Updates

Paid models: fewer tokens, and cache-aware

Fourth part of the chat-history work: API workers now follow the same rules as the agents.

• Same history rules. Workers get the same budget, relevance floor, pins and priority order as local models, with larger defaults for cloud models.
• Prompt cache aware. Where a provider caches the start of a prompt, Cockpit sends the history in order and trims it rarely, so the cache keeps hitting. Elsewhere it sends only the matching turns.
• Proof, not guesses. Cockpit reads the cached tokens each answer reports and sets the mode per provider. What is sent… lists the modes, with a Re-test button.
• You see the saving. Under a worker’s answer: tokens sent, tokens served from cache, the estimated saving, and how the history was chosen.

Pin what matters, and see which earlier turns were used

Third part of the chat-history work.

• Pins. Every message has a pin button. A pinned message is sent with every question, as long as it fits the model’s budget (at most 10 per chat). Pins survive rename, move, export, import and backup.
• Earlier turns used. Under an answer, Context used now lists which older turns were picked for that question, and how many were left out because they did not match.
• Shorter history for gemma3. Ollama cannot reuse the start of a gemma3 prompt, so each turn re-reads it. These models now get a shorter history, which makes their answers start sooner.
• A stopped answer is saved the same way everywhere. An answer stopped before any words is saved as “[stopped before any answer]” on every path.

You see, and control, everything that is sent with a prompt

Second part of the chat-history work: the fixed text that travels with every question.

• One budget for everything. Your directives, profile, project file and the earlier chat now share one budget per model. When it is over, the least important part is shortened first, and a marker says so.
• You choose the order. In Profile, What is sent… lists the parts in priority order; move them up or down, or reset. The question and the last exchange always stay on top.
• A look inside. Each answer’s Receipts can show Context used: how many tokens each part took, and what was shortened. It is on by default and can be switched off.
• Long project files by section. Put <!-- always --> before the sections that must always go; the other sections are sent only when they match your question. A file with no mark is sent whole, as before.
• Faster follow-ups on local models. The parts that do not change are now sent first and identically, so Ollama can reuse its work from the last turn, and the model stays loaded between turns.

Local models get a prompt that fits

First part of the chat-history work: what an agent is told about the earlier conversation.

• A budget of history per model. The latest exchange always goes in; older ones are added newest-first until the model’s budget is reached (about 2,000 tokens for a local model, 8,000 for the others). One setting changes it for a model, or for all of them.
• Only earlier turns that match. An older turn found by search is sent only when it shares at least half of the words in your question. An unrelated old turn no longer takes room.
• A context length that fits. Requests to a local Ollama model now ask for as much context as the prompt needs, not Ollama’s default, which saves video memory. It moves in big steps, so the model is not reloaded every few messages.

The guides, the tour and the sites now say what Cockpit really does

Last part of the full review: what we tell you, and the machinery that builds and ships Cockpit.

• Accurate guide and tour. The Toolbar list shows all 26 buttons, and the tour has steps for Archive, Backup and Manuals. The old claim that Stand-alone makes no network calls at all is replaced by the real, short list: the install note, Check for updates, the optional catalog feed, and a mirror look-up after a failed model download.
• Pricing and model-fit text corrected. The “does this model fit” paragraph describes the Catalog, and the old pricing document points to the live prices.
• Privacy page names what loads. Google Fonts and the Cloudflare bot check are listed with what each one receives.
• Logs stay small. The web server’s access log, the workers log, the relay log and the guard log now rotate, and the web log never records the part of an address after the question mark.
• Safer releases. A release is checked against what was built before it is sent, a failed check stops it, and a closed window can no longer leave the guard switched off.

Things that did nothing now work, and more places can be renamed

Third part of the full review: features that looked fine but did nothing, plus the admin rules you asked for.

• Folder pickers work in the Stand-alone edition. They listed nothing and showed a raw error; they now open, or say plainly to type the path.
• Honest results. Translate no longer says “Done” over failed parts; Sound accepts an empty prompt for Effect, Melody and Background; Esc in a list closes it instead of deleting; cancelling an answer keeps its text and gives your prompt back.
• Rename with the pencil now also works for Power Buttons, delegation Rules, your own Combos and the workers you added.
• Admins. The last admin can no longer be demoted or removed, removing a user asks first and says their data stays on disk, and a new Locations button lists where every user’s data, chats and library are. Dossier is closed to viewers.
• Smaller things. a double click on Track starts one timer; cancelling a scheduled job says Keep job / Cancel job.

Safer by default: who may change what, and what a model may run or fetch

The second security round of the full review. Nothing you do in Cockpit works differently; these refuse what should never have worked.

• A change must come from Cockpit’s own page. Delete, restore, save a key, sign out, run a tool, import and every other change now has to be sent as a request from Cockpit itself. A link on another web page, or a page served by another local program, can no longer trigger them.
• The viewer role really is read-only. A viewer sees every screen but can no longer delete projects, change keys, run tools, spend on paid workers or write notes.
• You see what a plan will run. A command a model writes to check a plan step is listed on the plan card before you press Start, and only simple read-only checks inside the project run; anything else is not run and the step waits for your OK.
• Web fetches are checked. Dossier, the fetch marker, custom providers, the models list and A2A refuse addresses on your own machine or private network (except a local server you configured), re-check every redirect, and cap size and time.
• Tools run by an agent are confined. They read only the project (or Public) and public web addresses.
• Zip imports are inspected. Skill and library zips with links, absolute or .. names, or an oversized unpacked size are refused with a message.
• Names in any language. Export, import and config now accept every name a project or chat can have, with accents, spaces and non-Latin letters.
• Smaller things. A bad parameter now gives a clear message instead of an empty error; one setting finds the local model server for every part of Cockpit; the site’s admin token is no longer kept in the browser.

Several things at once no longer undo each other

Part of the full review of Cockpit: what happens when two tabs, a scheduled job and an answer are working at the same moment.

• Long jobs no longer freeze the rest of Cockpit. While a combo, a Hive chain step, the sanitizer, a model download, a notes summary, an A2A call or a scheduler “Run now” is working, the status bar, the chat list and the Stop button keep answering.
• Counters, caps and the library no longer lose updates. The free-worker daily counts, the Auto cascade’s quota check, pending library proposals, the library and archive index, worker settings and the spend records are now changed one change at a time. Enabling a worker, switching a web worker’s mode or accepting its terms while an Auto answer is running is no longer undone when the answer finishes.
• A damaged file is never replaced by an empty one. The change is refused with a message, the file stays as it was, and a copy named .bad is saved beside it. If the monthly paid-spend record is damaged, paid workers stop with a clear message instead of assuming nothing was spent.
• Scheduled jobs. A job whose start could not be recorded is no longer run twice; “Run now” always keeps its result. Times you type for the scheduler and daily Power Buttons now mean this computer’s local time (they used to run 2–3 hours late, read as UTC), and a Power Button whose last run is still going is not started again on top of it.
• Hive chains and tool runs. Pressing Run on a chain from a second tab no longer runs the same step twice (it says the chain is already running); a tool run that finished is recorded once, with its real result.
• Web workers, checkpoints, sign-in. Two requests to the same web worker take turns instead of wiping each other’s conversation. A project checkpoint with a long label can be restored and deleted, and two made in the same second no longer overwrite each other. Signing in with “remember me” on two devices at once keeps both signed in.
• No more deleted answers. A prompt waiting more than 20 minutes behind a long answer, and an answer that takes longer than that, are no longer removed by the clean-up that runs on every send.

Rename everything with the pencil

• The pencil is now beside every name. Projects, chats, files in the Files tree, attachments, artifacts, plans, task chains, notes, skills, user themes and library or snippet entries all have the same small pencil. Click it, type, then Enter or the check button saves; Esc or the cross cancels.
• The edit box is big enough to read. While you edit, the row’s own buttons are hidden, so the box takes the whole width, with larger text and larger check and cross buttons.
• Renaming a project takes everything with it. Its chats, attachments, plans and settings move together, the open project follows, and a name that already exists is refused. A project or chat that is answering waits until the answer is finished.
• Skills and themes keep working. Renaming a skill keeps its file (a skill folder, its frontmatter name and its /trigger are renamed together, and a /trigger you chose yourself is left alone); renaming a theme keeps it active.
• Artifacts are listed for every project name. A project named with accents or non-Latin letters used to show an empty Artifacts list.

An easier rename, and correct message times

• You can rename a chat while an answer is being written. What you type stays in the rename box: Cockpit no longer moves the keyboard to the prompt, no longer rebuilds the Chats list under you, and never saves a half-typed name when the window loses focus. When the rename is done, the chat’s name in the list, the header and the status bar follow at once, and no empty lock file is left behind.
• Message times are the same before and after a reload. Your message is stamped with the moment you sent it and the answer with the moment it was saved. Before, both got the time the answer finished, so a reloaded chat showed your message later than you wrote it, and two turns could even show the same second.
• One clear way to rename: the pencil icon. Every chat in the list and every item in the file window has a small pencil. Click it, type the new name, then press Enter or the ✓ button to save, or Esc or the ✕ button to cancel. While you type, nothing else changes the list or takes the keyboard, and just clicking elsewhere saves nothing. The edit box has a thick double outline so it is easy to see in any theme. A chat that is still answering cannot be renamed until the answer is finished (the pencil says so). Double-clicking a name still works.
• A long answer no longer makes Cockpit redraw the chat. The check that tells your own answer from a message that came from elsewhere (your phone through the relay) now counts from the end of the answer, not from when it started.

Safer sign-in, chats and backups, and scheduled jobs that run again

A full review of Cockpit found these problems; this build fixes the serious ones.

• The sign-in no longer opens when its user list is damaged. If the list of users cannot be read, Cockpit now refuses every request with a clear message instead of running without a login. The list is also written in one step, so a crash cannot leave it half-written.
• A file viewer that needed no login now needs one. The “open local file” page could be called by anyone who could reach Cockpit. It now requires you to be signed in, and it never serves hidden files, Cockpit’s own data or program sources.
• The public web demo is read-only. Saving, importing, uploading and every other change on the demo now answers “not available in the web demo” instead of really writing; lists and views still work.
• Renaming or moving a chat can no longer empty it. A chat whose file cannot be read as a chat is left untouched and Cockpit says so. Renaming, moving, deleting and importing a chat now wait for an answer that is being saved, so no turn is lost and no old chat comes back.
• Backups are consistent. A backup taken while Cockpit is busy now passes its own check and can be restored. An older backup whose files changed while it was made is no longer refused: every matching file is restored, the others are left as they are now, and the Backup panel lists them with a short explanation.
• The project gallery serves only images inside the open project, and an SVG opened on its own no longer runs scripts.
• Scheduled and automatic runs work again. Scheduled Plan-and-Sequence runs and goal loops, the transcriber’s AI summary, orchestrator dispatch, A2A messages, Dossier searches, capability toggles and rules that hand a prompt to a worker used to call Cockpit in a way that was refused (or went to the wrong port on a user-mode install). They now reach the agents on the same install, and a goal loop shows the agent’s real error when it fails.
• An old helper script no longer ships. A small unused web listener was part of every install bundle; it is gone, and the installer removes an old copy.

Three small fixes you would have noticed

• The text you sent no longer comes back into the prompt box. A saved draft of what you typed was kept after a send, and the redraw of the chat at the end of an answer put it back. A send now removes the draft.
• The chat is no longer redrawn after your own answer. Cockpit used to reload the whole chat each time it noticed new messages, even ones this window had just added itself. It now redraws only for messages that came from elsewhere, such as your phone through the relay.
• Power Buttons no longer freeze. If the browser never answers a request to read the clipboard (a permission question that is not shown, as in some embedded windows), the click used to do nothing at all. After two seconds the paste box now opens instead. Reasoning models (Qwen3, DeepSeek-R1) also no longer put their thinking into the answer: thinking is switched off where the model allows it, thinking blocks are removed, and a model that only thought gives a clear message instead of an empty answer.

Local models: a catalog that knows your graphics card

• A Catalog button in the Model Manager (F8). It lists about fifty local models and says, for each one, how it would run on your computer: GPU (the whole model in the card’s memory, the fastest), Hybrid (part on the card, the rest on the CPU, slower but it runs bigger models) or CPU (no card involved), or that it is too big. The verdict comes from the hardware scan and the model’s real file size, with room for the context you choose. You can search, filter by task or method, sort by fit or size, and open each model for its strengths, weaknesses and file sizes.
• Licences are shown, and respected. Every model carries a badge: open licence, licence with conditions, or non-commercial only. Install shows the download size and the licence first; a non-commercial model needs you to tick that you understand. Cockpit never picks a non-commercial model for you. The licences are recorded from memory and not yet re-read from each publisher, and the badge says so: check before commercial use.
• Background tasks follow your card. Jobs that choose a model by themselves (the caveman rewrite, for example) were limited to 4B models, a rule written for a 4 GB card. The limit now follows your video memory: 4B on small or unknown cards, 7B from 6 GB, 8B from 10 GB, 14B from 16 GB. Embedding, coder, vision and reasoning-first models (DeepSeek-R1, Qwen3 and the like) are never chosen by that automatic fallback. Your own choice in the model picker is never limited.
• Honest numbers. The speeds in the catalog are marked estimate; they come from a research list, not from your machine. Real measurements on a 12 GB card are in the plans for the next steps (two models at once, one on the card and one on the CPU).

Check for updates, and a page for each edition

• A Check for updates button in About (both editions). It runs only when you press it. It sends your build number and edition (Stand-alone or Full) to cockpit.ruggi.site and gets the public list of builds back, then shows whether a newer build exists and what changed. Nothing else is sent, nothing is sent in the background, and there is no persistent ID: the site keeps one count row per press (date, edition, build and a hash of your address mixed with the day, which changes every day).
• A download page for each edition. Stand-alone and Full each say exactly what that edition sends. The archive carries two one-command shortcuts, bash install_standalone.sh and bash install_full.sh (the same installer with the edition already chosen).
• The Help us button is Stand-alone only, and stays hidden until a support link is set.

