Codeep for Mac — Releases

DeepSeek V4.1 Flash before DeepSeek routes V4 Pro to it on 14 September, Qwen 3.8 Max and Flash, GLM-5.3 in China — and four cost figures corrected, DeepSeek's by more than four times.

DeepSeek V4.1 Flash is the DeepSeek model, and the default. DeepSeek names it the model to use and says it outperforms V4 Pro. V4 Flash is already retired and served by it, and from 14 September every V4 Pro request is routed to it and billed at its price until a V4.1 Pro exists. A conversation set to either V4 model moves to it automatically — keeping a Pro entry would have meant a Pro label on a Flash model. Its thinking control now offers Low as well.

Qwen3.8-Max and Qwen3.8-Flash on Qwen API (pay-per-use), 3.8-Max the default. Both have a 1M window and cost less than the 3.7-Max and 3.6-Flash they sit above. GLM-5.3 on Z.AI China, plan and pay-per-use, with GLM-5.3 Flash on China pay-per-use.

Four prices were wrong. DeepSeek estimates ran two to four and a half times too low — V4 Flash at $0.14/$0.28 against $0.30/$1.20 today, V4 Pro at $0.435/$0.87 against $1.32/$3.96. Estimates carry the peak rate so they can run high but never low; these ran low. GPT-5.6 Sol is $4/$20, an OpenAI promotion through at least 21 November, not $5/$30 — and a correction to the 3.2.0 notes: against that, GPT-6 Astra is two and a half times Sol's price, not twice. MiniMax-M3 is $0.30/$1.20 up to 512K prompt tokens; the $0.60/$2.40 it carried is the long-context tier.

Caught before shipping. Three places decide things by model name, and the new ids slipped past all of them: the context meter would have shown DeepSeek V4.1 Flash at 128K instead of 1M, eight times too small; its thinking control would have been hidden; and a rule written for the Qwen Token Plan preview would have priced pay-per-use Qwen3.8-Max at zero. Each is now held by a test.

The OpenRouter list offered qwen/qwen3.8-max, which OpenRouter does not carry — only its -0902 snapshot — so choosing it before the live catalogue loaded failed.

Three things that were true but unsaid.

Which scope you are in. The sidebar highlight was the only signal, and "Personal" reads as the name of a workspace rather than as "no project is open". Ask the agent to look at your code after missing that, and being told it cannot see the disk sounds like a broken app instead of a mode with a one-click exit. The empty state now names the open project — or says no project is open, what personal mode can still do, and how to leave it.

That personal mode has no file tools. An open project puts a block in the system prompt; no project put nothing at all, so the model had to account for its own short tool list and invented a story — announcing access to "the web and GitHub repositories" as a property of its environment. It is now told plainly, including what it still has.

That this Mac is a device you can revoke. Registration ran once at sign-in, and a failure there was written off in the code as a "dashboard nicety". It is not: the device row is exactly what Revoke deletes, so a Mac whose one registration failed — a network blip at sign-in is enough — synced normally, never appeared under Connected devices, and could not be cut off at all. It now re-announces itself on every launch, which heals that on the next start and makes the dashboard's last seen mean last seen rather than linked.

Two more are already live at codeep.dev and need no update. Revoke now actually revokes — it deleted the device row and stopped there, while token lookup fell back to a one-row-per-user table holding whatever authorized most recently, so the device you linked last kept syncing after you revoked it. Worth re-revoking anything you thought you had already cut off. And linking a server no longer means signing in to GitHub on it: the link Codeep prints carries a one-time five-minute code that can be approved from any device you are already signed in on. That was always true and never said.

One new field in the usage report: whether a run was started from your phone.

It exists to answer one question — is a Codeep iOS app worth building — and to answer it with behaviour rather than opinion. Asking would answer the wrong thing: "would you like an iOS app?" costs nothing to say yes to. Codeep 3.1.0 already shipped the cheap version of that app, starting a task from your phone over Telegram, so what is worth knowing is whether anyone actually does it.

Said out loud rather than left in the code. Finding out from a diff that something new is being recorded is a reasonable thing to be annoyed by. Nothing about your message, your prompt or the answer is sent — this is a yes/no about where a run came from, and it goes only if you have linked the app to a Codeep account and left usage reporting on. Settings → Tools & Privacy → Send usage stats & auto-sync conversations turns the whole thing off, as before.

