AITerm Changelog

0.23.1 Your scrollback actually goes back

• The terminal now remembers 10,000 lines instead of 500. Run something long — a big ls -la, a JSON API response, a verbose build — and the start of it is still there. Previously anything past 500 lines was discarded outright, so it could not be scrolled back to and ⌘F could not find it. Nothing had ever set a scrollback depth, so every release through 0.23.0 inherited a 500-line buffer.

0.23.0 Every provider keeps its own key

• Per-provider API keys. Groq, DeepSeek, OpenRouter, Mistral and the rest of the OpenAI-compatible family now each keep their OWN key in your Keychain. Switching providers no longer overwrites the previous key — enter each one once, switch freely.
• Escalate a stuck fix to any keyed provider. The /fix hand-off can now target Groq, DeepSeek and friends directly — add that vendor’s key, pick it as your escalation model, done. If the key is missing, Settings says exactly what to add and the hand-off stays safely off.
• A careful one-time migration. Your existing shared key moves to the provider it belongs to, only when that provider is provably the active one — and any hiccup (locked Keychain, denied prompt, even a crash mid-move) safely retries on the next launch. Keys never leave the Keychain.

0.22.5 Small correctness touches

• Escalation edge cases now speak up. A hand-off chip whose designation was removed or lapsed tells you where to fix it instead of silently doing nothing; with two windows open, an escalation consent prompt can no longer be silently replaced by a click in the other window.
• Clearer Settings copy for a designation whose saved connection was deleted.

0.22.4 The LLM settings pane, dressed like the others

• The LLM tab now looks like the Terminal, Security and Privacy tabs. “Local AI Engine”, “Escalation model” and “System Prompt” are proper bold section headers with clear separation — no more cramped, unstyled rows. Screenshot-verified against the running app.

0.22.3 Escalation settings, final polish

• The Settings “Escalation model” row now renders correctly. 0.22.1’s relayout fixed the invisible model field but broke the pane’s column layout — the row could squeeze the Local AI Engine block and System Prompt into a sliver. The row is now laid out with its title above the controls, verified against live screenshots of the running app.
• Everything from 0.22.1 is included: usable escalation setup, CLI connections completing on pick, same-connection hand-offs, and the embedding-model chat fix.

0.22.2 The escalation row, actually laid out right

• The Settings “Escalation model” row now renders correctly. 0.22.1’s relayout fixed the invisible model field but broke the pane’s column layout — the row could squeeze the Local AI Engine block and System Prompt into a sliver. The row is now built with the pane’s native label/content columns, verified against live screenshots of the running app.
• Everything from 0.22.1 is included: usable escalation setup, CLI connections completing on pick, same-connection hand-offs, and the embedding-model chat fix.

0.22.1 The escalation setup works the way it looked like it should

• The “Escalation model” row is now actually usable. One aligned label, the connection picker and the model field side by side — the model field was invisible in 0.22.0, which quietly made the new hand-off feature impossible to set up by hand. If a designation is incomplete, the row now says so instead of looking configured.
• Pick Claude Code or Codex and you’re done. CLI connections complete the designation on pick — no model to type.
• Escalate to a bigger model on the same connection. You can now hand off from a small local model to a larger one on the same Ollama — the chip only offers when the destination genuinely differs.
• The history-search model can no longer hijack the AI. The 46 MB embeddings model that powers “search by meaning” could end up selected as your chat model (sometimes automatically) — every AI feature then failed with a bare “HTTP 400”. Embedding models are no longer offered or auto-picked as chat models, and if one is somehow active, the error now tells you exactly what to switch.

0.22.0 When a fix stalls, call in a stronger model

• Escalate a stuck fix with one click. Pick a stronger connection and model once in Settings (“Escalation model”). When a Fix conversation stalls — the attempt keeps failing, or the AI is out of ideas — a Try with … chip appears. Click it and the same conversation continues on the stronger model with 8 fresh turns; it even rescues a thread that has already hit its turn limit.
• Same privacy rules, enforced per destination. Escalated turns run on their own lane, never through your active connection: secrets are redacted for any cloud destination, the context a cloud model sees stays capped by your “How much the AI sees” setting, the preview names exactly which AI got what, and the first cloud escalation asks your consent. Local destinations stay fully local.
• Free. Escalation ships with the free command loop (Pro-tier providers still require Pro).
• Fix: settings from very old installs no longer silently reset. A config saved by a pre-0.9 version failed to load and quietly fell back to defaults — wiping BYOK URLs and safety profiles. Those configs now load correctly.