Changing the graphics card

• Cockpit notices a new graphics card. The hardware scan (processor, memory, card, video memory) was made once and kept for good, so after a card swap the top bar, the model picker and the video-memory checks would have kept describing the old card. The scan now carries a fingerprint of the display adapters and is made again by itself when it no longer matches; clicking the hardware line scans again on demand.
• The card is named by its model. The top line used the PCI list's name, which for one chip covers several cards (“Radeon RX 6700/6700 XT/6750 XT / 6800M/6850M XT 12.0GB”). The scan now asks the graphics driver (Vulkan) for the real model, so the bar reads “RX 6700 XT · 12 GB”; without Vulkan it shows the first entry of the list and /…, not a guess.
• Models are judged by their real size. The video-memory estimate used 1.5 GB per billion parameters, which called a 9 GB 14B model a 21 GB one and would have refused it on a 12 GB card. It now uses the size Ollama reports for the model (plus room for the context), and a Q4-class rule for a model it does not know. Dual mode and the Broadcast check use the same estimate.
• Web-page workers: Duck.ai and Perplexity removed, the rest need a notice accepted. We read the providers' own terms. Perplexity's and Duck.ai's forbid automated use of their web chats in plain words, so those two workers are gone. Mistral Le Chat, DeepSeek and Meta AI stay, in two modes you choose per site. Assisted (the default) operates nothing: Cockpit shows your prompt, copies it and opens the site, you send it there and paste the answer back, and it joins the chat like any worker answer. Automatic (the hidden window types and reads the page) needs a notice accepted that says what the provider's terms say, quotes the clause, links the terms and names the supported alternative (the maker's API, hosts already in Workers, or a local model). The server enforces it: Automatic cannot be switched on, nor the page opened, tested or called, until you accept, and the Auto rotation uses only workers in Automatic mode. If you had one of the two removed workers selected, Cockpit falls back to the first available.
• Log in tells a usage limit from a sign-in problem. When Claude says it has hit its session limit, the check now reports the limit (with the reset time it gave) instead of opening a sign-in terminal that would not help.
• The manual request now asks for integration facts. A 15th section tells programs how to drive an agent: the exact headless command, how it is signed in and how to see the sign-in status, how a limit is reported, streaming, permissions, sessions, whether the maker's terms allow driving that gateway from a program, and a one-line self-test. Cockpit counts these in the quality check, the list shows which manuals have them, and the short summary other agents read now includes how to run an agent headlessly. Older manuals keep working and say they have none; Update asks again.
• New in the guides. Adding a new AI provider or agent explains, for each kind (a command-line agent, an online service with an API, a web chat, new models of a service you have, a local model), where it is added, what you get and what you still do by hand, and the safety rules. The request that makes an agent write its manual shows what every agent is asked, how to send it by hand or replace its wording. Your hardware, and what happens when it changes says what Cockpit reads, what it feeds, when it scans again and what to do after a card swap. The Isolated-config text no longer claims the sign-in is shared by a link: the two copies can drift apart, which is what the Log in button is for.
• Two helper scripts for a card change. gpu_swap_check.sh shows what the machine, Ollama (Vulkan or ROCm) and the other local tools see, and gpu_bench.sh measures tokens per second for each installed model and whether it ran on the GPU, so the effect of the change is a number and not an impression. Neither changes anything.

Agent manuals: every AI writes its own

• A new Manuals button. Each AI agent can write its own operating manual — its models and exact names, prices, ways to reach it, commands, add-ons, strengths and weaknesses, and how to prompt it — in a fixed 14-section layout plus a machine-readable part. Press Ask it for its manual beside an agent (one fixed request, no chats or files, using a little of its normal usage), or send the request to any agent yourself and paste the answer in. Instead of searching the web for what changed, you ask the agent to update its own manual; an optional setting does this every 30 days while Cockpit is open.
• Every manual is checked, and says how good it is. On storing, Cockpit checks that all sections are there, that the machine-readable part parses, how much was verified online (and with a source) and how old it is, and labels it good, usable or weak in words. A manual that was written from memory alone is marked weak. Older versions are kept.
• The other agents read them too. A short pointer in every agent’s standing instructions says to read the index and an agent’s manual before calling or prompting it; the planner gets a validated summary of each manual; agents on the HIVE bus are told when one changes. A manual is data written by a model: nothing in it is ever run, and its text is never passed to another agent raw.
• Local models get one too, without asking a model. A small local model would invent a manual, so Cockpit builds the one for Ollama and LocalAI from the servers’ own answers (size, context length, quantisation, what each model accepts as input, its licence) and rebuilds it when you add or remove a model. A newly added agent is offered the request once.
• Asking works for the agent in Card 2 too, and says what an agent answered when it did not write a manual (a usage limit, a refusal): the request goes to the slot session, and only the agents in Card 1 and Card 2 are offered. The dialog's fields follow the theme.
• A Log in button on Card 1 and Card 2. The Claude agent runs with Cockpit's own config folder, so signing in from the card's ordinary terminal button (which uses ~/.claude) never helped, and an expired sign-in showed up as a long wait and then a “not logged in” answer with no way to fix it from Cockpit. The new button first checks whether the agent in the card is signed in, and opens the sign-in only when it is not (or when it cannot tell): it opens a terminal that signs the card's agent in where the loop looks for it, for whichever agent sits in the card; agents that run on local models say there is nothing to sign in to.
• Smaller things. Typing part of a button’s name in the Toolbar filter now lists the buttons with that name first, instead of also every button whose hover text contains it. The Dark/Light button in the setup window keeps one width when you switch, and the logo block gives back the 11 pixels that were unused beside its widest plate, so the five supplier cards fit at 1920 with room to spare.

A clean-machine install test, and what it fixed

• The installer asks before it sends anything at the end. The Stand-alone installer used to end with “send an install-succeeded line?” defaulting to yes, and in the setup window the question was easy to miss. Now Stand-alone sends nothing after the one “install attempt” line at the very start (which now also notes the desktop and file manager) and asks nothing at the end. Full and Both report progress as before.
• Stand-alone is the free local product, without the subscription features. Autopilot Cruise (the PLAN button) and AutoCognition are not part of Stand-alone and are hidden there; their Help entries stay, marked “(only on subscriptions)”. A first visit now starts on the local-models card, which works with nothing signed in.
• A first prompt on a machine with no model. A computer without a graphics card now gets the one small model (about 1 GB) pre-selected in the installer, and if a model is still missing the first prompt says it is downloading it, instead of sitting silent. Codex is no longer ticked by default (it needs an OpenAI account); Card 2 is Gemini unless Codex is installed.
• Smaller things. The LaTeX size is now stated honestly (about 125 MB on a fresh system), the wizard summary shows just the edition name, and on a narrow window the supplier strip glows at its right edge while Workers and Tools are still to scroll to.
• The install-attempt line now carries the hardware it promised. It used to go out before the hardware scan (CPU and memory read as zero); the scan now runs first, still before the first question. Choosing Stand-alone only still sends nothing after it. Pressing Cancel in the setup window now says “Setup cancelled. Nothing was installed.” instead of a FATAL error.
• Cockpit starts on its own small web server by default. The ordinary start (menu entry, cockpit-start, Ctrl+Alt+C) now serves the app from aicserver, on the loopback address only, instead of Apache. Apache stays installed: a second menu entry, AI Cockpit (Apache), starts it directly, and the start falls back to it by itself (and says so) when the small server cannot start. php-cgi, which the small server needs and the installer never installed, is now part of the package step. A clean-machine test found that without it the mode could not start at all.
• The setup window shows it is alive. During a long silent step (a compile, a big download) the progress bar now shows the elapsed time, a turning marker, and “still working, quiet for…” after 20 seconds. pip’s harmless conflict warning no longer shows as an ERROR, the Stand-alone V1 menu entry exists only where a second copy does, and Cancel in the setup window leaves no “continue the earlier setup?” question behind.
• The web server’s folder protection is really installed. Three Apache steps (cache headers, hiding Cockpit’s working folders, upload limits) failed with “Permission denied” when the installer ran as a normal user. They now use sudo.
• Stand-alone looks like Stand-alone. The start splash said FULL on a Stand-alone install; it now follows the install’s own edition. The first-run Help window no longer opens blank.
• Defaults that follow your computer. Piper voices and translation languages now default to the languages of your keyboard layouts and system language, instead of a fixed list. An empty password field no longer shows as dots in the setup summary.
• Autopilot Cruise and AutoCognition pause while the account server cannot be reached (Full edition), and the account server now slows repeated wrong passwords.

What changed on this day

• #307 Installer: Stand-alone sends nothing after the install attempt; Apache steps use sudo; Stand-alone splash; first-run Help; defaults follow system languages
• #308 Stand-alone has no Cruise/AutoCognition (Help entries kept, marked subscription-only); first visit starts on the local card; installer/telemetry fixes

What changed on this day

• #302 Plates (brand, version, stage, licence, Everywhere, Stand-alone), plans names, theme fixes, family seats, Agents-row sync, answer kept on reload/Stop, double-send guard, readable session errors, Profile button pinned
• #303 Translation Studio: translate Cockpit within Cockpit (strings list, progress, filters, placeholder check, machine suggestions, save/use/download/upload), long project and chat names cut with an ellipsis, chat-filter hint
• #304 Filters on every sidebar list and Find in the Preview, prompt History picker with chat/project/everywhere scope, translated labels and plates scroll as a marquee, right-to-left layout question in the Translation Studio, Send-your-translation button, Help us link (hidden until set)
• #305 AutoTranslate in the Translation Studio (local model drafts as grey placeholders: Tab, Accept page, Accept all), template with rules and how to send, small-screen first screen with a demo tour, whole app at full size to pinch and drag
• #306 Cruise and AutoCognition pause while the account server is unreachable; login throttle on the account server; offline flag saved

What changed on this day

• #301 Top bar keeps Help, Theme, About and Exit on screen from 1100 px, F8 opens the Model Manager, latency monitor starts on your own router, Translate chat no longer sends code, plan names corrected (Plus/Pro/Max) in tips, help and guide, Founder shows lifetime, Esc cancels a chat rename, Remember this saves the text, Plan mode honours the Agents row, whisper errors explain themselves, neutral language examples in help

What changed on this day

• #300 Dialogs close with Esc or a click outside (and ask before throwing away what you typed), tool jobs no longer hang on a terminal (FFmpeg now runs), quoted paths and files next to the input work in tool arguments, many checks fixed (recipe scaling and oven temperatures, packing list, podcast loudness, photo duplicates, listing check, word frequency, Anki cards, lesson checks, empty-site check), Cruise buttons follow your plan after sign-in, stronger account password rule, Full edition no longer contacts the live server for the clock

What changed on this day

• #297 Sixteen new project kinds for everyday life and work, each with a tool that does real checking and arithmetic: Cooking and recipes, Gardening, Pets, Health and fitness log, Collections, Genealogy, Hobby crafts, Tabletop, Travel, Personal finance, Home and DIY, Real estate, Teaching, Job search and CV, Non-profit and events, Music practice and songbook (49 kinds in 10 fields)
• #298 Agent tool markers work in projects (the project name is sent so relative paths resolve), a failing tool now shows its own message in the chat, kind notes say how to pass tool arguments, Recipes accepts the servings under other names, the kind picker lists the new Home & life and Work & community fields, and the guide explains running tools from an agent
• #299 Native engine: tool errors and project name

What changed on this day

• #285 Power Buttons, step 1: one click runs a saved prompt on text you copied with the supplier you choose (a model on this computer by default) and puts the answer on the clipboard, in a notification or in a file; six starters (Proofread, Make it polite, Summarise, Explain this, Plain language, Shorter), a panel to edit and try them, and a command-line client (power_run) for launchers; copied text is sent as data between markers, a supplier outside your computer is asked about once and never receives text that looks like a password or key, and paid suppliers use the same consent and caps as chat
• #286 Power Buttons fix after the first real run: the prompt now reaches a small local model as one plain message (task, a sentence saying the copied text is data, a line of dashes, the text), which made all six starters work on a real 2 GB model (the first layout made it repeat the rule and answer nothing); echoed scaffolding is stripped from answers; the guide says plainly that a small model can still be fooled by instructions hidden in text and that a button has no tools and only returns text
• #287 Power Buttons and the New kind dialog: choosing an icon no longer needs knowing icon names; a picker shows common icons and searches all of them by a word (mail, heart, book) or an idea (write, fix, translate, shorter), Power Buttons also get a colour, and a test checks that every icon the picker suggests exists in Cockpit's icon font
• #288 Power Buttons, step 2: your buttons appear as a row above the Style row (copy something, click one, the answer comes back in a small card with Copy and Save), pictures work as input (a picture-capable model on this computer, or Anthropic), a text that looks like a password asks what to do (use a model on this computer, send it once, or cancel), the first-send question shows what will be sent, a History view lists recent runs, and the command line asks each button what it needs (clipboard, selection or picture)
• #289 Power Buttons strip fix: it no longer pushes the prompt and the status bar off the screen; the buttons now sit in one row between the prompt and the status bar, the chat panel above gives up exactly that row while you have buttons, and everything returns to the old size when you have none; a test keeps the row height, the footer growth and the placement in step
• #290 Power Buttons hint and a steady Mode row: with no buttons yet a one-line hint (with an Add one button and a close that hides it for good) shows where the buttons will be; the Mode row no longer changes height in Pipeline, Broadcast or Plan (it was 29, 57 and 34 pixels, and Pipeline pushed the status bar off the screen), the Mode and Style rows are now exactly one line each and scroll sideways when too narrow, and a test keeps it that way
• #291 Frameless main window: the same three window buttons as the Browser windows (minimise, maximise or restore, close) now come up when the pointer reaches the empty strip along the right edge near the top, and go when it leaves; close runs the usual exit procedure; they never appear while the window has a normal title bar. Also in this build: Power Buttons hint and steady Mode and Style rows, and the Power Buttons strip between the prompt and the status bar
• #292 Top bar spacing: every card is now exactly 4 pixels from the next, from the first agent card to Settings (the Account card used to touch the Tools card and the gaps ran 0, 11, 8, 8), both ends of the bar have the same margin (it was 6 on the left and 24 on the right), the Clock card takes any spare width instead of a gap, and a test measures it in a real window
• #293 Power Buttons part 2: a hotkey per button (global, X11), the answer in a small window or pasted where the cursor is, launchers for Linux/macOS/Windows/WSL (applications menu, desktop icon or a file), the command line tool cockpit-run (pipes, PDF, audio, folders), right-click actions in Cockpit's file manager and in your desktop's, the lightning menu in Cockpit Browser windows (run a button on selected text), packs (export/import, always a local model), Automations (watch a folder, daily or every-N-minutes buttons on the scheduler) and /power from the phone through Everywhere; macOS and Windows paths are tested with stand-in tools only
• #294 Fix: the phone /power command lives in the web app (power_relay_lib.php) instead of a new scripts/ file that bundles never picked up; the Everywhere poller starts as before and loads it only when present
• #295 Apps now report their first run to cockpit.ruggi.site/api/setup_ping.php (the old maestro address redirects to a page that did not exist, so first-run pings were lost): the app's first-account step and the installer ping the live address
• #296 Plans groundwork in the app: the account cache can now carry a signed entitlement that the app verifies (an edited cache, an expired token or a token for another machine is refused), the app tells the account server its major version and a machine fingerprint when it signs in, and it knows the new plan capabilities; until the paid plans start nothing changes for anyone (accounts without a token are read the old way)

