What shipped.

Show listening feedback and pasted images in the composer (0.3.8) (#22) Voice chat and dictation now show a live microphone waveform, and images pasted or dropped into the composer attach through the existing file pipeline with thumbnails in the thread.

Refresh Google tokens through the Worker (0.3.7) (#21) The installed app was refreshing Drive and Gmail without a client secret, so Google rejected the token after the first hour. The Worker now holds the secret and the app asks the user to reconnect when the grant is dead.

Add voice chat and fix transcription and image fallback (0.3.5) (#20) Browser recordings are sent as wav so the chosen transcription model can read them, and a provider 502 now retries the image fallback. Voice chat speaks the reply with the tier voice; the mic only dictates into the composer.

Add Budget, Best value, and Premium model tiers (0.3.4) (#19)

• Add Budget, Best value, and Premium model tiers (0.3.4) A central tier map picks the primary model and fallback for each role and media lane, and the Worker allowlist is derived from it. Agents follow a global Best value default, existing installs keep their current model as Custom, and a new Manager stays on DeepSeek V4 Pro until the user changes it.
• Hide catalog prices and describe tiers by quality The app shows a tier badge, a plain quality note, and a one-line good-for line. Premium says it uses more credits. OpenRouter prices stay in the domain catalog for later credit math and are not rendered.
• Remove the retired Imagen and Content Flow media path Media already goes through the OpenRouter Worker. Drop the Imagen MCP URL, still-approval IPC, and leftover notes, and tell agents to report results in plain language.

Add speech, transcription, and audio through the Worker (0.3.3) (#18)

• Add speech, transcription, and audio through the Worker (0.3.3). Remove the Imagen preset, bake step, and Worker proxy, and keep MCP as a generic local server. Speech, transcription, and sound stay behind the install token and the existing spend caps.
• Reuse a prior still as the video first frame and post the clip once. A follow-up that animates an image already in the chat sends those bytes as the first frame and skips a new still. A generated first frame stays on the video as its poster. Media cards drop the Draft label, and video cards get Download and Open folder.

Generate images and video through the Worker without an approval gate (0.3.2). (#17) Ordinary stills and clips use OpenRouter via /v1/images and /v1/videos, so the Manager can render them in chat. Imagen stays optional for studio and 3D work.

Fix group image delegation and show Imagen stills in chat (0.3.1) (#16) Group tool approvals were inserted with the group id as the task id, so SQLite rejected them before Imagen ran. Create a real task, ignore stale project ids, and stop retrying a failed delegation.

Give the Manager bulk task cleanup and a model per agent (0.3.0) (#15) list_tasks and remove-all cover a project, No project, or a list of ids. Each agent stores its own allowlisted model, the chat menu scopes the project, and a new Manager starts on DeepSeek V4 Pro. MiMo V2.6 Pro joins the allowlist.

Render chat, group, and project messages as rich markdown (0.2.9) (#14)

• Render agent and user messages as rich markdown (0.2.9) Chat, groups, and project views were showing bold, lists, and links as literal text. Messages now render GFM, highlighted code, mermaid, and chart fences, and prompts ask for tables where they help.
• Keep markdown table cells on one line so wide price lists scroll

Run group chats through the agent loop and keep release secrets off the installer (0.2.8) (#13)

• Give groups a real agent loop and keep release secrets off the installer (0.2.8) Group messages now run the same tool loop as Manager chat, can ask roster members, and post scheduled results back into the group. The shared model list matches current OpenRouter prices. The Manager archives project tasks only when asked. Installed builds proxy Brave search through the Worker, use Desktop PKCE for Google, and bake public OAuth client ids.
• Read the GitHub OAuth client id from GH_OAUTH_CLIENT_ID GitHub rejects Actions variable and secret names that start with GITHUB_. The release and runtime-smoke workflows read vars.GH_OAUTH_CLIENT_ID, falling back to the secret of the same name, and export it as GITHUB_OAUTH_CLIENT_ID for the bake step.
• Stop the runtime smoke boot from waiting forever The boot step downloaded Node 24 with pwsh's web cmdlet, which has no default timeout, before it printed anything. That download is unnecessary because setup-node already put Node 24 on PATH. Every remaining wait is capped, the step itself times out after 8 minutes, and diagnostics still upload when the job is cancelled.

Let Groups address teammates by name and carry a color (0.2.7) (#12) Display names now resolve to live agents, mentions route to those members, and each group keeps a muted color that shows in the list and header.

Allow several live agents from the same template (0.2.6) (#11) Hiring from a template now creates a new agent with its own id, name, instructions, and memory. A live name collision is rejected instead of archiving or reusing the existing teammate.

Show only ticked shared models in the chat menu (0.2.5) (#10) A stored API key was pulling the whole bring-your-own-key catalog into the dropdown. The menu now lists ticked T-force models, with an explicit Advanced provider in its own group, and upgrades rewrite stale agent and chat refs without deleting keys.

Stop orphaned runtime node.exe from locking updates (0.2.4) (#9)

• Stop an orphaned runtime from locking the next install. Kill the bundled Node process with the app, including a hard kill and the in-app updater, and have NSIS close only this install's binaries before it copies files. Shrink the update notice to a corner card without release notes. Version 0.2.4.
• Use tokio's raw_handle when assigning the runtime job. tokio::process::Child does not implement AsRawHandle on Windows. raw_handle() is None once the child has already exited, so that case is reported instead of treating a missing handle as live.

Serve chat from a shared OpenRouter proxy instead of user API keys (#8)

• Serve chat through an owner-held OpenRouter proxy. Users tick models from an allowlist instead of pasting API keys. A Cloudflare Worker keeps the key, issues a per-install token, and forwards streaming completions.
• Point T-force at the deployed tforce-llm Worker
• Point proxy URL tests at the deployed origin and set 0.2.3. The configured Worker address is no longer empty. Tests check that no key ships and that overrides still build the /v1 base URL. The desktop release version is 0.2.3.

Bundle Node.js 22.23.3 so the installed app ignores system Node. (#7) better-sqlite3 is built for NODE_MODULE_VERSION 127. A machine with Node 24 (ABI 137) exits before the runtime is ready. The installer now ships node.exe and always spawns that binary.

Fix the installed app failing to start its runtime (#6)

• Check the installed runtime instead of scanning the NSIS exe. Tauri compresses the installer with solid LZMA, so setup.exe does not contain the runtime path as plain text. The release and smoke jobs now require runtime/main.js after a silent install.
• Fix the installed app hanging while the runtime starts. Rust's default Windows pipes are named pipes. Node can block in SetNamedPipeHandleState on those handles, so the process stays alive and startup never leaves "booting". Spawn Node with anonymous CreatePipe handles, wait for its ready line, and record stderr plus startup decisions in the app data folder. runtime-smoke uploads that log, startup.json, and the setup exe even when the job fails.
• Strip verbatim Win32 paths before handing them to Node. resource_dir() returns a \?\ path. Node's realpathSync treats that as drive-relative and exits with EISDIR lstat 'C:' before the runtime starts.

Align Tauri JS packages with the locked Rust crates. (#4) The Windows release failed because tauri 2.12.2 was paired with @tauri-apps/api 2.11.1. Pin both sides to the same major.minor and run the release build with pnpm.