0.21.0 Keep fixing until it’s actually fixed

Fix stops being a one-shot guess and becomes a short, bounded conversation.

• “Fix” is now a conversation. When the AI proposes a fix you can talk back — “we use pnpm, not npm” — and it revises, remembering what it just told you. Run its suggestion and it still fails? A one-click Keep going attaches the new error and tries again. The thread is about that one failure: it ends when the command finally works, when you start a different fix, or when you press Esc, and it’s capped so it can never run away.
• Nothing runs, and nothing is sent, unless you ask. Every proposal still loads as an editable command that only runs on Return, through the same safety gate; a failed attempt never calls the AI on its own — it offers, you decide. Replies take the same path your first fix did, and the “what the AI sees” preview grows to show exactly what each turn sends.
• Free, like Fix itself. The whole conversation is part of the free command loop.

0.20.0 A broken plugin can’t eat your exit codes

Two reliability fixes at the prompt itself, and the built-in Handbook catches up with search by meaning.

• Exit codes now survive a broken prompt plugin. If anything in your .zshrc errors while the prompt is drawn, AITerm used to lose that command’s exit code and captured output — /fix and the AI assistant quietly worked from stale data, with nothing on screen to say why. AITerm now records the result before any other prompt code runs, whichever way that code was installed.
• The git branch in the status bar stopped launching git on every prompt. It reads the repository directly: instant, correct through symlinked folders, shown even in brand-new repositories with no commits yet — and it refuses to display anything a corrupted or hostile repository plants in .git/HEAD.
• The built-in Handbook caught up with search by meaning. The history-search page now documents the one-click “Enable search by meaning” offer and is honest about what searching by meaning can and cannot find, instead of telling you to pull the model by hand.

0.19.1 The download button now knows it worked

• “Enable search by meaning” no longer keeps asking after it has already downloaded. Clicking it pulled the model correctly, but the row stayed on screen as though nothing had happened — you had to close and reopen ⌘K before search by meaning would actually run. The row now clears itself and your results appear straight away.

0.19.0 Search your history by what you meant

⌘K can find a command from a description of what it did, not just the words you typed. This existed before and was too noisy to be useful; it now uses a much better local model.

• “Related by meaning” actually finds things. Ask for “copy files to the nas” and it surfaces your rsync command; ask “which ports are open” and it finds the lsof one. Previously the same searches mostly returned one unrelated command over and over — measured on a real 500-command history, the old engine put the same entry in the top five of two thirds of completely unrelated searches.
• A good match is no longer hidden for scoring low. Results are now judged against the best match for that particular search rather than a fixed cutoff, which was quietly discarding correct answers.
• One click to turn it on. The first time you use it, ⌘K offers “Enable search by meaning” and downloads a 46 MB model. If local AI isn’t set up yet it points you there instead of failing silently.
• Still nothing leaves your Mac. The model runs locally, the search index stores no command text, and no history is ever sent to a provider. Pro feature; ordinary ⌘K text search stays free and unchanged.

0.18.5 The right exit code

Exit codes now follow the command that earned them, even when something in the pane swallows what you typed.

• A command typed into a pager, REPL or editor no longer breaks every command after it. If you sent a command from the AI bar while less, python3, psql or a text editor had the pane, that program ate it and the shell never saw it — and from then on every command you ran recorded the NEXT command’s exit code instead of its own, for the rest of the session. The “Fix?” chip and the command-not-found rescue blamed the wrong command with it. The shell now tells AITerm which command actually started, so a swallowed one is recognised and skipped.
• Pressing Return on an empty line no longer steals a running command’s exit code. A bare Return, a comment, or a line abandoned with ⌃C all look like a command finishing; they are no longer mistaken for one.
• Bash users get their command output back. AITerm’s bash integration was interrupting itself once per prompt, which wiped the captured output and the timing of every command just before they were read — so /fix and /explain saw nothing and every command appeared to take no time at all.

