not ready. Before, a script that arrived while the app was still loading, or after its page had crashed, waited ten minutes and then got told the turn timed out. The window now acknowledges work the moment it picks it up, so the server can tell nobody listening from still thinking, and the answer comes back in fifteen seconds naming the real state.

You can see your money. The wallet shows your OpenRouter balance and what this key has spent today, this week, this month and ever, next to what this session and today cost. A negative balance says overdrawn, never zero. Streamed replies are metered instead of counted as unknown, spend is counted once however many surfaces finished a turn, and a retried or fallback call is billed on the receipt like any other.

Long answers finish themselves. A reply cut off by the output limit continues instead of stopping mid sentence, and a turn that comes back empty is asked again rather than handed to you blank.

1.28.0: One place for the workbench

The Mori button is the whole workbench now. Open it and you get five tabs in one drawer: Mori, Tasks, Terminal, Code and Preview. Moving between them no longer means closing one thing to open another, the background task list finally has a proper home with per task Open and Stop, and the little side chat that lived in the panel is gone. Steering a running task happens where it always really did, in the main composer, and the panel says so.

The composer row got its space back: Terminal, Code and Preview left it for the drawer tabs, so what remains is Attach, Skills and Deep Research, with the model, depth and Mori controls pinned right.

  • The three dot menu no longer renders see through with chat text cutting across it. The chat text was painting on top of the open menu.
  • Day mode no longer leaves a black window ground behind rounded corners and overscroll. The boot script painted it once and nothing ever updated it.
  • A fresh install no longer reads every finished task aloud. Spoken replies are off until you turn them on with the voice control.
  • Home grew up. Returning users get a greeting, the machine's live state, and a Continue row that jumps straight back into recent conversations. New installs keep the proper introduction. The duplicate sidebar logo is gone, Bots moved in with the surfaces, and Sessions stopped wearing Chat's icon.
  • Routines grew a sixth: Tidy the Downloads folder, weekly, moves files into folders and deletes nothing.
  • Setup installs the whole toolbelt in one click, with per tool progress, checksum verified downloads into Mori's own folder, and an honest report of what landed, what already existed and what cannot be fetched on this platform yet.

1.27.0: The connection that kept dropping

Most of this release is one discovery, made by driving the app on real credits rather than trusting a green test run: large requests to the model provider were failing about half the time.

It was measured, not guessed. Eight identical large requests from inside the app, four of them dead; the same request from a plain script succeeded every time. The app speaks HTTP/2 to the provider and a plain script speaks HTTP/1.1, and the difference was costing whole turns. The longer the conversation, the worse the odds, which is exactly backwards from how a tool should behave.

  • Long chats and research runs stopped dying mid work. Big requests take the reliable route from the start now, a failed one is retried, and a second path backs both. Verified on a live run.
  • Research that loses its final write up hands back what it gathered. It used to throw away every note it had collected, after the tokens were already paid for, and tell you almost nothing.
  • A turn you cancel says it was cancelled. When a stop lands at the same moment as a request the browser reports a network failure, so stopping your own work looked like a broken internet connection.
  • Crash reporting was starting in one half of the app while the other half was switched off, leaving a broken reporter wrapped around every network call. Both halves agree now.

Also in this release:

  • The Chrome extension works in a background tab. Mori can read and act on a tab that is not the one you are using, see inside cross origin iframes, read a page's console, run JavaScript in the page, zoom into part of a screenshot, drag things and use keyboard chords. Messages from the side panel to your desktop are signed.
  • Discord and Telegram show her commands natively. Type a slash and they are there with descriptions, from the same single list the desktop uses.
  • Research reads sources, not summaries of sources. The final answer is written with the actual text of the pages that were read in front of it, its figures are checked against what was really fetched, and the same page is never fetched twice by two different angles. It keeps digging while it is still learning something.
  • A command sent from the command line or the API no longer waits on an approval dialog sitting on a desktop nobody is watching.

