Codeep for Mac — Releases

MiniMax M3.1 Flash is the new MiniMax default, with a thinking control, and M3 cached tokens are no longer priced at half their cost.

• MiniMax M3.1 Flash is first in the picker on all three MiniMax providers and the new default: one 1,000,000-token window, and on the pay-per-use API $0.15 in / $0.60 out per million tokens, with cached input at $0.015. MiniMax M3 stays in the picker, and a conversation that names it keeps it.
• A thinking control for M3.1 Flash. It offers Low, Medium, High and Max. Thinking cannot be switched off on this model, so none of them does. Auto sends nothing, and the model then runs at its own default, the highest level, which uses a subscription's 5-hour allowance fastest: pick Low, Medium or High for everyday work. M3 has no thinking control and is sent none.
• DeepSeek V4.1 Flash is now the 17 October release. DeepSeek kept the id and the price, so nothing changes for you.
• Fixed: MiniMax M3 cached tokens were priced at half their cost (a tenth instead of a fifth), so the toolbar figure, Usage, Insights and the cost sent to codeep.dev read low for a conversation that cached a lot. M3.1 Flash was also at risk of being priced as M3, which would have shown twice its real cost.

You can now choose how long a run must take before its answer goes to Telegram, from right away to five minutes.

• Send answers after sits under "Send answers to Telegram" in Settings → Tools & Privacy → Approval on your phone: Right away, 15 seconds, 30 seconds, 1 minute or 5 minutes. It is 1 minute unless you change it, as it was, so nothing changes until you pick another. Right away sends every run, however short.
• When it applies. The choice is available once "Send answers to Telegram" is on and a bot token and chat ID are saved. A run you start from your phone is not affected: it is still answered once, with no wait.

Gemini 4 Argon joins the Google model list as its new default, and tool calls on Gemini models work again: the app now sends back the thought signature Google requires.

• Gemini 4 Argon is first in the Google list and the default for Google. One 1,048,576-token window is shared by the prompt, the thinking and the answer, and the thinking control offers Low, Medium and High. It needs a paid Google key; Google does not offer it on the free tier. $2 in / $10 out per million tokens through 30 November, $4 / $20 from 1 December.
• Tool calls on Gemini. When a Gemini model called a tool, such as reading a file or running a command, Google refused the app's next request with an HTTP 400 for a missing thought signature. The app now keeps the signature the model sends with each call, also in saved conversations, and sends it back. This was the case on Gemini 3.8 Flash as well, not only on Argon.
• Thinking is counted. Google reports a Gemini model's thinking apart from its answer and bills it as output. The toolbar, Usage, Insights and the cost sent to codeep.dev now include it.
• Gemini 3.7 Flash and 3.5 Flash are gone from the list, as Google deprecated both on 8 October. A saved setting that named one moves to 3.8 Flash or 3.6 Flash.

Claude Haiku 5.5 arrives, priced by how long each prompt is, and a request the model declines no longer starts a build or a test run.

• Claude Haiku 5.5 is in the model list, with the thinking control and a 1M-token window. It is the first model priced by prompt length: $0.10 in / $0.50 out per million tokens for a prompt of up to 100,000 tokens, and $0.50 / $2.50 for every token of a request whose prompt is longer. The toolbar, the Usage popover (which now says when part of the bill was at the long rate), the Run inspector and the cost sent to codeep.dev all use it. Conversations saved before this update price their Haiku 5.5 tokens at the lower rate.
• A decline ends the run. When the model refuses a turn after the run edited files and Auto-verify is on, the app no longer runs the project's checks or asks the model for a fix, and the run is not marked as failing its checks.
• Croatian for the "Send answers to Telegram" switch and its note, which were English on a Croatian Mac.

A long run you start at the Mac can send its answer to Telegram, and a declined request now says so, through OpenRouter too, instead of telling you to check your API key.

• Send answers to Telegram (Settings → Tools & Privacy → Approval on your phone): when a run you started at the Mac takes a minute or longer, your chat gets how it ended and the agent's answer. Off by default, because an answer can contain file contents or secrets and Telegram keeps the chat.
• A decline says so. The Git sheet's suggestion, recall, Discuss in chat, /recall, Learn and /compact show the decline itself instead of blaming your key. Only a missing key asks for one.
• Declines through OpenRouter and other OpenAI-compatible providers end the turn with the model's reason, or with "The provider's content filter stopped this response." No tool calls run, nothing is retried, and no wrong-key banner appears.
• MCP servers get a readable reason when a sampling request fails, and a declined title request no longer names the chat after unfinished text.

The Codeep mascot moves into the app (and into the Dock, if you like), the icon's inner chevrons are the logo's again, and the name beside the logo is set the way codeep.dev sets it.