Reported coarsely here: the Mac pushes usage as a delta per conversation rather than per run, so the flag says "a phone-started run is part of this", not "this is one" — enough for a question that counts people, not runs. It is cleared once reported, so one phone-started run cannot read as a lifetime of them.

The reasoning, and the three things that would take the iOS app off pause, are written down in the CLI repository as docs/ios-decision.md.

Two frontier models landed in the same week, and both are in the picker.

GPT-6 Astra. OpenAI's frontier model, released 3 September — 1M context, 128K output, and the thinking control works on it. It is not the default, on purpose: it costs $10/$50 per million tokens against GPT-5.6 Sol's $5/$30, twice the price, and OpenAI is still rolling it out organization by organization, so a key that works today may not have it. Sol stays the default; Astra is one pick away in Settings → Model.

Gemini 3.8 Flash. Google's newest Flash, released 2 September, at the same price as 3.7 Flash ($0.75/$3.75 promotional). 1M context, 64K output, tuned for long-horizon agentic work. If you are on 3.7 Flash there is no cost reason not to move.

Two things that would have failed quietly. The thinking control was gated on a gpt-5 prefix, so GPT-6 — a reasoning model — would have arrived with the control hidden and nothing to explain why. And Google removed temperature, top_p and top_k in the 3.7 generation; 3.8 is built on 3.7, so without saying so every call would have returned 400.

Existing model ids are untouched. New ones are added beside, never in place of — dropping an id does not leave a pinned setting on the older model, it drops the lookup and lands that conversation on another provider's default.

Cost estimates use the promotional Gemini rate that runs to 31 December 2026. The rise scheduled for 1 January 2027 is deliberately not written ahead of time: doing exactly that for Sonnet 5 over-reported every run by 50% until someone caught it by hand.

Send the bot an instruction from your phone and it runs here, in the app, with the whole answer coming back to the same chat. Telegram already carried approvals — your phone could answer a question the agent chose to ask. Now it can ask one. The run appears in the conversation exactly as a typed one does: a task started from the phone must not be invisible to whoever is sitting at the Mac.

It is off until you ask for it, in Settings → Telegram, and it is a separate switch from the approval one on purpose. A chat that can only say Run, Skip or Cancel is bounded by what the agent already decided to do. A chat that can send a prompt is a keyboard attached to this Mac. Same bot, same chat ID, no second setup.

Choose which conversation it drives. Right-click one in the sidebar → Drive this from Telegram. A paper plane marks it, and instructions land there whatever you happen to be looking at — so you can read one conversation while the phone works in another. Without a choice they go to the selected one, which keeps it usable before you have picked, but the target then moves when you switch conversations at the Mac.

A long answer arrives whole. Telegram refuses anything over 4096 characters outright, so an uncut answer is not a long message — it is a missing one. Answers are split across up to three messages, on a paragraph or line break, with markdown stripped so the reply reads as words rather than as **words**. A run you started at the Mac sends nothing back: that answer is already on the screen you are sitting at.

One connection to Telegram, not two. Approvals and the inbox now share a single poller. A bot has one update cursor, and offset confirms every older update regardless of allowed_updates — that parameter filters the response, not the acknowledgement. Two pollers on one bot therefore eat each other's messages: an approval tapped on the phone would simply not register, with nothing anywhere to say why. A poll that cannot read the bot now says so in Settings, once when it starts failing and once when it recovers.

Fixes: the bot token appeared to need re-entering after a test run — it never went anywhere, but an unreadable Keychain and an empty one returned the same nothing, and the field showed blank either way. Settings now says which. Running the tests also wrote temporary folders into Open Recent and overwrote real settings; the suite gets a throwaway one.

Three cost figures were wrong. Nothing here changes how the app runs — it changes what it tells you a run cost.

Claude Sonnet 5 was priced 50% high. Its $2/$10 launch rate was billed as introductory through 31 August, with a rise to $3/$15 scheduled for 1 September. Anthropic cancelled that rise and made the launch price permanent. Nothing broke when the table still said $3 — the number was simply wrong, and no test was going to notice.