What changed on this day

• #273 Web page workers: a site that loads a second page right after the first (Mistral redirects its start page to another one) no longer swallows the prompt; Cockpit now waits until the page has stopped loading and its address has stopped changing before typing, and a test with a redirecting page guards it
• #274 The Cockpit Browser and the window of a web page worker (shown for a login) now have border handles when you run frameless: drag any edge or corner to resize, the middle of a side to move, Ctrl+W to close a Browser window; the handles live in the shell, not in the page, so a site never sees them
• #275 Web page workers: Mistral answers are read from the page's own answer element (not the whole page), so the animated 'Thought for' label, timestamps and footer no longer come with the answer; one text reader serves both the page and a selected answer, joins text drawn one letter per element, and keeps maths as TeX in both
• #276 The Cockpit Browser is now the default browser on every system: the toolbar Browser button opens it whenever the shell is installed (your own browser only when it is missing, or when you pick it in the Apps panel), and the installer pre-ticks it; the terminal and file manager stay the system's own, with Cockpit's own versions only as the fallback
• #277 Frameless Browser and web-worker windows get Min, Max/Restore and Close buttons: move the pointer into the top-right corner and they appear; a minimised window comes back from the taskbar or Alt+Tab; a real-mouse test guards them
• #278 Minimised Browser windows are listed as chips at the right end of the status bar: hover shows the title and address, click restores the window, right-click offers Restore and Close window; the list is kept by the shell on your machine, and a real-window test guards it
• #279 The minimised-window chips now show within a fraction of a second of the minimise (the shell reports the change at once and the status bar asks twice a second instead of every two seconds), and the test holds it to 1.5 s
• #280 DeepSeek and Meta AI web workers are tested and tuned: both pass their self-test and return a clean answer (no copy/download toolbar, no 'Show thinking', formulas as TeX, a reply that the site draws in several blocks comes back whole and in order); the engine now cleans selector-found answers too, and a test guards the split-reply case
• #281 The Anthropic API worker's model list and prices now follow Anthropic's published ones: Haiku 5.5, Sonnet 5.5, Opus 5.5 and Fable 5.1 are in (cheapest first), the older Opus 4.8 and Haiku 4.5 prices are corrected, Haiku 5.5's higher price above 100,000 prompt tokens is applied, and a test holds the prices
• #282 A signed catalog feed keeps models and prices current without a new Cockpit build (off by default; Workers shows the date the lists are as of and warns when they are old; new models and prices come from a file the maker signs and your machine verifies; a new supplier is only ever suggested), custom suppliers now really work (they have an address and are called at it; a paid one is gated like any paid supplier), and Add model and Add custom provider take an optional price
• #283 Language neutrality: Hebrew, Spanish and every other language are shown as ordinary languages next to English and nothing singles one out (the speech-language list is alphabetical, the Spanish and Hebrew transcribe presets became one Transcribe in a language you choose, examples in kinds and tools use a varied set of languages, public pages and guides reworded, old build notes filtered), and a guard keeps it that way
• #284 Language neutrality, and right-to-left support stated plainly: Hebrew, Spanish and every other language are shown as ordinary languages next to English and nothing singles one out (the speech-language list is alphabetical, the Spanish and Hebrew transcribe presets became one Transcribe in a language you choose, examples in kinds and tools use a varied set of languages, public pages and guides reworded, old build notes filtered); right-to-left languages such as Arabic, Hebrew and Persian are named together as supported; a guard keeps it that way

What changed on this day

• #260 Web page workers (experimental): Duck.ai, Perplexity, Mistral Le Chat, DeepSeek and Meta AI can be used through their own web page in a window nobody sees (the shell gets a worker mode), the prompt is typed into the site's own box and the answer streams back to the chat; a login or a bot check brings the window on screen for you and is never passed automatically; always last in the cascade, never counted as spend; each has Open window, Hide, Self-test and Probe in the Workers settings
• #261 Web page workers: the Duck.ai answer no longer carries the page's own header (the model name) and footer (second opinion, jump to latest, private-chat notice); adapters can trim the start of a heuristic answer as well as its end, and a test covers a page with no answer element
• #262 Web page workers: a window left over from an earlier session (after a deploy or a power cut) no longer makes the next call fail with 'the web worker window did not start': the stale marker file is no longer trusted, and the window's files are readable by the server whatever the launcher's umask
• #263 Fix: the hidden web page worker window was saving its own size over Cockpit's saved window size when it closed, so the app started at 1100x800, not maximised and hard to resize; a worker window now never writes the saved geometry, and a test guards it
• #264 The frameless window can be resized again: eight thin invisible strips along its edges and corners hand the resize to the window manager, so you can drag any edge or corner when the title bar is off
• #265 The frameless window can be dragged by empty header space again, carefully this time: only after the pointer has travelled 8 px with the main button down, never when maximised, never from a button, card or input, and once per press (the old drag was removed because a wandering press moved the whole window); tests pin each rule
• #266 The frameless window's border is now the handle: edges and corners resize, and the middle 15% of each side moves the whole window without resizing it (the header drag is gone); this build also brings the live files back in line with the build manifest
• #267 Web page workers: when a worker window cannot be started, the error now carries the launcher's own message (for example sudo refusing, or no display) instead of a guess about the desktop session, and a test covers it
• #268 Web page workers: a maths formula on a page (drawn twice by the site, once visual and once hidden) now comes back once as TeX instead of one token per line, block elements keep their line breaks, the Perplexity answer loses its Read more / Researched labels, and the page code is kept pure ASCII with a test guarding it
• #269 Web page workers: the Perplexity answer no longer carries the page's response-time line at its start or the source chips and suggested follow-up questions after it, so a question comes back as just the answer
• #270 Web page workers: lines the page prints inside an answer as source chips (a bare source name such as britannica, or +1) are dropped, never the first line of the answer, so a Perplexity answer reads as plain text; adapters get a dropLines option and a test covers it
• #271 Installer: the Cockpit window is always granted in the web server's sudoers rules (it was added only if the program already existed at install time, so web page workers failed with 'sudo: a password is required' on those installs); and when sudo does refuse, the web worker error now names the exact rule to add
• #272 Kind wizard: starter files and a tools box can be edited in the wizard (emptying the box removes a kind's tools); Translation tools (LibreTranslate on this machine: .txt, .md, .srt, .vtt; code, links and placeholders kept exactly, a line that cannot be kept safe is left in the original and reported); Image generation tools (stable-diffusion.cpp from a prompt file, logo, icon, favicon, variants, a seed record next to every image); attached pictures reach the Anthropic worker as real images; and the installer fix for web page workers

What changed on this day

• #242 Godot tools: check every GDScript for parse errors with file and line (with Fix with agent), run a project headless, list export presets, compare the project's Godot version with the installed one; Cockpit now finds tools fetched without root in the home folder
• #243 Castle Game Engine tools: create a game project, check or compile it (errors with file and line, with Fix with agent), clean, package a Linux archive; Cockpit finds tools unpacked as a release folder in the home folder
• #244 The deploy now reloads the running window as its LAST step (after the restarts have settled) and reopens it in the mode it was running in (self-contained or Apache, V1 or V2); the native window's log lines carry a time
• #245 Subtitling tools (check a subtitle file for overlaps, empty or unreadable cues, long lines and reading speed with the line of each problem; convert between SRT, WebVTT and ASS; shift or stretch the times) and the Subtitling project kind; the slow build guards now run only when their inputs changed; a library that reads and writes the VBA container of Office macros (not used by a tool yet)
• #246 Presentation tools: build a deck from markdown, check it (slides with no title, walls of text, tiny text, pictures without a description, missing notes, too many fonts) with the slide number of each problem, read it as an outline, draw every slide as one contact-sheet picture, convert between PowerPoint, Impress and PDF; the Presentation project kind; LibreOffice conversions run in a throw-away profile with macro security at its maximum
• #247 Academic paper tools (LaTeX): build the PDF in a scratch copy (engine from the preamble, bibtex, enough passes), check it with errors as file and line, undefined references and citations, lines running into the margin and missing TeX packages named with how to install them, check the bibliography against the citations, count words, start a new paper, convert to Word; TeX runs with file access restricted to the project and shell escape off; the Academic paper project kind
• #248 Document formats tools: convert between Microsoft, LibreOffice, OpenOffice, RTF, CSV, Gnumeric and PDF in both directions, REFUSING a conversion that would silently lose VBA macros (unless asked); list, extract and inject macros; inspect what is inside a file and what a conversion could lose; verify a conversion by going there and back; the Document formats project kind. The installer now asks which LaTeX system to install (none, recommended by default, or full)
• #249 Podcast tools (check loudness, true peak, silences and format against podcast norms, normalise to -16 LUFS, clean up a voice recording, trim silence, find chapter points, set tags), Meeting notes tools (clean a transcript, find decisions, action items, deadlines and questions in several languages, statistics, a minutes skeleton) and Language study tools (check a vocabulary list, Anki cards, word frequency, a spoken list, compare a reading with the text through Whisper), with their three project kinds
• #250 Legal review tools (compare two versions of a contract word by word and list first the changes that matter: figures, dates, shall to may, negations, and/or; check a document for placeholders, references to clauses that do not exist, numbering gaps, undefined terms and words that disagree with figures; clause outline; key terms), Bookkeeping tools (check a CSV ledger, summary by category and month, reconcile with a bank export, tax by rate and quarter; headers in several languages) and PHP project tools (syntax check, security scan, guard check for endpoints with no login check, outline, minimum PHP version), with their three project kinds
• #251 Music scores tools (LilyPond: check with line and column and bar-check failures, build PDF, MIDI, PNG, play as MP3, update syntax, import MusicXML and ABC, new tune; every run inside a bubblewrap sandbox because a LilyPond file can run commands, and the tool refuses to run without it), Photo tools (EXIF info, check for hidden GPS locations, strip metadata, web-ready copies, batch zip, contact sheet, duplicates, rename plan), Documentation site tools (check markdown pages, contents, static site with offline search, one-page export) and read-only System administration tools (report, disk, services, ports, log reader, journal), with their four project kinds; presets that need no input can carry a default
• #252 Shell scripts tools (ShellCheck, syntax, risky-pattern scan, systemd unit check; nothing is ever run), E-book tools (EPUBCheck, inspect, build from Markdown refusing paths outside the folder, new book), 3D printing tools (OpenSCAD inside a bubblewrap sandbox: check, STL/3MF/PNG, parameters, print check against your bed, STL analysis), Electronics tools (KiCad lite check, BOM, PDF, netlist, Gerbers, placement), Hugo site tools in a sandbox, Arduino tools (lint, info, compile that never downloads a core), Photo exiftool tags/set/shift, and the Tools dropdown filter now matches group names
• #253 Every project kind now names the tools it works with (Audio and video, Document, Image generation, Translation, Lazarus, Learning, Research, Creative writing; General names none on purpose), plus the Creative writing tools (statistics per chapter, repeated phrases and tics with their lines, names spelled almost the same); a test checks that no kind names a tool that does not exist
• #254 Shell and DevOps moved to the System and servers field (now 2 kinds there), and the guide now states the real numbers: 33 kinds in 8 fields, every kind except General naming its tools
• #255 Tools dropdown: typing a section name now finds it (the filter read the header text after the collapse arrow, which hid it), the sort chip is a button instead of a pop-up that opened behind the list, and the sections themselves are listed A to Z
• #256 Kinds can carry starter files: the kind's page lists them, you confirm, and only missing files are created inside the project (never overwritten, nothing outside the project); Writing, Research, Meeting notes, Study and Learning and Podcast ship with starters. The Ollama and combo model lists get the same sort button instead of the pop-up that opened behind the list
• #257 A kind can carry its own command-line tool: import lists every command and asks first, only plain commands are accepted (no shells, interpreters, pipes or redirects), built-in tools can never be replaced, and the wizard keeps a kind's tools when you re-save it; a kind can also be installed from the Marketplace with the same checks
• #258 The Anthropic worker streams its answer as it is written, sends the identity line and the earlier conversation as a real system prompt (cacheable when long), takes images and history, and reports real token counts including cached tokens; Test keys and Discover no longer report a good Anthropic key as rejected; with a spend cap set, a model whose price is unknown is refused instead of slipping past the cap
• #259 Every OpenAI-compatible worker (OpenAI, Groq, OpenRouter, Together, DeepInfra, Z.ai, Gemini) now streams its answer like the Anthropic one: one shared stream parser, a stream that stops half-way is an error and not a half answer, a provider that cannot stream still answers in one piece, and token counts are marked as estimated when a provider does not report them

