Changelog

What's new, improved, and fixed in each Muse Code release. For install and upgrade steps, see the Muse Code overview.

1.4.18

Improvements

• Sessions take less disk space: the goal reminder no longer saves a separate log file for each check. To keep those logs, set plugins.goal-reminder.child_session_log to "retained" in settings.json
• Sessions take less disk space: the verify reminder no longer saves a separate log file for each check. To keep those logs, set plugins.verify-reminder.child_session_log to "retained" in settings.json

Fixes

• Reading an image file or getting an image from an MCP tool no longer breaks the session on a model that cannot view images; the result says the image was not attached
• Agent sessions in editors warn when the session can no longer be saved
• muse exec --json --image now labels each attached image [Image #N] in the prompt, as muse exec --image without --json already does
• Answers in French, Spanish, German, and other non-English languages are no longer discarded and rewritten when your first message is short; Muse sets English as the session language only when your messages use common English words or you ask for English

Performance

• A session that has compacted no longer re-reads its whole session log in the background after a compaction

1.4.17

New

• The session protocol gains an experimental subagent/workStop request that stops a session's subagents the way the terminal UI's own stop does, so the agent is told the user stopped them
• Session-protocol clients get a subagentResult item each time a session consumes a subagent's result, at that point in the session, with the result's status (completed, failed or cancelled) when the view saw it, so a client can show each finished subagent where its parent read the result
• TypeScript SDK: FoldExtension hooks observe custom notifications in the session fold and host-wide events
• In the TypeScript and Python SDKs, session.events() streams what each incoming event changed in a session, so a client can update its view incrementally
• The TypeScript and Python SDKs add MuseClient.request for queries the client does not wrap, and command and request send experimental methods when the client is spawned with experimentalApi: true
• A subagent item's result in the session protocol now carries superseded: true once the subagent started a newer attempt after that result, so a client can take the subagent's status from its control state

Improvements

• Muse asks you right away, before the other steps, when a network policy refuses a download a step needs, instead of probing other sources or naming the block only in its final report, builds and tests on the up-to-date branch when your checkout is behind and its build fails, keeps working until a fix the failure output names is applied or offered, and makes browser app forms return their result from your own click instead of waiting on a background step
• A Muse build older than this release cannot open a chat that a newer build connected, or tried to connect, to another machine to run commands there. When such a chat is resumed by id or chosen in the session picker, that build may instead start a new local chat on its own that reads the old chat's log and continues the work on this machine; update the app before reopening the chat, because that work may have been written for the other machine. Other chats are unaffected
• Browser games follow the stack the request names instead of always using plain HTML files
• When a turn does not fit the model's context window, the message now says you can start a new session
• Session-protocol clients: view cursors are now minted in the v10: spelling; a cursor in an older spelling is refused once with the standard "reopen without a cursor" guidance, and a view cache saved by an older build is rebuilt on first use, so no client silently skips or misreads events
• Shell commands sandboxed on macOS can look up the current user name, so ssh works as it does outside the sandbox
• Session listings now run in two phases by default, so a long listing no longer holds the session log open while it runs; listings are unchanged, and logs that are already very large do not shrink yet
• The agent asks before changes you did not request: putting what it built on your PATH, replacing or shadowing a command already there, editing shell start-up files, or installing a background service
• muse serve clients can send a skill part together with video parts in one turn/start; each video's [Video #N] label joins the skill's arguments in order, as image labels already do
• When you ask for a checker or report that separates published from unpublished content, the agent is now prompted to rerun it and list items used only by unpublished content under their own draft-only heading, instead of calling them unused or leaving them out, before saying it is done
• In the TypeScript and Python SDKs, a call that fails because the host process died now says how it ended (exit code or signal, and the end of its error output) in the error's cause; such a call can fail up to 2 seconds later while the SDK waits for that exit, and the cause does not mean the session can be resumed

Fixes

• Security: The /goal summary no longer lets goal text written by the model change the terminal title, clear the screen, or move the cursor; invisible terminal control characters are removed before the summary prints
• Python and TypeScript SDKs: a command answered overloaded or backpressured with retryable: false is no longer resubmitted automatically; without the flag it still retries
• After a resume that fails and reopens the session picker, the session you tried is selected as soon as the picker lists it, so pressing Enter right away no longer opens a different session
• A prompt queued behind a running turn now reaches its UserPromptSubmit hooks with its text instead of an empty prompt
• A turn on a model with a known context window now trims the output it asks for to the room the window has left, which prevents most request-too-large errors in long conversations
• After a session log is deleted or replaced outside Muse, a subagent interrupt, stop, close or result read that the session protocol refuses now says why instead of saying the change can't be saved
• The compatibility link in the SDK errors about the Muse Code host now opens the compatibility page instead of a missing page
• A session that asks muse serve for workspace trust now opens with its extra workspace folders untrusted when trust.json cannot be read, instead of failing to open
• Resuming a session that has to continue in a new session no longer fails when its newest checkpoint was written between turns; the conversation is kept
• Session messages sent after a background task finishes can be approved normally. Pending approval cards show the background task trigger separately from the sender
• Keep saved workflows available to resume after compacting and reopening a session
• On a Mac where Muse Code cannot use the Keychain at startup, such as over SSH, the login screen now says why and how to fix it (run security unlock-keychain and restart Muse Code) instead of looking logged out with no explanation
• Reopening a session with --resume, --continue or /resume no longer repeats an earlier subagent in expanded history when its saved subagent state could not be read
• On Windows, a failed muse sandbox windows setup, or the setup a first start runs, now names the step that failed, such as a sign-in the machine's policy refuses for the sandbox account, instead of only reporting that its setup marker is missing
• Older app versions can't resume a workflow that recorded a failed status check; update the app to resume it
• When settings.json has no schema_version (for example, another tool created it), Muse now says to add "schema_version": 1 instead of reporting a bare parse error
• On a muse serve session, a command sent to a subagent while its history is still being rebuilt after a resume now answers that the subagent is busy and can be retried, even when the session cannot be saved, instead of reporting a save failure for a command that never ran
• Reading a JPEG that is cut off before its end now fails with "the file may be damaged or invalid" instead of sending the broken image to the model, which rejected the request
• On Linux, when two sandboxed shell commands start at the same time while ~/.config does not exist yet, the second no longer fails with exit 125
• On Linux, shell commands now run when Muse starts in a subdirectory of a Git worktree created with git worktree add, instead of every command failing with a "Not a directory" error
• Workflow token budgets and child usage now count all of a child's work, not only its first turn
• On Linux, the shared lock that keeps sandboxed commands from removing each other's protection of a missing denied path no longer lives in a file a temp cleaner can delete out from under a running command
• On Linux, a sandboxed shell command no longer loses the protection of a missing path such as ~/.config when another command sharing it finishes first after the sandbox's placeholder records were deleted, for example by a /tmp cleaner
• A plugin skill you turned off stays off after the plugin's author moves its folder and you update the plugin
• Stopping a task from the Tasks drawer or with /stop all no longer adds a second prompt row under your next message
• On Linux, a sandboxed shell command no longer loses a deny inside a missing protected folder such as .git when another sandboxed command starts in the same workspace
• Python and TypeScript SDKs: submitFeedback / submit_feedback no longer attaches a commandId to feedback/submit or resubmits it after a backpressured or overloaded answer; each call is one submit, as the wire defines it
• Attaching an image no longer fails with "Access is denied" on Windows when the session folder does not allow hard links, for example inside a sandbox
• muse sessions shows a parked side chat as a side chat of its conversation (sideOf) instead of an anonymous session beside it
• muse serve's hooks catalog read (hook/list) on a settings.json nobody could read now refuses with the read error and a recovery line instead of reporting zero hooks, and a resumed start (muse resume <id>, muse exec --session-id <id>) stops with the same refusal; a fresh muse or muse exec start keeps its permission-profile refusal, and commands that run no hooks keep continuing on defaults with the one warning
• Reopening a session no longer fails when saving a turn's setup failed and the next turn reused the same rules or instructions
• A forked session that ran before recording its workspace now takes the workspace on its next resume, so the resume picker lists it under the current workspace instead of hiding it as missing metadata

Performance

• An idle session now returns the memory a compaction freed to the system about half a minute later, instead of often holding it for minutes

1.4.16

New

• session/read of a subagent session now carries modelTurnRunning, which says whether the subagent is still running a model turn, when its parent session is open on the same server
• TurnErrorKind gains reasoningReplayRefused (a chat that cannot continue after a model switch) and contextOverflow (a turn that cannot fit the model's context window), both not retryable, so session-protocol clients can tell these two failures apart; existing matches receive them in their catch-all arm
• A session protocol toolCall item of a shell command now carries a short, display-safe title for the command (bashTitle) while Bash titles are on, so a client can label the row without parsing the model's raw text
• muse acp is on by default, so editors that support the Agent Client Protocol (like Zed) can run Muse as their agent; the surface is experimental and may change in a later release
• A prompt.surfaces setting turns developer-prompt blocks off by id (with an optional default) in global or project settings, and per session through session settings overrides; the five protected blocks stay on for now, and an unknown id is skipped with a startup notice (refused when a session sends it)
• TypeScript SDK: MuseClient.spawn and spawnMspConnection accept a spawnFn option, so you can run the handshake and sessions against an in-memory fake host instead of a real muse process

Improvements

• Muse now records each session's developer instructions when it starts. When you reopen a session in the terminal (--resume, --continue or tbh exec --session-id) after changing run.developer_prompt in your settings, Muse saves the new text and uses it from the next turn. On a session whose developer instructions were set by this release's start or update, a remote send, open, list or poll made while a run is in its first step can wait until that step's checkpoint, never past the call's own deadline; other sessions see no change. Sessions created now cannot be opened by an older build that has this off
• Muse checks its work more carefully: it tries other spellings and wider paths before saying something does not exist, finds which copy of the code a report is about before fixing it, reruns named failing tests in the setup they failed in, asks before a change a repository rule forbids or gates, reads the repository's own history and upstream branch, and stops to ask when a network policy blocks a step instead of routing around it
• A workflow cancel that muse serve refuses now names the exact stop refusal in the error's new stopRefusal field, for example stale_revision
• Muse keeps working when it built a result somewhere other than the screen, tab, page, or file you named, and adds it where you asked instead of offering to
• Resuming a session after a crash now shows one notice listing the calls the crash cancelled, joined to the abnormal-exit notice when one prints, or on its own as a warning when it does not
• Setting developerPrompt to a null or empty value in a session config now opts that session out of Muse's own developer context
• Muse now states your session language pin on eligible main runs from the first visible output, deriving the pin deterministically from your own messages in the session (English when your input carries no language signal yet) instead of inferring a language from names, code, or tool output
• A session on a host that muse serve --per-session or muse attach --stdio starts can turn its sandbox off or open its network at session/start, within what managed policy allows, when its client opts into the experimental API

Fixes

• On a muse serve session that has compacted, forking the conversation, including a subagent that starts from it, no longer fails as a malformed session log when a later turn's instructions are kept only by the compaction checkpoint
• A muse serve session whose trusted workspace path is a symlink to a folder now starts with the project's custom agents instead of failing with "source root is a symlink"
• In muse serve, taking back a queued message on a stuck session whose command queue is full now fails after 30 seconds with a busy error you can retry, instead of waiting until the session recovers
• Long sessions that start many subagents no longer stop saving checkpoints: a subagent that finished and whose result the main agent already read, for example by waiting for it, now drops out of the saved session once the conversation no longer mentions it, even if nobody closed it
• Messages that interrupt a subagent stop showing as queued when its replacement starts
• Stop sends its interrupt again when the host says it is busy, so the running turn stops instead of running on
• Reinstalling a plugin while a session is using it no longer fails when the only difference is the permissions of the plugin's top folder, which can differ when installs run under different umasks (for example one from a background service and one from a terminal); the copy in use is left alone and replaced at the next install after those sessions end
• Body-completion receipts now reach session-protocol clients as dedicated history rows, so a timed-out, steered, or compacted-away tool body keeps its result and expansion state on the client instead of dropping them
• The "session log flush degraded" note at the end of a turn no longer goes missing when a checkpoint flushed the session log after a save had failed earlier in the turn
• A long session no longer stops with an error that its input plus the requested output exceeds the model's context window: when the window is nearly full, Muse asks the model for a shorter reply instead
• A workflow cancel that hits a session storage error is now refused with a reason by muse serve instead of failing with an internal error
• A message sent or queued while the agent is busy no longer shows "steer failed" and comes back to the input box when the agent is slow to confirm it; it stays queued and is delivered once
• Sessions interrupted during startup now reopen normally instead of failing
• Session index no longer rewrites itself forever and hangs shutdown when the sessions folder is under a path that is not valid UTF-8
• Terminals that show program status (OSC 7501) now return to idle when a scheduled or other background turn completes after one of your turns failed, instead of showing that old error again after every background turn
• Resuming the same Workflow preserves the user's token limit
• Preserve background agent recovery after compacting and reopening a session
• The "session log flush degraded" note at the end of a turn no longer goes missing when a save failed earlier in the turn and the turn then sent a video or settled a tool approval that waited across a restart
• Show answers from /goal resume without reopening the conversation
• Pausing a workflow no longer reports unfinished background work as a missing result
• Message approval previews preserve comparison operators and underscores
• Forking a resumed session that has a goal no longer fails when the session compacted in the middle of a turn
• Compacting a session whose recent turns hold many full-size images, such as screenshots, now saves its checkpoint in most cases instead of skipping it, so the session can resume from that point; the compacted context keeps up to about eight recent full-size images as they are; older images, and a single batch of more than eight, are summarized