Cache reads on Kimi and Qwen were billed wrong, in opposite directions. Two errors, and the first hid the second. Cache hits were read only from prompt_tokens_details.cached_tokens; Kimi reports them at the top level of usage, so every Kimi cache hit came back as zero and the whole prompt billed at the cache-miss rate. And where a cache read was seen it billed at 0.1× — Anthropic's multiplier, applied to everyone — while Kimi lists $0.19 against $0.95 and Alibaba prices Qwen's implicit cache at 20% of input. Only the metered keys were affected; the subscription tiers quote no dollar figure at all.

Claude Fable 5.1 joins the model picker. It prices like Fable 5, which is exactly why it needed its own entry: it reads a cached token at 0.025× the input rate where every other Anthropic model charges 0.1×. Fable 5 stays selectable — dropping a model id does not leave a pinned setting on the older model, it drops the lookup and lands you on another provider's default.

Why this is 3.0.1 and not 3.1.0. The terminal released 3.1.0 today, and its headline is starting a task from Telegram — which this app does not have yet. Matching the number would have made one version mean two different things depending on which surface you were holding. The Mac catches up at 3.1.0 when the feature does; these corrections had no reason to wait for it.

Every run now records what it touched — including what it was stopped from touching. Each agent run appends to .codeep/audit/ in the project: one line per event, one file per day. It records reads and refusals, not just changes, because a capability boundary that nothing writes down is one you have to take on faith. A Git-only bot reaching for the shell is now a line in the record rather than a thing that quietly did not happen.

It is the same record the terminal keeps — same directory, same format, same field names — so codeep and /audit read runs this app made, and vice versa. A project worked on from both has one history rather than two that disagree. File contents are never written; paths and command lines are, so treat the directory like shell history. Switch it off in Settings → Tools & Privacy → Audit record; everything already written is kept.

The version numbers line up. Codeep V3 is one release across three surfaces, so the three carry one number: this app moves 1.14.0 → 3.0.0, the CLI 2.25.0 → 3.0.0, and the VS Code extension 2.9.0 → 3.0.0. Nothing here is a breaking change — the major is the alignment, said out loud rather than left to look like an accident.

Fixes: the OpenRouter routing settings appeared twice, because the section was referenced twice in the same view.

Answer a pending confirmation from your phone. When a run stops on a destructive tool it waits — and if you are not at the desk, it waits for as long as you are away. Connect a Telegram bot in Settings → Tools & Privacy and the same question arrives on your phone with the same three answers. Whichever you use first decides; answering on the Mac takes the message down rather than leaving buttons that no longer do anything.

Two rules matter more than the feature itself. Only the chat ID you configure can answer — a bot's username is discoverable, and without that check anyone who found yours could approve a destructive command on your Mac. And a late tap cannot reopen a settled question, so a slow answer can never run something you already declined. Telegram carries this because Telegram runs the infrastructure: the bot API is polled outbound, so there is no server to host and no inbound port to open. The message has to contain the command, or you cannot judge what you are approving — if that is not acceptable for your work, leave it off and the desktop sheet is unchanged.

GLM-5.3-Flash joins the model picker on the international Z.AI providers. The same million-token window and tool calling as GLM-5.3 at a twentieth of the price, and it takes the same graded thinking control. Cost estimates read the $0.15 / $0.50 list price rather than the 50% launch promotion: a promotional rate looks right until the day it ends, and then understates every session after it. The China gateway keeps the GLM-5.2 roster.

An agent you delete on codeep.dev now disappears from this Mac too. Until now it didn't: sync only ever walked the list of agents the server still had, so a deletion had no way to travel and the agent stayed on every machine indefinitely. Sync now applies the server's deletion list, copies each file to ~/.codeep/backups/personalities/ before removing it, and clears the selection on any conversation that pointed at one.

The rule underneath is deliberate: absence still means nothing. An expired session, the wrong account, or a truncated response all look identical to "you have no agents", and a client that treated that as a deletion list would empty your agent folder on the first bad request. Only an explicit tombstone removes anything, and a removal that cannot be backed up does not happen at all.

Agent Studio is where you'd look for it. It lived in the File menu, one item among nine, and the only other route was a toolbar chip labelled "Automatic" — a word that reads as a setting rather than a door into the bot editor, so the feature went unfound even by people who knew it was there. It now has a dedicated ✨ button in the chat toolbar, and its menu entry sits in the Codeep menu beside Settings. ⇧⌘A is unchanged.