What changed on this day

• #235 Project kinds are open-ended: your own kinds live in your data folder (updates never touch them), a New kind wizard, Draft with the agent, Import and Export, kinds can name the tools they use (shown as installed or missing, and the standing note tells the agent which tools it can run)
• #236 The project kind picker is redesigned: kinds are grouped in collapsible fields on the left with search, and the selected kind is explained on the right with a longer text and examples; Export is a button (any kind, shipped ones too)
• #237 The runtime tags in the status bar are shorter: each agent's tag is just native or shell, and the engine, scheduler and web tags are one word each (on, sup, aic), with the full meaning in the hover; with the redesigned kind picker (fields on the left, explanation and examples on the right, Export button)
• #238 Data Analysis tools: describe a CSV, ask it questions in SQL (read-only, safe to let an agent write), column statistics, frequent values, bar, line, scatter and histogram charts as SVG, spreadsheet to CSV; the Data Analysis kind now names them
• #239 Web site tools: preview a folder in the browser (local only, like a real server: unknown URLs 404, .git and .env never served), check every page and style sheet with file and line (markup, missing title or alt, duplicate ids, broken links, images, anchors, file names whose case would break on Linux) with Fix with agent, list the pages, pack as a zip
• #240 VB6 migration tools: UTF-8 copies of Windows-1252/1255 sources (originals never touched), a byte-for-byte round-trip check, a project inventory with an order to port in, and a VB6-to-Pascal cheat sheet; the encoding helper now ships with the app
• #241 VB6 cheat sheet preset no longer needs an input folder (it uses the current project's folder when none is given), so clicking it works

What changed on this day

• #219 File window: Open with the system now really starts the program (it was closed again after 6 seconds), and Public files get an Edit option (text up to 1 MB, Ctrl+S saves, asks before discarding changes); the guide lists what the command window can run
• #220 File window: Open with the system now really starts the program (it was closed again after 6 seconds), and files in Public get an Edit option that opens Cockpit's own code editor (colours, line numbers, find and replace); the guide lists what the command window can run
• #221 The code editor opened from the file window now stacks with the other floating windows: it opens on top, and clicking either window brings it to the front
• #222 worker_relay.php (a command-line helper) now answers 403 over the web instead of failing with an error page; the web front passed a logged-in comparison on 260 real Cockpit endpoints, identical to PHP's own server
• #223 The optional web front now answers the chat's progress polls itself (no PHP) when it can see you are signed in and the agent is running, and hands every other case to PHP unchanged (36 checks against bridge.php); its PHP sessions now live in the supervisor folder
• #224 The status bar's runtime chip now also says which web server answered the page you are on (web apache, or web aic for the optional aicserver front on port 8081)
• #225 The runtime indicator in the status bar is now three small tags (engine, scheduler, web server) like the ones beside each agent, instead of one line of plain text
• #226 Status bar: the agent labels now say just who and which model (Claude · Sonnet 4.6, OpenCode · model, Local · Dual), and the runtime indicator is three small tags (engine, scheduler, web server) instead of plain text
• #227 The status bar at the bottom of the window is back (the Attach button had pushed it out of view: CLEAR, SAVE and Attach now share a row); the Users button moved from the account card into the Cockpit Account dialog as Local users, so the cards bar is a row shorter; agent labels and runtime tags simplified
• #228 Pascal and Lazarus: two new tools build a project without the IDE (Lazarus build via lazbuild, Free Pascal compile/check), keeping the compiler messages with file and line even when the build fails; an agent can run them and read the errors
• #229 Pascal and Lazarus: the Lazarus tool can now start a project too (new console program, new form application, new unit), never overwriting; what it writes builds as it is (checked with the real compiler)
• #230 A self-contained start: the menu entry AI Cockpit (self-contained) and cockpit-self-start open the same native window on the optional aicserver front (port 8081 for V2, 8082 for V1) with no Apache; the ordinary start is unchanged
• #231 Pascal and Lazarus builds now report how many errors and warnings there were, list the first errors with file and line, and offer Fix with agent, which puts the errors in the prompt box ready to send
• #232 Self-contained mode needs no sudo: when PHP already runs as you, the Start, Stop, Terminal, Files, Browser and scheduler actions run directly instead of through sudo (Apache keeps its exact sudo calls); a Start from the self-contained front tells the launcher not to look for Apache
• #233 Install without administrator rights: a new installer (install_user_mode.sh) puts Cockpit in your home folder with no sudo and no Apache and starts it self-contained; the start scripts find a user-mode web folder, and Stop/Start through the web buttons work there (proved end to end in a throw-away home)
• #234 Self-contained mode: the Stop and Restart buttons stop only the agents and keep the web server that shows the page (Stop used to shut the whole supervisor down, so the page died with Load failed on every poll); Terminate and leave still shuts everything down

What changed on this day

• #210 Per-agent switch for the native loop: use_native_loop_ollama (or _claude, _gemini) turns it on for one agent only
• #211 No more false 'Agent session died mid-response' with the process supervisor (the progress poll asked tmux only); the deploy step that restarts agents now restarts supervised loops
• #212 The status bar shows which runtime is really in use (supervisor or tmux, shell or native loop per agent, engine, scheduler); no more false 'Agent session died' with the supervisor; the deploy restart step handles supervised loops
• #213 File window and command window (floating OS-style windows; Public read-write zone, read-only areas, kernel-confined commands via Landlock; engine 1.1.0); open picker lists above the chat area; Public hidden from the project list
• #214 Native loop: the variables the loop sets (Claude config folder, marker key) reach the agent and its helpers (the engine started children with a truncated environment); Claude config isolation proven identical on 8 situations
• #215 The native loop does the chat history itself (needs, relevance index, saving) with no PHP process: engine 1.2.0, 1,743 cases identical to history_cli.php, a loop with no PHP helper identical to the Bash
• #216 The native loop carries out the agent's markers itself (engine 1.3.0, 148 checks against the shell and PHP executors); the loop's key is no longer sent to a catalog entry's address; with the native loop on, chat, history and markers need no PHP
• #217 The native loop calls the free-REST suppliers (Groq, HuggingFace, Cloudflare) itself: it opens the encrypted Workers key store and makes the request with no PHP (engine 1.4.0, 46 checks against worker_relay.php); with the native loop on, card 2 needs no PHP either
• #218 An optional web front: with a file called use_aicserver the supervisor also runs aicserver and php-cgi on a side port (8081) next to Apache, refusing the same files Apache refuses (23 checks); the first side-by-side run showed the settings, usage log and quota file would have been served, now closed

What changed on this day

• #195 Drop-down lists (Workers, Tools, Ollama, LocalAI) now open scrolled to the entry you have selected
• #196 Drop-down lists open on the entry you have selected (opening its group if collapsed) and group headings stay on the top row while you scroll
• #197 Descriptions for chats and projects; Auto Generate themes by palette type (colour-vision and high contrast) with your own colours; Mixed themes generated and saved correctly; clock card tidy-up with the server hour difference; drop-down lists open on the chosen entry (opening its group) with floating group headings
• #198 The Stop button no longer ends the agent: stopping a generation used to kill the agent's loop so later prompts went unanswered until a restart (now tested on every build)
• #199 An optional process supervisor for the agent loops (off by default): a loop that dies comes back, Stop interrupts the agent's process group, open-session shows the live log; tmux stays the default and the fallback
• #201 Optional supervisor extras: start the supervisor and the agent loops by itself at login (a systemd user service, no administrator rights) and the Jobs panel's minute tick as a supervised job
• #202 Never two agent loops for one agent: a loop refuses to run when another already serves its queue, and the supervisor start and autostart installer end leftover tmux agent sessions
• #203 Open session in the native window shows a supervised agent's live log instead of a stale tmux pane; never two agent loops for one agent (a loop refuses to run when another serves its queue; supervisor start and autostart end leftover tmux agent sessions)
• #204 Gemini calls through the native engine over verified TLS (key in a header, any prompt size, reasons for blank replies); open session in the native window shows a supervised agent's live log; never two agent loops for one agent
• #205 Prompt assembly by the native engine (156 byte-identical cases; a prompt that was exactly -n or -e no longer vanishes); Gemini calls through the engine over verified TLS; open session shows a supervised agent's live log; never two loops for one agent
• #206 Clean-up after an agent answers by the native engine (304 byte-identical cases; the Ollama usage line is valid JSON for any chat name); prompt assembly and Gemini calls through the engine
• #207 The markers an agent writes (fetch, search, worker, tool, propose) work: the loop calls Cockpit's own pages with a private loopback key instead of no login; PROPOSE names fixed; a V1 loop calls V1's pages; plus build 206's clean-up by the native engine
• #208 The start of every turn by the native engine (request details, model file, supplier controls, effort text, argument whitelist; 56 byte-identical cases plus the whole loop run twice); the engine-refused message no longer prints 'log: command not found'
• #209 The whole agent loop as one native program (aicengine loop, off by default: use_native_loop): proven against the shell loop on 13 requests; capabilities and auto-route by the engine (69 cases); the markers' internal key; the start of every turn by the engine