0.18.4 Housekeeping

A small follow-up to 0.18.3: the app no longer remembers replies it never received, and the built-in manual matches how Homebrew works today.

• A failed AI request is no longer remembered as an empty answer. When a request failed, was refused, or you stopped it, AITerm recorded a blank reply as though the model had answered — and then sent that blank turn back to the model with every later question, for the rest of the conversation. Nothing is recorded for a request that produced nothing.
• The built-in manual has the current Homebrew instructions. Homebrew 6 asks you to trust a tap outside its own core before installing from one, so the published command needed a brew trust vega-llc/aiterm step. The website was corrected immediately; Help ▸ AITerm Manual now matches it.

0.18.3 The right command gets the blame

A correctness release. Exit codes now land on the command that actually produced them, and commands that live only inside your shell are recognised as real ones.

• Two AI requests at the same time no longer crash the app. The background fix suggestion overlapping a manual /explain, or two tabs sharing one connection, could corrupt the running conversation a provider keeps — taking the whole window down, and every terminal session in it, with no warning. All four API-backed providers now guard that history properly.
• Exit codes land on the right command during an ssh session. Anything you sent from the AI bar while ssh or mosh held the pane ran on the remote machine, which knows nothing about AITerm and can never report back — but the app went on waiting for an answer that would never arrive. Every later command then inherited the wrong exit code, for the rest of the session, in your history and in the Security Log. Commands run inside a remote session are now left without an exit code, which is the honest answer, and local commands keep their own.
• Commands that live only in your shell are commands. A function or alias — nvm, conda, pyenv, or the deploy you wrote yourself — is not a file anywhere, so AITerm used to conclude nothing had run when one failed, and would contact the AI unasked to rewrite a line that had worked fine. AITerm now learns their names from your shell at launch, alongside your PATH.
• A script in the current folder is found. When ./deploy.sh exits 127 because something inside it was missing, AITerm resolves the script against the shell’s working directory and says so, instead of admitting it cannot tell.
• Closing a tab stops the AI request it had in flight. A pane you close no longer holds on to a translation or a /fix — which, on a local model, was still occupying the engine your other tabs were queued behind.

0.18.2 Say what you meant

The input bar is much better at telling a command from a sentence — and much better at admitting when it cannot tell.

• Your installed tools are commands again. A Mac app launched from the Dock inherits a nearly empty PATH, so AITerm could not see anything Homebrew, pipx, nvm, cargo or go had installed. uv pip install requests, just build and poetry add requests were treated as English and sent to the AI instead of being run, and brew + Tab completed nothing. AITerm now asks your login shell what its PATH is, once, in the background at launch.
• A line that reads like English can be reinterpreted when it fails. Type find largest file here and AITerm runs it, because find really is a command — and when it fails you now get an Interpret as English link beside the usual Fix and Explain, never instead of them. Clicking it asks the AI what you meant and hands back an editable proposal that still only runs when you press Return. Lines that are genuinely commands are untouched: brew install ripgrep and git add file still just run, and nothing about what executes, or the safety gate it passes through, has changed.
• Honest answers after “command not found”. Exit code 127 usually means the shell found nothing to run — but a real program can return it too, when something inside it was missing. AITerm no longer claims “Not a command” about a command that plainly ran, and it no longer contacts the AI on its own unless nothing ran at all. Stopping mid-request always hands your line back.
• Quieter chips. Stopping a command yourself with Ctrl-C is not a failure, so nothing is suggested afterwards.
• Faster answers from Claude Code, and you can watch them arrive. The CLI-subscription provider used to run to completion before showing anything, so the bar sat on “Translating…” and then filled in all at once. It now streams the answer as it is written. Turning a sentence into a command is also no longer treated as a reasoning problem, which roughly halves the wait before the first character appears — measured 6.1s to 3.4s on a real request. Diagnosing a failure with /fix still gets the model’s full attention.
• A mistyped command is no longer remembered as something you asked for. When a command fails with “command not found”, AITerm offers to turn it into one. Accepting that used to record the misspelling as a request you had made, so the typo came back later as an inline suggestion. A line you explicitly ask to have read as English still is remembered — those words were the request.

0.18.1 Settings tidy-up

One cosmetic fix on top of 0.18.0.