Performance

• Resuming a long session uses less memory, because each tool-task record kept in memory is smaller
• Reduce reply display delays after resuming sessions with long subagent histories
• Resuming a session with many finished subagents uses less memory and does less work when it first reads each of them, because a finished subagent's tool history is no longer copied into the bookkeeping that tracks subagent attempts

1.4.15

New

• muse sessions --json lists the sessions running on this machine, with who opened each one and whether it can be attached; muse sessions --watch --json keeps printing the list as sessions start and end
• Several clients connected to the same session host can now drive one session together: each session/resume joins as a co-driver instead of refusing sessionInUse, submissions run one at a time in order (a busy submit queues unless it asks to steer or replace), and driveHolder names the earliest live driver
• Send messages to running Muse sessions from the command line, including from the session itself
• Session protocol serves turn/modelAttemptStarted each time a model attempt starts, before the provider is contacted, so apps can show the model as thinking only once it is working; in the TypeScript SDK, ViewEvent and StaleDroppableMethod gain turn/modelAttemptStarted, so code that matches them exhaustively needs a new case
• ItemKind gains subagentInput — session-protocol clients get one item for each input a session sent to a subagent, when it was queued and when it was delivered, and a delivered subagent result names the row its Finished marker follows, so a client can show those rows in record order on resume
• The agent now leaves a notice when it creates a goal or a cron job for you, and /cron lists and removes your scheduled jobs
• The TypeScript and Python SDKs can now list a session's tasks, skills, and hooks, pause and resume workflows, request a recap, submit feedback, open a side chat, and search stored sessions without raw protocol calls
• Session protocol reads of a forked session now report whether it came from a conversation rewind (forkedFrom.isRewind)
• muse attach --stdio <SESSION_ID> [-- <serve flags>] connects a client's stdin and stdout to the host that holds a session, starting the session's own host with those serve flags when none does (except --trust-workspace, which a started host does not take), the same way locally and over ssh; it exits 4 when a TUI, muse exec or an older muse already holds the session
• muse serve --per-session serves each connection from a fresh host of its own, which lists its sessions so another client can open and steer them with muse attach --stdio <id>; answers and notifications match plain muse serve, except that the host keeps running after your input ends (so no session/closed arrives) and its own diagnostics go to a log file instead of stderr; it does not take --trust-workspace
• Settlement is refused only while a live driver holds the session: an attached observer's turn/unqueue, approval/decide, and userInput/* settlement refuse sessionInUse (naming how to join the drivers) while another live driver holds, and settle without taking drive once nobody drives, while observing prompts and replaying settled commands stay available
• The TypeScript and Python SDK clients can send protocol commands the SDK does not wrap yet with client.command, which refuses the commands the SDK manages itself
• muse mcp list and muse mcp get show configured MCP servers with their source, transport, and sign-in status
• The TypeScript and Python SDKs can now run a turn in one call with session.run, which returns the final answer text, the turn's items, and its token usage, and stops the turn on an abort signal or task cancellation
• muse attach <session-ref> opens this terminal attached to a session that is already running, as a second driver on the same timeline; unknown, ambiguous, not-running, and not-attachable references refuse with the reason and open no terminal
• A client connected to muse serve over the session protocol can now list a session's subagents (running and finished) with ids, definition paths, parent, state, and result readiness, instead of parsing parent-stream child records
• Sessions served by muse serve now remember the recovery mode a client picks when starting or resuming them, and reading a loaded session reports which mode is in effect and where it came from
• Session protocol: a delivered subagent input item now carries deliveredBeforeTurnEnd: true when the subagent took that input before its parent's turn ended, so a client resuming the session can tell an interrupted turn from a finished one
• muse mcp add and muse mcp add-json save MCP servers to user settings or the project file
• muse mcp remove deletes MCP servers from user settings or the project file
• When a command asks to run outside the sandbox, its approval prompt now offers "Always allow outside the sandbox in this workspace" for that command, so later runs of it there skip the prompt; an older Muse version can't resume a session that showed this choice until it updates
• A session's peer-message history index is now a file inside the session folder, so a session folder copied to another machine resumes without rebuilding it
• muse serve clients can run one model completion with no session, cancel it, and get its text, stop reason, model and token counts
• A session protocol subagent item now names the subagent whose own session spawned it (parentSubagentId), so a client can file a nested subagent under its parent instead of under the root session

Improvements

• After a plan, the reply now says in plain words that nothing has changed yet and that you can reply go to start or say what to adjust
• Clarified instructions for reading prior reports in Workflow children
• Read long text lines in full when they fit the output limit, with byte-range guidance for larger lines
• On muse serve --listen, only the client driving a session can change its approval mode or permission profile; other connected clients get drive_required and can take the drive with session/resume once the driving client disconnects
• Workflows can read complete results from finished workers
• The resume picker preview of a long, compacted chat shows its recent conversation, the same history you see after resuming
• Compaction checkpoints keep answered questions and approval choices in a smaller form that holds no answer text; chats whose checkpoint holds one require a compatible app update, and older versions cannot open them
• When Esc pauses a goal, the pause notice now stands out, the status bar and one reminder after your next message name /goal resume, and /goal lists the commands you can use
• /hud can show the current session ID in the bottom status bar, the same ID /status reports
• Paging back through a compacted chat over the session protocol now ends at one earlier-conversation item, as reading the chat does, and an older cursor before it answers that the view was truncated
• /feedback uses the compressed upload that keeps sessions of up to about 760 MiB from the first launch, without waiting for Muse Code to fetch its remote settings
• Incoming session messages now reach the client when the session protocol client is on: pending queue rows show the sender, effect label, and body, and delivered messages appear in the transcript, matching the classic client
• In the muse serve session protocol, a finished workflow now lists its agents in the workflow's own order rather than the order they started, so every client numbers them the same way
• Session protocol now streams the model's narration between tool calls as it is written, like final answers; saved chats do not change, so older versions still open them
• The resume picker's comfortable view (ctrl+o) now explains why workspace status is unavailable — whether the workspace is not trusted, the probe sandbox is unavailable, or the status check failed — instead of silently omitting it; the default dense view is unchanged
• Session protocol now marks a streaming message as narration or as the answer from its first word, so clients can show narration as narration while it is written; clients that ignore the mark see no change
• The TypeScript and Python SDKs find muse on PATH when you do not pass a host path to spawn, and say what they searched when no host is found
• Confirming a conversation rewind now shows "Preparing rewind…" right away, and the action rows stop showing a selection, so it is clear the rewind is underway before the server answers
• When a waiting background notice keeps being refused its wake-up, the saved session now notes which hold refused it, so a stalled helper can be traced; an older Muse build cannot open a session holding this note, so update the app to open it (other sessions are unaffected)
• Muse Code no longer updates a shared task (its status, plan, or fields) just because the task's own text or agent hints tell agents to; it does the work you asked for, then offers the update and waits for your yes
• When you ask Muse Code to empty a directory or clean up files, its final answer now names what it removed and flags anything that looked unrelated to the task, such as another repository or a symlink into one
• The TypeScript and Python SDK quickstart and cookbook recipes now teach the high-level client (MuseClient.spawn, startSession, session.run, turn.cancel(), setModel, listModels) instead of raw session protocol calls
• A resumed chat whose saved view is damaged heals it from the log; a forked chat, which is not rebuilt, reports projectionRebuildFailed right away; health frames coalesce so the client sees the final state once
• A loaded chat whose live view fails closed is re-loaded once from its log (weak registry hold, no reopen); a failed re-load announces projectionRebuildFailed once
• After a healthy view-health signal, the client re-reads the view and adopts the turn state, skipping rows it already rendered
• When the agent reads an image file, it now also sees the image's width and height in pixels, plus the original size when the image was scaled down, so positions it gives in pixels match the image
• When you ask Muse Code to empty a directory or clean up files, it now lists what is there first, deletes what belongs to the task, and asks before deleting anything that looks unrelated, such as another repository, a symlink into one, or data; without your answer it keeps those items and says so
• Bug fixes now get a focused failing test for each reported defect, and the regression test also covers the inputs the fix claims to handle beyond the reported one (another position or order, extreme or boundary values, and input rules the request restates), still without new test frameworks or extra full-suite runs
• When you tell Muse Code about something the repository cannot show, such as a migration or a deployment that already happened, it now works from what you said, updates repository defaults that still point at the old setup, and remembers it in later turns instead of asking you to repeat it
• Session discovery now lists up to 128 local and Claude sessions, up from 64; each machine still makes at most 64 of its live sessions discoverable until a later release raises that limit
• Automatic Windows sandbox setup at startup now first explains the two local Windows accounts it creates or updates and what each one runs, then asks Yes or No; No exits without changing anything
• When the only thing left is a background job the agent started, the turn now ends instead of the agent polling it; the job's completion or stuck-job notice wakes the agent to finish
• When an answer compares many items on short numbers, such as estimates for several funds under several scenarios, Muse can now show them in one wider table that still fits a normal terminal instead of splitting them into narrow tables
• The terminal UI now switches between light and dark themes when your terminal does, while a session is running, in terminals that report it (such as Ghostty, kitty and Contour), unless you set a fixed light or dark terminal background in /theme
• Saved chats can now record that an approval is still being applied, so it settles exactly once after a restart; earlier versions can't open a chat that holds this record, and updating fixes it
• When you ask whether something already built behaves correctly, the agent now checks each observation against the source the project follows, fixes only what is wrong, and keeps behavior that is correct, explaining why instead of removing it
• When you ask for a 3D web page and the machine has no browser, Muse now installs a headless browser with the system package manager to check the page itself, and says plainly that the page was not run only if that install fails
• When the agent reads a file with Windows (CRLF) line endings, it is told so, which makes it less likely to switch the line endings when it rewrites the file
• On Windows, the agent is guided to write PowerShell commands such as Select-String and $env:NAME = ... instead of Unix commands such as grep and export, which PowerShell does not have
• Muse Code keeps closely linked facts in one sentence, so fix and build summaries read as connected sentences instead of one fact per line
• While a goal waits on something outside the session that ends at a known time, such as a soak or a cooldown, the agent schedules a one-time wake-up for just after that time instead of only snoozing
• Saved chats can now record that the 3D generation service accepted a job, so its job ID is not lost if the call is stopped; earlier versions can't open a chat that holds this record, and updating fixes it
• Resuming a session over the session protocol with a modelId now records that model the way muse resume --model does, and a model the host refuses keeps the session on its saved model instead of failing the resume
• MCP servers and hooks now get your proxy settings (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY), as other apps do
• When more skills are installed than the skills catalog can list, built-in and prompt-named skills keep their full descriptions first and more of the other skills are left out to make room
• A Muse build older than this release cannot open a chat in which a newer build resumed the session automatically after a crash and told the agent what was interrupted. Updating the app fixes it; other chats are unaffected
• When you ask for a 3D web page in a sentence or two, Muse now checks it in one light pass (a desktop run, one input test, a fix and a final run) instead of its full review rounds, so short requests finish sooner; detailed briefs still get every check
• Usage telemetry now trusts the certificate authority file set in telemetry.ca_bundle, so it keeps working on networks that re-sign TLS traffic with a company root certificate
• Session-protocol clients: view cursors are now minted in the v9: spelling; a cursor in an older spelling is refused once with the standard "reopen without a cursor" guidance, and a view cache saved by an older build is rebuilt on first use, so no client silently skips or misreads events
• When muse serve refuses a request to interrupt, stop, resume, reopen or close a subagent, the refusal now names the exact reason (for example owner_not_running or attempt_history_unavailable) instead of one general reason
• A resumed session's snapshot now carries each Monitor's recent output lines, including the ones already delivered to the model, so a client shows the Monitor's tail right after resuming instead of an empty one
• Muse follows your requests more closely: it answers a direct question first, keeps working when you send a question or remark mid-task, does not stop while a change you asked for is still unmade, asks its remaining questions before building on a partial answer, removes extras instead of hiding them when you ask it to simplify, asks you at once when a login only you can renew blocks the task, and no longer works around a download the environment blocks or a package index that fails its certificate check
• Muse Spark 1.3 at max reasoning effort now gets the same full base instructions as every other model and effort, including the newer answer-style and grounding guidance
• Through muse serve and the SDKs, stopping a subagent that has already stopped now answers subagent_already_stopped instead of subagent_state_ineligible, so a client can tell that race from a failed stop
• Over the session protocol, a refusal caused by a session log deleted or replaced outside Muse now carries the error reason session_log_lost when resuming, sending or steering a message, compacting, renaming, forking, opening a side chat, leaving, controlling a subagent or workflow, or choosing an approval that saves something for later, so a client can recognize it without matching the message