Cockpit’s working folders are private, and uploads stop failing silently

• Drop-down lists that match your theme. Every drop-down used to open the system’s own menu, which ignored the theme. Cockpit now draws the opened list itself: your colours and font, a check mark and bold for the chosen entry, group labels, upward opening near the bottom of the screen, full keyboard use, and for the theme picker colour swatches with a Dark / Light / Mixed tag. Checked under all 36 themes.
• Every theme is now checked for readability — including your own. Whenever a theme is applied, Cockpit tests each text colour (normal, dim, muted, and the light text of the dark areas in Mixed themes) and each agent and accent colour against the surfaces it is drawn on, and brightens or darkens any that cannot be read. Saving a theme in the Theme Editor tells you which colours were too faint. The 36 built-in themes are checked on every build.
• An optional process supervisor for the agent loops (off by default). With a file called use_supervisor in the Cockpit data folder, the three agent loops run as services of a small native program instead of tmux sessions: a loop that dies is restarted (it used to leave a session that still looked “running” and requests nobody answered), Stop interrupts the agent’s process group, and “open session” shows the live log (in the native window too). Tmux stays the default and the fallback. Proven with a real supervisor, the real agent loop and a stand-in CLI: Stop mid-request, a killed loop, and the next request all behave.
• A file window and a command window that look and behave like system windows. The toolbar’s Files and Terminal buttons now open two floating windows (drag, resize, minimise, maximise, remembered position). The file window is a small desktop-style file manager: your own Public folder (inside your projects folder) is yours — new folder or file, rename, move, copy, upload by drag and drop, download, delete to a trash — and everything else (your project folders, and areas an admin adds) is read-only, with copy-into-Public. Symbolic links are never followed and every change is recorded. The command window runs one simple command at a time, as you, and the operating system itself (Landlock) lets it write only in Public and read your project folders and the system’s programs; if a machine cannot confine commands, none are run. Both are done by the native engine, hosted by the process supervisor. Not in the web demo. The old system buttons remain one click away in each window’s title bar.
• The agent’s markers are carried out by the native engine too. %%CREATE%%, %%READ%%, %%DELETE%%, %%LIST%%, %%FETCH%%, %%SEARCH%%, %%WORKER%%, %%TOOL%%, %%PROPOSE%% and the library markers run inside the native loop, with the same results as the shell and PHP versions (148 checks, including every request sent to Cockpit’s own pages). Found on the way: the loop’s private key was also sent to a catalog entry’s address in the PHP version when that address sat under Cockpit’s own; it is now sent only to the four pages it is meant for. With the native loop on, chat, history and markers need no PHP at all.
• The native loop does the chat history itself, in the same process. Whether a prompt needs the earlier turns, which turns are relevant (the same search index as before, SQLite loaded from the system when present) and saving each turn into the chat file now need no PHP. Proven identical to the PHP helper on 1,743 cases (output, log lines, chat files and index rows); the few inputs it does not copy exactly are handed to the PHP helper for that one request. A loop run with no PHP helper at all gives the same answers as the shell loop.
• Native loop: variables set by the loop now reach the agent and its helpers. The native agent loop started the programs it runs with only the first part of its environment, so a variable it had just added (the private config folder for the Claude CLI, the loop’s key for the marker calls) could be missing. Found by comparing the Claude config folder the shell loop and the native loop leave behind, eight situations side by side; they are now identical.
• Open lists under the chat area (Ollama, LocalAI, Workers, Tools). The pickers of the top cards could be drawn under the chat area in the native window. An open list now uses the browser’s top layer, above everything.
• The status bar shows which runtime is really in use. Next to each agent: who keeps its loop alive and which loop runs (sup · native, sup · shell, tmux · shell), read from the running processes, not from the switch files. A chip shows whether the native engine is on and whether the scheduler tick is a supervised job or cron; hover it for the details. Meant for the period while the native parts run next to the shell ones.
• No more false “Agent session died mid-response” with the process supervisor. While an answer was still being written, the page asked tmux whether the agent was alive. With the supervisor switched on there are no tmux sessions, so any answer that took more than an instant (a local model loading, a long reply) was declared dead, the prompt was removed from the queue and nothing was answered. The check now asks whichever of the supervisor or tmux hosts the loop. The deploy step that restarts the agents had the same blind spot and reported a failure after every deploy; it now restarts the supervised loops (and recognises the native loop).
• The whole agent loop as one native program (off by default). With a file called use_native_loop in the Cockpit data folder (or use_native_loop_ollama and its claude / gemini twins for one agent only), each agent’s queue loop is the engine’s aicengine loop instead of the shell script: request details, supplier and catalog, capabilities and auto-route lists, prompt, the agent run (Claude, a catalog CLI, the free relay, Gemini, local Ollama), clean-up, markers, saving the chat and the done signal, with none of jq, sed, bc, python3 or curl. Proven against the shell loop on thirteen requests (answer, a hash of the whole prompt, saved chat, created files and log lines identical). The capabilities and auto-route step is also available to the shell loop through the engine (69 cases). Delete the file to go back.
• The start of every turn is done by the native engine (off by default). Reading the request, the Ollama model file and the supplier controls, putting the effort text in front of the prompt, the whitelist for extra command-line arguments and clearing the queue come out the same as from the shell version (56 cases, plus the whole loop run twice with a stand-in agent). Also fixed: the loop’s message when the engine stepped aside printed “log: command not found” instead of saying so.
• The markers an agent writes to use Cockpit’s own tools now work. %%FETCH%%, %%SEARCH%%, %%WORKER%%, %%TOOL%% and %%PROPOSE%% were answered “Authentication required” every time, because the agent loop calls those pages without a login. The loop now carries a private key kept in your data folder, and the pages accept it only from this machine, only for those few actions, and only as a person who exists (with their own role). %%PROPOSE%% also used action names the library page did not know; fixed. A V1 loop now calls V1’s pages instead of V2’s.
• The clean-up after an agent answers is done by the native engine (off by default). Stripping terminal artifacts from Ollama and Gemini replies, timing the turn, the Ollama usage line and the “not signed in” hint come out byte for byte the same as from the shell version (304 cases) without sed, bc or GNU date. A backslash in a chat name no longer breaks the usage line.
• The prompt for each turn is assembled by the native engine (off by default). Goal, kind and descriptions, COCKPIT.md, your profile, the global directives, the identity line and the layout come out byte for byte the same as from the shell version (156 cases, including cut points, broken JSON files and NUL bytes), without jq. A prompt that was exactly -n or -e used to vanish; fixed in both paths.
• Gemini calls without jq or curl, over verified TLS (native runtime, off by default). The engine now makes the Gemini REST call itself with its own HTTPS client, which always verifies the server’s certificate and host name, keeps the API key out of the address and off every command line, and has no limit on the prompt size. Proven byte-for-byte against the shell path on 18 response shapes, with refused-certificate and wrong-name tests. A bug fixed in both paths: a Gemini answer with no text (for example a safety block) showed as a blank reply instead of the reason.
• Never two loops for one agent. A second agent loop for the same queue (for example a tmux loop left running next to the supervised one) would have answered every prompt twice. A loop now refuses to start when a live one already serves its queue, and the supervisor start and the autostart installer end leftover tmux agent sessions.
• Supervisor extras (optional): cockpit_sup_autostart.sh install starts the supervisor, and with it the agent loops, by itself at every login as a systemd user service (no administrator rights; boot-time start needs one loginctl enable-linger that you run yourself). The Jobs panel’s minute tick becomes a supervised job too, so it runs even without a crontab line.
• The Stop button no longer kills the agent. Stopping a generation sent Ctrl-C to the agent’s session, which ended the agent’s loop along with the running CLI. The card still said “session running”, and every later prompt waited unanswered until the session was restarted. The loop now survives the interruption (the partial answer is kept) and serves the next prompt. A test that presses Stop mid-request on a real loop with a stand-in CLI now runs with every build.
• Auto Generate knows about colour vision and your colours. New themes can now be generated with a palette type — Normal, High contrast, Protanopia, Deuteranopia, Tritanopia or Achromatopsia — and with a background, panel and accent colour of your own choosing (or random). The colour-blind palettes were checked with a colour-vision simulation: the closest pair of agent colours stays clearly apart where a normal palette can leave two looking identical. Mixed themes are now generated, and saved, as real Mixed themes.
• Clock card: the “Loc. TZ” and “Ser. TZ” labels are gone, the server time is bold, and the local zone line ends with the hour difference to the server in bold.
• Descriptions for chats and projects. A note of up to 300 characters on every chat and every project — what it is for, or what it achieved — shown under the name in the Chats and Projects lists, with a filter box that searches names and descriptions. It is private to you unless you tick “also send this to the agent”, separately for the chat and the project.
• Lists open on the chosen entry. The Workers, Tools, Ollama and LocalAI lists now scroll to the entry you have selected when they open, instead of starting at the top. If it sits in a collapsed group, the group opens first, and a group’s heading now floats on the top row while its entries scroll past.
• Kind per project, goal per chat. The kind is set once for a project and every chat in it inherits it; the goal is now each chat’s own. Free chats can have both. The info-bar chips no longer flash “General” and “+ goal” before the real values arrive. Nine general project kinds join the programming ones: Research, Document Creation, Creative Writing, Image Generation, Audio and Video, Translation, Data Analysis, Web Site, Study and Learning.
• Workers and Tools lists could stay empty after start-up when the sign-in check answered a little late; they, and a few other start-up loads, now wait for it.
• Mixed themes, light areas: the supplier cards, clock, version label and EXECUTE button no longer show light text on a light background; the old single-surface check that wrongly lightened dark text is gone.
• Supplier-card lists now wear the card’s own colour, and a short list is only as tall as its entries.
• Mixed themes: the Theme Editor’s drop-downs were dark text on a dark background in the nine Mixed themes; fixed.
• Project kind picker could open with nothing to choose if its first request ran before sign-in; it now asks again.
• Terminal windows opened from Cockpit could appear behind the maximised app window and look minimised; the terminal now raises itself.
• Local-model chat (Ollama / LocalAI) can use the native runtime too, with no limit on the size of the prompt.
• A very long answer can no longer empty a chat. An agent answer of about 128 KB or more made the step that saves the turn fail, and that step then replaced the whole chat file with an empty one — every earlier turn gone, and the answer not saved. Turns now go through a temporary file and the chat file is left alone if saving fails.
• A native agent runtime, off by default. The parts of the agent loop that start the agent, pick earlier turns of the chat and carry out %%CREATE%%-style commands now also exist as small native programs, each checked against the Bash on the same inputs (more than 290 comparisons, your own chats included). Switch on with an empty use_engine file in your data folder; delete it to go back. The Setup and User Guides describe it.
• A leak closed. Apache answers on every network interface, and it used to list the queue/ and responses/ folders and serve the files in them — the agents’ replies — to anyone on your network, without a login. Both are now refused, and so are folder listings under Cockpit.
• Internal data files (paths, usage log, project state, quotas, lock files) are refused too. Nothing in the app reads them over the network, so nothing changes for you.
• How it arrives. The installer adds it on a new install, the update adds it on an existing one, and the Setup Guide shows the one command for a hand-built setup. The change is tested on a scratch Apache before it is applied, and undone automatically if Apache would not start.

Backup and restore, a personal archive, and a standards check for Lazarus

• Backup & restore. One button makes a plain .tar.gz of your settings, library, chats and projects. Test restores it into a scratch folder and checks every file against its checksum; Restore first saves the current state, so a restore can be undone. Rebuildable bulk (the Shelf index, Python environments) is left out, and API keys only go in if you tick them. Archives carry a data version, so a later build can migrate older ones.
• Personal archive. Add scans, photos or PDFs of your own papers; Cockpit reads them on your computer (text PDFs directly; scans through tesseract or a local vision model), guesses a type and a due date from words like expires and valid until, and files the text in the Library so you can ask about it. Every guess is editable, and nothing is sent to an online service.
• Redesign mode. A REDESIGN button beside PLAN: the agent writes a proposal (structure now, structure after, numbered steps, risks) and changes nothing; you approve the steps; then it does one step at a time, with a checkpoint of the project before each and a one-click undo after. Checkpoints are file snapshots — your own repository is never touched.
• Easier to read. The project kind and goal in the info bar are now chips with an accent border and your theme’s own text colour (readable on all 36 themes, dark and light), and the text in the Hive section is larger. The Toolbar buttons are kept in alphabetical order. The nine Mixed themes are fixed and less extreme: the dark top bar, status bar and sidebars used to get the dark text meant for the light content (nearly invisible); they now have their own light text, and the light content is a little darker and the dark panels a little lighter.
• Standards check. For a Lazarus project: text typed into code instead of a resourcestring, Windows-only code outside an IFDEF, no dark/light switch, thin comments. It is read-only and can hand you a ready resourcestring unit.

Lazarus beside Cockpit, project kinds, and a page on what hardware runs what

• The file viewer follows the file. When Lazarus, an agent or an applied edit changes the open file on disk, the viewer reloads itself and keeps its place. For Pascal and Lazarus files there is now an Open in Lazarus button that opens the file and its project.
• Project kinds. A project can say what it is (Lazarus / Free Pascal, VB6 migration, Castle Game Engine, Godot); a short standing note for that kind goes with every prompt in the project, and Cockpit suggests the kind from the folder.
• Fixed: a saved project goal never showed in the info bar after a reload (it was still sent to the agents).
• New page what runs on what: measured tiers, from running Cockpit on 4 GB of RAM to local models on a small graphics card. The site now states macOS and Dossier as they really are, and stops quoting free-tier limits that change.
• The site’s right-click menu replacement now applies only to the interactive tool pages; guides and docs keep the browser’s own menu.

Privacy & spending: a check before secrets leave, and a budget for paid agents

• Sensitivity gate. Before a prompt goes to an online agent, Cockpit checks it for private keys, API keys and tokens, passwords, and card, IBAN and US SSN numbers that pass their checksum. You choose: redact and send, use the local model instead, send anyway, or cancel. Or set a standing rule: never send them online unless you explicitly choose to each time (with a second confirmation), redact automatically, or never at all. It does not guess at names or e-mail addresses, so it will not cry wolf. Local agents are never checked.
• Free agents only refuses agents that need a paid plan. It is linked with Stay Free in the Suppliers dialog (Stay Free also turns it on, and the dialog then disables paid agents), and you can untie the two in Privacy & spending. It is on for a new install and off for an install that already has history, so an update never takes away the agent you use.
• Monthly budget counts prompts to paid agents, warns at 80% and stops at 100% (you can send one anyway). Everything is in the new Privacy button in the Toolbar. A Try the gate box lets you paste text and see what would be caught and what would be sent.

Cockpit speaks your language

• A new translate button beside the font-size picker chooses the language Cockpit is shown in. English is the default.
• Every label, hover hint, placeholder and message on the main screen is now translatable (about 1,600 pieces of text). The first language packs ship but cover only a small part so far; untranslated text stays English, so a half-finished language works fine.
• Your language missing, or want to improve one? The menu offers an empty template to translate. Save it in your Cockpit data folder and it appears in the list; developers can regenerate it from the code.
• Buttons keep exactly their English size in every language; a translated label that is too long scrolls inside its button instead of stretching it.
• The voice Language list now offers every language whisper supports (99), opens as a scrolling menu you can type into, and remembers your choice. English is the default.
• The top bar fits a 1920-pixel screen again, with a tidier Settings block.

A library that knows when it has nothing, chats that stay where they belong, and voice input you can see working

• The library can say “nothing here covers this.” Until now a question about something your library did not hold was still answered with its closest match, so an unrelated chapter could end up in front of the agent. An item now has to cover at least half of what the question is about, measured against your own library — common words count for little, rare ones for a lot. When some items matched loosely but none fits, nothing is added and the chat says so: “Your library has 22 loosely related items, but none covers what you asked.” Request words such as “explain” or “examples” no longer count as evidence. A library of fewer than twelve items is too small to measure, so the check stands down there.
• Replies stay in your chat. A small share of replies — in our own testing, about one in fourteen — were shown correctly and then saved to a shared chat file instead of yours, so they were gone after a reload. Cockpit now queues a prompt only once everything it needs to route the reply exists, so that can no longer happen.
• The button with your name works again. Pressing it did nothing in either edition for several days. In the Full edition it opens your Cockpit Account; in Stand-alone it opens the local user manager. The build now checks for this kind of slip before it ships.
• A tour that covers everything. The guided tour now has a step for every tab on both sides of the screen and for each of the twenty-one Toolbar buttons — sixty-odd steps, each with its own help topic. It opens each tab as it goes and puts yours back at the end, and the tab and button steps come in three sections with a Skip section button, so you can take just the part you want. Two steps — the Toolbar and the Proposals tab — used to be skipped without a word unless you already had that tab open; they show now.
• Voice input you can see working. While you dictate, a level bar with a pulsing dot opens to the left of the mic button and moves with your voice, and the button fills as it rises — so a muted microphone, the wrong input and a quiet room no longer all look like “nothing happened.” The menu’s three dropdowns now say what they are (Model, Language, Mic), the model line shows which model “Auto” picks, and the result line names the model that actually ran. A microphone you chose earlier that has since been unplugged is forgotten with a message, instead of breaking dictation for good. And after a reload the mic’s tooltip no longer claims whisper is missing, and the model list is filled in.

Capabilities that actually apply, PDFs that are actually read, and a Library you can fold

• Turning a capability on now reaches the agent. The step that applies your capabilities was being refused on every prompt, so toggling one had no effect. It now runs, and the switch itself is a clear bordered ON/OFF box — the old one was a 22×28 px icon that was easy to miss, and a near miss opened the card instead.
• PDFs are read. An attached PDF used to arrive as a bare file path with no text. Its text is now extracted. PDF Vision also works on scans now: the first six pages are rendered and handed to an agent that can see (they were being rendered and then thrown away). Ask your question in the same message as the attachment.
• The Library folds. A book is one row, collapsed, with Remove book on it; unfold it to see its chapters. The toolbar button is now called Bookshelf. Conversion markup left over from a book’s source is stripped when the text is read — about a fifth of every passage handed to the agent had been markup — so books filed earlier read cleanly too.
• The Toolbar is in alphabetical order, with full names (Accumulator, Transcriber) and count chips: Jobs shows how many jobs you have, Stop shows how many agent sessions are up (3/3).
• Artifacts tells the truth about who made a file. Chat backups no longer appear as things your project produced, saved code snippets sort under Code, and a file reads made by only when a tool reported writing it — otherwise mentioned by.
• The file preview refreshes. It has a refresh button, and re-reads itself after you apply a Margin edit instead of showing the old text until you click the file again.
• Search says what happened. Public search engines increasingly refuse automated queries, so a search can come back empty on a healthy network. The panel no longer claims no key is needed, and Cockpit says which engine refused.
• A tighter lock on your sign-in. A copy of the Claude sign-in that Cockpit keeps for its isolated agent configuration was readable by the web server’s group. It is owner-only again, and is re-checked on every run.

Your own books now really reach your answers

• Library questions finally use the Library. The step that pulls matching book chapters into a question never ran from the chat box (every prompt carries a Mode/Style prefix, and the step deleted the question along with it). It runs now, and the sources line names the chapter an answer drew on.
• Bookshelf finds chapters in books converted by calibre, the Library can remove a whole book, Browse remembers the last folder you used, and leftover markup is cleaned out of book text when it is added.
• Cockpit warns when a question about your library lands on a small coding or embedding model, and offers to switch to a suitable one.
• The Dossier, Intercom and Margin buttons did nothing because of a single wrong internal id; they now respond. Search says when an engine is throttling it instead of blaming your network, and Intercom no longer sends whisper’s marker for silence as if it were your prompt.
• The install integrity check no longer flags COCKPIT.md, which the installer adapts on every machine.