• The Terminal pane in Settings now matches the others. It was the only pane laid out in two columns, so “Default Shell”, “Theme”, “Font Size” and “Current version” hung off to the right and its section headings were not bold, while Security and Privacy ran hard left. Same controls, same behaviour — it just looks like the rest of the window now.

0.18.0 Fewer keystrokes, safer clicks

• Inline suggestions from your own history. As you type in the AI bar, AITerm completes the line in grey with something you have run — or asked — before. → accepts it, Esc dismisses it, and typing on ignores it. Everything stays on your Mac: the suggestions come from your local history and nothing is sent anywhere to produce them. Turn it off in Settings ▸ Terminal if you would rather not have it.
• Links in terminal output are clickable — and gated. Hold ⌘ and click a hyperlink a program printed. Because the program picks the visible text and the address behind it independently, a click goes through the same kind of check a command does: an http/https link shows you the real host and the full address before anything opens, with Cancel as the default; a file:// link is revealed in Finder and never opened, so a link to an app cannot start it; every other scheme is refused and named. Opened, revealed and refused links all appear in the Security Log.
• Security fix, included above. In earlier versions ⌘-clicking a link in the terminal handed it straight to macOS with no confirmation — so output from any program could open a URL, or a file, that you never saw. Those clicks now go through the check described above.
• Fixed: the manual and the model manager could quit the app. Both read files that a packaging fault left out of the download entirely — they resolved only on the machine the release was built on. On any other Mac, opening Help ▸ AITerm Manual, the Model Manager or the local-engine installer quit AITerm instead of opening. Present since 0.16.0. The build now refuses to produce a release with those files missing.

0.17.1 Find where you are looking

A fix release for the new windows in 0.17.0.

• ⌘F searches the window you are actually in. Reading the Manual, ⌘F now lands in the Manual’s own search box — it used to open the find bar in the terminal behind it. The Manual’s search also gained a clear button.
• Terminal-only View menu items stand down when they do not apply. Find Next/Previous and Jump to Previous/Next Command are greyed out unless the terminal is the window in front, so they never scroll or search a window you cannot see.
• Jump to Previous/Next Command moved to ⌘⇧↑ / ⌘⇧↓ (was ⌘↑ / ⌘↓). Those plain arrow combinations are macOS’s "go to start/end of document" keys, and AITerm was claiming them app-wide — so they did nothing in the Settings system prompt box or the Manual’s search field. They now work as they should everywhere.

0.17.0 Own windows

The Manual, Keyboard Shortcuts, and the Security Log are real windows now — keep them open beside your terminal instead of on top of it. Plus a Stop button, and a clearer name for the most serious risk tier.

• Reference surfaces are real windows. Help ▸ AITerm Manual, ⌘/ Keyboard Shortcuts, and AI ▸ Security Log open beside your work, resize, and stay put while you type. Esc or ⌘W closes the one you are looking at.
• A Stop button for AI requests. A slow translation can be stopped from the input bar, and it hands back exactly what you typed. A running command gets a Stop next to the status dot.
• The top risk tier is now called Irreversible (it was “Dangerous”, which said nothing that “Destructive” below it did not). Same behaviour, clearer ladder.
• Dialogs no longer freeze the whole app. Every file panel and alert now attaches to the window that asked for it, so other windows keep working.
• Saved connections have a visible Remove button — it used to be right-click only.
• Notices keep a history. Anything the input bar told you is one click away in the status strip, so a message that flashed past is no longer lost.

0.16.9 No dead ends

A batch about honesty: no silent failures, no one-way doors, and no telling you something worked when it did not.

• Reset to Defaults always asks first — and says what it will take. It used to wipe a hand-written System Prompt with no confirmation and no undo.
• Apply no longer claims success for a key it could not save. If your API key does not reach the Keychain, Settings stays open and tells you, instead of showing a green checkmark and closing.
• "Using a cloud model" can be dismissed with Esc, and the button that shares your request now says so. Escape keeps you local rather than quietly consenting.
• Crash-report checks can be turned back on. "Don'"'"'t check again" was a one-way door that needed a Terminal command to undo; there is now a Settings toggle.
• A failed policy-pack export tells you it failed instead of silently writing nothing.
• Autopilot risk labels match the rest of the app — same names, same colors.
• A failed engine reinstall no longer leaves local AI stopped — the engine comes back up.
• Settings controls are now named for VoiceOver, the font-size slider shows its value again, and status messages no longer overwrite each other.