Windows note: this build also fixed thirteen internal test lanes that had never once run on Windows, because they loaded their subject by file path and Windows paths are not valid module URLs. They had been reporting success while testing nothing.

1.21.0: The things that looked fine

Everything below was green somewhere before this release. A test passed, a screen rendered, a tool appeared in the list. Each one was still broken.

  • Nobody else can pair to your Mori. The phone link ran on a channel anyone who knew your account id could join, and it accepted a pairing handshake from anything that sent one, with no code and no signature. Driven end to end: an anonymous client became the paired phone, survived a restart, and its next message arrived with owner permissions. A pairing is now only accepted as the answer to one you asked for, and it expires. Your phone needs no update.
  • Her memory works again. Recall was calling for a model it never had, so every "what do you remember about" came back empty while the Brain page reported READY, and the failure itself was being read to her as though it were a memory. Both halves are fixed, and a failed lookup can never again be presented as something she recalls.
  • Seven listed tools could not run. Both video tools answered "Unknown action" on every call, and all five Skills Hub tools reported the hub unavailable. They are wired to code that was already written and already tested, and the bench now refuses to let a tool be listed without a path that runs it.
  • The first-run terms describe this app. They named no company, and said your chats sync to a database you configure and that we never receive your data, neither of which was true once plans and sync existed. Rewritten to match the privacy policy, which was already correct. You will be asked to accept them once.
  • The cost estimate is right. It quoted three times too much for Opus 5 and three times too little for Fable 5, off a price table a generation out of date. Every model is now priced against the live catalog.
  • A free account is no longer told it has a subscription, and the plan chip reads from what you actually pay for rather than a server setting.

Underneath: the managed proxy can no longer be talked into serving a model your plan does not include, usage is recorded against the model that really answered, and the publish step refuses to ship a build it cannot prove was notarized.

1.20.2: The other half of the same fix

1.20.1 stopped the argument of every typing hand reaching the durable record. It missed that the result is a record too, and on some paths the result handed the value straight back. This closes that, on both platforms.

  • What she types no longer comes back in the answer. A typing hand's result used to read "Typed: <the thing you typed>". The argument had just been withheld from the log, and then the result printed it anyway, to the model and into the activity view. Every typing path on both Windows and macOS now reports a character count instead. Proven by typing into a real application and reading the log file back afterwards.
  • Reading the clipboard is now treated like writing it. Putting a password on the clipboard was already withheld; reading it straight back wrote it to disk in full. A clipboard is where a password manager puts things.
  • Crash reports from the main process are covered too. The fix in 1.20.1 reached the window but not the process where the work actually happens.
  • Tools from your own connected servers are covered. A list of names can never include a tool someone else supplies, so what gets withheld is decided by the shape of the request rather than by a name we knew in advance.
  • The character count now describes what you typed, rather than the length of the notice replacing it. A number that is wrong reads like evidence.

1.20.1: What she types into a page stays between you

A security and honesty release. Nothing here is a new feature; all of it is Mori keeping promises the last version only appeared to keep.

  • Nothing you type into a page is written down any more. Her tool results already hid password fields from the model, and the durable record beside them held the password in plain text, appended to the activity file in your application data and printed on the Home page and in Settings, in the very same row that said the field was hidden. Every hand that can put a value on a page or in an app now withholds it and writes the character count in its place.
  • Crash reports no longer carry your session. Console output was attached to every error report and uploaded, and this app narrates what it is doing constantly. Those breadcrumbs are dropped before they can leave the machine.
  • Research from GitHub is treated as a stranger's writing. Issue bodies and code comments are text anyone can author and get indexed, and reading one issue pulls its whole comment thread. That content now crosses the same untrusted boundary as a web page.
  • "Close that tab" works. She refused to close any tab she had not opened herself, which is every tab you opened. She now closes a tab you name and tells you which one went, and still will not tidy your browser on her own initiative.
  • She stops at the payment step without lying about the form. She used to list fields as filled that the browser had refused outright. She reads the form back now before handing you the final button.