Bookshelf takes books from anywhere

• Real chapters. The first real test of Bookshelf found four faults (a split that divided nothing, titles taken from the first line of a slice, a non-breaking space that silently defeated every pattern, and pandoc markup leaking into titles). Chapters now come out named properly.
• Add books from anywhere: Browse opens the native file chooser, a plain browser can upload, and a typed path asks you to Allow that folder. Cockpit never reads a folder you have not approved.
• Profile opens on a sample that says it is one. The sample is never written to disk, so invented facts cannot reach your agents.
• The icon font now carries the full Material catalogue (about 4,250 icons) plus 18 Cockpit glyphs.

Four dead buttons revived, the editions tidied apart

• Bookshelf, Dossier, Profile and Intercom were never loaded by the page (their script tags were missing), so their buttons did nothing. Fixed, and the build now refuses any script or stylesheet the page does not load.
• The Stand-alone edition can see and stop its own sessions, shows its own badge and local user, has its own window title, and installs the native window component instead of falling back to a browser. A Close all running sessions button on the edition-clash dialog is the way out when the running edition cannot close its own.
• The two editions stop sharing settings and data.
• A tidier top bar: Rules, Jobs and Accumulator moved to the Toolbar, Profile to the account card, the font controls into Settings, and the stage badge now comes from the build itself. The frameless window and splash were reworked.

macOS passes, and numbers replace guesses

• macOS passes the full install test on Apple Silicon, after five portability faults were found and fixed along the way. The guide, the download page and the QA page now say so.
• Hardware recommendations are measured, not asserted. About 4 GB of RAM runs Cockpit with cloud agents; 8 GB without a GPU makes small local models usable; 4 GB of video memory is comfortable. Nothing is enforced.
• Bookshelf sizes its chapters to your machine (a flat size cost minutes of prompt processing on a small GPU).
• Whisper installs and uses the model you chose; the installer used to fetch the large model regardless of your answer.
• The last bash-4-only shell constructs were removed, so the agent loop works on macOS’ older bash.

Languages, privacy and a demo that caught up

• Text-to-speech voices now cover 42 languages and the sound picker 43 (before, only two languages had a voice, and anyone else silently got none).
• Your location and the developer’s details are gone from the About panel and the guides; the Terms no longer name a jurisdiction and measure lawful use against the law that applies to you.
• Downloading videos (yt-dlp) no longer needs Python.
• The public demo had fallen a release behind and was drawing icons as text; it is back in step, and the build now refuses to ship a copy that has drifted. Installer bundles no longer carry a usage log or a developer home path.

Cockpit reads books, pages, images and sound — and shows its working

• Bookshelf. Converting a book was never the hard part — scale was. Over ~50 KB of extracted text an agent only gets a file path and a preview, which is useless to a local model. A book is now split into chapters and filed in the Library, so retrieval pulls the one chapter that matches the question and Receipts names it: a 400-page book works with a 7B model because it never sees more than the chapter it needs. The chapter list is shown before anything is written, because a bad split is obvious in a preview and invisible afterwards.
• Dossier. A researched answer with a numbered source list you can check. The gathering is deterministic, so the same question fetches the same pages whichever agent writes the report, and a small local model can do the writing without driving a search loop it would get lost in. It reads the first pages a search engine returns — a fast survey, not a literature review — and the report says so itself.
• Margin. Select lines, say what should change, approve a diff. The agent never touches the file: it returns only the replacement for the selected lines, and the splice happens here against the file as it is on disk. The anchor travels with the request, so it cannot drift onto a similar-looking passage further down — an early version matched on text alone and would have corrupted a file whose neighbouring line had just been edited.
• Intercom. Hands-free: it listens, notices when you stop talking, transcribes, sends, speaks the answer and listens again. Silence ends the turn rather than a timer, and the voice reads the answer, not the markup.
• PDF Vision and vision dispatch. PDF pages can be rendered and read as pages, not as the text scraped out of them. Each agent now receives an image the way it can actually take one; where an agent cannot see, Cockpit says so rather than accepting a description it quietly invented.
• Sound. Measured audio facts — tempo, key, loudness — computed by local tooling, not guessed by a model. Sheet music works both ways: a hummed melody becomes engraved notation, and notation plays back with a piano-like voice. Transcription follows one melodic line, and a photo of sheet music is refused with an explanation rather than confident nonsense.
• Receipts, Profile, and your own agents. Answers cite the retrieved passage they used. A Profile carries who the agent is working with, capped and sized because it rides on every prompt. And the agent catalog is editable in-app: describe how a new CLI is invoked and test it before putting it on a card — no rebuild.
• Machines have names. The relay listed rigs by a 32-character id. Each machine now carries a name you choose, sent with every heartbeat, so nothing is re-paired when it changes.
• macOS — the pass that wasn’t. The weekly Apple Silicon run was reporting success while the installer was aborting part-way through: it exited with status 0 after dying, so the job went green. Made to assert completion instead, it exposed three real faults — stat -c is GNU-only and a failed command substitution under set -e kills the script; the Homebrew httpd.conf was looked for at two paths that do not exist, so the port move, the Cockpit alias and the PHP module were all skipped; and ${var,,} is bash 4 syntax while macOS still ships bash 3.2, which killed the install and would have killed the agent loop. All fixed, and the build now refuses to ship bash-4-only syntax at all — but the confirming end-to-end run has not happened yet, so macOS stays listed as unfinished.
• Correction, 1 October. This entry described these features as working when several were not. Bookshelf, Dossier, Intercom and Profile had no way to open until build 131; library retrieval — and so Receipts — did not fire from the chat until build 134; Margin, Dossier and Intercom were silently broken until build 137; and PDF Vision could not read scanned pages until build 147. All of that is fixed. Dossier is paused again, because public search engines now refuse its automated searches. And macOS passed its full run on 25 September (build 124), so it is no longer unfinished.

Everywhere works, the cron tick runs, and your agents stop inheriting your terminal

• Everywhere relay — proven end to end. A prompt typed on a phone now runs on the rig and the answer comes back to every device watching. It had shipped, been entitled and never once run: the poller looked for a path that the edition merge deleted, read a data directory it could not open, wanted an account password in plaintext, mistook a successful login for a failure (PHP 8 stopped flushing cookie jars on curl_close), and reported its liveness into a table the phone's rig list does not read. All five fixed; the poller now authorises with a revocable token and no password is stored anywhere.
• An answer is no longer eaten by whichever device asks first — a phone and a desktop can both follow the same run, and a prompt sent from one appears on the other.
• Scheduled jobs actually fire. The minute tick had three faults stacked on each other: no crontab line was ever installed, the tick was refused by the session gate, and a lock bug stopped the sweep after the first data directory. The installer now installs the tick, and the Jobs panel can install it with one click.
• Agents no longer inherit your personal CLI setup. An agent the cockpit starts used to read your own hooks, plugins, skills and global memory — on the developer's machine a terse-style hook was quietly rewriting every answer while the Style selector said otherwise. Cockpit's agents now run against an isolated config holding only your login (so you never sign in twice); switch on Use my global CLI config if you want the old behaviour.
• RAG Search does something. The capability toggled nothing before: matching snippets, library notes and sources are now put in front of the agent, and the chat says what was added.
• New: an Artifacts tab listing everything a project produced with its provenance, a per-project Goal, autonomous goals with a visible budget and per-step progress, a recovery token you can actually obtain, and an A2A switch so another Cockpit can call this one.

Six Linux distributions, then Windows through WSL2 — all as a stranger would

• Debian 13, Manjaro, openSUSE Tumbleweed and Arch (MATE) joined Ubuntu and Fedora on the hand-tested list, every option on, zero hand patches after the fixes: Debian’s CD-only apt source and PHP package names, Manjaro/Arch keyrings, mirrors, php-apache wiring and the expired http account, openSUSE’s SELinux and wwwrun:www, KDE and MATE shortcuts, the terminal and file-manager launchers of every desktop. A machine with no browser, file manager or terminal is offered them on a setup page; with no browser at all the Cockpit window itself becomes the system browser (cockpit_shell --browser).
• Windows 11 through WSL2 — tested for real. install_windows.ps1 had never run on a Windows machine; the first run found it unreadable by Windows PowerShell (UTF-8 quotes), then blind to wsl.exe’s UTF-16 output, then it wiped the distro’s systemd switch. Fixed, plus what the run taught: zstd for Ollama’s installer, .wslconfig so WSL does not stop Cockpit a minute after the last terminal closes and so localhost reaches it from Edge (mirrored networking), a reboot offer, the exact next command printed, and an AI Cockpit shortcut in the Start menu and on the Desktop. The Cockpit window, the setup wizard, gnome-terminal and Nautilus all open as ordinary Windows windows through WSLg.
• The window: frameless is a setting (live on X11, on Reopen under Wayland), position and monitor are remembered, deploys reload or reopen the running window, the sessions card holds Reopen / Reload / Refresh / fullscreen; a two-minute freeze that appeared in build 69 was WebKit’s own signal handler being replaced — found with gdb, gone.
• Remote administration page in the setup: optional SSH from one address or network; inside a KVM machine the QEMU guest agent is installed so a host can drive it.
• A full pass over the app, as a user (every card, mode × style, toolbar tool, sidebar panel, proposals, export/import, attachments, TTS, whisper, translation) found and fixed: Card 2 set to opencode was still running the Gemini CLI (the daemon read the shared settings once at start, never the per-user file); a turn’s Mode · Style was never saved (every reload read “· Submit”); Claude Code’s own file writes landed at the shared projects root instead of the project; a sub-second duration written as .9 made PHP call the chat corrupt (export failed, history skipped it); image generation died on the 4 GB card while an Ollama model was loaded — Ollama is now asked to drop it first; the transcriber never found whisper (an undefined variable); proposal cards, the chat list and history hits showed server time; scratch chats leaked into history; tool inputs typed as relative paths; right-to-left answers left-aligned; and the About window still said AGPL (the licence is Apache-2.0 with conditions).
• Also: the build number shows in the version (v2.0.0:87); the setup window is dark on MATE too; the rig line names the OS, desktop, terminal and file manager; the account and clock cards explain themselves on hover; response labels and the status pills name the supplier actually in the slot (opencode, Dual) instead of the slot’s old name; an installed CLI whose version probe fails under the web server (opencode) no longer reads “not installed”; the help, tour and User Guide describe the sessions card’s window controls.

The installer became a setup window, and was run by a stranger on fresh machines

• A setup window instead of forty questions. On a desktop install_cockpit.sh opens a wizard (ckdialog: Free Pascal + GTK 3, ~1000 lines, in the bundle): edition, install user, projects folder, optional CLIs, models sized to the hardware it detects, media tools, desktop shortcut, logins — every choice first, a summary, one Install. The system password is asked once, in a dialog; a progress window then follows the install log phase by phase and says Done. Light or dark to match the desktop, with a ☾/☀ switch. Over SSH the same questions are asked in the terminal, up front.
• Interrupted, or run again later? It remembers every answer (never passwords) and asks Continue or Start anew. Components already on the machine — Node, Ollama, LocalAI, LibreTranslate, Piper, whisper.cpp, Aider, the companion tools — are listed on a Keep page: ticked ones are left alone, unticked are redone. Re-running over a finished install is the upgrade path. Everything goes to ~/cockpit-install.log.
• First run in the Full edition: the account comes first. The first local login on a machine takes the Cockpit account name (an existing one, or a free registration with the human check, inside the setup or the app), so the person in the chat is labelled by their own login.
• Tested as a stranger would on fresh Ubuntu 24.04 and Fedora 44 virtual machines, every option on, twice each. What that found, all fixed: no agent sessions on any fresh install (the shipped paths.json had no home), the human check blank in the native window, a hidden prompt that hung the install, a fresh install that named the Card 3 model picker “Dual mode off”, a Keep list that was never read back, LocalAI pulls that aborted the run on an already-present model, and the terminal buttons doing nothing on Fedora (Ptyxis, GNOME Console and the rest are now recognised, and a missing terminal is reported).
• Fedora is a first-class install now: dnf package set, httpd/apache account, home-folder bits, a posix_* polyfill for PHP builds without it, and one SELinux change — only the web-server domain (httpd_t) is made permissive so it can run your agents; everything else stays enforcing. The Ollama card pulls a model the first time it is asked for it and shows Ollama’s own error instead of an empty bubble. The boot splash follows light/dark like the window.
• Also: the BETA badge shows site-wide; the stats page counts finished installs and first accounts; the Setup Guide names the LocalAI gallery ids that actually exist in 4.7.

AI Cockpit is a program now, not a browser tab

• Cockpit now opens in its own native window (cockpit_shell: GTK 3 + WebKitGTK, 400 lines of Free Pascal, Apache-2.0 — sources in the bundle and on the Download page). The window’s close button, Alt+F4 and the dock’s Quit all open the same Leaving Cockpit dialog as the Exit button: kill jobs, stop sessions, wait, or leave. The window closes only when you say so. Outside links open in your browser; F11 fullscreen, F5 reload; the local login is remembered. Machines without the WebKitGTK runtime fall back to a browser window.
• Panels detach into their own windows. The title bar of every sidebar panel has an open-in-new button: Preview on the second monitor, Code beside the chat, Attachments while you work. Escape or Ctrl+W closes a detached window; the main one is untouched.
• The window does desktop work itself. Open folder / open file / open a terminal here, agent sessions in a real terminal, files pasted from the file manager attached by their true path, and a GPU meter read straight from the driver (hover for GPU, VRAM, CPU, RAM). Opened when nothing is running, it starts the web server and the agent sessions itself and says what it is doing.
• Ctrl+Alt+C from anywhere brings the Cockpit window up (again to put it down), and starts Cockpit when it is not running (the installer offers the desktop shortcut); the window remembers its size, can run fullscreen without decorations (COCKPIT_KIOSK=1), and checks the shipped files against the build manifest before loading the app — a changed index.html means it refuses to run rather than trusting the page to report on itself.
• Real file paths, notifications, tray. In the native window a file dropped on the prompt or chosen with Attach is attached by its real path (native file dialog, nothing uploaded); a file dropped elsewhere opens in the floating editor. Finished jobs raise real desktop notifications with an Open Cockpit action, and a tray icon offers Show / Minimise / Exit (GNOME: with the AppIndicator extension, which the installer enables).
• Signed in, without typing. In the native window the local login has Keep me signed in on this computer: a per-device sign-in token kept in your OS keyring (GNOME Keyring / KWallet via libsecret) — not in Cockpit’s files — revoked by Sign out, expiring after 90 days. And Fill from Bitwarden buttons on Cockpit’s own login forms, through the official bw CLI: the master password is typed into bw’s own prompt, never into Cockpit.
• It can bring itself up. Opened when nothing is running — at login, from the dock, with the shortcut — the window shows a boot screen, starts the web server and the agent sessions, and loads the app when it answers; if that takes too long it says so and offers Try again. It remembers its size, runs fullscreen and undecorated for a dedicated screen (COCKPIT_KIOSK=1), and verifies the shipped files against the build manifest before loading the app.
• Fixed. Chat turns showed UTC while the lines beside them showed local time (the agent loop wrote a timestamp with no zone); the second clock in the hardware row now says when this Cockpit window was opened; the saved theme applies at start (it used to show only after a change); the settings card keeps its width and a long theme name scrolls; Files, Attachments and every other chat-scoped panel follow a chat switch; the Code panel’s Propose toggle no longer spills its markup; account card and settings block padding.

