AITerm Changelog

0.25.7 Honest to the last step

• The agent’s last word is its own. When an agent task ends right after a step that failed or was blocked, its closing summary no longer sits under a green check. It is drawn as the agent’s claim, with a note that the last step did not succeed, in the Autopilot panel and in the bar.
• The safer alternative shows its risk. Taking the safety gate’s safer alternative now loads it into the bar with its own risk badge instead of none.
• A line that ran as something else. In zsh, when the shell reports a different identity for the line it ran than the one you approved — a plugin such as oh-my-zsh’s paste magic rewriting what AITerm typed, or a locale or shell setting — AITerm warns you before the next step and writes a LINE DIVERGED row in the audit log beside the approved line. The warning stays through the next approval until you dismiss it.

0.25.6 What you approve is what runs

• zsh with set -e. If your .zshrc turns on set -e, AITerm’s zsh integration left you with a dead first prompt since 0.25.4. Fixed.
• What you approve is what runs. An approved command used to be typed into your shell as keystrokes, so a vi-mode binding such as jk could edit it on the way in. It is now inserted as literal text in zsh, bash and fish, and a command holding a raw control character or tab is refused with a hint to write it as \t or \033 instead.
• Plainer waiting messages. When AITerm holds a step, the message says the terminal may have unsent text even if its prompt looks empty, and how to clear it. The file-write card says Approve writes the file after any required confirmation. Report a Problem names the form choices that match your Mac.

0.25.5 Clean lines for strict shells

• bash with set -u. If your .bashrc turns on set -u, AITerm’s bash integration used to print an error at every command and tell AITerm nothing: it could not see when your commands started or finished. It now works under it.
• zsh vi insert mode by name. With a zle-line-init hook or plugin that selects the vi insert keymap by name (zle -K viins), an empty Return you typed ahead no longer makes AITerm wait for you to clear an empty line.

0.25.4 Keys where you left them

• The agent never types onto keys you left behind. In zsh and bash, a key you pressed just as a picker like fzf closed could land on your next command line without AITerm knowing. The shell now tells AITerm, and the agent waits for you to clear the line.
• No false “line has text” after a program exits. Leftover terminal replies that zsh discards, and an empty Return you typed ahead, no longer make AITerm wait for you to clear an empty line.
• Plays well with your shell setup. AITerm’s zsh hooks run alongside your own line hooks and plugins such as zsh-vi-mode and powerlevel10k — yours still run, once each — and the check works even when your .zshrc doesn’t touch the line editor.
• fish 4.1 and 4.2, tested on the real releases. A line fish rejects at a new window’s first prompt is reported. On fish 4.3 and later, a line fish never answered that you clear with Backspace now ends as not run.
• Consent that names the destination. The prompt says where your request goes — Microsoft Azure, Amazon Bedrock with your AWS credentials, or your own server by name. The Handbook explains Checking… and Allow cloud use….

0.25.3 Every line accounted for

• The agent never types onto a line you started. In zsh and bash, a key you pressed in the instant a command finished could be missed, and the agent’s next command was typed onto what you had begun. AITerm now waits — at most a twentieth of a second — until it knows where the key went, and when it can’t tell, it waits for you to clear the line first.
• fish: every line accounted for. On fish 4.1 and 4.2, a line fish refuses is now reported instead of leaving the step running. A line fish never answered that you clear with ⌃C and then Return now ends as not run, instead of taking the result of the next command you run. And with fish_transient_prompt on, a line fish is about to run is no longer reported as refused.

0.25.2 Doors, polished

• Consent you can read before you give it. When your connection is waiting for your OK to use a cloud model, setup’s Allow cloud use… shows what is sent and to whom before you agree. The main window’s prompt now uses Claude Code’s and Codex’s own words — your sign-in, not an API key.
• Clearer doors. The Claude Code or Codex door says “Checking…” while it checks, a door in use shows one checkmark, and a button looks like the default only when Return presses it.
• Typing around a command is read right. In fish, zsh and bash, AITerm keeps better track of keys you type just before or after a command finishes: the agent never types onto a line you started, and a line is not reported as refused when the shell simply drew its next prompt.
• Fixes. A managed-MLX setup request at launch opens Settings ▸ AI instead of being dropped; a plan change while the subscription step is open gives Get started and Skip their keys back; a disabled Save key & check looks disabled in dark mode.

0.25.1 Three doors

• Setup shows at most three ways in, chosen from what is on your Mac. Your Claude Code or Codex subscription when its CLI is installed (an AITerm Pro feature, included in the 14-day trial), an OpenAI or Claude key, or AI that runs on this Mac with Ollama. Everything else — your own server, Groq, OpenRouter, Azure, Bedrock, managed MLX — is one click away under More….
• Paste a key and you are done. The key door saves the key to the macOS Keychain, sends it only to that provider, picks a model and checks that it works. It says when the key is rejected, when the provider is down or rate-limiting, and when what you pasted looks like another provider’s key — and then sends nothing.
• Sign in… for a signed-out CLI. When Claude Code or Codex isn’t signed in, setup opens a tab that runs its login.
• Learn the basics opens the Handbook on Getting Started, and Check again re-runs the connection check from setup.
• The Handbook’s Getting Started page walks through the three doors.

0.25.0 Ready when it says so

• AITerm checks that your AI connection works. After you apply a connection, switch to one, or pick one in setup — and once at launch — AITerm sends one short message (“Reply with the single word OK.”) and shows the result: a mark on the status bar’s connection chip, and a line in Settings ▸ AI under the selected connection with a Check button. When it fails, the line says why and what to do: the key was rejected, the CLI isn’t signed in, the model isn’t offered, the engine isn’t running, you may be offline. A check never runs while you are waiting on an answer, never before you have agreed to use a cloud model, and sends nothing from your terminal.
• The status bar names your connection. The chip shows the connection’s name and model — “Select model” is gone; a connection that needs a model and has none says so and offers to choose one.
• Run, Edit and Discard buttons on a proposal. The keys still work (Return, click into the field, Esc); the buttons make them visible. While an agent run is active, the run’s own panel keeps its controls.
• One click to use a saved address. When a saved server was moved and asks for its key, the notice now has a Use saved address button that does what clicking the server does; Apply is still yours to click.
• Help ▸ Report a Problem… opens the public tracker with your AITerm version, macOS version, chip, the kind of connection and your safety profile filled in — never a key, an address, a server or model name, a command, or anything from your terminal.