GLM-5.3 has a price, and is available pay-per-use. Z.AI opened the standalone model API to it and listed it at $1.40 / $4.40 per 1M tokens, so it joins the pay-per-use roster and Insights stops showing that traffic as free. It previously carried no cost at all, deliberately: no per-token rate was published while it was Coding-Plan only, and inheriting GLM-5.2's would have been an invented number. The figure is read off Z.AI's own price page — that it happens to match GLM-5.2 is a fact about today's list, not a rule linking the two. GLM Coding Plan usage is flat-fee and still reads Included in plan. The China gateway is a separate listing and keeps the GLM-5.2 roster.

Custom bots become a real boundary, not a polite request. A bot built in Agent Studio — or on the dashboard, and synced down — can pin an exact model, expose only the capabilities you granted, and be limited to the projects it belongs to. Disallowed tools are not refused after the fact: they are never offered to the model, so a Files-only bot has no shell to reach for. Legacy prompt-only personalities keep working exactly as before, unrestricted.

Capabilities now say what they actually grant. The Tools label promised that deselected groups are removed from the runtime, which reads as a guarantee that a Git-only bot cannot see your files. It can: git show HEAD:file returns the contents of any committed file, and the same allowlist permits git rm, git commit and git push — so such a bot can rewrite the repo and publish that. Granting Git without Files now says both, plainly, on the sheet. The enforcement did not change; the promise is now true.

Fixes: a blocked command no longer asks for your approval first. A Git-only bot that tried head -5 README.md raised the destructive-tool sheet and was refused only after you answered it — implying a choice you did not have, while "Always allow" would have recorded a grant the runtime still rejects. The policy is now checked before the sheet. Agent Studio also reached the menu bar (⇧⌘A); until now it was reachable only by knowing to click the persona chip.

Plan-based usage stops showing a made-up price. Z.AI's GLM Coding Plan, MiniMax, Kimi's Coding Plan, Qwen's plans and the free ModelScope tier bill a subscription — but their tokens were being priced at pay-per-use rates, so Insights quoted a figure you never pay. Those rows now read Included in plan, and the totals leave plan usage out instead of folding it in. Token counts, message counts and the energy/water estimates are untouched: those are measured, only the price was fiction. Also new: Grok 4.6, Gemini 3.7 Flash and GLM-5.3 (GLM Coding Plan only — Z.AI publishes no per-token rate, so it carries no price at all). Fixes: Gemini estimates were double, because gemini-3.6-flash stored the post-promotional rate rather than the one actually charged through 2026-12-31; and a plan row's token count could read as money on a European locale, where the grouping separator turned 226668 into "226.668" in the same column that shows a dollar amount one row down.

An Agent Inspector rail, session metrics, and a refreshed model catalogue. The chat window gains a collapsible right rail showing the current run's stage, the files it touched, the checks it ran, and the context shaping the next request — plus a metrics bar under the composer with run state, tokens, estimated cost, and the estimated electricity and cooling water for the session (research-derived ranges, labelled as estimates, matching the CLI and web readouts). ⌘K now really does focus conversation search. The provider catalogue is refreshed across OpenAI, Google, Kimi and Qwen. Fixes: a remembered model that a provider retired no longer follows you into new chats as an opaque 404; clearing a conversation no longer makes all its later usage invisible on the dashboard; a stats hiccup no longer signs you out of codeep.dev; the Inspector no longer re-scans the whole run on every streamed token; and the minimum window width rises to 900pt so the toolbar has room.

Inline @mentions, Claude Opus 5, and Croatian localization. Attach context straight from the composer: @file, @folder, @git <ref> and @web <url> pull in files, directories, diffs and web pages without leaving the message. The model picker gains Claude Opus 5 (now the Anthropic default) and Moonshot's Kimi K3 line with its 1M context window. Also new: a Keyboard Shortcuts sheet (⌘?), conversation pinning, custom accent colors, Quick Agent pinned prompts, a retry button on failed turns, and a first pass at Croatian localization. Fixes: the Settings window no longer clips its content, a large @git diff no longer freezes the app, streaming long code blocks is markedly faster, slash commands send on the first Return again, editing your profile no longer writes to disk on every keystroke (and syncs across devices again), and the agent-limit, live-review and web-tool settings apply to open chats immediately.