1.20.0: She stops telling you things she has not checked

Nineteen capability gaps closed, and then a night of driving the real app on a real machine, which is where the interesting part happened. Five bugs came out of that session. Every one was a green light that promised more than the code had measured.

  • A verification badge that could not lie. "Verified: 1/1 change confirmed on disk" only ever checked that files she wrote exist. It now says what it did.
  • Tool parity across Mac and Windows, with the gaps named rather than quietly missing.
  • Her own benchmark refuses to publish on stale proof, a claim with no fresh evidence behind it does not make the page.

1.19.0: Workflows live, agents yours, routines on home

  • Real workflows. Multi-step work runs as a visible plan with live boxes you can watch, not a wall of tool calls.
  • Agents you define. Roles with their own tools and instructions, saved and reusable.
  • Routines on Home. Schedule the things you ask for every day, and see them where you start.

1.18.2: She knows what you pay for

A money and entitlements release. Nothing here changes how she works. It changes whether the app agrees with your account about what you bought.

  • An unreachable server no longer means Free. Signing in fired one 8 second call to ask what plan you are on, and every failure of that call became the answer "free" for the rest of the session. If you paid, you spent that session on free limits, with the app telling you to upgrade to a tier below the one you already owned. It knows the difference between being told Free and not being told now, retries, and falls back to the last plan the server actually gave you.
  • The server stopped inventing an answer. The endpoint behind that call returned a cheerful "free" whenever its own database query failed. It says it could not answer instead.
  • Free managed mode actually works. Leaving the model chip on Auto in Managed mode was refused for anyone on Free, because the request was classified as a premium model before the code that resolves Auto to the free model ever ran.
  • A declining card no longer strips your plan. Stripe marks a subscription past due the moment one payment attempt fails and then retries for days. The app kept your tier through that window and the database disagreed. They agree now.
  • The App Store and the web can no longer both bill you. Subscribing on iPhone and then buying again on the site would have opened a second paid plan against the same account.

Every fix here was found by an adversarial audit of the money path rather than by a bug report.

1.18.1: Stop actually stops

A fix release. If you were on 1.18.0, the Stop button in that build could not reach a running command.

  • Stop kills what it started. Two bugs sat on top of each other. Nothing tagged a spawned process with the run that owned it, so the scoped kill matched nothing every time. It read as "Stop works sometimes", because cancelling a model call always worked and the moment a shell command was running Stop did nothing. Fixing that exposed the second: a persistent terminal session lived where Stop never looked, and it is the path she prefers for long work.
  • Stop tells you the truth. The toast said "Stopped." whether or not anything was reached. It still answers instantly, and now corrects itself if the kill came back empty.
  • The model chip named your pick, not what ran. Sitting on Opus, a request could still go out as Haiku. It shows both now.
  • Forge, Trance and Swarm were partly decoration. The frontier gears bought effort and depth and then let the classifier swap the model out from under them. They refuse the downgrade now.
  • Commands stopped appearing in the chat body. A command she ran belongs in the activity log and the card, not a third time in the sentence.
  • Asking what she is no longer goes to the web. She knows her own name, version and platform, and answers instantly.
  • Deep Research remembers being on. It was missing from the defaults, so every launch painted the toggle off.

1.18.0: Porcelain, and a light she can live in

The app now wears the same system as this site.

  • Light blue, not pure white. The site's near white read flat on a dense app screen, so the app's grounds carry a blue cast. Self hosted type, titles in the sans, and a serif kept for real italics.
  • Night mode is one press. The title bar and Settings both return the original dark Mori look, and it survives a restart.
  • Custom themes are parked, never destroyed. So is any preset you picked on purpose, so someone on Midnight lands back on Midnight.
  • The sign in page matches the site. Same account, same look, across the desktop app, Mori Link on iPhone, and Mori Chrome.
  • Floating panels got an opaque face. A translucent popover reads solid on dark and invisible on light, which is how the overflow menu vanished.

1.17.0: Watch her work

You can watch the work now, from the first thought to the proof.