Fixes

• Security: In muse serve, subagents and workflow agents now use the same approval mode as the session that started them, so an allow-all session no longer prompts for its subagents and a deny-unmatched session's workflow agents deny instead of asking
• Security: Sessions in workspaces the user has not trusted no longer start any MCP servers. Startup withholds every configured server, shows one notice naming the withheld count and reason (project-scope servers are withheld unread, without being listed), and /mcp marks each knowable withheld server as "withheld: workspace untrusted". Trusting the workspace starts them on the next session
• Security: Sandboxed Linux commands can no longer redirect their own approved network connections to a different local service than the one you approved
• Security: A ! shell command run in a session that muse serve hosts can no longer write the folders where Muse keeps its client credentials and settings
• Security: In an untrusted workspace, the agent now asks for approval before writing to memory, showing what it wants to save, instead of running silently
• Security: Sandboxed Linux commands can no longer redirect another concurrent command's approved network connections to a different local service than the one you approved
• Security: A Meta API key after Bearer or Authorization: token, such as in a printed curl -H command or a provider error, is now hidden whole from the model, session logs and error output
• Security: When a command running in the sandbox asks to reach a new host, Muse now asks for your approval before looking the hostname up, so a declined host is not looked up; only localhost names are still looked up first, to confirm they point at this computer, and a hostname that does not exist now also asks for approval before it fails
• Security: A tool call's shell argument can now select only bash, zsh or sh (PowerShell or pwsh on Windows); any other value runs the default shell, so an approved command always runs under a shell you expect
• Security: On Linux, sandboxed commands and file tools can no longer read sign-in details or settings in ~/.config/muse and the other settings folders through a second mount of the same filesystem, such as WSL's /mnt/wslg/distro or a home folder bind-mounted at a second path; on such a computer a subagent started before updating can lose its work tools when it continues after /resume, and a command that walks that second mount reports the settings folders inside it as unreadable
• Security: Muse no longer trusts its local session registry folder, or the startup folder of a session's own host, when it sits inside a folder another local user owns; that user could swap in folders of their own, and on a shared Mac change what is inside through folder settings
• Security: A session's own host no longer starts through a folder link that another local user owns, even one reached through another link, since they could swap the link and move the host's files
• Security: When your data folder's path is too long for its own socket, muse attach --stdio and muse serve --per-session now start their host under /tmp/tbh-<uid>-rt only when that folder is yours, mode 0700, and not a link (they create it when it is missing); otherwise they stop with an error that says how to fix it
• Security: /feedback now removes more kinds of secrets, such as passwords in connection strings, authorization headers, JWTs and common API key formats, from your note, the recent activity, crash reports, the screen snapshot and the configuration snapshot before upload. Text that follows a secret-looking label, such as token: or password:, is hidden too, so a note titled "Auth token: refresh loop" is filed as "Auth token: [REDACTED]"
• Security: A host that muse attach --stdio or muse serve --per-session starts now refuses a startup file that something changed after it was written, so another session cannot alter what the host starts with
• When a subagent's result arrives on its own while the parent agent is doing other work, the parent is now told where to read the subagent's whole answer instead of only its first 512 characters
• A recovered subagent's child view now shows its retained result after an explicit result read instead of an empty result slot
• Model list no longer shows saved models the server does not serve
• A chat whose compaction keeps failing to save its checkpoint no longer pays for a new summary on every request; after 2 failures in a row Muse stops automatic compaction for that chat, shows one error naming the cause, and tries again when you reopen the chat or a compaction works
• A session parked waiting on watched external work now resumes when a watcher change event or a background task completion arrives, instead of staying on Working until interrupted
• Moving another file onto session-index.db while Muse Code runs no longer shows the replaced file's sessions (unless another program has the new file open at that moment) or crashes the app
• In the classic Windows console, such as a plain PowerShell window, the prompt and status symbols now show as readable characters instead of boxes with question marks
• A turn keeps working after a long-running command it was polling completes
• Retrying a queued turn that restart recovery abandoned now reports it as abandoned instead of looking still queued
• Background work status results now tell the agent that completion arrives automatically, so it stops repeatedly checking status while a long command runs and waits for the delivered result instead
• Late background updates keep stopped Monitors labeled as stopped
• A fork reopened after it compacted no longer re-reads its whole history each turn, so damage in older history no longer stops it
• A muse serve chat whose saved view fell behind its latest compaction now rebuilds that view from the compaction point when it is next opened, instead of re-reading the whole session log; earlier history shows collapsed behind the "earlier conversation restored from checkpoint" divider. If the records after the compaction point are damaged, the chat still opens and keeps working, starting from its newest message instead of refusing to resume
• Opening a chat whose saved permission change was lost now shows the reset permission level when a resume would commit a reset, instead of the older, wider level. When the reset is refused or cannot be decided, it keeps showing the surviving level
• Resuming a forked session no longer sometimes fails with a log-replay error that forced a recovery session instead
• A monitor that stops itself for noise, timeout, or a closed stream now always records its stop reason in the session
• When /feedback has to shorten a long session record twice to fit the upload, the notice after sending now shows the kept and dropped sizes of the record that was actually sent
• Resumed forked sessions keep the grouped Ran commands card instead of expanded raw output
• Moving a larger session index onto session-index.db while Muse Code runs no longer leaves the session list failing as a corrupt index
• A chat whose newest compaction checkpoint belongs to a cancelled turn now refuses to resume, read, or fork with a clear error instead of reloading history from before the checkpoint; use muse export to recover its log
• A compaction no longer leaves its checkpoint unwritten when the saved chat view is momentarily behind; the checkpoint is saved and the view catches up or is rebuilt from it the next time the chat is opened
• A reminder whose duty names a tool that does not exist, or has a malformed tool token, is now turned off when the session starts, with a notice in the TUI and in tbh exec output that names the reminder and the token and says how to fix it, instead of failing silently each time it would run (under tbh serve it is turned off without a notice for now)
• Two Muse Code processes that recreate a deleted session index at the same moment no longer lose one side's first writes
• A session parked waiting on a Monitor watcher now resumes on that watcher's change lines even when the watcher was started by the canonical Monitor path, instead of staying parked until interrupted
• Reopening a compacted conversation no longer runs completed queued messages again
• A session that paused to wait now resumes when its background task finishes instead of staying stuck until you intervene
• Running /compact in a long session with a saved context checkpoint no longer freezes the terminal for tens of seconds and then fails with "no compactable run is available"
• Replies that switch into another script (such as Chinese characters) mid-task are now retried once so progress text stays in your language
• A fork or side chat of a fork that has compacted starts from that fork's newest checkpoint instead of re-reading its whole history
• Parallel tool calls start their hooks without waiting for each other
• A resumed command with an unrecognized result status no longer shows as succeeded
• Agent acts on a finished background task instead of waiting for the next message
• Cancelling or steering a run waiting on a covered external wait now takes the cancel or supersede exit instead of reporting an error or resuming
• session/read on a subagent's session no longer keeps showing its worktree as active, or a delivered input as queued, when the parent recorded the change during an earlier read
• A tool call that finished just before a crash no longer keeps its settled row after resume; the resumed view marks it — unresolved so an uncertain outcome is never shown as settled
• Subagent guidance now tells the parent agent to fetch a truncated child answer itself instead of spawning a reader, to poll long waits without a fresh watcher subagent per round, and to stay silent instead of posting a status update every time a subagent returns with nothing new to report
• Typing into a prompt you recalled with Up no longer throws away the message you were writing; the recalled prompt shows · edited next to its history position, and Down or Esc brings your unsent message back
• Over the session protocol, a reread or resumed compacted chat no longer keeps showing restored earlier messages from a turn that was taken back
• File edits in Windows-style (CRLF) files now match multi-line text written with plain line breaks and keep the file's CRLF line endings in the replacement; a failed edit says when only the line endings differ
• A forked chat that opened in the terminal but failed to load elsewhere now opens in all clients
• Background work waits no longer loop on repeated status checks that burn turns
• Answers and other tool results that mention bearer tokens in plain words, such as "JWT bearer tokens", now reach the model unchanged instead of showing a redaction marker the model could copy into code; real bearer credentials are still hidden
• A resume whose load quarantines a corrupt cron database now reports it on session/resume, so the client shows the warning row once
• A parked run resumes when the watcher task it waits on finishes
• When the same plain model failure stops two turns back to back with nothing shown between them, it now appears once while the session runs, as it already does after a resume
• Built-in skills you start with a slash command now name tools the way the model is offered them, so it calls them by the right name (not yet with --no-session-log)
• Built-in skills that a custom agent preloads now name tools the way that agent's model is offered them, so it calls them by the right name
• The SDKs no longer list a question from a turn that already finished as still waiting for an answer after a resume
• Default Light theme: darker secondary, success, warning, accent and stroke colors for readable contrast on white
• Forking a session, or opening a side chat from it, no longer fails with "invalid_target" when the session compacted and later saved a checkpoint while catching up
• Research workflows use complete large results through verification and report synthesis
• Sessions started on standalone muse serve with a plain session/start now get an automatic name, served on session/read at start and after the first turn, like the TUI's embedded host
• A Workflow whose script already finished no longer fails because one read of its records failed briefly while its final summary was being built; it retries for a short while, and a read that keeps failing fails the Workflow with a reason saying its records could not be read
• A finished background task no longer starts a second agent turn beside one that is still working, which refused compaction checkpoints
• The quota pace offer ("You're using your quota fast") now appears in sessions on the new TUI client just as in classic sessions, instead of never showing
• A chat no longer compacts early just because a background detail such as its session name was filled in after the first reply; the context-size estimate now counts only what actually changed
• Background-task results and monitor events queued while the chat sits idle are delivered without waiting for your next keypress; a parked end-of-turn wait no longer strands them for hours
• A session whose saved history no longer matched its live record of a turn now keeps saving compaction checkpoints instead of failing every attempt until a restart, so it still resumes from its latest compaction
• An image wider or taller than 2048 pixels, up to 6144, sent over the session protocol, such as a full-screen screenshot, is now resized to fit 2048 pixels before the model sees it, as in the terminal app, so apps can show its thumbnail in the sent prompt and rewind and resume keep the image
• A rotated phone photo that is resized or re-encoded before the model sees it, because it is over 2048 pixels or 2 MiB, now stays upright instead of turning sideways
• On a store kept on an NFSv3 mount, a chat's history in muse serve stays readable after a restart instead of being reported unavailable
• Workflow reports retain earlier results after a subagent follow-up
• Running /compact keeps its progress indicator visible while the summary is being prepared
• Resuming a compacted session whose last turn was taken back now shows the conversation since the last compaction, as the other clients do, instead of replaying the whole log or showing the taken-back turn's summary
• When a finished background task wakes the agent, the waiting turn now ends first, so it cannot resume beside the new turn and block its checkpoints
• After a crash and resume, orphaned background monitor calls now revise to "Review … unresolved" like other orphaned tools instead of keeping their pre-crash settled text, and the revised row keeps its duration stamp
• Long sessions that run Workflows nonstop keep saving their resume checkpoints. A checkpoint no longer keeps every finished child of a Workflow that has ended, which grew it until saving failed after about 2,000 children. Asking a child of a long-finished Workflow for more work now explains that the Workflow has ended. Opening a session compacted this way needs this app version or later
• /goal resume now starts the resumed turn when it is sent while a turn or a !shell is running, or at the moment the goal reminder pauses the goal; before, the goal could show as active while nothing ran
• Long tasks no longer stop early after announcing the next step; shell commands that already finished no longer block the agent from continuing
• view/subscribe from earlier history of a session whose latest compaction belonged to a turn that was taken back now refuses with the same error as reading the session, instead of pointing the client at a cursor that gives the same answer again
• After you store a different API key or sign in to another account, a restarted muse serve lists that credential's models instead of the previous credential's saved model list
• Side chats opened by session-protocol clients keep the workspace, model and MCP tools of the session they branch from
• Apps connected to Muse Code no longer show a hook that blocked a prompt as a rejection when that block never took effect
• After starting a long command in the background, the agent ends its turn and reports the result when it finishes, instead of sometimes waiting up to five minutes and missing the finish
• Resuming an older session from a connected client no longer drops an earlier completed turn from the model's context, or names it as unreadable, when a leftover restart followed it
• When the model catalog service answers with no models, the app now reports the catalog fetch as failed instead of silently emptying the model list
• /rewind no longer offers points from before a compacted summary in older sessions whose summary cannot start a branch; the points after it are shown as unavailable instead
• On macOS and Linux, a damaged saved-session index is now set aside and rebuilt automatically, so /resume no longer stays slow until the file is removed by hand
• The terminal now redraws the chat area when its window regains focus, so a garbled frame recovers instead of staying broken
• A forked session keeps its folder, model and provider in the session list after its first turn, instead of being listed with none
• Commentary and tool text that flips into French, Spanish, or Indonesian during an English session is now resampled like foreign-script flips
• Reading a very large session through muse serve now returns its details with pageable history instead of failing with "response exceeds the outbound frame limit"
• Preserve session recovery state when saving the next checkpoint
• Resuming or forking a session whose last turn was taken back after it saved a checkpoint without compacting now continues from the previous compaction, instead of refusing the session or replaying the whole log
• Standalone muse serve generates session titles when automatic naming is on
• Reopening a session no longer makes the agent start a turn by itself to react to a background command that quitting had stopped. The reopened transcript then shows the command as backgrounded, with no finished row
• Paging back through a session that was compacted under an older version now stops at the earlier-conversation summary once the session has been read, as reading it does, instead of showing the history from before the compaction; after a new turn, that history can still appear until the session is read again
• A file link whose label is its own absolute path now shows that absolute path in the TUI transcript instead of shortening it to a workspace-relative path, so asking for a file's full path gets the full path
• A session no longer becomes unreadable ("MalformedJsonl") after it compacts its context while a turn and a background task's follow-up are running at the same time
• Resuming a chat from a saved position after view/unsubscribe no longer sends an event twice when a change lands while the resume is reading history
• A session started with /goal is no longer named after Muse's hidden goal instructions in /resume and in apps that list your sessions; it shows your first prompt, or no title until you send one
• After resuming a long session, a new agent can no longer reuse the name of a child from a long-finished Workflow under the same parent. Before, the resumed session allowed the name while the full session history refused it. Opening a session that holds such a name needs this app version or later
• A session waiting at the end of a turn now wakes when a result arrives that would wake an idle session, such as a failed background command or a message another session sent to wake it, including one that arrived just before it began waiting for background work, instead of staying on Working until you type