Open source, integrity, guard, and a lot of polish

• AI Cockpit is open source — Apache License 2.0. Read it, change it, redistribute it. Three conditions: a modified version ships under another name, says it is based on AI Cockpit wherever it is presented, and runs its own server. The account client (cockpit_auth) and the live server stay proprietary. Full text on the Licence and terms page, and in the app (logo → Terms). The Terms of Use name no jurisdiction and measure lawful use against the law that applies to you.
• Build integrity. Every bundle carries a manifest (sha256 per shipped file + a build id). The app checks itself on first use and on demand (logo → Integrity), lists changed or missing files, and can restore the shipped files from the bundle the installer keeps. The live server answers account services to official builds only.
• Lockdown and guard. The installer makes the shipped files root-owned and read-only (sudo to edit — a deliberate act) and starts cockpit-guard, a small service that logs any change to a shipped file, flags it in the app at once and puts the file back.
• Chat context, done properly. A gate decides whether a prompt needs history; a full-text index over every chat picks the turns that matter; Claude gets a pointer and reads the chat file itself. Workers (REST) and Tools runs are now recorded in the chat too.
• Tools. Runs are jobs in a cockpit_tools tmux session (the card’s open button shows them live), with an installed-check before Run, a long-run watchdog, Stop that stops everything, output files with the tree’s permissions and open-folder / open-file buttons in the chat. The local file chooser now uploads the file and fills the server path.
• Interface. Every emoji replaced by monochrome Material icons; hover hints drawn by Cockpit itself (never cut off), a First-use mode with summaries from the guide, and a 26-step guided Tour; chat turns are foldable cards with a sticky title row; Enter sends, Ctrl/Shift+Enter add a line; an Exit procedure; a four-row clock with the live server’s time; the account card, sessions and settings blocks tidied.
• Workers. Groq’s retired llama-3.x models replaced by gpt-oss-20b / 120b and qwen3.6-27b; a stale cascade order no longer blocks the cascade; the Delegate classifier picks an installed model and no longer asks on every prompt.
• Fixed. The bundle had been shipping the developer machine’s paths.json; ftpush’s progress percentage was always 0 %.

The account check moved to the server, and modes can now run durably

• The Full edition’s account check is now the server’s answer, not the app’s. Cockpit asks cockpit.ruggi.site whether this machine is registered to an account, and the server replies from its own records. Two things follow. An install that cannot prove it has an account is asked to sign in, whatever its local files say. And when the server cannot be reached at all, that counts as no answer rather than no — a paid install keeps working offline exactly as before.
• Fixed: the check used to pass when it failed. If the account service errored or could not be reached on first load, the app treated “could not tell” the same as “signed in” and took the panel down. Unknown is not permission; it now asks.
• Fixed (security): the account endpoint had no local authentication. Every other Cockpit backend requires you to be logged into the app; this one did not, and the app is served on every network interface. Anyone who could reach the machine on port 80 could read the signed-in e-mail, licence mask and tier — or sign the install out with a single request. It now requires the local session like everything else. Worth updating if you run Full on a shared or office network.
• New: ⛓ Durable. With Pipeline or Broadcast selected, a button in the mode strip turns that exact selection — your prompt, the agents you ticked, their current models — into a checkpointed chain that resumes at the step that died instead of starting over. Enter is unchanged and still runs the mode in the page; durable is something you press, never a hidden setting.
• Docs. The Setup Guide’s contents worked for none of its twelve steps — every link was dead. Fixed. Both guides now also cover the account requirement, what the installer sends and how to switch it off, the companion tools it installs (ftpsuite, secrets), and the new button.
• Corrected on this site: the Free tier was described as “no registration”. That is true of Stand-alone (V1) and not of Full, which registers the install once with a free account. The pricing page now says which is which.

Version check at install, and what No Phone Home actually covers

• The installer now checks for a newer release when it starts. If one exists it says so and points at the download page — then carries on with the version you have. That check sends one anonymous line: OS, distro, architecture, package manager, coarse hardware, and the installer's own version. No username, no file paths, no files, no IP. Opt out entirely with COCKPIT_NO_TELEMETRY=1 before running.
• Why it happens before you choose anything. One installer serves every edition, so at that moment there is genuinely no choice yet to respect — the decision you would be making has not been offered. Rather than guess, the installer tells you what it is about to send, sends one line, and gives you something back for it.
• No Phone Home starts at your selection. Choose V1 and that boot line plus the record of your choice are the last things sent. No progress, no errors, nothing. At the very end you are asked once — knowing the install worked — whether to send a single anonymous “it succeeded” line. Decline and nothing is sent, and nothing asks again.
• Your choice is now recorded for every option, including V1. That sounds like more data; it is actually less guesswork. Previously, an install that reported nothing might have been a V1 user or someone who closed the terminal — indistinguishable. Now the absence of a selection means “walked away”, and V1 users stop being mistaken for failures.
• V2 and Both are unchanged: install progress and errors are reported so broken installs can be found and fixed, with the same opt-out.

The Hive moves into the sidebar

• A Hive section in the left sidebar — Autopilot Cruise and AutoCognition now share one home, with a live view of which agents are up and which chains are running. Buttons for Agents, Chains and Broker open the panel scoped to just that concern instead of one long scroll
• flight PLAN acts on the normal prompt box — one place to type a goal. Press Enter to dispatch to the agent you picked, press PLAN to hand the same text to the Hive as a durable chain
• The Autopilot Cruise mode toggle is gone — it was a checkbox that silently changed what the Enter key did, and it defaulted to on, so the same prompt could dispatch or plan depending on a setting you could not see from the chat. Planning now happens only when you ask for it. Nothing was lost: Cruise is still there, behind an explicit button. Any saved preference is cleared automatically on first load
• Interrupted chains are visible without opening anything — the sidebar status line turns amber and tells you how many stalled and where to resume them. The floating hive button that used to carry that badge was retired, since the sidebar section replaced it

Autopilot Cruise, AutoCognition, and a new tier lineup

• Autopilot Cruise — state a goal in the main chat and Cockpit plans it into steps, picks the best agent/model for each, and runs it as a durable, resumable workflow (survives a crash or a closed tab), then posts the result back. A fast-path skips planning for trivial messages, and Manual Override is always one toggle away
• AutoCognition — a local multi-agent bus: agents advertise presence and can see, message, and call each other; durable task chains with a board, checkpoints, and auto-resume-on-kill; capability routing (route a step to the best-fit agent), quorum voting (several models answer, a judge picks/synthesizes), a consent-gated broker, and one-click turn any Power Combo into a durable chain
• New tier lineup — Free (no account, all local) · Starter (free account + Marketplace + unlimited combos) · Basic (Autopilot Cruise) · Pro (AutoCognition) · Ultimate (Pro + Everywhere), plus Everywhere as a standalone add-on. Everything except Cruise, AutoCognition, and remote access stays free with your own keys. All paid tiers are open free during beta
• Site + home moved to cockpit.ruggi.site — the product now lives at its own domain (old maestro.ruggi.site links 301-redirect over, with a short history page), and the pricing/landing/features pages were rebuilt around the two new capabilities
• Leaner download — trimmed ~46 MB of unused art from the bundle; the app itself is unchanged by that

Account recovery, Workers Auto-cascade, and a full launch experience

• Account recovery tokens — a one-time code shown when you first create your account restores your paid account and tier on a reinstalled or new machine. Recover right from the app; admins can reset a token
• Workers — Auto (cascade) — pick this and free-tier workers are used in a priority order, automatically advancing to the next when one hits its daily quota (or a rate limit), for constant free AI. Reorder the priority in Workers settings
• Marketplace — restore your content — a "my downloads" filter plus a one-click restore that re-downloads everything you previously downloaded and everything you published, so a fresh machine is quick to set up again
• Auth reliability — fixed a case on newer systems where sign-in/validation could report "server unreachable" and leave a paid account stuck on Free
• Desktop launch experience — the installer adds AI Cockpit to your applications menu (under an "AI" category) plus cockpit-start / cockpit-stop commands; launching shows a branded splash, then opens Cockpit in a clean app window. Install both versions and AI Cockpit V1 (No-Account) gets its own menu entry and cockpit-v1-start — only one version runs at a time
• Browser/launch polish: opens a fresh window reliably (no more hijacking the app tab), and a login guard keeps the browser's display flags in place across browser updates

Downloads refreshed to the current build — please re-download

• The install bundle now ships the current install_cockpit.sh. The 2026-08-23 overhaul (V1/V2/both, offline, hardware-aware, telemetry, guided prompts) was already written, but the download had kept serving a pre-overhaul installer — so anyone who downloaded before today got the old one. Fixed: re-download to pick it up
• New bundle shape (dist-based): extract → cd cockpit → sudo bash install_cockpit.sh, which installs from the bundled dist/cockpit_v2.tar.gz / cockpit_v1.tar.gz. Both the automated and manual-copy paths in the Setup & Manual guides were updated to match
• Tool downloads brought in line with fixes that had only been live in the browser: Drive Migration Calculator (per-drive transfer time now honors per-drive rates), Palette Generator (WCAG luminance threshold), Subscription Sleuth ("Semi-Annual" label), and Veil-10 (large-input encode fix)
• Every downloadable archive on the site was audited to confirm it contains the latest version of each file it bundles

Installer overhaul — V1/V2/both, offline installs, hardware-aware, guided prompts, and install telemetry

• One installer, your choice of version: pick V1, V2, or both at the start. "Both" installs V2 at /cockpit and V1 at /cockpit-v1 side by side. The edition is now derived from the version instead of a separate question — V2/both use the full account edition (needs at least a free account, no card), V1 uses the fully-local stand-alone edition
• Every prompt now explains what each option means and its implications in plain language, shows the default (Enter = …), and supports proper line editing — backspace, arrows, ctrl-u — so typos are fixable
• Offline installs: the installer detects no connection and skips every download gracefully (packages, CLIs, Ollama/LocalAI, models, account) while still deploying the local app + web files — ideal for a private, offline V1 setup. V2 warns that its account and models need a connection later
• Hardware-aware: detects your CPU model + cores, RAM, and GPU/VRAM and recommends a local-model size that actually fits (so a 4 GB card isn't handed a model it can't run)
• Cross-distro package completeness: the package lists no longer assume a fresh Linux Mint — every tool the app shells out to (unzip, ping, lspci, and GNU coreutils/grep/sed on Alpine, etc.) is installed explicitly on apt/nala, pacman, dnf, zypper, and apk, plus the Docker image
• Ollama now keeps its own default model location instead of being forced to a custom path, and detects a pre-existing custom location to warn you before continuing. One consistent per-user npm location for the agent CLIs (no more root/user split)
• New: anonymous install telemetry so we can find and fix installs that fail and see where they stop — reports only OS/distro, your version+edition choice, coarse hardware, and any OS error, with usernames and file paths stripped out; never your name, files, or IP. On for V2 (opt out with COCKPIT_NO_TELEMETRY=1), opt-in for V1 (superseded 2026-09-11 — see the entry above)
• Verified end to end on a real Linux Mint 22.3 machine: V1 + V2 both installed and serving, the 50 open Power Combos seeded, all three agent sessions running, and the Claude + Gemini CLIs authenticated and responding

Fixed the install counter showing zero; Windows installer hardened; Card 2 defaults to Gemini

• Found and fixed the real reason the stats page showed zero installs despite real downloads: the first-run setup ping sent edition: "full", but the endpoint receiving it only accepted "v2" — every real install's completion signal was silently rejected. New installs now register correctly; installs completed before this fix were never counted and can't be recovered retroactively
• install_windows.ps1 hardened: added a Windows-build preflight check (fails with a clear message instead of a confusing error three steps in on unsupported Windows versions), wrapped both WSL detection calls so a never-initialized WSL install no longer crashes the script, fixed the Linux-user-exists check to key off the actual exit code instead of output text, and switched the generated sudo password to a cryptographically secure generator
• Card 2 now defaults to Gemini CLI (Google's free-tier API key works directly, no subscription required), restricted to Flash models only. Groq remains available as a background/fallback option but is no longer the default
• All of the above CI-verified: install_windows.ps1 syntax-checked on a real Windows runner, install_cockpit.sh --unattended run end-to-end on a disposable Linux runner (exit 0)

Full account and Stand-alone unified into one download; real installer bugs fixed; Everywhere relay activated