• The mascot greets you on the empty chat and the first-run screen, and sits beside the phase label while a run is live. Reduce Motion holds it still.
• Settings → General → App icon: Logo or Mascot. Mascot shows in the Dock while Codeep runs; Finder keeps the logo, because changing the bundle's icon would break its signature.
• The app icon uses the logo's own geometry again — its inner chevrons had been a shrunk, thinner copy.
• The name beside the logo is set in spaced monospaced capitals, as on codeep.dev.

A new chat opens on a provider you have a key for, the toolbar says what the agent is actually doing, and the Run inspector starts over with each request.

• New chats follow the chat you were in, then the provider you last used, then one you have a key for — no more Anthropic chats without an Anthropic key after deleting your last chat.
• The toolbar and Run inspector no longer say “Connecting…” for the whole run: they show Thinking…, the tool that is running, a confirmation you are asked for, or the checks.
• The Run inspector's stages start at Plan on every request and follow only that request. An exploratory command no longer counts as a passed check, and auto-verify's fix round no longer restarts the stages.

GPT-6.1 Sol arrives as the new OpenAI default: near-Astra quality at $2/$10, with cache reads at half GPT-6 Sol's price.

• GPT-6.1 Sol (gpt-6.1-sol): 1.05M context, 128K output, thinking from low to max. It calls tools over OpenAI's Responses API, which the app uses at OpenAI's own endpoint. Through OpenRouter it is openai/gpt-6.1-sol.
• GPT-6 Sol stays in the picker for conversations and choices that name it. A new chat opens on GPT-6.1 Sol only if you never picked an OpenAI model.

Requests no longer fail when an MCP server's tools carry a 0 or a 1, and an error no longer freezes the window.

• Every request failed with some MCP servers connected. The app read each 0 and 1 in an MCP tool's definition as false and true, so providers rejected the whole request — Z.AI with 1210 “Invalid API parameter”, DeepSeek with “Invalid schema for function”. Current ios-simulator-mcp and @playwright/mcp both carry such numbers.
• An error froze the window instead of showing the banner. The message now takes at most four lines; hover or Copy shows all of it.
• The error says what the provider said, not the first characters of its raw JSON.

Claude Sonnet 5.5 arrives, and a request Claude declines now says so instead of leaving an empty reply.

• Claude Sonnet 5.5, Anthropic's new Sonnet: $2/$10 like Sonnet 5, 1M context, thinking on by default. Sonnet 5 stays in the picker for conversations pinned to it, and Opus 5.5 stays the Anthropic default. Through OpenRouter it is anthropic/claude-sonnet-5.5.
• A declined request shows “Claude declined this request (category: …)” instead of an empty bubble, and runs none of that turn's tool calls.
• Compact, Learn, session titles, the commit message suggestion and recall take nothing from a declined request, so your conversation, learned profile and commit message stay as they were.

MCP servers and skills can be removed from Settings, the MCP list shows every server while it connects, and two servers the catalog offered never worked.

• Settings → MCP servers lists every server at once, marked “Connecting…” until it answers. Servers start together, and one that exits says why instead of timing out.
• Remove your own MCP servers and installed skills from Settings.
• New and installed skills take effect at once — no restart.
• The catalog no longer offers Fetch (the package does not exist — Codeep's own fetch_url does the job) or the unmaintained Postgres and GitHub servers. If you added Fetch or Postgres earlier, remove them with the new button.

Stop stops, Undo no longer overwrites your own edits, conversations stop getting lost, and a trusted project's hooks and MCP servers need your OK again whenever they change.

• Stop kills the running command or hook with everything it started and skips the tool calls queued behind it.
• Undo refuses to overwrite a file you changed after the agent wrote it, and survives a model or provider switch.
• Conversations: a failed save is reported instead of losing history on quit, an unreadable history file is kept aside, and cloud sync no longer drops turns.
• Auto-verify reports failing checks as failures, and asks once per project before running its build and test commands.
• MCP: tools no longer leak from one project to another, and trust can be revoked in Settings.

Please note: hook and MCP trust from earlier versions is asked for again, because trust now covers the scripts and server list exactly as you saw them. Your own ~/.codeep/hooks now run in every project. The Git sheet commits tracked files by default, with untracked files behind a checkbox.

A repository you open can no longer run code on your Mac, read your secrets or write outside itself — and Claude Opus 5.5, Grok 4.7 and GPT-6 arrive.