• A session reopened after the previous process stopped in the middle of a batch of tool calls now keeps saving compaction checkpoints instead of failing every attempt, so it still resumes from its latest compaction
• Built-in skills you start with a slash command in the terminal app now name tools the way the model is offered them in every session, including ones started with --no-session-log
• A checkpoint records its foreign-prefix length, so resume of a log with foreign lines below the checkpoint no longer refuses on the ordinal check
• Stopping a subagent after another message now ends its running work instead of only marking it cancelled
• An active /goal keeps working on its own after a reply that did not continue it, instead of waiting for you to send another message
• Resuming a session saved by an older version whose last turn was taken back after it wrote a checkpoint without compacting now continues from the previous compaction instead of refusing the session
• In muse serve, a resumed or forked chat whose saved reasoning effort is ultra now runs at xhigh while ultra is unavailable, as a newly chosen ultra already does; the saved choice is kept and applies again once ultra is available, unless you set the effort again in the meantime
• When Muse dies on a memory fault (for example a disk that fills up mid-session), your terminal is put back to normal instead of being left without echo until you run reset
• After a chat reopens from a crash, queued follow-ups and background results now wait for your next message instead of starting a reply on their own
• Resumed sessions keep the Workflow tool again, including sessions saved by an older version; when a session's saved Workflow version can't be used, it uses the version a new session gets instead of asking you to start a new session
• A browser game built on a remote machine now hands off an SSH tunnel command with its local URL, so you can open it from your own computer
• Several muse serve processes sharing one data folder no longer grow the session index write-ahead log by about one index size every few seconds, which could fill the disk
• In long turns, skill, memory and to-do suggestions now still see your latest request, so a suggestion no longer contradicts it, such as adding tests when you only asked for an explanation
• A session an app or SDK starts with a chosen model keeps that model in session lists and after the host restarts, instead of switching to the host's default model
• Settings, credential, and trust files larger than 16 MiB are now refused with an error instead of being read into memory whole
• When one agent in a Workflow cannot confirm that its start was saved (for example, because the disk is full), the Workflow's other agents now keep running instead of being stopped
• /goal resume in the terminal now puts the goal back to paused when the resumed turn then fails to start for good, so another /goal resume can start it; before, the goal could show as active while nothing ran
• When a finished background task wakes the agent after a resumed goal turn, its result now waits for the next turn instead of running beside it, which refused compaction checkpoints
• A session waiting at the end of a turn no longer stops waiting early because of a message from another session that it already read during that turn
• Keep Monitor stop status tied to its source session after a rewind
• Paging back through a compacted muse serve chat now stops at the earlier-conversation summary from the first page when its view was rebuilt, and for a chat compacted under an older version it keeps stopping there after a new turn once the session has been read
• File paths with apostrophes display correctly in /rules
• When you tell the agent to stay inside one folder, it keeps its throwaway test scripts there instead of writing them under /tmp
• A session you fork or start through muse attach --stdio beside the one it opened is now listed by muse sessions and reopens on the same host with muse attach --stdio <id> while that host runs
• A background compaction summary that finishes while an internal turn is already running now installs after that turn ends, instead of mid-turn where its checkpoint was refused
• Pending message batches keep sent messages marked as sent when delivery remains unconfirmed
• session-message send reports success after a Linux session accepts the message
• Sending a session message no longer stalls while another session updates the session list
• On Linux, messages sent from inside a session now show as accepted instead of unverified
• Several muse serve processes sharing one data folder no longer rewrite the session-name list in the session index on every maintenance pass, so session list subscribers stop getting a change notification every few seconds
• Sending or resuming a session no longer fails with "projection failed: tool-result clear entry did not match" when a stored clear record matches no result or matches more than one; the bad entry is skipped and the session continues with the old output left in context
• The /resume preview of a session a /goal drove no longer shows Muse's hidden goal prompts as your messages
• Resuming a session with a side chat no longer fails
• Worktree sessions load project skills, rules and hooks from the worktree copy, so edits there take effect and skill files stay readable
• Opening an older, never-compacted session from a connected client for the first time no longer reports a stale runtime_turn_task_lost failure from a leftover restart as its last turn
• muse serve now frees a session's memory when the session is left or unloaded, so a long-running server no longer grows with every session it has served
• Scheduled and background wakes queued while the agent is idle no longer wait for your next message after a lost wake-up signal — the runtime re-queues the wake itself once the blocking state clears
• A muse serve chat that was compacted and has an unusable saved view (unreadable, or left as a terminal marker) now builds that view from its latest compaction point when it is next opened, instead of re-reading the whole session log; earlier history shows collapsed behind the "earlier conversation restored from checkpoint" divider, and records missing or damaged before the compaction point no longer stop the chat from opening
• Resuming after successful context compaction no longer shows a false interruption warning
• Show MCP tool and server names while a call is running
• Resuming a chat with a lost record above a checkpoint reopens with permissions reset to defaults and a warning instead of refusing
• When you dismiss or interrupt a question prompt, the agent now treats the unanswered questions as still open and asks about them again before building on them
• Recovering (muse workflows recover --apply) or resuming a workflow interrupted on Muse Code 1.4.5 or earlier keeps its finished agent calls, reruns the ones that were still running from the start, and says which model each rerun used
• Agent cards show the total number of tool calls
• Answering a pending question right after a crash resume works again: a submit that meets a full queue waits for the next drain instead of dropping
• A resumed subagent's turn now waits until a background task wake or a compaction install in its session finishes, instead of running beside it where compaction checkpoints were refused
• muse serve no longer sends "cost": null in a session snapshot's token usage before the first model reply, which made schema-checking clients reject the snapshot; an unpriced cost is now left out, as the protocol schema defines
• Fixed subagents failing when receiving a message after the parent conversation was compacted
• The TUI no longer occasionally runs one needless extra auto-compaction right after a compaction that happened during a reply, in a reopened session, or after a background task's reply
• On a Mac, when you ask for a link to a page Muse built, Muse now gives the file path or the start command right away instead of asking what to do, and says plainly when a server it started stops as Muse quits
• session/resume of a side chat now reports the chat it came from in sideFrom, as session/sideChat already does, and no longer reports it in forkedFrom; session/list now reports sideFrom: null for a just-opened side chat too, as it already does for every other session
• Subagent retries return the saved creation result when execution recovery is unavailable
• Fixed a task-history error that could prevent interrupted Workflows from resuming after a restart
• When the verify observer reviews a finished turn, it can now see the end of a long tool result, where a check usually prints whether it passed, as well as the result's start — so a task that already passed its check is less likely to be sent to verify again
• Paging back through a muse serve chat compacted under an older version now stops at the earlier-conversation summary from the first page after a resume, even when a new turn lands before that page
• A session resumed thousands of times, for example by repeated exec runs, no longer saves every resume's start records in each checkpoint, which had made its checkpoints too large to save
• Resumed workflow reports retain results completed before the pause
• When Muse fails to start because of a setting, the error a session shows now also says to fix the setting and start Muse again
• Prevent interrupted subagents from failing or repeatedly waking when background commands finish
• Keep compaction progress visible in reopened sessions
• muse mcp get and muse mcp list text failures now print the pending MCP warnings ahead of the error line, matching the --json stderr behavior
• In muse serve, a text message that starts or steers a turn on a stuck session that cannot take more commands now fails after 30 seconds with a busy error you can retry, instead of never answering
• In the TypeScript and Python SDKs, turn.unqueue() now always hands back the queued draft it reclaimed, whatever order the server's replies arrive in
• A long session no longer saves every past prompt's intake records in each checkpoint, only those whose message the saved conversation still holds, so checkpoints of sessions with thousands of turns stay small enough to save
• muse mcp list and muse mcp get fault reports now name the exact project file at fault and classify non-file settings paths correctly
• muse mcp list and muse mcp get report an error when repository markers cannot be read instead of silently omitting project servers
• In a short terminal, the rewind confirmation keeps its warnings and the selected action on screen, Enter no longer confirms an action the screen could not show, and a terminal too short for any action asks you to make it taller
• When a running session's log file or folder is deleted or replaced outside Muse while Muse is saving to it, Muse no longer starts a new log partway through or writes into the replacement. It says the log was deleted or replaced, stops saving that session and refuses new messages and setting changes there; run Muse again to start a new session. A lost log of another conversation, such as a side chat's, stops saving only that conversation. If the log file itself was moved away instead, Muse says so and saving resumes once you move it back
• After the session log is deleted or replaced outside Muse, answering an approval with allow once, allow for this session or reject still reaches the waiting tool and the turn finishes; once Muse has noticed the loss, a choice that would save a rule for later is refused and says why
• After a session log is deleted or replaced outside Muse, renaming the session, changing permissions or a setting, sending a message, /compact, /new, /clear, rewinding, and messaging, following up with, resuming or reopening a subagent from its view say so and what to do instead of a generic or misleading error, from the first thing you do after the deletion; a /goal change the running turn already received is no longer shown as still waiting to reach the model; leaving the session over the session protocol says so when its log was replaced; and muse exec no longer adds a second error at exit or says it flushed the logs when a signal stops it
• When a session log is moved or deleted outside Muse, turn and leave errors over the session protocol and the muse serve stop line say so and how to get saving back, /export trajectory says the log is missing and to move it back instead of suggesting --no-session-log, and /new or /clear held back by another conversation's moved log names it
• After a session log is deleted or replaced outside Muse, /fork and /side say so and start nothing, even when one is the first thing you do after the deletion; /resume into another conversation, such as a side chat, whose log was lost while Muse was saving it alongside this one is refused before it can stop the current conversation's running turn or background work; and when you leave a session whose log was lost, its notice says so and no longer offers to resume it, whether that session did not shut down cleanly or Muse stopped waiting for it to shut down, and the "To continue this session" line that /clear and /new show for it is removed when that notice appears
• When a session log is replaced outside Muse, or deleted on macOS or Linux, while a save to it is still unconfirmed, Muse now says the log was lost instead of reporting a failed flush every time, and another conversation's lost log, such as a side chat's, no longer holds back new messages, /fork, /side or new subagents in the conversation you are in
• While a confirmed conversation rewind is preparing, the exit key (Ctrl-D, or your remapped exit binding) works again: the first press shows the "press again to quit" hint on the rewind screen, and when work is still running the exit confirmation appears and Stay or Esc returns to the rewind
• When you ask for a plan in a file, the agent now saves it at the path you named (or a visible spot in your project) and replies with the link, a one-line verdict, and the key decisions instead of pasting the whole plan into chat
• On a Mac, after Muse hands you a file path or a start command for a page, Muse no longer goes back to start a hidden background server for it
• A host started by muse attach --stdio or muse serve --per-session no longer stops taking connections or ignores SIGTERM for as long as one of its sessions is slow to respond
• A model whose catalogue entry gives its context window but no output limit now shows in the model list, keeps that window for compaction, and uses the standard output limit
• Paging back through a muse serve chat compacted under an older version now stops at the earlier-conversation summary even when the session was never resumed or read since the server started, instead of showing the history from before the compaction
• On a short terminal during a running turn, the plan panel now folds to fewer rows instead of pushing the live status row (token use, when the HUD tokens field is on) out of view, so the current plan and token use stay visible together
• Prevent empty background notifications from adding turns or blocking rewind
• Terminals that show program status (OSC 7501) now see Muse as working while a turn started by a finished background task, a schedule, or another wake runs, instead of keeping the previous turn's done or idle state
• In muse serve, a message that runs a skill on a stuck session, or a cancel sent to a stuck session that cannot take more commands, now fails after 30 seconds with a busy error you can retry, instead of an internal error (skill) or no answer (cancel)
• A session reopened after the previous run was stopped while still saving now keeps saving compaction checkpoints instead of failing every one until the next restart
• After a resume, answering a pending structured prompt no longer silently drops your Enter when a stray key lands before the retry sends; the staged answer still sends exactly once
• Keep the compaction status visible after resuming a session
• Paging back through a muse serve chat saved by an older version now also stops at the earlier-conversation summary when that chat was condensed by a periodic history checkpoint, or by a compaction whose checkpoint was skipped, instead of showing the history from before the checkpoint
• Messages from hooks no longer appear as rows in the transcript; they show only as a brief status notice
• A resumed session whose scheduled job fires as its first turn starts now saves that turn's compaction checkpoints instead of skipping them
• When the agent checks on a command that is still running and the new output is longer than it asked to see, it now gets the newest output as well as the start, with a line counting the bytes left out between them, instead of only the oldest part
• On a Mac, when you ask Muse to keep a server running, Muse now says it cannot keep it running after it quits and gives the command to start it, instead of promising to look after it
• With many sessions running in their own processes, new TUI sessions and muse exec runs keep local session messaging: once only 16 of the 64 local session slots are free, sessions a program opens through muse serve --per-session (or as a further session over one muse attach --stdio connection) stop being listed in muse sessions instead of taking those slots, while each Desktop tab's own session, and the forks and side chats made on it, still register until all 64 are taken
• A background task or workflow that finishes during a turn that compacts its context no longer makes every later turn fail with "event id … conflicts with an existing event"
• Terminals that show program status (OSC 7501) now see Muse as working while it compacts context, starts a turn, or generates a recap you asked for, instead of the previous turn's done or idle state
• Scheduled prompts with an hourly or faster cadence now fire during both passes of the repeated hour when daylight saving time ends, instead of skipping the second pass
• Keep the compaction status visible after returning from a side chat
• A session saved by one Muse Code build can take new prompts when a differently compiled build reopens it, instead of failing to send with an internal error
• While a long command runs in the background, Muse no longer keeps re-checking its log file or process from new shell calls; it ends the turn for the automatic result or watches progress with the Monitor tool
• Checkpoint-carried fork seeds the loader must accept are no longer refused as mismatched: covered turns and carrier children count the way the replay mints them
• A host started by muse attach --stdio or muse serve --per-session whose last client left after a session stop timed out now exits once that stop finishes, instead of staying up until the session is unloaded for being idle
• Assistant replies stay visible in short terminal windows
• The Python SDK now derives its schema fingerprint from its wheel's bundled schema when imported from inside a source checkout, instead of the checkout's live schema
• A session whose reminder list was lost across a restart now reopens instead of refusing every turn
• Resumed subagents report a missing answer instead of empty success after exhausting their reminders
• When the server refuses a login because the Muse Code app is deactivated, the login panel now shows that reason and that signing in again will not fix it, instead of saying the API key is invalid