  • The right rail. Plan, activity, files, and preview sit beside the chat instead of scrolling it away. The conversation and the work stay visible at once.
  • Live phase boxes. Plans render as numbered boxes with honest counts, each one pending, in progress, or done as she moves.
  • Thinking that types. Reasoning streams in word by word and holds until the last word lands. The pace is capped for reading, and the words are real.
  • The workflow card. Deep research runs on an inline card in the chat: waves, sources, and the trail that produced the answer.
  • The composer queue. Send while she works and the message queues, then folds into the run in order.
  • The CLI auto-demo. A build that ships a command line tool ends with a live demo run in a real terminal.

Shipped for macOS and Windows.

1.16.0: Every chat is its own

The deepest change under the hood since Mori shipped: each conversation now runs on its own engine.

  • Chats can't bleed into each other anymore. Another chat's plan, steps, or receipts can no longer show up in the wrong conversation, each one carries only its own work.
  • Stop any task from the background panel. Hover a running task, hit Stop, and exactly that one stops while everything else keeps building. The tray Stop now honestly stops everything, in every chat.
  • The status pill answers for the whole app: whichever chat is actually working is what you see, and one chat finishing no longer blanks a busy machine.
  • Ollama models on tap. Ask for local AI and Mori pulls the model you need (with your OK, they're big), then verifies it's really there before continuing.

1.15.0: She sets up the machine

The first slice of Mori Infinite: any task, gated by your credit, never by the app or a missing runtime.

  • A build never dies on "command not found." Mori checks what your machine has, node, npm, python, git, ollama, and installs what a task needs through your own package manager (Homebrew on Mac, winget on Windows), asking you first. No package manager? She hands you the official download instead of piping remote scripts into a shell, that line does not get crossed.
  • Credits are checked before the build starts. An empty OpenRouter balance gets a clear "top up first" before any work begins, never again a half-finished build dying at a 402 five minutes in. A low balance gets a heads-up and keeps going.
  • Plus everything in 1.14.2, for anyone catching up.

1.14.2: She knows what she's clicking

A safety hardening and the two most-reported paper cuts.

  • Stricter stop-at-pay. Mori never clicks the final pay button, that was already the rule. Now she also refuses to click anything she can't identify: if the page changed since she read it, she reads it again instead of clicking blind. And with several chats using your Chrome at once, each task keeps its own approval and its own view of the page, one chat's "yes" no longer covers another's.
  • Mori's mark on the Mori panel. The panel header and its composer button wear her icon instead of the same sparkle the Skills button wears.
  • Small windows behave. Opening a side panel in a small window used to crush the chat into an unusable sliver. The panel now measures the space it actually has and always leaves the chat room to breathe.

1.14.1: Stop means stop

Two fixes on top of 1.14.0, both reported after install.

  • Stop actually stops. It only ever worked if it caught a network request in mid-air, which is why it looked random: pressed between steps, inside a running command, during a sub-agent, or while Mori was driving your browser, it did nothing at all. The stop signal was being erased one line after it was set, by the very call meant to enforce it. It now holds until the work has genuinely wound down, on every one of those paths.
  • Mori's face is back on the pill. The always-on status pill and the app's own window icon were falling back to a plain dot, so the pill read as an older, different one. The logo was being packaged into the wrong folder, a bug that is invisible when running from source and only appears in an installed build. Fixed on Mac and Windows, with a check that now compares the packaging config against the code that reads it.

1.14.0: She tells you first

Mori answers before she builds, says what she understood and how she'll do it, and names the point where she'll need you, before she gets there, not after.