0.24.7 Settings you can resize

• The Settings window really resizes now. Drag its bottom edge to make it taller or shorter, and it keeps the height the next time you open it. In 0.24.6 the window could not be dragged: macOS turned the resize off again right after AITerm turned it on. AITerm now keeps it on. The width stays the same.

0.24.6 Escalate to Opus

• Escalating to Claude Code can use Opus. In Settings ▸ AI ▸ Escalation model, Claude Code now has a Sonnet / Opus menu, and a stalled /fix is handed to the model you choose. Before, the Model field was ignored and Claude Code always ran Sonnet. Picking Claude Code starts on Opus; an escalation you set up earlier keeps running Sonnet until you change it. Opus uses more of your Claude subscription than Sonnet.
• Codex says what it runs. Choosing Codex as the escalation connection shows “Uses Codex’s default model” instead of a field it never read.
• The Settings window can be taller or shorter. Drag its bottom edge to fit your screen; AITerm remembers the height. The width stays the same.

0.24.5 Settings, side by side

• The AI tab is side by side. Your connections are listed on the left and the selected one’s settings on the right, each scrolling on its own. Picking a connection no longer jumps the window down to its settings, and New custom server… and Set Up AI… stay in view under the list. The Settings window is wider to make room.
• The tab is called “AI”. The Settings tab that was labelled “LLM” is now “AI”, and messages that point you there say Settings ▸ AI.
• Renaming a server keeps its key. In Change address…, editing the name and clicking Save address renames that server and keeps its saved key, instead of adding a second server. A name another connection already uses is refused, and nothing changes.
• A key your Keychain wouldn’t share is named as such. When the Keychain refuses to let AITerm read the key of the connection you pick, AITerm now says it couldn’t read the key and asks you to unlock the Keychain and pick the connection again, instead of saying the key is missing.
• Settings tells you the second step of a moved server’s repair. After you type the key a moved server asks for and click Apply, Settings stays open and says “Key saved. Click “<name>” again and Apply to use it at its saved address.” (If you close Settings before that second step, it asks for the key once more.)
• Smaller fixes. The “key you typed was discarded” notice ends when you pick another connection or close Settings, instead of following you to unrelated screens. The custom-server sheet labels its fields and shows real placeholders.

0.24.4 Keys, settled

• The model menu stops asking your Keychain over and over. When your Keychain refused to let AITerm read a key, the model menu asked again every time you typed. Now it asks once, and a server whose key couldn’t be read stays in the list, marked “key couldn’t be read”.
• Saving a key never deletes the one you had. AITerm now updates a saved key in place. If your Keychain refuses the change, the key you had stays saved, and a prompt you declined isn’t asked again right away.
• A server whose address moved asks for its key. If an earlier version changed a saved server’s address while it couldn’t check the key, AITerm now asks you to enter that server’s key again — when you pick it or open Settings — instead of using the key it had stored. Type the key and click Apply, then click the server once more and Apply to put it back on its saved address (for an Azure OpenAI connection, type the key and click Add Connection).
• Amazon Bedrock saves its keys first and checks the region. Adding or re-saving a Bedrock connection saves its AWS keys before anything else, and says so in the Bedrock fields if they couldn’t be saved. A region has to look like one (such as us-east-1).
• Changes to the connection you’re using take effect at once. Re-saving your current Azure OpenAI or Bedrock connection with a new deployment or model switches to it right away, deleting the server you’re using switches to local AI right away, and after you save your current connection in its sheet, Return keeps the cloud model.
• Settings says what it did. A key you typed and then left behind by switching connections is named as discarded; a server running at a different address than it was saved with shows both; Change address… opens “Change address for <name>” with a Save address button.
• Smaller fixes. A locked Keychain no longer makes the signed audit-log export create a new signing key — the export says to unlock and try again. The launch model check never undoes a switch you made while it ran, never fills an empty model with an embedding model, and moves an OpenAI-compatible provider left on an embedding model (which can’t chat) to a chat model — your own saved servers keep the model you set.

0.24.3 Every key in its place

• The key Settings shows is the key your connection uses. For some OpenAI-compatible setups — one whose shared key hadn’t yet moved to its provider’s own slot, or a provider whose address changed — the API key field showed one saved key while saving wrote another, and clearing the field could delete a key you weren’t looking at. Now the field, Save key & load models and Apply all use the key your connection sends. Moving a shared key to its provider’s own slot never overwrites a key already saved there.
• Picking another model keeps each provider on its own key. Choosing a model in the quick switcher (or AITerm filling in a missing model at launch) could move an OpenAI-compatible connection onto the generic connection’s key and send that key to another service, and a provider AITerm no longer lists could lose its saved key at the next launch. Both are fixed.
• Apply never undoes a switch you made elsewhere. With Settings open, a provider or model you picked in the status bar or the quick switcher stays picked when you click Apply for something else — also after Save key & load models, and while a key you typed is still waiting to be saved.
• A key you are typing stays put. Clicking the connection you’re already on no longer clears a key you haven’t saved. Azure OpenAI’s key has its own field, saved only by Add Connection, which says so when your Keychain wouldn’t let AITerm read the saved key. Saving an Amazon Bedrock connection again keeps the keys you pasted before.
• When a key can’t be saved, Settings says what happened. If your Keychain removes the old key but refuses the new one, Settings says the saved key is gone and how to try again.
• Fewer Keychain prompts. Settings reads your keys when it opens, not every time it redraws, so a Keychain prompt you declined doesn’t keep coming back. A key that a failed save removed is no longer used from memory.
• Easier-to-read warnings. Orange warning text in Settings has enough contrast in light mode.