0.16.8 The update pill you can trust

One targeted fix from the first real-world test of background updates.

• The "Update ready" pill now appears for every background update — including the case where macOS lets Sparkle pop its own window, which could land on another monitor or behind other apps and be missed entirely. The pill in the status strip is now the guarantee; it clears itself the moment you open the update.
• Update activity is now logged (Console: subsystem com.vega.aiterm), so "I never saw an update" is diagnosable in minutes.

0.16.7 Quieter, clearer, quicker

The second usability batch from the same full app review as 0.16.6.

• Update checks you control. Settings ▸ Terminal gains a "Check for updates automatically" toggle. If you ever declined the old system dialog about automatic checks, AITerm turns checking back on once — the toggle is in charge from then on.
• Less nagging. The "Ollama is too old" alert shows once, then becomes a quiet status-bar pill (clicking it re-checks your Ollama first). Pro reminders appear at most once per feature per launch, can be muted for good, and repeats become a one-line note.
• A real command palette. ⌘K now covers Settings, Set Up AI, the Security log, the Manual, shortcuts, tabs and splits, and Safety Profiles — with arrow-key selection, shortcut hints on each row, and an honest "No matches" state.
• Modes you can see. Dry Run shows a persistent pill (click: straight to Settings ▸ Security) and says so in the input bar. Suggestion chips are dismissible and explain themselves the first time.
• Settings polish. The window remembers your tab, Esc closes it, every tab says which controls apply instantly vs on Apply, connection forms say "Add Connection" instead of a second "Save", disabled Pro editors say why, and a model-list refresh can no longer silently swap your configured model.
• Notifications, honestly. A Settings row shows whether finish-notifications are on, asks properly when they'"'"'re not, and links System Settings if they'"'"'re off at the system level.

0.16.6 Honest and safer by default

A usability release, built from a full review of the app'"'"'s dialogs and flows.

• Risk badges tell the truth for your profile. The badge blurb now reflects what the gate will actually do under YOUR Safety Profile — on Production or Locked Down a Dangerous command says "Blocked", not "you'"'"'ll get a confirmation".
• Return can'"'"'t run something dangerous by reflex. In every confirmation — including the new ones for Clear history, Clear security log, Delete workspace, and Remove connection — Return and Esc both cancel; running requires a deliberate click.
• Settings behaves. Apply saves and closes (and stays open with the reason if a Pro provider couldn'"'"'t apply), reopening shows current values, and Set Up AI / upgrade flows now appear on the window you'"'"'re actually using.
• Better first run. Every "AI is unavailable" message carries a Set Up AI button, onboarding can be skipped (Esc works), and a "Finish AI setup" pill sticks around until AI actually works.
• Notices you can use. The message bar is dismissible, selectable, and no longer truncates errors to two lines; blocked-command explanations survive until you'"'"'ve read them.

0.16.5 Publisher transition complete

The managed local MLX engine is now signed by Vega LLC too — the last piece of the publisher switch. If you use the MLX engine, AITerm quietly re-downloads it once (~16 MB) the next time it starts; engines already on disk keep working in the meantime. Nothing to do.

0.16.4 New publisher: Vega LLC

AITerm is now signed and published by Vega LLC — same developer, same app, new company name on the certificate. Because macOS ties your saved items to the publisher, the first time this version touches a saved API key or your license, macOS will ask for your login password — once per item. Click “Always Allow” and that item never asks again. (This one-time step also permanently fixes a bug where some saved keys asked for your password after every update.)

• Nothing else changes: your settings, history, license, and saved connections all carry over.
• Local AI (Ollama and the managed MLX engine) keeps working unchanged.

0.16.3 Maintenance

• “See what the AI sees” popover fix. The context inspector now always shows the session block it promises — it could previously come up empty if the preview refreshed while open — and gains a Copy button for the full, untruncated context.
• Under the hood. AITerm’s publisher is moving from DriveBoss LLC to Vega LLC (same developer, same app). This update quietly prepares your saved keys and license so the transition is seamless — no prompts, nothing to do.