  • Answer first. A question gets an answer, not a build. Ask "should I move this to a framework?" and she reads the actual files, then gives you a recommendation and the one trade-off that matters. Ask a question *and* give an order in the same message and she does both, in that order. A plain build order still goes straight to work, it just tells you the plan first.
  • She says what she is about to do. Every task now opens with her reading of the ask, the approach and why, and anything she decided for you, before the first tool call, not buried in the summary at the end. This applies to everything, not just building. It stays in the chat too, so stepping away to another conversation mid-build and coming back no longer leaves you looking at tool activity with no idea what she set out to do.
  • She tells you where she will need you. A job needing a Supabase project, Stripe keys, a deploy under your hosting account or an App Store submission is flagged in the *first* reply, with what she needs and why. She builds everything she can, gets right up to the wall, and stops there with the exact ask, instead of inventing a placeholder key and handing you something that looks finished and works nowhere.
  • Visible plans. Work with three or more real steps shows a live plan with done / in-progress / remaining, updated as she goes.
  • The Mori panel got honest. Ask it mid-build and it answers from live state instead of last turn's: the files it just wrote, the actual error text of anything that failed, and where it really is. Typing an instruction into it now reaches the build, before, an instruction containing a word like "progress" or "status" was silently answered as a question and thrown away.

Fixes. A terminal line ending in an erase sequence no longer swallows the whole message. A failed review whose finding began with "None" no longer renders as nothing at all. Every CLI tool failure is now recognised as a failure, so the repeat-failure guard actually fires. An ordinary commit can no longer be mistaken for passing test evidence. A message queued in one chat can no longer be delivered into another. A piece of work handed to a sub-agent can no longer land in a previous project's folder: ask for a site at one path right after building one at a similar path, and the files go where you asked. Deep research stays attached to the chat that started it. A dead shell no longer bricks its terminal session, and terminal output can no longer grow without limit. And when the provider says you can afford a smaller reply, Mori retries at that size instead of failing the turn and telling you to top up.

1.7.0: The Claude-grade mind

Memory grew up, vague references resolve, and every past conversation is searchable word for word.

  • Memory rewrite. Every fact is now its own markdown file with a findable one-line description, a tiny always-loaded index, enforced update-not-duplicate, first-class delete with tombstones, and [[links]] between memories. "The demo is Friday" is stored with the actual date. One-time migration from the old store, with a .bak backup.
  • The entity resolver. "The guy from the demo", "that site", "my resume", a universal registry maps slight terms to the real person, file, URL, build, app, or past chat, and asks one short question instead of guessing.
  • Total recall. Full-text search over every past conversation's raw transcript, /sessions <query> or just ask. Export any chat as Markdown or a styled HTML page with automatic secret-scrubbing (/export, --redact for more).
  • Real schedules. A main-process cron service: 5-field cron expressions, at: one-shots, every:N intervals, running with the window closed, missed runs fired once on wake, never replayed. Heartbeat checklists that stay silent unless something's wrong, and an off-by-default localhost webhook to poke her from scripts.
  • The Brain works out of the box. No Ollama? A built-in local embedder keeps the knowledge graph alive at $0, honestly labeled as lexical-grade, sticky per brain, never silently switched.
  • Nothing durable is lost. Facts are flushed to memory right before a long conversation compacts, and bot replies are recorded before sending, recovered exactly once after a crash.
  • New Memory page. Browse, edit, and delete everything Mori knows; inspect the entity registry; read the nightly dream-consolidation reports.
  • /retry and /branch are real, and cold start measured at 0.7s.

The deep dives live in Memory and Automation & schedules.

1.6.2: Memory fix, polished

Small release, real fixes.

  • "Open the game you built" actually opens it: a fresh chat asking to open/run/launch a past project reliably enters the tool path and opens the real thing.
  • Cleaner recent-builds list. Saving a loose file to Desktop or Downloads no longer mistakes the whole folder for a project.
  • "Open Terminal / Notes / Music" launches the real app again, even with a same-named folder around, and project paths with parentheses are handled correctly.

1.6.1: Memory 1:1 + honest usage

Cross-chat build memory and a plan meter that tells the truth.