0.24.2 Your keys stay put

• Settings never erases a key it couldn’t read. If your Mac’s Keychain was locked or refused access when you opened Settings, the API key field looked empty — and clicking Apply, even to change the theme, deleted your saved key. Now Settings saves a key only when you type one; a key it couldn’t read is left alone, and the field says so.
• A saved key only goes where you saved it. A saved server’s key is sent only to that server; if your settings ever point it at a different server, AI stays off and says so instead of sending the key. Choosing another provider for a saved server uses that provider’s own key. At launch, AITerm no longer moves a saved gateway onto another key when your model isn’t in its list, and it no longer sends the generic connection’s key to another service while checking for models.
• Change a saved server’s address with Change address… A saved server’s address is no longer edited in place. Change address… opens its window: the saved key is kept when the server stays the same (same host and port), and you type the key when it moves somewhere new. Your model is kept, and the change takes effect right away.
• Adding a connection under a name you already use is safe. AITerm saves the key first; if that fails, nothing changes and the window says why. A key pasted as a blank line no longer deletes the key that was there.
• A server list AITerm can’t read no longer costs you your keys. If your saved servers couldn’t be read at launch, AITerm deleted all of their keys. Now it leaves them alone.
• If Settings can’t read your key and you point the connection somewhere new, your current connection stays as it is, and Settings asks you to type the key for the new address.
• Quick switcher: the generic OpenAI-compatible row offers Choose in Settings… when it isn’t the connection you’re using.
• Handbook: the agent’s “waits for an idle, empty prompt” rule now says it relies on AITerm’s shell integration (zsh, bash and fish).

0.24.1 Your terminal stays yours

• Privacy fix: a failed switch never falls back to the AI you left. If AITerm could not start the AI you switched to (for example a local server with no key, or MLX before its engine was up), it kept sending to the previous provider — and, believing the new one was local, stopped removing secrets first. Now nothing is sent: AI is off, secrets stay redacted, and the status bar says why (“AI is off — … couldn’t start”). In the same spirit: switching to MLX with Settings open no longer leaves the previous AI answering; a key that fails to save no longer sends your request with another service’s key; AI requests never follow a redirect off your Mac or to another server; and the background /fix suggestion only runs when the AI is really local.
• The agent never types over your work. It sends a step to the terminal only when the prompt is idle and empty and you are not using the terminal — not while a program runs there, not over a half-typed line, not over keys you typed ahead. Otherwise the step waits on its card and says why (“Waiting — the terminal was busy.”, “Paused — you have the terminal.”).
• No more frozen runs. A step the shell refuses (a syntax error, an unclosed quote you cancel) is recorded as failed and the agent is told, instead of leaving the run on “Running…”. Stop only ever interrupts the agent’s own command — never a program you started.
• Confirmations answer the question on screen. A dialog’s buttons act only on that dialog; a step never replaces a confirmation you are reading; Cancel on an agent step brings it back for review instead of ending the run. Declines are recorded in the Security Log (“Declined by user”).
• Dry Run means dry. Agent steps, runbook steps, “Back up, then run” and “Run anyway” all re-check Dry Run at the moment they would run.
• A file-write card you can read at any window size. The file name is always visible, warnings wrap instead of being cut off, an overwrite says it overwrites, a write inside .git explains that hooks run as code, long files say there is more below, tabs are visible, and pressing Return never approves a file write.
• Setup tells the truth. An installed Claude Code or Codex is no longer called ready before it has answered; a “Check AI setup” reminder stays until your AI really answers; setup buttons open the AI tab of Settings — and five Settings buttons that did nothing on macOS 14 and later work again. When AI can’t start, the model chip says “AI off” and why.
• bash: a PROMPT_COMMAND no longer makes an idle prompt look busy.

0.24.0 The agent shows its work

• The agent can write files — and you see what it will write first. In /agent and /auto the agent can now propose creating or replacing a whole text file. It always stops for you, even with Trust this session on. The card shows the full path, the risk, how much changes and the exact text that will be written (a very long file says how much of it you are seeing). Protected places (system folders, SSH and shell startup files, .git, AITerm’s own settings) are refused, or on the Personal profile need a second “Write anyway”. It never writes through a link, never creates folders, keeps the file’s permissions, honors Dry Run, and records every attempt in the Security Log.
• A plan you can follow. A run starts with a short checklist of what the agent intends to do; items tick off as steps succeed.
• See what a step will touch. A delete, move or permissions change waiting for approval now says what it would affect (“Would delete 3 paths.”) — worked out from disk, never by running it.
• Undo the last step. After a run ends, Undo last step loads the reverse command (for example rmdir after mkdir) into the input bar for you to review.
• An agent that knows where it is. Steps are planned with the same folder, branch and recent-command context /fix uses, under the same privacy settings.
• Steadier approvals. Clicking into the terminal no longer throws away a step waiting for you, and Skip tells the agent you declined instead of letting it ask again.
• Claude Code and Codex answer as plain models. When AITerm delegates to your Claude Code or Codex subscription, the CLI now runs with every tool of its own switched off: it cannot run commands, read files or search the web on its own, and nothing it answers touches your Mac until you approve it here. Needs Claude Code 2.1.169 or Codex 0.153.3 or later; an older CLI is told to update.

0.23.1 Your scrollback actually goes back

• The terminal now remembers 10,000 lines instead of 500. Run something long — a big ls -la, a JSON API response, a verbose build — and the start of it is still there. Previously anything past 500 lines was discarded outright, so it could not be scrolled back to and ⌘F could not find it. Nothing had ever set a scrollback depth, so every release through 0.23.0 inherited a 500-line buffer.

0.23.0 Every provider keeps its own key

• Per-provider API keys. Groq, DeepSeek, OpenRouter, Mistral and the rest of the OpenAI-compatible family now each keep their OWN key in your Keychain. Switching providers no longer overwrites the previous key — enter each one once, switch freely.
• Escalate a stuck fix to any keyed provider. The /fix hand-off can now target Groq, DeepSeek and friends directly — add that vendor’s key, pick it as your escalation model, done. If the key is missing, Settings says exactly what to add and the hand-off stays safely off.
• A careful one-time migration. Your existing shared key moves to the provider it belongs to, only when that provider is provably the active one — and any hiccup (locked Keychain, denied prompt, even a crash mid-move) safely retries on the next launch. Keys never leave the Keychain.

0.22.5 Small correctness touches

• Escalation edge cases now speak up. A hand-off chip whose designation was removed or lapsed tells you where to fix it instead of silently doing nothing; with two windows open, an escalation consent prompt can no longer be silently replaced by a click in the other window.
• Clearer Settings copy for a designation whose saved connection was deleted.

0.22.4 The LLM settings pane, dressed like the others

• The LLM tab now looks like the Terminal, Security and Privacy tabs. “Local AI Engine”, “Escalation model” and “System Prompt” are proper bold section headers with clear separation — no more cramped, unstyled rows. Screenshot-verified against the running app.