Slash-command parity, new provider models, and a cleaner message view. The composer now understands the CLI's slash commands — /scan, /recall, /plan, /export, /clear, /help — so the same shortcuts work across the terminal and the app. The model picker gains OpenAI's GPT-5.6 family (sol / terra / luna, with sol the new default), xAI Grok 4.5, Google Gemini 3.1 Flash-Lite, and Qwen3.7-Max — each with correct cost and context-window estimates. Message rendering now runs through a shared markdown/table parser for more reliable output, alongside new Checkpoints, Tasks, Insights, and Usage views. Privacy: cloud key-sync stays opt-in and key mutations are serialized to prevent races.

Claude Sonnet 5 & Fable 5, plus cost-accounting fixes. The Anthropic model picker gains Claude Sonnet 5 — the new balanced flagship, replacing Sonnet 4.6 — and brings back Claude Fable 5, Anthropic's most capable model, now that it's available again. Under the hood, several cost-accounting bugs are fixed: MiniMax and Gemini were mis-priced ~4× in the usage popover and Insights; switching provider mid-conversation no longer zeroes the thread's usage and cost; and the codeep.dev cost upload now matches the app's own per-model total. Also: the context-window gauge now sizes OpenRouter model ids correctly, and the reasoning-effort field is shaped from the actual per-request provider.

Cost insight + smarter recall. The message toolbar now ends with a running cost next to the token counter, and the usage popover adds a By model breakdown when you've switched models mid-thread — so a mixed Claude / GLM / Kimi / Qwen conversation is priced per model instead of lumped under one. Cross-session /recall gains a "Discuss in chat" button that folds a recap of your matches into the live thread, so you can ask follow-ups without leaving it. And Anthropic prompt-caching now surfaces on your codeep.dev dashboard, so you can see how much caching saved.

New providers + smoother streaming. Adds Kimi (Moonshot — Kimi Code subscription or pay-per-use), Qwen (Alibaba — Coding Plan, pay-per-use, or the free ModelScope tier), and Grok (xAI), so Codeep now covers the major coding models. Long replies render noticeably smoother (the token hot-path no longer re-allocates or re-parses every bubble per token), and scrolling up to read earlier output is no longer yanked back down — with a "Jump to latest" pill when you've scrolled away. Also: the ⌥Space quick panel now renders markdown + code, and the tool-confirmation prompt's "Always allow" is moved clear of the Run button.

More accurate usage insights. The Insights panel now attributes token usage to the model that actually earned it, instead of lumping a whole conversation under whatever model it's set to now — so switching a thread between models (e.g. GLM-5.1 → GLM-5.2) no longer relabels the earlier tokens, and mixed-model chats are priced per model. Existing totals are unchanged; the per-model split applies to usage from this version onward.

Thinking effort, right next to the model. A new effort control (Auto · Low · Medium · High · Max) lets you dial how hard the model reasons. It sits beside the model picker in the toolbar and shows only the levels each model actually distinguishes — GLM-5.2 → High/Max, Gemini → Low/High, Claude Opus/Sonnet & GPT-5.x → the full range. Also in 1.4.0: the agent now always identifies as Codeep and answers truthfully about its underlying model; new MCP servers for iOS-Simulator & mobile testing; and an Always allow button in the tool-confirmation prompt.

Clearer status + tidier model list. While the agent connects (or briefly retries a busy API) it now shows Connecting… and a retrying in Ns notice instead of a "Streaming…" that looks stuck. The model picker is also trimmed: Claude Opus 4.8 stays the Anthropic default and Z.AI defaults to GLM-5.2; a few unavailable or older variants were removed.

Fix: the new default Z.AI model was rejected by the API (“Unknown Model”), so a fresh Z.AI chat failed on its first message. The default is now glm-5.2, which works. If a chat still errors, pick GLM-5.2 in the model menu. Everything from 1.3.0 (privacy controls, model tuning, agent limits) is included.

Codeep 1.3.0 — privacy controls, model tuning, and a new default model. You now decide what reaches the cloud, can tune temperature and limits, and get Z.AI’s latest GLM-5.2.