Security. A full audit of what a cloned or downloaded repository can do, fixed the same way as Codeep CLI 3.4 and checked with real attacks:

• A folder with its own .git could run a program the moment you opened it, because git runs commands named in a repository's own config and Live Review runs git straight away. Every git call now neutralises those settings, submodules included; git-lfs, git-crypt, nbstripout and git-annex keep working.
• The agent could write files that run later — git config and hooks, .codeep/hooks, skills, agents, MCP server lists — without asking. Those writes now always ask and say what the file controls.
• Repository files that go into the prompt no longer follow symlinks out of the project, and @file, @dir and search refuse secrets files and private keys.
• What you approve is what runs: approvals show the full command with hidden characters made visible.

Models. Claude Opus 5.5 is the Anthropic default. Grok 4.7 and GPT-6 Sol and Luna are added, and OpenAI agent turns now use the Responses API, so GPT-6 Astra calls tools and GPT-6 reasons while it works. GPT-6 Sol is the OpenAI default.

Also fixed: conversations on OpenRouter, Ollama or custom models no longer reopen on the default model, and git calls are about ten times faster.

A page the agent read could send fetch_url to an address on your own network — a Tailscale machine above all — and it runs without asking.

fetch_url refuses loopback, private and link-local addresses, including the cloud metadata endpoint, because the URL comes from model output or page content: a file or a web page the agent reads can put one there, and the tool is read-only, so it runs without a confirmation prompt.

The check compared spellings, not addresses. Anything carrying a private address without a dotted quad went through — CGNAT 100.64.0.0/10, where every Tailscale machine lives, along with NAT64, IPv4-compatible and 6to4 wrappers, site-local fec0::/10, and the multicast and reserved ranges. Addresses are now parsed and judged by their bytes, so every spelling of the same address is treated alike. Redirects were already re-checked hop by hop and now use the same check.

The same guard and the same test vectors as the CLI's 3.3.3, where the gap was wider.

DeepSeek cached tokens were estimated at five times their price.

A cached DeepSeek V4.1 Flash token costs $0.006 against $0.30 for a miss — 2% of the price. DeepSeek had no cache rate of its own in the app, so it fell back to the 0.1 default and every cached token was estimated at five times what it costs. In a long session where most of the input comes from cache, that is most of the estimate. The Saved via caching figure in Usage moves with it, since it is computed at the same rate. Historical DeepSeek V4 Pro usage keeps its own ratio, 1/30.

A correction. The 3.3.0 release said Codeep could not read DeepSeek's cache-hit count. That was wrong: DeepSeek reports it in two fields and the app has always read one of them. The fault was only ever the rate.

DeepSeek V4.1 Flash before DeepSeek routes V4 Pro to it on 14 September, Qwen 3.8 Max and Flash, GLM-5.3 in China — and four cost figures corrected, DeepSeek's by more than four times.

DeepSeek V4.1 Flash is the DeepSeek model, and the default. DeepSeek names it the model to use and says it outperforms V4 Pro. V4 Flash is already retired and served by it, and from 14 September every V4 Pro request is routed to it and billed at its price until a V4.1 Pro exists. A conversation set to either V4 model moves to it automatically — keeping a Pro entry would have meant a Pro label on a Flash model. Its thinking control now offers Low as well.

Qwen3.8-Max and Qwen3.8-Flash on Qwen API (pay-per-use), 3.8-Max the default. Both have a 1M window and cost less than the 3.7-Max and 3.6-Flash they sit above. GLM-5.3 on Z.AI China, plan and pay-per-use, with GLM-5.3 Flash on China pay-per-use.

Four prices were wrong. DeepSeek estimates ran two to four and a half times too low — V4 Flash at $0.14/$0.28 against $0.30/$1.20 today, V4 Pro at $0.435/$0.87 against $1.32/$3.96. Estimates carry the peak rate so they can run high but never low; these ran low. GPT-5.6 Sol is $4/$20, an OpenAI promotion through at least 21 November, not $5/$30 — and a correction to the 3.2.0 notes: against that, GPT-6 Astra is two and a half times Sol's price, not twice. MiniMax-M3 is $0.30/$1.20 up to 512K prompt tokens; the $0.60/$2.40 it carried is the long-context tier.

Caught before shipping. Three places decide things by model name, and the new ids slipped past all of them: the context meter would have shown DeepSeek V4.1 Flash at 128K instead of 1M, eight times too small; its thinking control would have been hidden; and a rule written for the Qwen Token Plan preview would have priced pay-per-use Qwen3.8-Max at zero. Each is now held by a test.

The OpenRouter list offered qwen/qwen3.8-max, which OpenRouter does not carry — only its -0902 snapshot — so choosing it before the live catalogue loaded failed.

Three things that were true but unsaid.