• Subagents are reminded to submit required results before reaching their step limit
• A subagent's view keeps its activity in order across parent turns, and a cancelled or failed attempt's result row no longer reads Result ready
• A long session no longer saves the approval history of every past tool call in each checkpoint, only approvals still pending, approvals that grant a session-wide permission, and those whose tool call the saved conversation still holds, so checkpoints of approval-heavy sessions stay small enough to save
• A session whose workspace folder was deleted mid-session now recovers on the next tool call instead of failing every tool
• Resuming a compacted session restores subagents that finished before the checkpoint instead of dropping their rows
• Compaction now works up to the model's real context window instead of stopping at 512,000 tokens, and when Muse cannot tell which recent messages a turn must keep and so skips compaction, a turn larger than the context window now fails right away with a clear "could not fit within the model's context window" error instead of being sent for the provider to refuse
• When a chat's own messages already fill the space compaction must keep, Muse no longer pays for a summary it would throw away on every request, and the compaction error names the kept messages as the cause
• Resumed sessions can continue after an unrecorded tool result, with the outcome shown as unknown
• Workflow retries that had started but were interrupted before their first model request now continue after a restart instead of being held back
• When a conversation rewind is refused before it starts (the command queue is full or closed, the request fails, or the server rejects it), the rewind screen now shows why instead of returning to its choices with no message
• A clean successor fork of a compacted session (its summary flattened ahead of the model's answer) is no longer counted as a mismatched seed: the answered summary is its context run, not a turn
• When muse attach --stdio gives up on a session host that is slow to start, the start log its error names is kept instead of deleted
• After resuming a session, a question the agent asked can no longer be answered twice, so the agent gets exactly one answer
• After a crash, reopening a chat in the terminal no longer starts a reply on its own — queued follow-ups and restored results wait for your next message instead
• In muse serve, a background compaction started at the soft context threshold is now applied instead of being thrown away, so served sessions usually compact in the background instead of waiting on a blocking compaction at the hard threshold
• Background task results, scheduled check-ins and watcher events no longer stop waking an idle session after a workflow worker finishes
• Reopening a chat no longer drops completed workflow turns after compaction
• Resuming a session after an interrupted compaction no longer fails when the leftover compaction records are large
• After you pause a workflow, later context compactions keep working instead of failing every time; if a paused workflow can't be kept in the saved context, Muse tells you it can still be resumed in this session but not after a restart
• While /goal works on its own, a progress reminder now comes after about 30 model calls without reported progress, as designed, instead of about 15, because each call is counted once
• Scrolling back through earlier output with the mouse wheel or trackpad works again while a session runs; clicking in the input no longer moves the cursor
• When one Workflow worker's results can't be claimed, background updates for every other session, its parent included, still wake an idle session; only that worker's update waits
• With a goal reminder active, when the only thing left is the result of a watcher the agent started on a long job, the turn now ends instead of the agent polling; the watcher's notice wakes the agent to finish
• On a Mac with a locked Keychain, such as over a remote login, signing in now says to run security unlock-keychain and restart Muse Code, with the Keychain's own error code, instead of showing only an internal code
• The desktop app now shows the saved history of a conversation that Muse Code 1.4.9 to 1.4.14 still has open in a terminal, instead of an empty history
• In muse serve, a background compaction whose summary finishes while the next turn is running is now applied when that turn ends, instead of being discarded when that turn starts its own compaction
• A host that muse attach --stdio <id> starts now lists that session from its first session/list, with the session that opened it (spawnedBy), even when the session's previous host exited before indexing it
• Terminals that show program status (OSC 7501) now see Muse as waiting for you when a turn ends by asking a question in plain text, instead of done
• Sandboxed commands and hooks no longer fail at random with "Can't find source path" while another sandboxed process in the same workspace exits
• In a terminal pane only 5 or 6 rows tall, the end of a turn no longer leaves a blank-looking session: the last line of the conversation stays visible above the typing area, so a session with history no longer looks like a fresh start
• Keep Goal recovery usable when compaction leaves a paused workflow behind
• Over the session protocol, resuming a session the host still has loaded after its log was deleted or replaced outside Muse now refuses with a message that says so and how to go on, instead of answering that the session was not found or resuming it as if its log were intact
• When /feedback or /bug cannot upload because there is no Model API key, the message now says how to get the report sent: set a Model API key so /feedback can send it, or, as a Meta employee, use the internal Muse build
• Workflow workers no longer get a background-command reminder queued while their turn is still running, which could stop them from submitting their result
• A hosted session no longer skips a compaction checkpoint after a subagent's write to the same session file recovers from a disk error
• Code blocks inside quotes keep their indentation and highlighting, and their fence lines no longer show
• Through muse serve and the SDKs, stopping a subagent that another subagent started now stops it instead of failing
• Avoid a false active work warning when quitting a resumed fork
• A periodic context save that fails, for example on a storage error, no longer ends the turn; the save is skipped with a note of why and the turn goes on, and a save whose cleanup of older history fails still counts as saved
• After a crash, a ! command that had not finished is marked cancelled with a note that it may have run, instead of an empty result
• When queued background work cannot be started, the failure is now written to the local diagnostics that /feedback sends, and to the terminal outside the full-screen view, instead of being silently dropped
• A chat keeps the name saved in its own history when you open it, even if Muse's separate list of names has lost it; before, it could get a new automatic name and muse resume <name> stopped finding it
• Truncated shell output keeps its correct total size when output arrives slowly
• Over the session protocol, resuming a session that a client had left with session/leave no longer reports that its last run ended abnormally
• Sandboxed hooks and commands no longer fail at random with "Can't find source path" when another sandboxed process in the same session starts or exits
• Stopping a paused workflow now still reports the stop after Muse restarts
• On macOS, pasting a screenshot with Cmd+V now attaches it in terminals that send an empty paste for images, such as VS Code and Cursor
• Right after an upgrade, muse attach <session-name> now waits for the session index to finish reading session names (it prints "indexing session names after an upgrade..." while it waits, as muse resume <name> does) instead of refusing that the session-name authority is unavailable; before, every retry refused the same way
• Reading a forked or rewound conversation over the session protocol now shows the messages you sent in its copied turns that were missing before: each message of a turn that began with several, a message with an image, and a message you sent while the original turn was still working
• Terminals that show program status (OSC 7501) now see Muse as waiting for you when a quick turn ends on a plain-text question before Muse confirms your message, instead of done
• A long muse exec session that resumes for every prompt no longer stops saving its checkpoints after a few thousand prompts, because every session now drops the records of prompts that the conversation summary has already replaced
• Clarify guidance to decode Workflow report fields before quoting them verbatim, keep literal escapes, and place commentary outside the quote
• During the five seconds that a hook's block, failure or timeout notice shows in the lower-right corner, another hook's message no longer replaces it and is not shown
• After Muse Code restarts from a crash, messages you queued before the crash now run before your next message, once each and in the order you sent them; before, your new message ran first
• With a goal reminder active, a background command the agent stopped itself (or saw finish while checking on it) no longer counts as still running, so the reminder can send the agent back to unfinished work instead of leaving the session idle with nothing left to wake it
• Apps connected to muse serve --listen now get the session/started notification before the reply to session/start, the same order as over stdio
• A subagent whose definition declares memory no longer stops with a memory error partway through its work, and it now saves its context when its history is compacted, so reopening it stays fast
• A paused workflow now stays resumable after Muse restarts even when a context compaction happens before any session checkpoint
• When Muse asks a clarifying question, the recommended option now keeps the full scope you asked for instead of offering a reduced or skeleton variant, and on a request that already settles the outcome it proceeds without stopping to ask
• Restore missing Workflow failure notifications when a child start cannot be confirmed
• Rewind works in forked conversations, including copied messages and new messages added after the fork
• After a crash during automatic naming, a chat whose history already holds its name keeps that name on the next start instead of getting a new automatic one
• In muse serve, when a busy session has not started a message within 30 seconds, the message is now withdrawn with a busy error you can retry, instead of an internal error after which it could still run later
• muse exec with a model already chosen no longer exits when the model catalog service answers with no models; it prints one notice and runs that model
• A muse exec session that resumes for every prompt no longer adds a record per prompt to every saved checkpoint, which made such sessions stop saving checkpoints after a few thousand prompts
• /stop all in a subagent's thread now stops that subagent's own running subagents instead of reporting the stop as failed
• A muse serve chat that an older Muse version still holds open now shows its saved history when its log had an unreadable stretch, instead of showing no history
• When you resume a session and its log is deleted or replaced outside Muse before Muse saves anything new to it, Muse now tells you what happened to it instead of quietly starting a new log or writing into the replacement. A session log or folder moved away outside Muse is no longer re-created empty, so moving it back keeps saving in the same place
• When the model catalog lists no visible model, Muse now starts on the newest hidden model it grants you and names it in a startup notice, instead of stopping with "model catalog has no visible models"
• After a crash, a question the agent was still waiting on can be answered even when earlier work in the session was compacted
• After a model switch makes a chat unable to continue, Muse now says why and that starting a new session continues the work with this session's history kept, instead of only saying the turn could not prepare the conversation
• A session started by a newer Muse no longer disappears from session lists while an older Muse process keeps running on the same machine
• A session whose first prompt is very large, for example a log file of several megabytes, no longer drops out of the session list in apps that list your sessions, and you can still resume it and send more prompts; the session title shows the first 1,000 characters of that prompt
• A prompt queued through the session protocol while a finished turn's follow-up waits to start now reports its own turn, so a client that waits on that turn gets its answer
• Subscriber sessions no longer fail with "Model not found" when the model list arrives after sign-in
• When a Workflow finishes after its script handled a failed agent call, Muse no longer tells the agent that the Workflow failed, so the agent no longer reports a finished Workflow as failed
• When a long thread goes over the model's context window, the automatic smaller retry now drops enough older messages to fit instead of being refused again
• After a session storage error clears, a Workflow agent that already finished no longer shows as scheduled or running again when the Workflow settles
• Skill reminders no longer steer the agent onto a different skill when a skill it already loaded covers the same step
• muse mcp login works after adding the first server to a fresh config
• Fixed re-loading a chat's failed view while a tool streams output, which could fail with projectionRebuildFailed
• Stopping a turn over the session protocol while a shell command's second permission ask is open, after you allowed the first one, no longer makes every later prompt in that session fail with "approval replay failed" or stay queued
• muse attach <session> from a terminal to a session a muse serve host is running now says at once that a terminal can't join it yet and to keep using the window that runs it, instead of opening the resume picker and reporting the session as already in use
• A chat whose automatic compaction keeps failing at the context limit no longer pays for a new summary on every request; after 2 failures in a row, Muse stops automatic compaction for that chat until a compaction works or you reopen it, and /compact still works
• A session whose recent turns hold many full-size images, such as dozens of screenshots, can still be resumed after its context fills up; before, the compaction that followed could leave the session impossible to resume. If automatic compaction stops because those images make the compacted context too big to save, the stop notice now says so
• Resuming a chat no longer repeats subagent completion messages or shows new child work as finished
• When you report that a change does not show up in your own run, the agent is now prompted to trace the code path you ran instead of stopping at setup or flag steps
• When a reminder such as a goal keeps a turn going after its answer and you press Esc while Muse is thinking again, the answer now shows Interrupted under it
• A session no longer skips a compaction checkpoint when a Goal turn ended while its Workflow kept running and later finished
• Forking a chat that contains an empty turn whose start was not recorded is now refused with a message saying why, instead of creating a fork that fails to open
• In a compacted session, an image prompt that you send after you reopen the session now stays in the model's context after the next reopen, and /compact works again in that session; you cannot yet rewind to that turn or fork from it
• IDE and other session-protocol clients now show the same warning as the terminal when a paused workflow is left out of a saved context checkpoint (NoticeOrigin gains workflowCheckpoint)
• A prompt with an image is no longer dropped when the context is compacted at the start of its turn, so the agent answers that prompt instead of the previous one
• A fork whose seed would fail to load elsewhere is now refused at creation with a clear error instead of publishing and then failing to open
• Fixed a race where re-loading a chat's failed view during a running turn could fail with projectionRebuildFailed
• A session/resume check (admitOnly: true) no longer makes the checking client a driver of the session, sends session/driveChanged (experimental) to its other clients, or re-sends it the session's pending approval and user-input requests; a session/resume without admitOnly still joins the session's drivers, as before
• In muse serve, leaving a chat that another connected client is driving no longer stops and unloads it under that client: session/leave answers sessionInUse and the chat stays loaded
• Aborting Session.run in the TypeScript and Python SDKs while its turn is still queued and the host is busy now keeps taking the turn back, so the turn no longer runs after the abort; in Python, cancelling again returns at once while the take-back still finishes
• A Workflow resume that stops because an agent's saved start record is damaged now reports the plain reason and next step in its result and in the Latest error row, not only an error code
• The "session log flush degraded" note at the end of a turn no longer goes missing when a queued message or a model, approval or reasoning-effort change was refused once because a save had failed earlier in the turn
• The first message you send after an automatic compaction finishes in the background now builds on its summary, instead of requesting another summary and dropping the recent turn that summary kept
• Through muse serve and the SDKs, a subagent that was interrupted and resumed no longer shows its earlier run's late result as its own while the new run is working
• Branching a forked or side session right after it compacts, before its next message, no longer fails with a fork seed count mismatch
• A session running Workflows no longer gets stuck unable to save its context when a Workflow capacity record has lost its launch record; that one Workflow can no longer resume its children after a restart, and the session keeps saving and continuing
• Preserve subagent Stop information when reopening a chat
• After a crash, a subagent's earlier turns show a monitor's own recorded end (ended, timed out, or failed with its reason) instead of stopped when the monitor finished just before the crash
• The queued input panel no longer says "your input still works" when message updates fail
• Workflow scripts preserve their complete return value, including partial status and remaining work
• Rewinding to a turn whose pasted image can't be read now says the image couldn't be read and that you can retry, instead of saying the conversation changed
• Resuming a session after two or more successful /compact runs no longer shows a false "runtime closed before context compaction completed" warning
• In a long /goal session, pausing, editing or otherwise changing the goal while Muse compacts the conversation no longer leaves that compaction without a resume point
• Resume paused Workflows while preserving completed child results
• A compaction no longer skips its checkpoint when a tool result was saved to the run but not to the session log