0.16.2 Polish

• Clearer first-run prompt. When local AI isn’t set up yet, the “Set Up AI…” action now renders as a button, so it’s obvious you can click it.

0.16.1 Reliability

• Dry-run preview lists the files. The safety preview now shows exactly which files a delete or move would touch — previously it showed the count but the list could render blank.
• Amazon Bedrock works with the latest Claude models. Requests to newer models (via a us.anthropic.* inference profile) no longer fail, and a rejected request now shows the real reason instead of a misleading “API key” message.
• Model ID edits stick. Changing a Bedrock or Azure model / profile id and clicking Apply now saves what you typed.
• Remove saved connections. Right-click a saved connection to delete it.
• Friendlier first run. A clear “Set Up AI…” prompt instead of a raw connection error when local AI isn’t set up yet, plus a status-bar progress indicator while the local model downloads.
• Move to Applications. Launching from the mounted disk image now offers to move AITerm to Applications so automatic updates work.

0.16.0 Handbook

• Built-in user manual. A complete, searchable handbook ships inside AITerm — open it from Help ▸ AITerm Manual and browse every feature.
• Also on the web. The same manual is published at ai-term.com/manual.

0.15.2 Maintenance update

• Behind-the-scenes updates. Internal service endpoints and project links moved to their new home — no change to how AITerm works.

0.15.1 Settings polish & reliability

• Tidier Settings. The Privacy and Security tabs are now left-aligned and scroll properly.
• Reset to Defaults now really resets — per-host SSH profiles, imported policy packs, and the cloud-context level are cleared (after confirmation).
• Under the hood. More robust command-history loading.

0.15.0 “Guardrails”

• Dry-run preview. See exactly which files a delete or move would touch before it runs — or the tool’s own dry run, like rsync -n.
• Safety profiles with teeth. Production and Locked Down make risky commands stop and ask — or block outright; per-host SSH profiles turn a pane red on hosts you mark (authoring is Pro).
• Team policy packs. Import always-block / always-ask rules that can only ever tighten your gate. Importing is free; authoring and export are Pro.
• Tamper-evident audit log. Every command decision and its exit code goes to a hash-chained local log; signed export is Pro.
• Transfer safety. scp and rsync are risk-tiered by direction and scope, so a destructive sync asks first.
• Back up, then run. One click backs a file up before a risky delete.
• History, grown up. Capacity to 10,000 commands, a fuzzy ⌘K palette, and search by meaning (Pro).

0.14.0 “Total Context”

• The AI understands your session. /fix and /explain now get real context — recent commands, exit codes, and (when you allow it) their output.
• “See what the AI sees.” An eye chip shows the exact session context sent after every AI request — redacted for cloud models, exactly as received.
• You control what the cloud sees. A new Privacy setting caps how much session context a cloud model receives; local models always get full context.
• Privacy fix. Each tab’s AI context now comes only from that tab’s own history.

0.13.0 “Navigator”

• Scrollback search (⌘F). Incremental find across your whole scrollback with highlights and a live match count.
• Jump between commands (⌘↑ / ⌘↓) and click a mark to select one command’s exact output.
• Proactive “Fix?” chip. When a command fails, AITerm instantly names the likely cause — entirely on your Mac, no model call. Clicking never runs anything.
• Finish-line notifications. A long command that finishes in the background posts a macOS notification with its exit code.
• fish shell support with the same nonce-authenticated integration as zsh and bash.
• Opt-in crash reports — local first. Nothing is uploaded unless you click; no third-party SDK.

0.12.0 Licensing you can trust

• Pro licenses are now validated server-side and cryptographically signed; the app verifies them locally with an embedded key. About one reconnect a month keeps Pro active; roughly six weeks fully offline before it pauses.

0.11.0 The AI agent

• /agent — multi-step tasks, your approval each step. Describe the goal; it proposes each command and waits for you.
• /auto — opt-in autopilot. Auto-runs only the steps the safety gate can prove are safe and inside your project folder; pauses for anything that deletes, reaches the network, or acts outside it.
• Bounded build trust. An exact-form allowlist lets common build steps (npm install, cargo build…) auto-run — nothing else qualifies.
• Help ▸ Using the Agent explains both modes honestly.