Which scope you are in. The sidebar highlight was the only signal, and "Personal" reads as the name of a workspace rather than as "no project is open". Ask the agent to look at your code after missing that, and being told it cannot see the disk sounds like a broken app instead of a mode with a one-click exit. The empty state now names the open project — or says no project is open, what personal mode can still do, and how to leave it.

That personal mode has no file tools. An open project puts a block in the system prompt; no project put nothing at all, so the model had to account for its own short tool list and invented a story — announcing access to "the web and GitHub repositories" as a property of its environment. It is now told plainly, including what it still has.

That this Mac is a device you can revoke. Registration ran once at sign-in, and a failure there was written off in the code as a "dashboard nicety". It is not: the device row is exactly what Revoke deletes, so a Mac whose one registration failed — a network blip at sign-in is enough — synced normally, never appeared under Connected devices, and could not be cut off at all. It now re-announces itself on every launch, which heals that on the next start and makes the dashboard's last seen mean last seen rather than linked.

Two more are already live at codeep.dev and need no update. Revoke now actually revokes — it deleted the device row and stopped there, while token lookup fell back to a one-row-per-user table holding whatever authorized most recently, so the device you linked last kept syncing after you revoked it. Worth re-revoking anything you thought you had already cut off. And linking a server no longer means signing in to GitHub on it: the link Codeep prints carries a one-time five-minute code that can be approved from any device you are already signed in on. That was always true and never said.

One new field in the usage report: whether a run was started from your phone.

It exists to answer one question — is a Codeep iOS app worth building — and to answer it with behaviour rather than opinion. Asking would answer the wrong thing: "would you like an iOS app?" costs nothing to say yes to. Codeep 3.1.0 already shipped the cheap version of that app, starting a task from your phone over Telegram, so what is worth knowing is whether anyone actually does it.

Said out loud rather than left in the code. Finding out from a diff that something new is being recorded is a reasonable thing to be annoyed by. Nothing about your message, your prompt or the answer is sent — this is a yes/no about where a run came from, and it goes only if you have linked the app to a Codeep account and left usage reporting on. Settings → Tools & Privacy → Send usage stats & auto-sync conversations turns the whole thing off, as before.

Reported coarsely here: the Mac pushes usage as a delta per conversation rather than per run, so the flag says "a phone-started run is part of this", not "this is one" — enough for a question that counts people, not runs. It is cleared once reported, so one phone-started run cannot read as a lifetime of them.

The reasoning, and the three things that would take the iOS app off pause, are written down in the CLI repository as docs/ios-decision.md.

Two frontier models landed in the same week, and both are in the picker.

GPT-6 Astra. OpenAI's frontier model, released 3 September — 1M context, 128K output, and the thinking control works on it. It is not the default, on purpose: it costs $10/$50 per million tokens against GPT-5.6 Sol's $5/$30, twice the price, and OpenAI is still rolling it out organization by organization, so a key that works today may not have it. Sol stays the default; Astra is one pick away in Settings → Model.

Gemini 3.8 Flash. Google's newest Flash, released 2 September, at the same price as 3.7 Flash ($0.75/$3.75 promotional). 1M context, 64K output, tuned for long-horizon agentic work. If you are on 3.7 Flash there is no cost reason not to move.

Two things that would have failed quietly. The thinking control was gated on a gpt-5 prefix, so GPT-6 — a reasoning model — would have arrived with the control hidden and nothing to explain why. And Google removed temperature, top_p and top_k in the 3.7 generation; 3.8 is built on 3.7, so without saying so every call would have returned 400.

Existing model ids are untouched. New ones are added beside, never in place of — dropping an id does not leave a pinned setting on the older model, it drops the lookup and lands that conversation on another provider's default.

Cost estimates use the promotional Gemini rate that runs to 31 December 2026. The rise scheduled for 1 January 2027 is deliberately not written ahead of time: doing exactly that for Sonnet 5 over-reported every run by 50% until someone caught it by hand.

Send the bot an instruction from your phone and it runs here, in the app, with the whole answer coming back to the same chat. Telegram already carried approvals — your phone could answer a question the agent chose to ask. Now it can ask one. The run appears in the conversation exactly as a typed one does: a task started from the phone must not be invisible to whoever is sitting at the Mac.

It is off until you ask for it, in Settings → Telegram, and it is a separate switch from the approval one on purpose. A chat that can only say Run, Skip or Cancel is bounded by what the agent already decided to do. A chat that can send a prompt is a keyboard attached to this Mac. Same bot, same chat ID, no second setup.

Choose which conversation it drives. Right-click one in the sidebar → Drive this from Telegram. A paper plane marks it, and instructions land there whatever you happen to be looking at — so you can read one conversation while the phone works in another. Without a choice they go to the selected one, which keeps it usable before you have picked, but the target then moves when you switch conversations at the Mac.