• Full account and No-Account (Stand-alone) editions are now one codebase and one download (cockpit_install.tar.gz) — the installer asks which you want partway through instead of shipping two separately-maintained tarballs. Stand-alone's zero-network-calls promise is now enforced by a runtime flag file, checked before the one call that used to be edition-specific (an anonymous first-account-created ping)
• Fixed real installer bugs found during testing: a nala update flag mismatch, a home-directory permission bit that could block service accounts (ollama) from starting, and a missing group membership that could deny ollama write access to its own models folder
• New: a manual-install .zip for anyone who'd rather hand-copy files than run the install script — includes a new step-by-step Manual Install Guide for Linux, macOS, and Windows, plus the existing Setup/User guides. The install scripts are still bundled inside in case you change your mind partway through
• Everywhere relay (remote phone/tablet access) is now actually wired up and reachable — was previously sold but had no activation path. The local rig now auto-starts the relay poller on cockpit_start.sh (self-gates on entitlement), and the Account panel has a real "Everywhere — pair a device" button linking to the phone-pairing page
• Scope doc for Everywhere relay corrected — it was marked "NOT BUILT" but the backend/client were already real and functional, just not connected to the install flow or UI; that gap is what got fixed
• All of the above CI-verified end-to-end (both editions, install to a running server) on Linux Mint/Ubuntu, ARM Linux, and macOS; Windows installer syntax-checked (full WSL2 run still needs a human on real hardware)

New: Local AI Models Guide, complete Power Combos catalog, Marketplace title fix

• New: a Local AI Models Guide, in plain language — real ollama pull/local-ai run commands and Hugging Face URLs for every model in the pool, organized by RAM/VRAM tier and what each one is good/weak at. Published on both ruggi.site and maestro.ruggi.site (Backups pages and its own dedicated page)
• New on maestro.ruggi.site only: the Power Combos paper — how Parallel/Sequential/Judge patterns work, why Dual Mode on Supplier Card 3 is AI Cockpit's real differentiator, and multiple real usage examples per domain (coding, office, language, image, learning, data, creative, accessibility)
• New: a complete combo catalog page — all 705 combos across all three backends, each with its description, what it's good for, and a worked example, browsable by backend/category
• Fixed: several combo packs had 2-3 entries sharing the same name (same task, different underlying models) — Marketplace listings and downloaded combos were indistinguishable. Renamed by total model size (e.g. "... — Lite / Standard / Pro") across titles and the actual downloadable payload
• Model files themselves are no longer hosted on the server — the guide instead points to the real upstream sources (Ollama's registry, Hugging Face) directly

Pre-release pass: sitewide polish, QA infra, live demo, account management, real Marketplace pool

• New QA infrastructure: temporary test accounts across all tiers, a re-runnable manual test plan, and real per-OS install CI runs (Linux, ARM Linux, macOS, Windows)
• New: right-click is now suppressed sitewide (ruggi.site + maestro) except the browser's own title bar — copy/open-in-new-tab etc. are handled by a themed menu instead. F12 devtools unaffected
• New: ruggi.site tool upgrades — Drive Migration Calculator (unit selector, custom transfer types, per-drive rate), Palette Generator (per-color pickers, Save-as, Saved Palettes with import/export), Media Subtitles (ARM Linux/macOS/Windows sections), a proper HTML page for the Claude Code Linux Mint guide (previously PDF-only), VeilStream's source-view link now opens a Download/View modal instead of a blank page
• New: the live Web Demo's Supplier Slots now offer real predetermined options (Claude/Gemini/Codex/Groq/Qwen Code, Ollama/LocalAI/Dual), default to Claude · Groq · Dual, and Card 3's model/combo lists are populated for both backends. Unscripted prompts get Lorem Ipsum filler instead of a meta "not available" message. Workers and Tools panels also ship with real sample entries
• Fixed a real bug in Card 3's Supplier Slots (v2 and demo): picking "Dual — Ollama + LocalAI" wrapped the long name into garbled-looking text on the collapsed card — now shows a short "DUAL" label with the full name as a tooltip
• maestro.ruggi.site: renamed "Open on phone/tablet" to a distinctly-styled "Everywhere Relay" button; the homepage download counter now only counts real app downloads (v2/v1/Docker), not per-platform helper binaries; Q&A gained search and sort (by date/author/topic); the Account page is now a real account manager — editable profile, a Subscription tab, and a payment-method flow that's wired up but stays inert until billing goes live
• New: the Marketplace page on maestro.ruggi.site now browses the same live content pool the in-app Marketplace uses — real titles, kinds, and download counts, no login required to look. The in-app Marketplace's kind filter also gained the "User Combos" option it was missing
• Download page: the old per-platform cockpit_auth binary buttons are gone — that section now just explains the manual (non-scripted) install path and links back to the real tarball/zip downloads. Fixed a spacing bug that pinned the Docker card too close to the section above it
• Fixed: Quick Utils' search icon overlapped the placeholder text — moved to the right side like a normal search field

Dual Mode + Power Combos: real feature parity, mixed-backend combos, and a real bug hunt

• New: the Ollama and LocalAI panels on Card 3 are now structurally identical — same master row (total count, filter, "+ new", collapse/expand-all), same categorized combo groups (Code, Office, etc.), same "Needs both backends" section, same model list with a sort control. Only the accent color and the model curation depth differ (Ollama's Tier 1-4 is hand-curated; LocalAI's is one real group, since it has no equivalent per-model data)
• New: "Needs both backends" combos are now merged across both catalogs — a dual combo saved while Card 3 was set to Ollama shows up in the LocalAI panel too, and vice versa, instead of only appearing wherever it happened to be saved
• New: missing-model combos are unselectable and disabled, but a combo you authored yourself stays editable even while it's missing a model — the whole point of opening Edit is to fix that. Hovering a missing combo now says which backend each missing model is missing from (e.g. "foo:3b (Ollama), bar:7b (LocalAI)")
• New: the Combo Editor's model fields are now real dropdowns built from your actually-installed models (Ollama + LocalAI), not free-text — a newly authored combo can no longer reference a model you don't have. Model lists are alphabetized. Switching a step's backend correctly resets the model pick instead of carrying over an incompatible one
• New: engine-level support for vision/multimodal steps (LocalAI's vision-capable models) — an images field now flows end-to-end from the combo API through to both Ollama's and LocalAI's actual wire formats. No shipped combo uses it yet; this is the plumbing a real one needs
• Simplified: Card 3's Supplier Slots now only offers Ollama, LocalAI, or Dual — LM Studio and llama.cpp were listed but never actually wired up for Power Combos or the model picker. Either is still usable as a custom Worker. Also removed the dead "Custom..." option, which had no handler and silently broke Power Combos if picked
• Fixed a real bug: the Combo Editor's Ollama model list could show up empty — dual_model.php's model-listing endpoint was gated behind Dual mode (so it errored whenever Card 3 wasn't literally set to "Dual") and, underneath that, used shell_exec('ollama list'), which silently fails under most web-server users. Both fixed — model listing now works regardless of Card 3's provider, via Ollama's own HTTP API
• Fixed: saving/deleting/publishing a combo only refreshed the Ollama panel — an edited combo's row stayed stale on the LocalAI panel (or in "Needs both backends") until a hard reload. Both panels now refresh together
• Fixed: a dual (mixed-runner) combo's missing-model check used to validate every referenced model against only one backend's installed list — a model genuinely installed on LocalAI could wrongly show as missing when checked from the Ollama catalog. Each model is now checked against its own step's actual backend
• Installers: Ollama and LocalAI model suggestions now come with "Good for:" notes, and pressing Enter installs the whole suggested set by default (previously required typing "all"). Linux installer now also installs ffmpeg/pandoc, matching macOS
• Fixed: the cockpit_auth licensing binary was missing from every downloaded tarball (see the notice above) — also added .zip downloads and Docker edition selection (v2/v1) this week

Ollama + LocalAI together in regular chat, not just Power Combos

• New: Card 3's model list now shows every Ollama model and every LocalAI model together — pick one of each and both stay loaded side by side (VRAM permitting)
• New: a real fit-check runs every time you pick a model while the other slot is filled — if the two wouldn't fit in your detected VRAM, the other slot is freed automatically instead of silently over-committing
• New: with both loaded, sending a prompt first asks both models to rate their own confidence (a quick 1-10, not a full answer), shows both scores, then lets you pick a winner or run the two together — parallel, sequential, or judge, the same patterns Power Combos already use
• Picking just one model (either backend) works exactly like before — nothing changes unless you actually use the new dual slot
• Known limit, shown right in the UI: LocalAI has no confirmed reliable "unload model" API, so freeing its slot updates the app's own state honestly but can't guarantee the model actually leaves memory yet

Dual-mode Power Combos, CI-verified installers, real AMD GPU detection

• New: Power Combos can now mix Ollama and LocalAI in the same run — both servers run genuinely in parallel (not switched back and forth), each step tagged with which one it uses. A pre-flight check confirms every server a combo needs is actually reachable before it runs, instead of failing partway through
• New: the Docker bundle now installs and runs LocalAI alongside Ollama too, matching what the native install already did
• New: hardware detection rewritten as a plain shell script — no compiled binary, no recompile needed for tweaks — and extended to detect real AMD GPU VRAM too (read straight from the kernel's own driver, not a vendor tool), not just NVIDIA
• New: install scripts gained an unattended mode, and our CI now runs the real installers end-to-end on Linux, ARM Linux, and macOS — a genuine install, not a hand-rolled approximation of one, so a failure there means a real bug. Windows gets a lighter syntax check for now (WSL2 can't run end-to-end on cloud CI without nested virtualization)
• Fixed: 7 real installer bugs this new CI caught and closed the same night — a text-editor package missing on plain Ubuntu, a file-permission ordering bug on Linux, an Ollama startup race, a wrong Homebrew path on Apple Silicon macOS, PHP never actually loading into macOS's web server, and two Windows-script timing/verification gaps

Real hardware detection, LocalAI support for Power Combos

• New: AI Cockpit can now detect your actual CPU cores, RAM, and GPU/VRAM (NVIDIA only, for now) and use it to raise the local-model auto-load ceiling past the old fixed 4B default — safe fallback to the original limit whenever hardware can't be read. Built and CI-compiled for Linux, macOS, Windows, and ARM; only Linux has actually been run on real hardware so far
• New: Power Combos now work with LocalAI as Card 3, not just Ollama — same 50 free combos, translated to LocalAI-compatible model identifiers (same underlying models, different naming convention). Combos correctly hide themselves if Card 3 is set to anything else (LM Studio, llama.cpp) since those aren't wired up yet
• Fixed: switching Card 2 to Groq showed a false "not installed" warning — Groq doesn't use a local binary at all, it routes through the encrypted Workers key store. The Supplier Slots picker now correctly shows key status instead of a misleading binary check
• Fixed a real (if narrow) bug before it could ever affect anyone: installing a LocalAI combo pack would have silently overwritten Ollama's encrypted combo files — each backend now writes its own file

Bug sweep, Q&A board, Docker option, and honest beta labels

• New: a Q&A board — ask a question with no account (guest posts stay up 7 days), sign in to answer or keep yours permanent
• New: a Docker option for Windows/macOS — one bundle, Cockpit and Ollama share a container since the app talks to Ollama on a fixed local address
• Fixed a real bug: the Power Combos panel was silently empty on every install (a response-shape mismatch between the backend and the UI) — the 50 free bundled combos now actually show up and have been tested working
• Fixed: fresh installs could end up with the app looking in the wrong folder for your projects (the installer created one folder, the app defaulted to a different one) — Linux, macOS, and Docker installers all corrected
• Fixed: the Supplier Slots picker (Card 1/2 alternate CLI choice) now correctly shows which CLI is actually configured after a normal page load, not just right after changing it
• The Everywhere relay is now clearly labeled Beta in the app itself, not just announced
• Labeled the macOS installer, Windows installer (since tested, 2026-09-21), and Docker bundle Not Tested Yet on the download page — all written and reviewed carefully, but not yet run for real on their target platform. If you try one, please tell us how it went
• Assorted site accuracy fixes: stale terminology, broken/incomplete stats tracking, and several documentation gaps found and closed

Live Demo — try it before you install

• New: a browser-based Live Demo — the real UI, real themes, real chat flow, no install and no signup, hosted right on our server
• Agent replies are canned/scripted (no real Claude/Gemini/Ollama calls, no local-machine access) so it's safe to host publicly, but every screen, panel, and interaction is the genuine app
• Linked from the homepage, Features, Pricing, Docs, and every guide page — look for the "play_arrow Live Demo" button

Live Beta is here

• AI Cockpit is out of "under development" and into open beta — download it and use it today, free
• New: a No-Account Edition download alongside the registered build — same local app, zero SaaS account, ever, no network calls to our server, no Marketplace/remote-control features
• The registered build now asks for a free account once at first run (no card) — local features stay free forever either way
• Platform downloads added: native binaries for Windows, macOS, and ARM Linux / Raspberry Pi, alongside the existing Linux package
• Q&A page, Marketplace, and Setup/User Guides all fixed and verified live
• Paid tiers marked "Free during beta" until monetization actually launches

Combo catalog expanded to 235, Delegate task routing, in-app guides

• Power Combo catalog grown from 50 to 235 recipes across 30 categories
• New Delegate feature — set keyword/phrase rules that auto-route matching tasks to a chosen worker, combo, or Ollama model, regardless of active mode
• User Guide and Setup Guide now open inside the app itself (searchable, with back/forward navigation) instead of an external browser tab
• Collapse/expand added across all supplier dropdowns (Ollama tiers, Workers, Tools, Power Combos)
• Full theme editor — every palette color is an editable swatch, export/import as JSON

Marketplace and per-user data separation

• Community Marketplace: browse, download, and publish Skills/Tools/Capabilities/Combos, with compatibility badges before you download
• Multiple local users on one machine now get genuinely separate data — own tools, skills, combos, and SaaS account per login
• Account Portal — profile and subscription management (registered-machines panel)

SaaS layer goes live

• Cockpit Account system launches, with free and paid tiers
• Lemon Squeezy billing integration (test mode)
• Cross-platform compatibility metadata — every downloadable item shows whether it'll run on your machine before you get it
• Cloudflare Turnstile bot protection on registration

Core application

• Five supplier classes: configurable paid CLI, free REST, and local LLM server slots, plus cloud Workers and local Tools
• Single / Pipeline / Broadcast / Plan multi-agent modes
• Full local RAG — Library, Snippets, Accumulator, semantic search
• 36 themes including 18 Protanopia-safe Dalton variants
• Smart attachment routing (PDF/DOCX/audio/video/image), scheduler, chat export/import