0.22.3 Escalation settings, final polish

• The Settings “Escalation model” row now renders correctly. 0.22.1’s relayout fixed the invisible model field but broke the pane’s column layout — the row could squeeze the Local AI Engine block and System Prompt into a sliver. The row is now laid out with its title above the controls, verified against live screenshots of the running app.
• Everything from 0.22.1 is included: usable escalation setup, CLI connections completing on pick, same-connection hand-offs, and the embedding-model chat fix.

0.22.2 The escalation row, actually laid out right

• The Settings “Escalation model” row now renders correctly. 0.22.1’s relayout fixed the invisible model field but broke the pane’s column layout — the row could squeeze the Local AI Engine block and System Prompt into a sliver. The row is now built with the pane’s native label/content columns, verified against live screenshots of the running app.
• Everything from 0.22.1 is included: usable escalation setup, CLI connections completing on pick, same-connection hand-offs, and the embedding-model chat fix.

0.22.1 The escalation setup works the way it looked like it should

• The “Escalation model” row is now actually usable. One aligned label, the connection picker and the model field side by side — the model field was invisible in 0.22.0, which quietly made the new hand-off feature impossible to set up by hand. If a designation is incomplete, the row now says so instead of looking configured.
• Pick Claude Code or Codex and you’re done. CLI connections complete the designation on pick — no model to type.
• Escalate to a bigger model on the same connection. You can now hand off from a small local model to a larger one on the same Ollama — the chip only offers when the destination genuinely differs.
• The history-search model can no longer hijack the AI. The 46 MB embeddings model that powers “search by meaning” could end up selected as your chat model (sometimes automatically) — every AI feature then failed with a bare “HTTP 400”. Embedding models are no longer offered or auto-picked as chat models, and if one is somehow active, the error now tells you exactly what to switch.

0.22.0 When a fix stalls, call in a stronger model

• Escalate a stuck fix with one click. Pick a stronger connection and model once in Settings (“Escalation model”). When a Fix conversation stalls — the attempt keeps failing, or the AI is out of ideas — a Try with … chip appears. Click it and the same conversation continues on the stronger model with 8 fresh turns; it even rescues a thread that has already hit its turn limit.
• Same privacy rules, enforced per destination. Escalated turns run on their own lane, never through your active connection: secrets are redacted for any cloud destination, the context a cloud model sees stays capped by your “How much the AI sees” setting, the preview names exactly which AI got what, and the first cloud escalation asks your consent. Local destinations stay fully local.
• Free. Escalation ships with the free command loop (Pro-tier providers still require Pro).
• Fix: settings from very old installs no longer silently reset. A config saved by a pre-0.9 version failed to load and quietly fell back to defaults — wiping BYOK URLs and safety profiles. Those configs now load correctly.

0.21.0 Keep fixing until it’s actually fixed

Fix stops being a one-shot guess and becomes a short, bounded conversation.

• “Fix” is now a conversation. When the AI proposes a fix you can talk back — “we use pnpm, not npm” — and it revises, remembering what it just told you. Run its suggestion and it still fails? A one-click Keep going attaches the new error and tries again. The thread is about that one failure: it ends when the command finally works, when you start a different fix, or when you press Esc, and it’s capped so it can never run away.
• Nothing runs, and nothing is sent, unless you ask. Every proposal still loads as an editable command that only runs on Return, through the same safety gate; a failed attempt never calls the AI on its own — it offers, you decide. Replies take the same path your first fix did, and the “what the AI sees” preview grows to show exactly what each turn sends.
• Free, like Fix itself. The whole conversation is part of the free command loop.

0.20.0 A broken plugin can’t eat your exit codes

Two reliability fixes at the prompt itself, and the built-in Handbook catches up with search by meaning.

• Exit codes now survive a broken prompt plugin. If anything in your .zshrc errors while the prompt is drawn, AITerm used to lose that command’s exit code and captured output — /fix and the AI assistant quietly worked from stale data, with nothing on screen to say why. AITerm now records the result before any other prompt code runs, whichever way that code was installed.
• The git branch in the status bar stopped launching git on every prompt. It reads the repository directly: instant, correct through symlinked folders, shown even in brand-new repositories with no commits yet — and it refuses to display anything a corrupted or hostile repository plants in .git/HEAD.
• The built-in Handbook caught up with search by meaning. The history-search page now documents the one-click “Enable search by meaning” offer and is honest about what searching by meaning can and cannot find, instead of telling you to pull the model by hand.

0.19.1 The download button now knows it worked

• “Enable search by meaning” no longer keeps asking after it has already downloaded. Clicking it pulled the model correctly, but the row stayed on screen as though nothing had happened — you had to close and reopen ⌘K before search by meaning would actually run. The row now clears itself and your results appear straight away.

0.19.0 Search your history by what you meant

⌘K can find a command from a description of what it did, not just the words you typed. This existed before and was too noisy to be useful; it now uses a much better local model.

• “Related by meaning” actually finds things. Ask for “copy files to the nas” and it surfaces your rsync command; ask “which ports are open” and it finds the lsof one. Previously the same searches mostly returned one unrelated command over and over — measured on a real 500-command history, the old engine put the same entry in the top five of two thirds of completely unrelated searches.
• A good match is no longer hidden for scoring low. Results are now judged against the best match for that particular search rather than a fixed cutoff, which was quietly discarding correct answers.
• One click to turn it on. The first time you use it, ⌘K offers “Enable search by meaning” and downloads a 46 MB model. If local AI isn’t set up yet it points you there instead of failing silently.
• Still nothing leaves your Mac. The model runs locally, the search index stores no command text, and no history is ever sent to a provider. Pro feature; ordinary ⌘K text search stays free and unchanged.

0.18.5 The right exit code

Exit codes now follow the command that earned them, even when something in the pane swallows what you typed.

• A command typed into a pager, REPL or editor no longer breaks every command after it. If you sent a command from the AI bar while less, python3, psql or a text editor had the pane, that program ate it and the shell never saw it — and from then on every command you ran recorded the NEXT command’s exit code instead of its own, for the rest of the session. The “Fix?” chip and the command-not-found rescue blamed the wrong command with it. The shell now tells AITerm which command actually started, so a swallowed one is recognised and skipped.
• Pressing Return on an empty line no longer steals a running command’s exit code. A bare Return, a comment, or a line abandoned with ⌃C all look like a command finishing; they are no longer mistaken for one.
• Bash users get their command output back. AITerm’s bash integration was interrupting itself once per prompt, which wiped the captured output and the timing of every command just before they were read — so /fix and /explain saw nothing and every command appeared to take no time at all.