A long answer arrives whole. Telegram refuses anything over 4096 characters outright, so an uncut answer is not a long message — it is a missing one. Answers are split across up to three messages, on a paragraph or line break, with markdown stripped so the reply reads as words rather than as **words**. A run you started at the Mac sends nothing back: that answer is already on the screen you are sitting at.

One connection to Telegram, not two. Approvals and the inbox now share a single poller. A bot has one update cursor, and offset confirms every older update regardless of allowed_updates — that parameter filters the response, not the acknowledgement. Two pollers on one bot therefore eat each other's messages: an approval tapped on the phone would simply not register, with nothing anywhere to say why. A poll that cannot read the bot now says so in Settings, once when it starts failing and once when it recovers.

Fixes: the bot token appeared to need re-entering after a test run — it never went anywhere, but an unreadable Keychain and an empty one returned the same nothing, and the field showed blank either way. Settings now says which. Running the tests also wrote temporary folders into Open Recent and overwrote real settings; the suite gets a throwaway one.

Three cost figures were wrong. Nothing here changes how the app runs — it changes what it tells you a run cost.

Claude Sonnet 5 was priced 50% high. Its $2/$10 launch rate was billed as introductory through 31 August, with a rise to $3/$15 scheduled for 1 September. Anthropic cancelled that rise and made the launch price permanent. Nothing broke when the table still said $3 — the number was simply wrong, and no test was going to notice.

Cache reads on Kimi and Qwen were billed wrong, in opposite directions. Two errors, and the first hid the second. Cache hits were read only from prompt_tokens_details.cached_tokens; Kimi reports them at the top level of usage, so every Kimi cache hit came back as zero and the whole prompt billed at the cache-miss rate. And where a cache read was seen it billed at 0.1× — Anthropic's multiplier, applied to everyone — while Kimi lists $0.19 against $0.95 and Alibaba prices Qwen's implicit cache at 20% of input. Only the metered keys were affected; the subscription tiers quote no dollar figure at all.

Claude Fable 5.1 joins the model picker. It prices like Fable 5, which is exactly why it needed its own entry: it reads a cached token at 0.025× the input rate where every other Anthropic model charges 0.1×. Fable 5 stays selectable — dropping a model id does not leave a pinned setting on the older model, it drops the lookup and lands you on another provider's default.

Why this is 3.0.1 and not 3.1.0. The terminal released 3.1.0 today, and its headline is starting a task from Telegram — which this app does not have yet. Matching the number would have made one version mean two different things depending on which surface you were holding. The Mac catches up at 3.1.0 when the feature does; these corrections had no reason to wait for it.

Every run now records what it touched — including what it was stopped from touching. Each agent run appends to .codeep/audit/ in the project: one line per event, one file per day. It records reads and refusals, not just changes, because a capability boundary that nothing writes down is one you have to take on faith. A Git-only bot reaching for the shell is now a line in the record rather than a thing that quietly did not happen.

It is the same record the terminal keeps — same directory, same format, same field names — so codeep and /audit read runs this app made, and vice versa. A project worked on from both has one history rather than two that disagree. File contents are never written; paths and command lines are, so treat the directory like shell history. Switch it off in Settings → Tools & Privacy → Audit record; everything already written is kept.

The version numbers line up. Codeep V3 is one release across three surfaces, so the three carry one number: this app moves 1.14.0 → 3.0.0, the CLI 2.25.0 → 3.0.0, and the VS Code extension 2.9.0 → 3.0.0. Nothing here is a breaking change — the major is the alignment, said out loud rather than left to look like an accident.

Fixes: the OpenRouter routing settings appeared twice, because the section was referenced twice in the same view.

Answer a pending confirmation from your phone. When a run stops on a destructive tool it waits — and if you are not at the desk, it waits for as long as you are away. Connect a Telegram bot in Settings → Tools & Privacy and the same question arrives on your phone with the same three answers. Whichever you use first decides; answering on the Mac takes the message down rather than leaving buttons that no longer do anything.

Two rules matter more than the feature itself. Only the chat ID you configure can answer — a bot's username is discoverable, and without that check anyone who found yours could approve a destructive command on your Mac. And a late tap cannot reopen a settled question, so a slow answer can never run something you already declined. Telegram carries this because Telegram runs the infrastructure: the bot API is polled outbound, so there is no server to host and no inbound port to open. The message has to contain the command, or you cannot judge what you are approving — if that is not acceptable for your work, leave it off and the desktop sheet is unchanged.