  • Open what you built, from any chat. A durable index of every project Mori builds, so a brand-new conversation can "open the game you just made" and land on the exact folder.
  • The plan meter is honest. On your own API key it says so ("on your own key") instead of showing a stuck 0%, with one tap to switch to your Mori plan. Keyless subscribers default to their plan automatically.
  • All 154 tools verified wired end-to-end: nothing declared that can't actually run, and dead code removed with no behavior lost.

1.6.0: The brain + true agent

A real memory Brain, terminal sovereignty, and the autonomy ladder.

  • The Brain. A private, on-device knowledge graph that remembers people, projects, and files across every conversation and answers "what were we working on?" with cited sources and honest gaps. Runs fully local on Ollama, with its own Brain page.
  • Never loses the thread: the active task always comes first, so an old project can't hijack a session just because it looks similar.
  • Named terminal sessions that stay alive across turns, local, Docker, or SSH, and you can type into the same shell Mori is driving.
  • Autonomy ladder (Guided / Trusted / Commander) with time-boxed grants and a Stop that really stops; computer use shows a floating pill with a Stop button even when the app is minimized.
  • Mori for Traders: market research, backtests, and paper trading, never real money, plus local Ollama models for internal chores.

See The brain, Terminal sessions, and the Autonomy ladder.

1.5.0: Command Deck

Mori stopped being one conversation.

  • Multi-pane chat. Run two, three, or four live sessions side by side, Single, 1+1, or 2×2: each with its own conversation, model, and composer. Cmd+1-4 jumps between panes.
  • Broadcast. Type once and send to every pane at once, compare the answers side by side, then Promote the winner. The losing panes are archived in both stores, never deleted.
  • Truly concurrent. Panes run at the same time without stepping on each other.
  • Settings by chat. Tell Mori "switch to the Terminal theme and Forge stage" and it happens through configure_app: but sensitive settings (autonomy, API keys, billing) can never be changed by chat, only in Settings.
  • Session-scoped engine. Under the hood the whole chat engine now keys off a session id, so steering, Stop, the usage meter, and verification are all per-pane.

The deep dive lives in Command Deck.

1.4.0: Sovereign II

The reskin, the migration path, and skills that version themselves.

  • Theme Studio. Six shipped looks, including a full Terminal skin, a live token editor, and import/export of your own theme.
  • Import from other agents. One click pulls your skills and memories in from Hermes, Claude Code, or OpenClaw. Everything lands pending your approval; nothing is trusted on arrival.
  • Skills 3.0. The open SKILL.md standard, semantic-version history with rollback, an in-place editor, and an approve/reject flow that covers both Mori's own drafts and imported skills.
  • /learn. Teach Mori a new skill from a folder, a link, or "what we just did."
  • Mid-run learning. A failing step becomes a lesson the very next step can use.
  • Kanban, for real. Rename, add, and reorder columns, set WIP limits, and switch between Board and List views, while workers still only pick up what you stage as Ready.
  • Always-on plan meter. Every signed-in user watches their usage fill up right in the composer, with reset times on hover.

See Theme Studio, Import from other agents, Skills, and Context & usage.

1.3.0: Sovereign

Persistent shells, a real autonomy model, and the slash layer.

  • Named terminal sessions. Mori keeps real shells alive across turns, local, docker, or ssh: and you can type into the same session she is driving.
  • Autonomy ladder. Guided / Trusted / Commander, with time-boxed grants, a live countdown, and an append-only action ledger. The hard safety floor can never be bypassed, on any rung.
  • Context transparency. Click the usage chip for a full token breakdown, a next-turn cost estimate, and one-click Compress.
  • Slash commands. Type / in the composer, /usage, /compress, /clear, /model, /autonomy, and more.
  • Artifact cards. Files Mori makes for you now show as rich cards with Open, Reveal, and Preview.
  • Better bot replies. Discord DMs get real file attachments, and long replies chunk cleanly without breaking code blocks.
  • What Mori knows about you. View and edit your profile right in Settings.
  • Ollama support. Run local models, with an automatic one-hop fallback if your primary provider fails.

See Terminal sessions, the Autonomy ladder, Slash commands, and Context & usage.