0.18.4 Housekeeping

A small follow-up to 0.18.3: the app no longer remembers replies it never received, and the built-in manual matches how Homebrew works today.

• A failed AI request is no longer remembered as an empty answer. When a request failed, was refused, or you stopped it, AITerm recorded a blank reply as though the model had answered — and then sent that blank turn back to the model with every later question, for the rest of the conversation. Nothing is recorded for a request that produced nothing.
• The built-in manual has the current Homebrew instructions. Homebrew 6 asks you to trust a tap outside its own core before installing from one, so the published command needed a brew trust vega-llc/aiterm step. The website was corrected immediately; Help ▸ AITerm Manual now matches it.

0.18.3 The right command gets the blame

A correctness release. Exit codes now land on the command that actually produced them, and commands that live only inside your shell are recognised as real ones.

• Two AI requests at the same time no longer crash the app. The background fix suggestion overlapping a manual /explain, or two tabs sharing one connection, could corrupt the running conversation a provider keeps — taking the whole window down, and every terminal session in it, with no warning. All four API-backed providers now guard that history properly.
• Exit codes land on the right command during an ssh session. Anything you sent from the AI bar while ssh or mosh held the pane ran on the remote machine, which knows nothing about AITerm and can never report back — but the app went on waiting for an answer that would never arrive. Every later command then inherited the wrong exit code, for the rest of the session, in your history and in the Security Log. Commands run inside a remote session are now left without an exit code, which is the honest answer, and local commands keep their own.
• Commands that live only in your shell are commands. A function or alias — nvm, conda, pyenv, or the deploy you wrote yourself — is not a file anywhere, so AITerm used to conclude nothing had run when one failed, and would contact the AI unasked to rewrite a line that had worked fine. AITerm now learns their names from your shell at launch, alongside your PATH.
• A script in the current folder is found. When ./deploy.sh exits 127 because something inside it was missing, AITerm resolves the script against the shell’s working directory and says so, instead of admitting it cannot tell.
• Closing a tab stops the AI request it had in flight. A pane you close no longer holds on to a translation or a /fix — which, on a local model, was still occupying the engine your other tabs were queued behind.

0.18.2 Say what you meant

The input bar is much better at telling a command from a sentence — and much better at admitting when it cannot tell.

• Your installed tools are commands again. A Mac app launched from the Dock inherits a nearly empty PATH, so AITerm could not see anything Homebrew, pipx, nvm, cargo or go had installed. uv pip install requests, just build and poetry add requests were treated as English and sent to the AI instead of being run, and brew + Tab completed nothing. AITerm now asks your login shell what its PATH is, once, in the background at launch.
• A line that reads like English can be reinterpreted when it fails. Type find largest file here and AITerm runs it, because find really is a command — and when it fails you now get an Interpret as English link beside the usual Fix and Explain, never instead of them. Clicking it asks the AI what you meant and hands back an editable proposal that still only runs when you press Return. Lines that are genuinely commands are untouched: brew install ripgrep and git add file still just run, and nothing about what executes, or the safety gate it passes through, has changed.
• Honest answers after “command not found”. Exit code 127 usually means the shell found nothing to run — but a real program can return it too, when something inside it was missing. AITerm no longer claims “Not a command” about a command that plainly ran, and it no longer contacts the AI on its own unless nothing ran at all. Stopping mid-request always hands your line back.
• Quieter chips. Stopping a command yourself with Ctrl-C is not a failure, so nothing is suggested afterwards.
• Faster answers from Claude Code, and you can watch them arrive. The CLI-subscription provider used to run to completion before showing anything, so the bar sat on “Translating…” and then filled in all at once. It now streams the answer as it is written. Turning a sentence into a command is also no longer treated as a reasoning problem, which roughly halves the wait before the first character appears — measured 6.1s to 3.4s on a real request. Diagnosing a failure with /fix still gets the model’s full attention.
• A mistyped command is no longer remembered as something you asked for. When a command fails with “command not found”, AITerm offers to turn it into one. Accepting that used to record the misspelling as a request you had made, so the typo came back later as an inline suggestion. A line you explicitly ask to have read as English still is remembered — those words were the request.

0.18.1 Settings tidy-up

One cosmetic fix on top of 0.18.0.

• The Terminal pane in Settings now matches the others. It was the only pane laid out in two columns, so “Default Shell”, “Theme”, “Font Size” and “Current version” hung off to the right and its section headings were not bold, while Security and Privacy ran hard left. Same controls, same behaviour — it just looks like the rest of the window now.

0.18.0 Fewer keystrokes, safer clicks

• Inline suggestions from your own history. As you type in the AI bar, AITerm completes the line in grey with something you have run — or asked — before. → accepts it, Esc dismisses it, and typing on ignores it. Everything stays on your Mac: the suggestions come from your local history and nothing is sent anywhere to produce them. Turn it off in Settings ▸ Terminal if you would rather not have it.
• Links in terminal output are clickable — and gated. Hold ⌘ and click a hyperlink a program printed. Because the program picks the visible text and the address behind it independently, a click goes through the same kind of check a command does: an http/https link shows you the real host and the full address before anything opens, with Cancel as the default; a file:// link is revealed in Finder and never opened, so a link to an app cannot start it; every other scheme is refused and named. Opened, revealed and refused links all appear in the Security Log.
• Security fix, included above. In earlier versions ⌘-clicking a link in the terminal handed it straight to macOS with no confirmation — so output from any program could open a URL, or a file, that you never saw. Those clicks now go through the check described above.
• Fixed: the manual and the model manager could quit the app. Both read files that a packaging fault left out of the download entirely — they resolved only on the machine the release was built on. On any other Mac, opening Help ▸ AITerm Manual, the Model Manager or the local-engine installer quit AITerm instead of opening. Present since 0.16.0. The build now refuses to produce a release with those files missing.

0.17.1 Find where you are looking

A fix release for the new windows in 0.17.0.