GLM-5.3-Flash joins the model picker on the international Z.AI providers. The same million-token window and tool calling as GLM-5.3 at a twentieth of the price, and it takes the same graded thinking control. Cost estimates read the $0.15 / $0.50 list price rather than the 50% launch promotion: a promotional rate looks right until the day it ends, and then understates every session after it. The China gateway keeps the GLM-5.2 roster.

An agent you delete on codeep.dev now disappears from this Mac too. Until now it didn't: sync only ever walked the list of agents the server still had, so a deletion had no way to travel and the agent stayed on every machine indefinitely. Sync now applies the server's deletion list, copies each file to ~/.codeep/backups/personalities/ before removing it, and clears the selection on any conversation that pointed at one.

The rule underneath is deliberate: absence still means nothing. An expired session, the wrong account, or a truncated response all look identical to "you have no agents", and a client that treated that as a deletion list would empty your agent folder on the first bad request. Only an explicit tombstone removes anything, and a removal that cannot be backed up does not happen at all.

Agent Studio is where you'd look for it. It lived in the File menu, one item among nine, and the only other route was a toolbar chip labelled "Automatic" — a word that reads as a setting rather than a door into the bot editor, so the feature went unfound even by people who knew it was there. It now has a dedicated ✨ button in the chat toolbar, and its menu entry sits in the Codeep menu beside Settings. ⇧⌘A is unchanged.

GLM-5.3 has a price, and is available pay-per-use. Z.AI opened the standalone model API to it and listed it at $1.40 / $4.40 per 1M tokens, so it joins the pay-per-use roster and Insights stops showing that traffic as free. It previously carried no cost at all, deliberately: no per-token rate was published while it was Coding-Plan only, and inheriting GLM-5.2's would have been an invented number. The figure is read off Z.AI's own price page — that it happens to match GLM-5.2 is a fact about today's list, not a rule linking the two. GLM Coding Plan usage is flat-fee and still reads Included in plan. The China gateway is a separate listing and keeps the GLM-5.2 roster.

Custom bots become a real boundary, not a polite request. A bot built in Agent Studio — or on the dashboard, and synced down — can pin an exact model, expose only the capabilities you granted, and be limited to the projects it belongs to. Disallowed tools are not refused after the fact: they are never offered to the model, so a Files-only bot has no shell to reach for. Legacy prompt-only personalities keep working exactly as before, unrestricted.

Capabilities now say what they actually grant. The Tools label promised that deselected groups are removed from the runtime, which reads as a guarantee that a Git-only bot cannot see your files. It can: git show HEAD:file returns the contents of any committed file, and the same allowlist permits git rm, git commit and git push — so such a bot can rewrite the repo and publish that. Granting Git without Files now says both, plainly, on the sheet. The enforcement did not change; the promise is now true.

Fixes: a blocked command no longer asks for your approval first. A Git-only bot that tried head -5 README.md raised the destructive-tool sheet and was refused only after you answered it — implying a choice you did not have, while "Always allow" would have recorded a grant the runtime still rejects. The policy is now checked before the sheet. Agent Studio also reached the menu bar (⇧⌘A); until now it was reachable only by knowing to click the persona chip.

Plan-based usage stops showing a made-up price. Z.AI's GLM Coding Plan, MiniMax, Kimi's Coding Plan, Qwen's plans and the free ModelScope tier bill a subscription — but their tokens were being priced at pay-per-use rates, so Insights quoted a figure you never pay. Those rows now read Included in plan, and the totals leave plan usage out instead of folding it in. Token counts, message counts and the energy/water estimates are untouched: those are measured, only the price was fiction. Also new: Grok 4.6, Gemini 3.7 Flash and GLM-5.3 (GLM Coding Plan only — Z.AI publishes no per-token rate, so it carries no price at all). Fixes: Gemini estimates were double, because gemini-3.6-flash stored the post-promotional rate rather than the one actually charged through 2026-12-31; and a plan row's token count could read as money on a European locale, where the grouping separator turned 226668 into "226.668" in the same column that shows a dollar amount one row down.

An Agent Inspector rail, session metrics, and a refreshed model catalogue. The chat window gains a collapsible right rail showing the current run's stage, the files it touched, the checks it ran, and the context shaping the next request — plus a metrics bar under the composer with run state, tokens, estimated cost, and the estimated electricity and cooling water for the session (research-derived ranges, labelled as estimates, matching the CLI and web readouts). ⌘K now really does focus conversation search. The provider catalogue is refreshed across OpenAI, Google, Kimi and Qwen. Fixes: a remembered model that a provider retired no longer follows you into new chats as an opaque 404; clearing a conversation no longer makes all its later usage invisible on the dashboard; a stats hiccup no longer signs you out of codeep.dev; the Inspector no longer re-scans the whole run on every streamed token; and the minimum window width rises to 900pt so the toolbar has room.