0.10.7 Security hardening

• Sharper command-safety checks. The risk classifier now catches remote commands over ssh/mosh, obfuscated interpreter one-liners, and generated payloads piped into a shell.
• The AI gate covers every way you enter text — dictation, the emoji picker, IME, and Services insertions.
• Runbook review fix. A step built from an earlier step’s output is reviewed as the real command, not the placeholder.
• Robustness. Hardened Bedrock streaming and saved-session loading against malformed input.

0.10.6 Paste fix for terminal typing

• Pasting now works when typing directly in the terminal — pasted commands go to the shell line instead of the AI input bar.

0.10.5 Remote-command safety

• The safety gate now vets commands you run on other machines. A risky ssh host '…' gets the same risk badge, confirm, or block — escalated for the larger blast radius.
• Your safety profile is the prod dial. Production or Locked Down blocks destructive remote commands outright; harmless ones run without nagging.
• Hardening fix. Clustered shell commands like bash -lc '…' are vetted too.

0.10.4 Type directly in the terminal

• Click into the terminal to type on the shell line — a clear indicator shows the AI safety gate is bypassed.
• Focus stays where you put it, and drifts back to the AI bar after 15 seconds idle at the prompt.

0.10.3 Shortcuts & settings polish

• Font size shortcuts. ⌘+ / ⌘− resize the terminal text, ⌘0 resets — live in every pane.
• ⌘⇧F runs /fix on your last command.
• Software Update settings fixed and a tidier ⌘/ cheat sheet.

0.10.2 Update settings you can reach

• Fixed: the update notification could get stuck when automatic installs were on; the badge is restored.
• New: Settings ▸ Terminal ▸ Software Update — version, auto-install toggle, and check-for-updates in one place.

0.10.1 Better text selection

• Selection auto-scrolls past the top or bottom edge, so you can select more than one screenful.
• Readable selection highlight — each theme now uses a high-contrast selection color.

0.10.0 Keyboard-shortcut cheat sheet

• New: Keyboard Shortcuts reference. Press ⌘/ (or Help ▸ Keyboard Shortcuts) for a one-look cheat sheet of every shortcut.

0.9.9 “Automatically update” now works

• “Automatically download and install updates” is now honored — the setting sticks across launches instead of resetting every time.

0.9.8 Scrolling in interactive tools

• Scrolling works correctly inside interactive tools. When a full-screen program supports the mouse (vim, htop, fzf, …), the wheel scrolls the program instead of cycling its history.
• Settings: clearer separation between the provider list and the selected provider’s configuration.

0.9.7 Terminal scrolling & settings polish

• The mouse wheel now scrolls full-screen programs — pagers, man pages, and any alternate-screen tool.
• Provider setup is easier to find. Picking a provider scrolls straight to its configuration fields.

0.9.6 Privacy & reliability hardening

• Local (Ollama) always stays on your Mac. The managed Local engine is pinned to loopback, so a stray OLLAMA_HOST can no longer send on-device requests off the machine unredacted.
• Fixes a startup crash with scheme-less OLLAMA_HOST values.
• Tighter subscription-CLI hardening. The Claude Code / Codex helpers no longer inherit unrelated cloud credentials or NODE_OPTIONS.
• Smoother sign-in & fewer stray prompts.

0.9.5 One-click sign-in for Claude Code & Codex

• Sign in / switch account, in the app. A new button opens a tab and runs the official CLI browser login — authenticate or switch accounts without leaving AITerm.

0.9.4 Your subscription in the provider picker

• Claude Code & Codex, front and center. Your Claude or ChatGPT subscription via the official CLI is now a first-class choice in the AI-provider picker (under Pro).

0.9.3 Security hardening & clearer descriptions

• Stronger command-safety checks. More disguised download-and-run commands and command-laundering inside scripting one-liners now trigger the safety confirmation.
• Local AI stays local. The managed Ollama engine always binds to loopback; Managed MLX only connects to AITerm’s own engine.
• Honest provider descriptions and a configuration panel that reliably names the selected provider.

0.9.2 Clearer provider picker

• Right settings for the right provider. The inline configuration panel always names the provider you actually selected.
• Every provider explained with a one-line description; the Bedrock template and your saved Bedrock connection are clearly distinguished.