• ⌘F searches the window you are actually in. Reading the Manual, ⌘F now lands in the Manual’s own search box — it used to open the find bar in the terminal behind it. The Manual’s search also gained a clear button.
• Terminal-only View menu items stand down when they do not apply. Find Next/Previous and Jump to Previous/Next Command are greyed out unless the terminal is the window in front, so they never scroll or search a window you cannot see.
• Jump to Previous/Next Command moved to ⌘⇧↑ / ⌘⇧↓ (was ⌘↑ / ⌘↓). Those plain arrow combinations are macOS’s "go to start/end of document" keys, and AITerm was claiming them app-wide — so they did nothing in the Settings system prompt box or the Manual’s search field. They now work as they should everywhere.

0.17.0 Own windows

The Manual, Keyboard Shortcuts, and the Security Log are real windows now — keep them open beside your terminal instead of on top of it. Plus a Stop button, and a clearer name for the most serious risk tier.

• Reference surfaces are real windows. Help ▸ AITerm Manual, ⌘/ Keyboard Shortcuts, and AI ▸ Security Log open beside your work, resize, and stay put while you type. Esc or ⌘W closes the one you are looking at.
• A Stop button for AI requests. A slow translation can be stopped from the input bar, and it hands back exactly what you typed. A running command gets a Stop next to the status dot.
• The top risk tier is now called Irreversible (it was “Dangerous”, which said nothing that “Destructive” below it did not). Same behaviour, clearer ladder.
• Dialogs no longer freeze the whole app. Every file panel and alert now attaches to the window that asked for it, so other windows keep working.
• Saved connections have a visible Remove button — it used to be right-click only.
• Notices keep a history. Anything the input bar told you is one click away in the status strip, so a message that flashed past is no longer lost.

0.16.9 No dead ends

A batch about honesty: no silent failures, no one-way doors, and no telling you something worked when it did not.

• Reset to Defaults always asks first — and says what it will take. It used to wipe a hand-written System Prompt with no confirmation and no undo.
• Apply no longer claims success for a key it could not save. If your API key does not reach the Keychain, Settings stays open and tells you, instead of showing a green checkmark and closing.
• "Using a cloud model" can be dismissed with Esc, and the button that shares your request now says so. Escape keeps you local rather than quietly consenting.
• Crash-report checks can be turned back on. "Don’t check again" was a one-way door that needed a Terminal command to undo; there is now a Settings toggle.
• A failed policy-pack export tells you it failed instead of silently writing nothing.
• Autopilot risk labels match the rest of the app — same names, same colors.
• A failed engine reinstall no longer leaves local AI stopped — the engine comes back up.
• Settings controls are now named for VoiceOver, the font-size slider shows its value again, and status messages no longer overwrite each other.

0.16.8 The update pill you can trust

One targeted fix from the first real-world test of background updates.

• The "Update ready" pill now appears for every background update — including the case where macOS lets Sparkle pop its own window, which could land on another monitor or behind other apps and be missed entirely. The pill in the status strip is now the guarantee; it clears itself the moment you open the update.
• Update activity is now logged (Console: subsystem com.vega.aiterm), so "I never saw an update" is diagnosable in minutes.

0.16.7 Quieter, clearer, quicker

The second usability batch from the same full app review as 0.16.6.

• Update checks you control. Settings ▸ Terminal gains a "Check for updates automatically" toggle. If you ever declined the old system dialog about automatic checks, AITerm turns checking back on once — the toggle is in charge from then on.
• Less nagging. The "Ollama is too old" alert shows once, then becomes a quiet status-bar pill (clicking it re-checks your Ollama first). Pro reminders appear at most once per feature per launch, can be muted for good, and repeats become a one-line note.
• A real command palette. ⌘K now covers Settings, Set Up AI, the Security log, the Manual, shortcuts, tabs and splits, and Safety Profiles — with arrow-key selection, shortcut hints on each row, and an honest "No matches" state.
• Modes you can see. Dry Run shows a persistent pill (click: straight to Settings ▸ Security) and says so in the input bar. Suggestion chips are dismissible and explain themselves the first time.
• Settings polish. The window remembers your tab, Esc closes it, every tab says which controls apply instantly vs on Apply, connection forms say "Add Connection" instead of a second "Save", disabled Pro editors say why, and a model-list refresh can no longer silently swap your configured model.
• Notifications, honestly. A Settings row shows whether finish-notifications are on, asks properly when they’re not, and links System Settings if they’re off at the system level.

0.16.6 Honest and safer by default

A usability release, built from a full review of the app’s dialogs and flows.

• Risk badges tell the truth for your profile. The badge blurb now reflects what the gate will actually do under YOUR Safety Profile — on Production or Locked Down a Dangerous command says "Blocked", not "you’ll get a confirmation".
• Return can’t run something dangerous by reflex. In every confirmation — including the new ones for Clear history, Clear security log, Delete workspace, and Remove connection — Return and Esc both cancel; running requires a deliberate click.
• Settings behaves. Apply saves and closes (and stays open with the reason if a Pro provider couldn’t apply), reopening shows current values, and Set Up AI / upgrade flows now appear on the window you’re actually using.
• Better first run. Every "AI is unavailable" message carries a Set Up AI button, onboarding can be skipped (Esc works), and a "Finish AI setup" pill sticks around until AI actually works.
• Notices you can use. The message bar is dismissible, selectable, and no longer truncates errors to two lines; blocked-command explanations survive until you’ve read them.

0.16.5 Publisher transition complete

The managed local MLX engine is now signed by Vega LLC too — the last piece of the publisher switch. If you use the MLX engine, AITerm quietly re-downloads it once (~16 MB) the next time it starts; engines already on disk keep working in the meantime. Nothing to do.

0.16.4 New publisher: Vega LLC

AITerm is now signed and published by Vega LLC — same developer, same app, new company name on the certificate. Because macOS ties your saved items to the publisher, the first time this version touches a saved API key or your license, macOS will ask for your login password — once per item. Click “Always Allow” and that item never asks again. (This one-time step also permanently fixes a bug where some saved keys asked for your password after every update.)

• Nothing else changes: your settings, history, license, and saved connections all carry over.
• Local AI (Ollama and the managed MLX engine) keeps working unchanged.

0.16.3 Maintenance

• “See what the AI sees” popover fix. The context inspector now always shows the session block it promises — it could previously come up empty if the preview refreshed while open — and gains a Copy button for the full, untruncated context.
• Under the hood. AITerm’s publisher is moving from DriveBoss LLC to Vega LLC (same developer, same app). This update quietly prepares your saved keys and license so the transition is seamless — no prompts, nothing to do.