Inline @mentions, Claude Opus 5, and Croatian localization. Attach context straight from the composer: @file, @folder, @git <ref> and @web <url> pull in files, directories, diffs and web pages without leaving the message. The model picker gains Claude Opus 5 (now the Anthropic default) and Moonshot's Kimi K3 line with its 1M context window. Also new: a Keyboard Shortcuts sheet (⌘?), conversation pinning, custom accent colors, Quick Agent pinned prompts, a retry button on failed turns, and a first pass at Croatian localization. Fixes: the Settings window no longer clips its content, a large @git diff no longer freezes the app, streaming long code blocks is markedly faster, slash commands send on the first Return again, editing your profile no longer writes to disk on every keystroke (and syncs across devices again), and the agent-limit, live-review and web-tool settings apply to open chats immediately.

Slash-command parity, new provider models, and a cleaner message view. The composer now understands the CLI's slash commands — /scan, /recall, /plan, /export, /clear, /help — so the same shortcuts work across the terminal and the app. The model picker gains OpenAI's GPT-5.6 family (sol / terra / luna, with sol the new default), xAI Grok 4.5, Google Gemini 3.1 Flash-Lite, and Qwen3.7-Max — each with correct cost and context-window estimates. Message rendering now runs through a shared markdown/table parser for more reliable output, alongside new Checkpoints, Tasks, Insights, and Usage views. Privacy: cloud key-sync stays opt-in and key mutations are serialized to prevent races.

Claude Sonnet 5 & Fable 5, plus cost-accounting fixes. The Anthropic model picker gains Claude Sonnet 5 — the new balanced flagship, replacing Sonnet 4.6 — and brings back Claude Fable 5, Anthropic's most capable model, now that it's available again. Under the hood, several cost-accounting bugs are fixed: MiniMax and Gemini were mis-priced ~4× in the usage popover and Insights; switching provider mid-conversation no longer zeroes the thread's usage and cost; and the codeep.dev cost upload now matches the app's own per-model total. Also: the context-window gauge now sizes OpenRouter model ids correctly, and the reasoning-effort field is shaped from the actual per-request provider.

Cost insight + smarter recall. The message toolbar now ends with a running cost next to the token counter, and the usage popover adds a By model breakdown when you've switched models mid-thread — so a mixed Claude / GLM / Kimi / Qwen conversation is priced per model instead of lumped under one. Cross-session /recall gains a "Discuss in chat" button that folds a recap of your matches into the live thread, so you can ask follow-ups without leaving it. And Anthropic prompt-caching now surfaces on your codeep.dev dashboard, so you can see how much caching saved.

New providers + smoother streaming. Adds Kimi (Moonshot — Kimi Code subscription or pay-per-use), Qwen (Alibaba — Coding Plan, pay-per-use, or the free ModelScope tier), and Grok (xAI), so Codeep now covers the major coding models. Long replies render noticeably smoother (the token hot-path no longer re-allocates or re-parses every bubble per token), and scrolling up to read earlier output is no longer yanked back down — with a "Jump to latest" pill when you've scrolled away. Also: the ⌥Space quick panel now renders markdown + code, and the tool-confirmation prompt's "Always allow" is moved clear of the Run button.

More accurate usage insights. The Insights panel now attributes token usage to the model that actually earned it, instead of lumping a whole conversation under whatever model it's set to now — so switching a thread between models (e.g. GLM-5.1 → GLM-5.2) no longer relabels the earlier tokens, and mixed-model chats are priced per model. Existing totals are unchanged; the per-model split applies to usage from this version onward.

Thinking effort, right next to the model. A new effort control (Auto · Low · Medium · High · Max) lets you dial how hard the model reasons. It sits beside the model picker in the toolbar and shows only the levels each model actually distinguishes — GLM-5.2 → High/Max, Gemini → Low/High, Claude Opus/Sonnet & GPT-5.x → the full range. Also in 1.4.0: the agent now always identifies as Codeep and answers truthfully about its underlying model; new MCP servers for iOS-Simulator & mobile testing; and an Always allow button in the tool-confirmation prompt.

Clearer status + tidier model list. While the agent connects (or briefly retries a busy API) it now shows Connecting… and a retrying in Ns notice instead of a "Streaming…" that looks stuck. The model picker is also trimmed: Claude Opus 4.8 stays the Anthropic default and Z.AI defaults to GLM-5.2; a few unavailable or older variants were removed.