0.9.1 Provider settings polish

• Real download progress for Managed MLX setup.
• Cleaner provider picker — grouped Local / Cloud / Pro / Custom, with the selected provider’s settings inline.
• Accurate engine status, clearer Bedrock save errors, and a quick switcher that lists every active provider with its models.

0.9.0 Amazon Bedrock & Managed MLX

• Amazon Bedrock (Pro). Claude and other Bedrock models through your own AWS account — profiles, SSO, assumed roles, or keys, with per-region model discovery and streaming.
• Managed MLX (Pro, macOS 14+). Apple-Silicon-native local AI: a one-tap, on-device inference engine that runs entirely on your Mac.
• Private by default. Local engines keep every prompt on-device; cloud providers receive secret-redacted requests.

0.8.1 Security & polish

• Security and reliability fixes following the 0.8.0 release — tighter key handling and redaction, safer engine downloads.

0.8.0 Private local AI & a generous Free tier

• Private local AI, set up for you. AITerm downloads and runs a small on-device model — no account, fully offline once installed. Already have Ollama? It just uses it.
• Connect almost anything. One-tap presets for OpenRouter, Groq, DeepSeek, xAI, Mistral, Gemini, Perplexity, Cerebras, and more — or your own server.
• Free forever. The native AI terminal — command loop, /fix & /explain, tabs, splits, workspaces, the safety gate, local AI, and BYO cloud key — is now free. Pro adds subscriptions, runbooks, /agent, and Azure OpenAI.

0.7.1 Security & reliability hardening

• Sharper command safety check for dangerous commands disguised inside eval or scripting one-liners.
• No more lockouts on a network blip — license hiccups fall back to your offline grace period.
• Saved API keys are safe across updates, and runbook suggestions never save secrets.

0.7.0 Saved workspaces

• Save your layout and bring it back. Save tabs and split panes as a named workspace and reopen it anytime — every pane in its own folder.
• Picks up where you left off. Your last session is restored automatically on launch (toggle it off anytime).
• Manage your workspaces — rename or delete from the workspace manager.

0.6.1 Fewer update prompts

• Updates stop nagging for your login password. Saved API keys now carry a team-stable Keychain partition, so future updates read them silently.

0.6.0 Split panes

• Split panes. Several shells side-by-side in one tab: ⌘D splits right, ⌘⇧D splits down, ⌘⌥arrows move focus.
• Numbered tabs with a clearly highlighted active tab.
• Smarter input. ⌃C interrupts the running command while keeping your draft.
• Passive runbook capture. After a clean run, AITerm quietly offers to save the commands as a runbook.

0.5.1 Smoother updates

• Updates no longer install silently — the “Update ready — Install & Relaunch” pill waits for you.
• Fewer Keychain password prompts on update.

0.5.0 Tabs

• Tabs are here. Multiple terminals in one window — each tab its own real shell, history, and AI session. ⌘T new, ⌘W close, ⌘1–9 to switch.
• Your safety profile and audit log span every tab — a command approved in one tab only ever runs in that tab.

0.4.9

• Update notice fixed: the “Update ready — Install & Relaunch” pill now actually appears when a new version is published (the 0.4.7 wiring was inverted).

0.4.8

• Cleaner runbook capture: repeated ls/pwd/clear and duplicate lines are dropped, so you get a tidy, replayable sequence.

0.4.7

• Updates that actually land: a subtle “Update ready — Install & Relaunch” pill in the status bar instead of silent background staging.
• Rollback suggestions for destructive commands when a conservative undo or backup-first step exists.
• Project-aware AI: /fix and /explain factor in your repo, branch, and language.
• Runbook output chaining ({{step1.output}}) and history search.

0.4.6

• Fixed a bug where a second window showed another view of the same shell and sent typing to the original window.

0.4.5

• Safety Profiles: Personal, Work, Production, and Locked Down — stricter profiles escalate confirmations and block more at the command gate.
• Smarter /fix: original vs. proposed fix side by side, with one-click save to a runbook.

0.4.4

• Capture runbooks from your history: press ⌘⌥R to save recent commands as a reusable runbook — repeated values become {{variables}} automatically.
• Starter runbooks so your library isn’t empty on day one.

0.4.3

• Fixed a rare data-migration edge case where an interrupted upgrade could ask a licensed user to re-activate — the app now keeps your existing license and retries the move safely.