Performance

• The built-in browser-game skill finishes games built from long design documents faster: the first critic plays the game as soon as it runs, before the art is in, and the second and third critic rounds play the same copy at the same time
• When a background task's status can no longer be read (for example, a finished subagent whose session log is gone), the TUI stops retrying it several times a second, so an idle session no longer keeps a CPU core busy
• Resuming a long session without a saved checkpoint no longer opens one background thread per finished shell command, so memory and startup work no longer grow with the session's command history
• Resuming a long session no longer scrolls the whole history through the terminal; it shows the newest part that fits the terminal's scrollback, with a note that earlier conversation is not shown
• An idle session no longer holds a CPU core while an older Muse Code version runs on the same machine; the two versions no longer keep rebuilding each other's saved-session list
• Long-running sessions use less memory while the session list refreshes its index of large past sessions
• Resuming a long session recorded by an older version uses less memory, because model instructions and context settings repeated on every run are kept once instead of once per run
• Resuming a long session uses less memory, because background-task and subagent records read back from the session log are no longer kept twice
• Resuming a long session uses less memory, because the subagent view no longer keeps its own copy of every past event
• Resuming a session with finished subagents uses less memory, because reading a subagent's task state no longer keeps that subagent's whole conversation loaded
• An open session that has run subagents or workflows uses less memory, because an unused second copy of their admission records is no longer kept
• Resumed sessions with compaction checkpoints use less memory
• Rebuilding the session list after an update uses much less peak memory, because large sessions are no longer read at the same time
• A session that has run many subagents or workflows uses less memory, because each small per-task record list keeps only the slots it uses
• Refreshing the session list's index of a large past session that has no checkpoint uses less memory
• A long session uses less memory as it runs, because model instructions and context settings that stay the same between turns are kept once instead of once per turn
• Resumed long sessions use less memory, because each kept run event is stored once instead of once in the run history and again in the model context view
• A session that runs commands with a lot of output uses less memory, because Muse Code now keeps each piece of command output once in memory instead of three times
• When a long-running background task wakes the agent only to report that it is still running, the agent now ends that check quietly instead of making an extra model call to write a summary
• Resuming a long session uses much less memory, because the session log's records are no longer kept a second time to prove their original bytes
• Resuming a long session uses less peak memory
• muse serve spends less CPU per loaded session while idle, and creating a session stays cheap with many sessions loaded
• Resuming a long session that has no saved checkpoint needs much less peak memory while it loads, because each line of the session log is no longer held twice
• Resuming a long session with many finished background tasks uses less memory, because each finished task's recent output lines are kept once instead of twice
• A resumed long session holds less memory while it stays open
• Creating a session writes its scheduled-task store with fewer disk flushes, so bursts of new sessions in muse serve finish sooner
• A resumed long session uses less memory, because the task and run state kept for later appends no longer copies records the session already holds
• Resuming a long session keeps less memory, because the live session log no longer holds a spare buffer sized for every record
• A long session uses less memory, because the index that matches recorded copies of run and approval events keeps each copy once
• A resumed session uses less memory, because the replay check it keeps for later checkpoints no longer holds a copy of every queued message
• Long sessions grow more slowly in memory, because each new session record is no longer kept a second time to prove its original bytes
• Paging through a long session's retained history no longer reads the whole file into memory before decoding it; each line is decoded as it is read
• Long sessions use less memory, because every recorded step of a run takes less space in memory
• Long sessions that run workflows use less memory, because a workflow subagent that fails or ends without a result no longer stays loaded after the workflow reads its outcome
• Long sessions that run workflows or subagents use less memory, because the workflow view now keeps only each agent's tool calls and token usage instead of its whole run
• Long sessions that run workflows or subagents use less memory, because a finished subagent's conversation is no longer kept loaded after it was last read
• In a long chat, Muse sends your message sooner after you press Enter: the work before each request no longer repeats once for every installed skill, so it stays close to a fresh chat's

1.4.14

New

• session/read shows which connected client currently drives a session (driveHolder, the holder's initialize name and version; absent when nobody live holds it)
• A failed turn's error now carries requestDenied: true when the provider refused the request, so session protocol clients can show "Request denied" instead of a generic model failure
• Permission profiles can now allow, prompt for, or deny Unix-socket access per path, and a refused Docker socket connection explains the sandbox block with the way out
• Startup names the effective approval mode when --yolo was requested but a restrictive permission profile took effect
• session/read, session/list and the session/resume result show which client last resumed a session over the wire (resumedByClient, the resuming connection's initialize name and version, recorded durably on the resume marker)
• session/resume accepts an optional modelId that overrides the retained model for that resume — over a stamped label or pin — and recovers an otherwise-unresolved label binding
• session/start accepts an optional previousSessionId that records which session the new one replaces, even when that session no longer exists
• Settings-listed models can name a separate background model for reminders and reviews
• When the approval judge escalates to you instead of deciding, the approval card now shows the judge's reason as one short line under the command, so a risky request is harder to approve by reflex
• session/list, session/read and the session/resume result show which session opened a worker session (spawnedBy: the opening session's id plus optional project and thread labels, recorded once when the worker's first session starts)
• session/start accepts an optional spawnedBy (the opening session's id plus optional project and thread labels); the host records it once as the new session's opener and serves it back as spawnedBy on session/list, session/read and session/resume
• muse session-message list --json rows carry spawnedBy, the session that opened each listed worker session (its id plus optional project and thread labels), read from the same session index session/list serves

Improvements

• An older Muse build cannot open a chat whose permissions were reset because part of its saved permission history was lost or damaged; update the app to open it (other chats are unaffected)
• muse serve --preset applies the preset's prompts and run settings, accepts presets defined with -c, and keeps the preset chosen at startup after login
• New features in a project the agent built earlier in the same session no longer start with a failing test, and reported bugs still get a regression test
• Inside tmux, Muse now reports its program status (OSC 7501) without waiting for the terminal to answer, so iTerm2's tmux integration (tmux -CC) shows whether a session is working, waiting for you, or done; a client that attaches later sees it once the attach resizes the window or the status next changes
• Permission profiles that prompt before socket access keep prompting after a session is reopened, and opening such a session requires the latest app version
• When an answer compares several things in a table, the detail that does not fit the table now comes as short paragraphs or list items instead of one long block per item
• Resume checkpoints of long sessions no longer keep every finished Workflow's child-capacity records, so they stay smaller; opening a session compacted this way needs this app version or later
• When Muse Code double-checks its work after giving a final answer, it now reports the result of the check in a sentence or two instead of repeating or extending the answer
• Long /goal sessions that start sub-agents keep their resume checkpoints small and resume quickly, instead of carrying every step since the first sub-agent started
• When you ask for a plan in a file and say what the chat reply should contain, Muse Code saves the plan and replies only as you asked
• Overviews, explanations, comparisons, and answers in a format you asked for no longer open with a top-finding line; reports on work Muse Code did still lead with the main finding
• When branching a conversation through muse serve fails because a session file could not be written, the error now names the step that failed, the kind of path and the operating-system error instead of only WriteFailed
• initialize now refuses a clientInfo.name longer than 64 characters, with the same invalidParams error a malformed name already gets
• Compaction checkpoints keep rejected commands in a smaller form; chats whose checkpoint holds one require a compatible app update, and older versions cannot open them
• /feedback shows how big the session record is before you agree to attach it, and notes when it will be trimmed
• The built-in browser-game skill builds games from long design documents with an art-director subagent, which makes the art and ships it in the game folder while the game is built, then runs three critic rounds that play and review the game; short game requests stay light
• Apps that show tool activity now see a tool call while a pre-tool hook is still deciding on it, marked as held
• When a task gives a reference image, the Blender skill now runs a required critic loop of blind reviews and fixes, as a workflow where available, so renders match the reference more closely
• Models that support max reasoning effort now use it by default when you have not chosen an effort, including future models
• Reopening a compacted session through muse serve (session/read, or session/resume when it returns inline or snapshot history) now shows the earlier conversation as one collapsed earlierHistory item holding the checkpoint's recent messages, followed by what came after, instead of replaying history from before the checkpoint. Clients that do not know the item kind show its fallback line