Fix: the new default Z.AI model was rejected by the API (“Unknown Model”), so a fresh Z.AI chat failed on its first message. The default is now glm-5.2, which works. If a chat still errors, pick GLM-5.2 in the model menu. Everything from 1.3.0 (privacy controls, model tuning, agent limits) is included.

Codeep 1.3.0 — privacy controls, model tuning, and a new default model. You now decide what reaches the cloud, can tune temperature and limits, and get Z.AI’s latest GLM-5.2.

Privacy & cloud. API keys are now keychain-first: they stay on this Mac unless you switch on Sync API keys to codeep.dev (off by default), matching the CLI. A telemetry toggle stops automatic uploads of usage stats and conversation transcripts, and Remove my keys from codeep.dev wipes anything you synced before — all in a new Privacy & cloud section in Settings.

Model parameters. Set a custom temperature and max response tokens — off by default (provider defaults), and never sent to models that reject them (Claude Fable 5, Opus 4.7+).

Agent limits. Tune the safety ceilings — max tool turns, max run time, and auto-fix rounds — instead of the old fixed values. A paused run reports the real limit.

Per-project hook trust. Project .codeep/hooks scripts are now trusted per project (like the CLI’s /hooks trust), so opening a repo no longer arms every project’s shell scripts at once.

Claude & GLM updates. GLM-5.2 is the new default Z.AI model. Opt-in background profile auto-learn rounds out the personalization.

Codeep 1.2.0 — tidier tasks and chats. Author full tasks from the app, rename any conversation, and decide whether Codeep auto-names your chats.

Richer task creation. The Tasks sheet now lets you set a type — Task, Bug, or Feature — and an optional description when adding a task, not just a title. It syncs to codeep.dev and the CLI; each task shows its type, and its description folds into the chat when you send the task to the agent.

Rename a conversation. Right-click any chat in the sidebar and choose Rename… to give it a name that sticks — carried across your devices like everything else.

Your call on auto-naming. Codeep names new chats for the sidebar with one short background model call. Prefer to keep the first-message title (or avoid any unsolicited API call)? Turn it off under Settings → Conversations.

Codeep 1.1.0 — the biggest Mac update yet. In-app code review, local-model management, a menu-bar presence, and a global quick-chat hotkey — plus a fix for an agent that stopped when you switched conversations.

In-app code review. A new Review changes action (in the Git sheet) runs the same deterministic reviewer as the CLI over your working tree — score, findings grouped by file, and one-click Ask agent to fix. It also runs live: a toolbar badge flags errors and warnings in your changed files before you commit, continuously and at zero token cost. You can also install a pre-commit review hook in one click.

Local models, no terminal. Settings → Manage models browses a curated catalog of local coding models with VRAM hints, pulls them with live progress, and removes ones you don’t need — no ollama pull required.

Always within reach. Press ⌥Space from any app for a quick question, or click the menu-bar icon to see what Codeep is doing right now — live runs, pending approvals, and today’s activity. When a long run finishes or needs your approval, an actionable notification lets you allow or skip without switching back.

Pin files into context. Drag files onto the chat (or use the paperclip) to keep them in the agent’s context — their current contents are sent on every message.

Quality-of-life. New chats remember the last model you used per provider; save provider+model profiles and apply them in one click; Compact conversation frees up the context window; export chats to JSON or plain text; 52 built-in skill presets; per-project custom rules and OpenRouter routing preferences. Claude Fable 5 joins the Anthropic model picker.

Fixed. The agent no longer stops mid-reply when you switch to another conversation or project — in-flight runs now keep going and finish in the background.

No more lost API keys. A key you save while codeep.dev is unreachable now stays safely on this device and syncs up on its own once you’re back online — previously the next cloud pull could overwrite it with an older value. When a save can’t reach the server, Settings now says so and retries later.

Automatic updates. Codeep now checks for new versions on its own and offers them with release notes — no need to open Help → Check for Updates.

Continue survives a restart. A run paused at its step or time limit can be resumed from the Continue banner even after you relaunch the app or switch sessions.

Safer & clearer. Clearing a conversation now asks first; skill save/publish/install and “Suggest commit message” report failures instead of doing nothing; plus small persona and copy-button polish.

Continue a paused run. When the agent hits its tool-step or time ceiling it no longer dead-ends — a one-tap Continue above the composer resumes the task from where it left off, with a fresh budget.

Send a task to chat. Each row in the Tasks sheet now has an “Add to chat composer” button, so a task tracked on codeep.dev drops into the chat in one click.

Automatic project intelligence. Opening a project now builds its project map (.codeep/intelligence.json) in the background, so the agent understands your codebase right away — the same awareness the CLI builds on /init, with no manual scan.

Also fixed: switching projects mid-scan no longer applies the old project’s context to the new one.