Privacy & cloud. API keys are now keychain-first: they stay on this Mac unless you switch on Sync API keys to codeep.dev (off by default), matching the CLI. A telemetry toggle stops automatic uploads of usage stats and conversation transcripts, and Remove my keys from codeep.dev wipes anything you synced before — all in a new Privacy & cloud section in Settings.

Model parameters. Set a custom temperature and max response tokens — off by default (provider defaults), and never sent to models that reject them (Claude Fable 5, Opus 4.7+).

Agent limits. Tune the safety ceilings — max tool turns, max run time, and auto-fix rounds — instead of the old fixed values. A paused run reports the real limit.

Per-project hook trust. Project .codeep/hooks scripts are now trusted per project (like the CLI’s /hooks trust), so opening a repo no longer arms every project’s shell scripts at once.

Claude & GLM updates. GLM-5.2 is the new default Z.AI model. Opt-in background profile auto-learn rounds out the personalization.

Codeep 1.2.0 — tidier tasks and chats. Author full tasks from the app, rename any conversation, and decide whether Codeep auto-names your chats.

Richer task creation. The Tasks sheet now lets you set a type — Task, Bug, or Feature — and an optional description when adding a task, not just a title. It syncs to codeep.dev and the CLI; each task shows its type, and its description folds into the chat when you send the task to the agent.

Rename a conversation. Right-click any chat in the sidebar and choose Rename… to give it a name that sticks — carried across your devices like everything else.

Your call on auto-naming. Codeep names new chats for the sidebar with one short background model call. Prefer to keep the first-message title (or avoid any unsolicited API call)? Turn it off under Settings → Conversations.

Codeep 1.1.0 — the biggest Mac update yet. In-app code review, local-model management, a menu-bar presence, and a global quick-chat hotkey — plus a fix for an agent that stopped when you switched conversations.

In-app code review. A new Review changes action (in the Git sheet) runs the same deterministic reviewer as the CLI over your working tree — score, findings grouped by file, and one-click Ask agent to fix. It also runs live: a toolbar badge flags errors and warnings in your changed files before you commit, continuously and at zero token cost. You can also install a pre-commit review hook in one click.

Local models, no terminal. Settings → Manage models browses a curated catalog of local coding models with VRAM hints, pulls them with live progress, and removes ones you don’t need — no ollama pull required.

Always within reach. Press ⌥Space from any app for a quick question, or click the menu-bar icon to see what Codeep is doing right now — live runs, pending approvals, and today’s activity. When a long run finishes or needs your approval, an actionable notification lets you allow or skip without switching back.

Pin files into context. Drag files onto the chat (or use the paperclip) to keep them in the agent’s context — their current contents are sent on every message.

Quality-of-life. New chats remember the last model you used per provider; save provider+model profiles and apply them in one click; Compact conversation frees up the context window; export chats to JSON or plain text; 52 built-in skill presets; per-project custom rules and OpenRouter routing preferences. Claude Fable 5 joins the Anthropic model picker.

Fixed. The agent no longer stops mid-reply when you switch to another conversation or project — in-flight runs now keep going and finish in the background.

No more lost API keys. A key you save while codeep.dev is unreachable now stays safely on this device and syncs up on its own once you’re back online — previously the next cloud pull could overwrite it with an older value. When a save can’t reach the server, Settings now says so and retries later.

Automatic updates. Codeep now checks for new versions on its own and offers them with release notes — no need to open Help → Check for Updates.

Continue survives a restart. A run paused at its step or time limit can be resumed from the Continue banner even after you relaunch the app or switch sessions.

Safer & clearer. Clearing a conversation now asks first; skill save/publish/install and “Suggest commit message” report failures instead of doing nothing; plus small persona and copy-button polish.

Continue a paused run. When the agent hits its tool-step or time ceiling it no longer dead-ends — a one-tap Continue above the composer resumes the task from where it left off, with a fresh budget.

Send a task to chat. Each row in the Tasks sheet now has an “Add to chat composer” button, so a task tracked on codeep.dev drops into the chat in one click.

Automatic project intelligence. Opening a project now builds its project map (.codeep/intelligence.json) in the background, so the agent understands your codebase right away — the same awareness the CLI builds on /init, with no manual scan.

Also fixed: switching projects mid-scan no longer applies the old project’s context to the new one.