Fixes

• Security: Sandboxed Linux commands can no longer rewrite kernel helper settings under /proc/sys, even when Muse itself runs as root
• A follow-up task sent to a subagent that finished before muse serve restarted no longer stops before reaching the model when MCP servers are configured
• After a brief disk error interrupts one background save, the next save on the same chat clears it and goes through, instead of being refused until restart
• A session waiting on a finished background task now wakes when the task finishes instead of staying stuck until you intervene
• When a background context summary fails or is too large to use, Muse Code no longer pays for a new one every turn; it retries only after the conversation has grown well past the failed attempt, including after the session is reopened
• Restore resume for older Side chats while preserving their history and permission settings
• Preserve active tasks when compacting a conversation more than once
• While a storage error lasts, a periodic save that has to be skipped no longer ends the turn when the note recording the skip cannot be written either; the error is logged and the turn goes on
• Resuming a session saved by an older version no longer offers Workflow; start a new session to use it
• /new or /clear right after cancelling a run no longer exits with a missing-file error
• On Windows, sandboxed shell commands now start in the workspace when it is inside your user folder, so relative paths no longer resolve under the PowerShell install folder
• On Windows, Ctrl+V pastes copied text into the prompt in consoles that pass the key to Muse, such as the classic PowerShell window, instead of reporting that no image could be attached
• Forking a chat with muse serve on Linux works again instead of failing with "file birth time is unavailable"
• The game-3d-visuals skill now stops its pipeline loop when you ask it to stop, open the file or change course: "open it" opens the file (or says it is not ready yet) instead of waiting for the running stage, and a comment such as "thanks" lets the pipeline continue
• Fixed workflow instructions that did not match the current session
• A sub-agent started from a /goal chat saves its history again when it compacts, so it can be resumed from that point
• The built-in python-env skill tries a container image, conda channel or prebuilt wheels that the user or the project names before compiling a dependency from source
• A chat in which one record of a turn could not be written to disk, even after a retry (for example on a full disk that stayed full), can be forked, side-chatted and rewound again; that turn is left out of the new chat, and Muse says so once
• Resumed sessions with a recorded selection keep the model you selected instead of switching to a default
• After resuming a compacted session, follow-ups and waits on a subagent no longer fail once a shell command ran after the compaction
• Reopening a chat whose saved view fell behind, for example after a cancelled turn, shows its latest turn instead of an older one
• A subagent's transcript that a restart cut off reads again as soon as its parent session resumes, with no action on the subagent
• Sessions where an older Muse Code (1.4.5 or earlier) recovered an interrupted workflow save context checkpoints again, so compaction is no longer skipped or dropped in them
• A forked chat whose saved history has an unreadable part, and where the start of one of its own turns could not be written to disk, no longer refuses every message after it is reopened, forked or side-chatted; that turn is left out, and Muse says so once
• A session saves its history again when it compacts after a Workflow's agents were skipped or retried more than 128 times, so it can be resumed from that point
• Background work status survives a restart after correcting a missing Workflow name
• A session with a lost permission change now refuses to resume when its safe permission reset cannot be enforced, instead of opening with silently dropped Deny rules
• A chat in the app or muse serve that was closed while a workflow was running saves its history again after it is reopened
• When you tell the game-3d-visuals skill to stop or exit while its pipeline runs, it now also stops the running background stage (unless you ask it not to call any tools), and a stage that finishes after you stopped no longer starts the next one
• Stopping a background task or Monitor from /tasks just as it finishes now records the stop right away instead of dropping it after a 30-second wait
• A chat in which a reminder for one turn could not be written to disk, even after a retry, can be forked and side-chatted again; that turn is left out of the new chat, and Muse says so once. Rewinding such a chat is still refused
• Rewinding past a message you sent while the agent was busy no longer leaves the new branch stuck refusing every message and showing that message as still queued
• Resuming a compacted session with tbh exec --session-id keeps its subagents, so following up with, waiting on or checking a subagent no longer reports it missing
• Keep unknown Workflow result references unchanged
• Complete Workflow reports remain readable when their preview is shortened
• MCP servers start again when you resume a session after it was compacted, instead of every turn failing with "MCP startup audit failed" or the MCP tools going missing
• A forked chat whose copied checkpoint can no longer be replayed (written by an older build, or slightly damaged) opens, forks and side-chats again with its copied history rebuilt; only history that truly cannot be read is left out, and Muse says so once
• A Workflow paused just as it finishes now stays paused, instead of also reporting a finished result after the pause
• A deactivated Muse Code app now names the server reason instead of telling the user to log in again
• muse serve refuses to reopen a session whose automated reviewer this host cannot prepare with the permission_profile_reviewer_unavailable reason instead of a generic internal error
• A chat in which a reminder for one turn could not be written to disk, even after a retry, can be rewound again; that turn is left out of the new chat, and Muse says so once
• When a full disk could not save a task link, a monitor line or, in most cases, a named workflow launch, compaction checkpoints now keep working without restarting the chat
• Cancelling, force-sealing or stopping a subagent whose own background work is still being killed no longer reports it done early: the result arrives once that work has ended, a cancel that cannot finish yet fails with a typed error naming the task, a stop answers stopping until then and is recorded once the jobs are dead
• After a resumed session, following up with a subagent started before the conversation was compacted works again instead of failing the subagent with a missing ownership error
• A chat in which two different kinds of record could not be written to disk can be forked and side-chatted again; both turns are left out of the new chat, and Muse says so once for each
• Restore native MP4 and MOV video reading for supported models
• Sessions with an earlier video read keep working when the current model, provider or video setting can't send that video
• A denied cross-origin redirect no longer replaces the stored session for an Agent plugin's MCP server, and redirect grants no longer match non-HTTP(S) origins
• Reopening a session no longer fails when a turn after a compaction reuses rules or instructions from before it
• Background task output now wakes a waiting session instead of staying queued until you intervene
• Resuming a session whose worktree was deleted now recreates it on hosts without an enforceable creation sandbox when you already trust the source repository; untrusted repositories still refuse
• Built-in skills the model loads on its own now name tools the way the model is offered them, so it calls them by the right name
• A session started by another app now takes its title and first-prompt preview from the prompt as it was shown, not the app's wrapper text, so it no longer appears with raw JSON as its name; a session that starts with a skill or image is titled by its display form (its typed form, or [Image 1] for an image-only start)
• Saved Workflows can run again from their local script paths on Windows
• Agent no longer repeats a question you already answered in the same conversation
• Keep recovery guidance intact in long background Workflow results
• Preserve the specific failure reason when a subagent fails
• A chat reopened on an older build, whose log saved two background-result notices at the same spot, keeps saving compaction checkpoints in the running process instead of refusing them until the next reopen
• In the terminal app, resuming a chat whose saved history lost a record after your last permission change (without a permission flag) now reopens it with a reset to the narrower of the default and your surviving profile — or to :read-only when the two are crossed — and a warning, instead of refusing it; a resume with no safely-resettable profile is still refused
• Resuming a muse serve session after Muse Code exited unexpectedly no longer shows the interrupted run's work as still in progress
• After a session reopens from a compacted history, retrying an approval decision, a question answer or a queued-message removal returns the original result instead of handling it again
• After a crash, muse serve no longer asks again about tool calls that were waiting for approval and no longer runs an approved call by itself; the interrupted calls are closed and a call the model makes again gets the normal permission check
• Branching a conversation on Windows no longer fails with a write error
• When more skills are installed than the startup skill list can show, the agent can still find the ones left out by looking one up with part of its name or description
• Plugin MCP servers approved in review can now sign in through muse serve as well as muse mcp login, instead of being refused as plugin-managed
• Retrying a workflow child skip or retry with the same command id after a restart returns its original result; chats whose checkpoint holds such a result require a compatible app update, and older versions cannot open them
• Recovered Workflow children release unused capacity reservations, and conflicting attempts get a clear restart error
• A resumed coordinator lane whose session takes a moment to redraw now still receives its handover brief and answers, instead of going silent
• Reopening a subagent chat keeps replies from earlier work
• Tell the main agent to read complete Workflow reports before answering from a shortened preview
• A long run no longer fails with "Origin read requires valid checkpoint-suffix or origin-preserved full-replay authority" when a tool result's saved copy has to be re-written after context compaction
• A long-running served chat whose earlier checkpoint was saved together with a compaction keeps saving checkpoints instead of refusing every one after a reopen
• Very long sessions no longer stall while compacting a conversation too large to summarize at once
• A finished background task now wakes a waiting session even when an earlier wake was lost
• Work status checks now show a short work ID once instead of repeating the full ID in the header and the status card, and listing background work shows item labels when present (else a short work ID) instead of raw JSON
• Preserve background command results in session history after a recording error
• A background task that keeps running through several compactions no longer shows as invalid after you reopen the chat
• A side chat reopened after it compacted no longer re-reads its whole history each turn, so damage in older history no longer stops it
• In the terminal app, resuming a chat whose saved history lost a record with a permission flag (for example --permission-profile or --sandbox-network) now applies your chosen permissions as the lost_record_reset commit that drops pre-loss grants (after the reset, or in its place when the reset is not allowed), and one warning that your chosen permissions apply. A pick the retained managed pin refuses, or a reset :read-only cannot be shown never wider than both profiles, still refuses with no reset and no warning
• Deleting session-index.db while Muse Code runs no longer makes the session list fail or crashes the app; the index is rebuilt with fresh files
• Opening a side chat over the session protocol no longer intermittently reports the new session is already in use
• A parent agent can now read a subagent's whole final answer instead of only its first 512 characters, so it no longer spawns extra agents just to read the rest
• Compaction avoids copying preserved user messages into its automatic history notes
• A model response whose tool-call signals disagree on the tool name or call id now retries that attempt instead of ending the whole run
• After a crash, a resumed client's subagent rows no longer show a recovered child as running, and its child-view composer correctly reports the thread as read-only instead of attempting a send the host rejects
• Rewinding to an earlier turn no longer fails after a compaction that ran while a finished background task's result was still waiting to be delivered
• A fork or side chat that compacted no longer writes later checkpoints that hide the compaction, so its next resume still starts from the checkpoint
• Compaction handoff summaries now preserve operational state-to-action triggers (standing duties with their exact command) verbatim, so a duty like starting a bot once an approval arrives survives context compaction instead of being summarized away
• In a session resumed from a checkpoint, running /goal set while a turn was running could cancel the new goal turn and then refuse every later message with "Message not sent — saving failed"; the goal turn now starts and later messages go through
• Muse is told when the permission mode changes mid-session, so it stops insisting it is still on the launch mode after switching to Unrestricted
• Pasting an API key into a logged-out session now shows the contributor models in /model immediately, instead of only after a restart
• After context compaction summarizes a skill body away, the skill reminder can offer that skill again instead of treating it as already read for the rest of the session

Performance

• Resumed and long-running sessions use less memory, because saved copies of session records made mostly of structured data are kept as compact text instead of an expanded in-memory form
• Long sessions use less memory, because each saved run event takes less space in memory
• Resumed long sessions use less memory, because each run's model instructions and context settings are kept once in memory instead of being copied for every run
• Resuming a session with subagents no longer re-reads a subagent's history from before its last compaction
• Typing in long sessions with many subagent runs stays responsive, because the subagent tree no longer re-checks every delivered result against every run on each frame
• An idle session no longer re-reads the whole session index every two seconds, which removes a constant background disk read on machines with many saved sessions
• Resuming a long session that has many subagents and no saved context checkpoint is faster, because checking each subagent log for a checkpoint no longer parses every record

1.4.13

New

• On macOS and Linux, permission profiles extending :ask-me with filesystem deny rules now enforce them: workspace-root deny globs (**/*.pem) and absolute/~/ denies refuse matching reads and writes, and sandboxed shell access to matching paths that exist when each shell command starts (files created mid-command under a deny glob are not covered on Linux — macOS enforces globs live through Seatbelt regex with no snapshot window; a deny on a not-yet-existing path is masked at its first missing component), instead of being silently ignored, while the profile keeps its write grants elsewhere
• muse usage shows your subscription allowance (window and weekly use, reset times, tier) without running a model turn; muse exec --json reads it too when the run saw no usage update
• Desktop and other connected clients offer the same third-party models as the terminal model picker
• Added a built-in visual-coding skill: for a 3D page, a browser game or Blender work, it points the agent to the one built-in skill that owns that kind of work before any code is written, so one request no longer runs two competing build processes
• Warnings near your usage limit show the remaining allowance and reset time above the message queue

Improvements

• /game-3d-visuals now runs its plan, build and review as three steps and posts a one-line result to the todo list after each
• When cleanup after a finished turn keeps failing (goal accounting or the live turn state), the chat now shows one "cleanup failed after this turn" warning naming what gave up, instead of failing silently. It shows right after that turn, or the next time you open the chat if you have already moved on to another turn (in the rare case that the warning itself could not be saved, it shows only while you are still on that turn)
• --yolo keeps the request_user_input question tool and enables async questions instead of withholding them; pass --disable-request-user-input for runs that should ask nothing