0.16.2 Polish

• Clearer first-run prompt. When local AI isn’t set up yet, the “Set Up AI…” action now renders as a button, so it’s obvious you can click it.

0.16.1 Reliability

• Dry-run preview lists the files. The safety preview now shows exactly which files a delete or move would touch — previously it showed the count but the list could render blank.
• Amazon Bedrock works with the latest Claude models. Requests to newer models (via a us.anthropic.* inference profile) no longer fail, and a rejected request now shows the real reason instead of a misleading “API key” message.
• Model ID edits stick. Changing a Bedrock or Azure model / profile id and clicking Apply now saves what you typed.
• Remove saved connections. Right-click a saved connection to delete it.
• Friendlier first run. A clear “Set Up AI…” prompt instead of a raw connection error when local AI isn’t set up yet, plus a status-bar progress indicator while the local model downloads.
• Move to Applications. Launching from the mounted disk image now offers to move AITerm to Applications so automatic updates work.

0.16.0 Handbook

• Built-in user manual. A complete, searchable handbook ships inside AITerm — open it from Help ▸ AITerm Manual and browse every feature.
• Also on the web. The same manual is published at ai-term.com/manual.

0.15.2 Maintenance update

• Behind-the-scenes updates. Internal service endpoints and project links moved to their new home — no change to how AITerm works.

0.15.1 Settings polish & reliability

• Tidier Settings. The Privacy and Security tabs are now left-aligned and scroll properly.
• Reset to Defaults now really resets — per-host SSH profiles, imported policy packs, and the cloud-context level are cleared (after confirmation).
• Under the hood. More robust command-history loading.

0.15.0 “Guardrails”

• Dry-run preview. See exactly which files a delete or move would touch before it runs — or the tool’s own dry run, like rsync -n.
• Safety profiles with teeth. Production and Locked Down make risky commands stop and ask — or block outright; per-host SSH profiles turn a pane red on hosts you mark (authoring is Pro).
• Team policy packs. Import always-block / always-ask rules that can only ever tighten your gate. Importing is free; authoring and export are Pro.
• Tamper-evident audit log. Every command decision and its exit code goes to a hash-chained local log; signed export is Pro.
• Transfer safety. scp and rsync are risk-tiered by direction and scope, so a destructive sync asks first.
• Back up, then run. One click backs a file up before a risky delete.
• History, grown up. Capacity to 10,000 commands, a fuzzy ⌘K palette, and search by meaning (Pro).

0.14.0 “Total Context”

• The AI understands your session. /fix and /explain now get real context — recent commands, exit codes, and (when you allow it) their output.
• “See what the AI sees.” An eye chip shows the exact session context sent after every AI request — redacted for cloud models, exactly as received.
• You control what the cloud sees. A new Privacy setting caps how much session context a cloud model receives; local models always get full context.
• Privacy fix. Each tab’s AI context now comes only from that tab’s own history.

0.13.0 “Navigator”

• Scrollback search (⌘F). Incremental find across your whole scrollback with highlights and a live match count.
• Jump between commands (⌘↑ / ⌘↓) and click a mark to select one command’s exact output.
• Proactive “Fix?” chip. When a command fails, AITerm instantly names the likely cause — entirely on your Mac, no model call. Clicking never runs anything.
• Finish-line notifications. A long command that finishes in the background posts a macOS notification with its exit code.
• fish shell support with the same nonce-authenticated integration as zsh and bash.
• Opt-in crash reports — local first. Nothing is uploaded unless you click; no third-party SDK.

0.12.0 Licensing you can trust

• Pro licenses are now validated server-side and cryptographically signed; the app verifies them locally with an embedded key. About one reconnect a month keeps Pro active; roughly six weeks fully offline before it pauses.

0.11.0 The AI agent

• /agent — multi-step tasks, your approval each step. Describe the goal; it proposes each command and waits for you.
• /auto — opt-in autopilot. Auto-runs only the steps the safety gate can prove are safe and inside your project folder; pauses for anything that deletes, reaches the network, or acts outside it.
• Bounded build trust. An exact-form allowlist lets common build steps (npm install, cargo build…) auto-run — nothing else qualifies.
• Help ▸ Using the Agent explains both modes honestly.

0.10.7 Security hardening

• Sharper command-safety checks. The risk classifier now catches remote commands over ssh/mosh, obfuscated interpreter one-liners, and generated payloads piped into a shell.
• The AI gate covers every way you enter text — dictation, the emoji picker, IME, and Services insertions.
• Runbook review fix. A step built from an earlier step’s output is reviewed as the real command, not the placeholder.
• Robustness. Hardened Bedrock streaming and saved-session loading against malformed input.

0.10.6 Paste fix for terminal typing

• Pasting now works when typing directly in the terminal — pasted commands go to the shell line instead of the AI input bar.

0.10.5 Remote-command safety

• The safety gate now vets commands you run on other machines. A risky ssh host '…' gets the same risk badge, confirm, or block — escalated for the larger blast radius.
• Your safety profile is the prod dial. Production or Locked Down blocks destructive remote commands outright; harmless ones run without nagging.
• Hardening fix. Clustered shell commands like bash -lc '…' are vetted too.

0.10.4 Type directly in the terminal

• Click into the terminal to type on the shell line — a clear indicator shows the AI safety gate is bypassed.
• Focus stays where you put it, and drifts back to the AI bar after 15 seconds idle at the prompt.

0.10.3 Shortcuts & settings polish

• Font size shortcuts. ⌘+ / ⌘− resize the terminal text, ⌘0 resets — live in every pane.
• ⌘⇧F runs /fix on your last command.
• Software Update settings fixed and a tidier ⌘/ cheat sheet.

0.10.2 Update settings you can reach

• Fixed: the update notification could get stuck when automatic installs were on; the badge is restored.
• New: Settings ▸ Terminal ▸ Software Update — version, auto-install toggle, and check-for-updates in one place.

0.10.1 Better text selection

• Selection auto-scrolls past the top or bottom edge, so you can select more than one screenful.
• Readable selection highlight — each theme now uses a high-contrast selection color.

0.10.0 Keyboard-shortcut cheat sheet

• New: Keyboard Shortcuts reference. Press ⌘/ (or Help ▸ Keyboard Shortcuts) for a one-look cheat sheet of every shortcut.

0.9.9 “Automatically update” now works

• “Automatically download and install updates” is now honored — the setting sticks across launches instead of resetting every time.

0.9.8 Scrolling in interactive tools

• Scrolling works correctly inside interactive tools. When a full-screen program supports the mouse (vim, htop, fzf, …), the wheel scrolls the program instead of cycling its history.
• Settings: clearer separation between the provider list and the selected provider’s configuration.

0.9.7 Terminal scrolling & settings polish

• The mouse wheel now scrolls full-screen programs — pagers, man pages, and any alternate-screen tool.
• Provider setup is easier to find. Picking a provider scrolls straight to its configuration fields.

0.9.6 Privacy & reliability hardening

• Local (Ollama) always stays on your Mac. The managed Local engine is pinned to loopback, so a stray OLLAMA_HOST can no longer send on-device requests off the machine unredacted.
• Fixes a startup crash with scheme-less OLLAMA_HOST values.
• Tighter subscription-CLI hardening. The Claude Code / Codex helpers no longer inherit unrelated cloud credentials or NODE_OPTIONS.
• Smoother sign-in & fewer stray prompts.

0.9.5 One-click sign-in for Claude Code & Codex

• Sign in / switch account, in the app. A new button opens a tab and runs the official CLI browser login — authenticate or switch accounts without leaving AITerm.

0.9.4 Your subscription in the provider picker

• Claude Code & Codex, front and center. Your Claude or ChatGPT subscription via the official CLI is now a first-class choice in the AI-provider picker (under Pro).

0.9.3 Security hardening & clearer descriptions

• Stronger command-safety checks. More disguised download-and-run commands and command-laundering inside scripting one-liners now trigger the safety confirmation.
• Local AI stays local. The managed Ollama engine always binds to loopback; Managed MLX only connects to AITerm’s own engine.
• Honest provider descriptions and a configuration panel that reliably names the selected provider.

0.9.2 Clearer provider picker

• Right settings for the right provider. The inline configuration panel always names the provider you actually selected.
• Every provider explained with a one-line description; the Bedrock template and your saved Bedrock connection are clearly distinguished.

0.9.1 Provider settings polish

• Real download progress for Managed MLX setup.
• Cleaner provider picker — grouped Local / Cloud / Pro / Custom, with the selected provider’s settings inline.
• Accurate engine status, clearer Bedrock save errors, and a quick switcher that lists every active provider with its models.

0.9.0 Amazon Bedrock & Managed MLX

• Amazon Bedrock (Pro). Claude and other Bedrock models through your own AWS account — profiles, SSO, assumed roles, or keys, with per-region model discovery and streaming.
• Managed MLX (Pro, macOS 14+). Apple-Silicon-native local AI: a one-tap, on-device inference engine that runs entirely on your Mac.
• Private by default. Local engines keep every prompt on-device; cloud providers receive secret-redacted requests.

0.8.1 Security & polish

• Security and reliability fixes following the 0.8.0 release — tighter key handling and redaction, safer engine downloads.

0.8.0 Private local AI & a generous Free tier

• Private local AI, set up for you. AITerm downloads and runs a small on-device model — no account, fully offline once installed. Already have Ollama? It just uses it.
• Connect almost anything. One-tap presets for OpenRouter, Groq, DeepSeek, xAI, Mistral, Gemini, Perplexity, Cerebras, and more — or your own server.
• Free forever. The native AI terminal — command loop, /fix & /explain, tabs, splits, workspaces, the safety gate, local AI, and BYO cloud key — is now free. Pro adds subscriptions, runbooks, /agent, and Azure OpenAI.

0.7.1 Security & reliability hardening

• Sharper command safety check for dangerous commands disguised inside eval or scripting one-liners.
• No more lockouts on a network blip — license hiccups fall back to your offline grace period.
• Saved API keys are safe across updates, and runbook suggestions never save secrets.

0.7.0 Saved workspaces

• Save your layout and bring it back. Save tabs and split panes as a named workspace and reopen it anytime — every pane in its own folder.
• Picks up where you left off. Your last session is restored automatically on launch (toggle it off anytime).
• Manage your workspaces — rename or delete from the workspace manager.

0.6.1 Fewer update prompts

• Updates stop nagging for your login password. Saved API keys now carry a team-stable Keychain partition, so future updates read them silently.

0.6.0 Split panes

• Split panes. Several shells side-by-side in one tab: ⌘D splits right, ⌘⇧D splits down, ⌘⌥arrows move focus.
• Numbered tabs with a clearly highlighted active tab.
• Smarter input. ⌃C interrupts the running command while keeping your draft.
• Passive runbook capture. After a clean run, AITerm quietly offers to save the commands as a runbook.

0.5.1 Smoother updates

• Updates no longer install silently — the “Update ready — Install & Relaunch” pill waits for you.
• Fewer Keychain password prompts on update.

0.5.0 Tabs

• Tabs are here. Multiple terminals in one window — each tab its own real shell, history, and AI session. ⌘T new, ⌘W close, ⌘1–9 to switch.
• Your safety profile and audit log span every tab — a command approved in one tab only ever runs in that tab.

0.4.9

• Update notice fixed: the “Update ready — Install & Relaunch” pill now actually appears when a new version is published (the 0.4.7 wiring was inverted).

0.4.8

• Cleaner runbook capture: repeated ls/pwd/clear and duplicate lines are dropped, so you get a tidy, replayable sequence.

0.4.7

• Updates that actually land: a subtle “Update ready — Install & Relaunch” pill in the status bar instead of silent background staging.
• Rollback suggestions for destructive commands when a conservative undo or backup-first step exists.
• Project-aware AI: /fix and /explain factor in your repo, branch, and language.
• Runbook output chaining ({{step1.output}}) and history search.

0.4.6

• Fixed a bug where a second window showed another view of the same shell and sent typing to the original window.

0.4.5

• Safety Profiles: Personal, Work, Production, and Locked Down — stricter profiles escalate confirmations and block more at the command gate.
• Smarter /fix: original vs. proposed fix side by side, with one-click save to a runbook.

0.4.4

• Capture runbooks from your history: press ⌘⌥R to save recent commands as a reusable runbook — repeated values become {{variables}} automatically.
• Starter runbooks so your library isn’t empty on day one.

0.4.3

• Fixed a rare data-migration edge case where an interrupted upgrade could ask a licensed user to re-activate — the app now keeps your existing license and retries the move safely.