Fixes

• Security: Sessions in untrusted workspaces no longer receive project rules recorded by an earlier trusted session
• Security: Session worktree recovery now enforces the same protected paths as the rest of the session
• Security: Served sessions in workspaces you have not trusted no longer run workspace status checks or Sapling snapshots, and sessions that never establish trust now fail closed instead of inheriting trusted behavior
• Security: When muse serve resumes, forks or opens a side chat from a chat whose saved history lost a permission change, the chat no longer reopens with older, wider permissions: it resets to your defaults, keeps your saved settings when they were stricter, or switches to read-only when the two cannot be safely combined, and "allow for this session" approvals given before the loss stop applying. A permission profile you choose when resuming such a chat applies after the reset, or in its place when the reset is not allowed. When no safe reset exists, or managed policy forbids it, the chat refuses and asks you to start a new chat
• A chat whose tool result could not be saved (for example on a full disk) can compact again right away, and after a restart that turn is kept with the result shown as lost, instead of disappearing
• Notes sent to a subagent over a remote session keep their plain summary
• Removing a queued message with turn/unqueue now works when the message is waiting behind an internal turn, instead of failing with missing_run and running the message anyway
• Session names you gave earlier show up again in the session list and work with muse resume <name>, read from each session's own history
• /feedback uploads with a very large session record no longer fail; the record is shortened to fit and the shortening is noted
• When a chat's file could not be read while loading it for a save (a brief I/O error), the chat goes back to saving its progress once the read works again, instead of staying unable to save until restart
• Stopping messages say whether a workflow or a background command was stopped
• Long /goal sessions save their resume checkpoints again, so they stay compact and resume quickly instead of slowing down after every compaction
• A forked chat where the start of one of its own turns could not be written to disk keeps working after it compacts and is reopened; that turn stays left out, and Muse says so once per reopen
• A chat that messaged a subagent and then ran several tools at once no longer stops saving checkpoints for the rest of the session
• Fixed automatic compaction losing Monitor messages after a model response ended early
• A prompt that looks like a session-message envelope no longer stops later sessions from saving resume checkpoints
• A forked chat where the start of one of its own turns could not be written to disk (for example on a full disk) saves checkpoints again after a restart; that turn is left out, and Muse says so once
• After a subagent message or other background record could not be saved to a full disk, compaction checkpoints work again without restarting the chat
• session/leave with stop: true no longer releases a session while one of its workflows cannot be stopped (its stop record is in conflict); the leave fails and the session stays with its host, including when you retry it with a new command id; until the host process restarts, such a leave keeps failing (a known limitation)
• The todo list now stays on screen while a background workflow is still running, instead of disappearing as soon as the turn that launched it ends
• Notes waiting on a busy subagent now show Queued rows while they wait
• After a brief storage error in the middle of a task, the chat goes back to saving its progress at the next checkpoint once the error clears, instead of waiting for the task's next tool call or its end
• After a brief disk error interrupts one background save, the chat goes back to saving its progress once the error clears, also when the save had fully reached the disk or belonged to a side chat
• Loading a forked chat in the app or another client, where the start of one of its own turns could not be written to disk, no longer blocks its checkpoints; that turn is left out, and Muse says so once
• A chat forked from a compacted chat, where the start of one of its own turns could not be written to disk, can be reopened and continued; that turn is left out, and Muse says so once
• A compaction that runs while a background task's save is still unconfirmed now saves its checkpoint (keeping the older history until the task's save resolves) instead of skipping it
• The game-3d-visuals skill now names each of its pipeline runs, so its first launch is no longer refused and retried
• Usage limit stops explain when you can continue, and denied requests retain useful error details
• Pausing a Workflow that has just finished now reports that it already finished and shows its result, instead of leaving the Workflow paused with no result
• The peer message timeline no longer shows as unavailable after a session accepts a message automatically

Performance

• Context that hooks add after a prompt or tool call now stays in the conversation where it arrived, so a new hook rule no longer makes the whole conversation re-process on the next model call
• Reduce repeated session-log bookkeeping while disk writes are failing
• Starting the app or muse serve while other sessions are running uses much less memory, because listing sessions no longer keeps a full copy of each running session's history

1.4.12

New

• Added a built-in browser-game skill for building playable browser games from a brief: it sizes the work to the request, plays the game with real input before handoff, and for a long design document runs up to three rounds in which a fresh critic plays a copy of the game against a checklist and the brief's rules, fixing what each round finds
• Permission profiles can open chosen local development ports to sandboxed commands with network.local_ports (allow, ask, or deny per port); ask prompts for each connection on Linux and once per session on macOS; a loopback entry in network.targets is now rejected, so move it to network.local_ports; an older Muse build cannot open a chat that saved local-port rules or a managed local-port limit, so update the app to open it (other chats are unaffected)
• Choose a run preset when starting a session host with muse serve --preset

Improvements

• After you allow a network request once, the same non-interactive command's later requests to that exact host, port, and protocol no longer ask you again while it runs
• Chats containing saved continuations of finished subagents require a compatible app update; older versions cannot read them
• Better guidance for carrying research findings and notes into final reports
• An older Muse build cannot open a chat whose permissions were reset because part of its saved permission history was lost or damaged; update the app to open it (other chats are unaffected)
• /game-3d-visuals finishes in about half the time: it skips the separate visual-plan review and runs one render-vs-reference fix round by default
• Tiny text, style, or config changes, throwaway prototypes, one-file scripts or pages, and requests for a quick result no longer start by writing a failing test; other fixes run the broad test suite once after the last edit and post a status line during long test runs

Fixes

• Security: Deny rules now cover paths that do not exist yet in sandboxed shell commands, blocking their creation without leaving anything behind
• Security: Shell and file tools refuse a workspace root that no longer resolves to its recorded location instead of following it to a new target
• Security: The Sapling commands the harness runs for you (workspace snapshots, session worktrees) now run inside the sandbox instead of directly on your machine, and session worktrees refuse to run Sapling in a workspace you have not trusted
• Shell commands can write under every workspace root a session protocol client grants with workspaceRoots, not only the primary root
• Startup warns again when the configured Bubblewrap path is unusable instead of hiding the sandbox-unavailable notice
• When a Workflow pause or stop keeps an agent call from starting, its Recovery line and its failed row now say so instead of calling it an internal error and asking for a /feedback report
• A chat whose tool call could not be written to disk (for example on a full disk) while its result was written can now be forked or given a side chat after a later checkpoint, instead of the fork failing
• A Workflow agent call whose Agent Definition asks for a model this session doesn't offer now runs on the session's model instead of failing, and the main agent tells you which calls ran on which model
• After a session/leave times out, reading that session on the same host works again once its runtime has stopped; until then the read reports that the session is still stopping
• A session/leave whose accepted reply cannot reach the client now fails at its deadline, instead of holding the session until the connection closes
• The TUI refreshes the model catalog once in the background when the chosen model is missing from the cache, instead of starting a second refresh
• Pending approvals and questions in muse serve --no-session-log sessions stay readable after the agent starts a subagent
• session/leave with stop: true now stops a running workflow before it hands the session over, so resuming the session no longer offers to recover the workflow you stopped
• Subagent crash recovery reports missing tool results as unknown without automatically rerunning the calls
• Over muse serve, resending a finished turn's turn/start with the same command id after a restart returns its original reply instead of a command id conflict
• When a finished reply or a subagent result cannot be saved, Muse retries briefly, then shows a clear error that says why new messages are refused instead of retrying silently every second
• /permissions now names why a permission change could not be saved
• When a sandboxed shell command fails writing outside the session's writable roots (for example a cache under the home directory failing with Read-only file system), the failure now explains that the sandbox blocked it and names the workspace_roots grant, a one-time unsandboxed run, and workspace-or-/tmp cache options, instead of the raw filesystem error
• In the terminal app, a chat where the start of one turn could not be written to disk (for example on a full disk) no longer loses every later checkpoint after a restart; that turn is set aside, and Muse says so once
• Sessions wake once the blocking run settles after a background task finishes while the session is busy
• Rewinding to before a turn that failed, or whose end could not be saved (for example on a full disk), now works instead of every attempt being refused, and a turn that can never be rewound is shown as unavailable instead of offered
• Opening a subagent's detail view now loads the child's transcript from the child's own session and keeps it live while open
• Keep long requests running with their full context when compaction fails
• When a Workflow pause or stop keeps an agent call from starting, its Recovery line and its failed row now end with what you can do: "Start the Workflow again if it is still needed."
• On EdenFS checkouts, sl and hg commands need the launcher (sandbox disabled) to reach Eden state; the native sandbox no longer grants Eden filesystem or socket access
• Rewinding to a turn after one that was still running when the chat saved a checkpoint now works, instead of every such rewind being refused after you confirm it
• Goal sessions waiting on external work wait on a change watcher instead of appearing stopped
• Stopping background work from a notification now works instead of reporting it was not found
• A chat that lost two saves in one turn on a full disk (a tool result, then the next tool call) can be reopened again; the affected turn is set aside instead of blocking the whole chat
• A prompt sent while the session view is stale-idle steers into the active background delivery over the session protocol instead of starting a duplicate fresh run
• /game-3d-visuals now starts on its own only for polished 3D work (a reference image, Blender, or an explicit high-fidelity ask); quick 3D pages and games are built directly instead of waiting on its multi-agent pipeline
• Rewinding to a turn after the conversation was compacted now works, instead of every such rewind being refused
• Keep interrupted startup from leaving a partially created session
• A subagent stop that was interrupted right after it took effect no longer leaves that subagent stuck: the next open completes the stop's record, and if that record cannot be written the session still opens and the next open retries
• Startup fails with a clear error when the configured Linux sandbox helper path is unusable instead of silently starting unsandboxed
• After a crash, a message you sent to replace Muse's current reply, or one Muse showed as queued while it was busy, is no longer treated as done: retrying it now says it was abandoned instead of claiming it already ran
• Apps built on the Muse SDKs now see the new turn a Replace starts as the running turn (the session snapshot's activeTurn) instead of no running turn
• In apps that open chats through the Muse session server, a chat where the start of one turn could not be written to disk (for example on a full disk) no longer loses later checkpoints after it is reopened; that turn is set aside, and Muse says so once
• Fork and side chat no longer fail with an internal error when the system is under load
• Forking a session at an earlier turn keeps exactly the turns up to that turn instead of refusing the cut (some compacted sessions and forks of forks still refuse the cut or fork from a later turn, and a cut that keeps no turns of an older session still refuses while that session is open)
• After a reply or an ordinary tool result could not be saved to a full disk, compaction checkpoints work again without restarting the chat
• Fixed degraded session recovery losing the latest workspace root set
• After a mid-reply compaction, the TUI no longer fires a needless second auto-compaction on the stale Blocked pressure reading
• Hooks set with muse serve -c hooks.… now run in served sessions instead of being silently dropped
• pip install muse-code-sdk now also installs its companion wire-types package, so import muse_code works in a fresh Python environment
• When one write to a side chat's file fails (for example on a full disk), the main chat keeps saving its progress and can still be forked once the problem clears, instead of staying unable to save until restart
• The first manual compaction in a side chat now works, including after resuming it
• A user review gate now explicitly defers outward-facing actions until post-inspection approval, so bounded steps stop instead of running ahead into tracker and chat writes
• Idle sessions reliably wake when a background task finishes
• /plan on a small change now plans instead of implementing it — the skill keys the explicit case on how its body arrived, so implement-shaped task text is read as the planning subject, not an implement request
• With MCP servers configured, using /side before your first message (for example right after resuming) no longer stops every later message before it reaches the model; a side chat you open with /side now runs without MCP tools
• A chat whose Workflow result could not be saved (for example on a full disk) and that then ran another tool now reopens in the same app session after a restart, instead of failing to open
• When a write to a background helper session's file fails once (for example on a full disk) right after it starts, its later writes and checkpoints go through once the problem clears, instead of staying refused until restart
• Older builds keep reading durable session records after a newer build adds a member, instead of failing the whole session read
• A workflow that ended after its durable fact write failed no longer stays listed as running forever in the bottom work list; its row now shows the failed or cancelled result and clears after the usual grace
• On macOS, Muse Code no longer freezes when the Keychain stops answering: it stops waiting after 5 seconds and says your login is still saved, and muse --help no longer waits on the Keychain
• A sandboxed shell command killed mid-run no longer breaks the next command with the same deny rules; its leftover empty placeholder is now cleaned up automatically
• Notes sent to a running subagent now show a Delivered row once the child picks them up
• After a full disk, starting a new chat no longer retries the previous chat's unsaved run ending in the new chat
• When a brief storage failure, such as a full disk, keeps the session log from saving a new Workflow agent call's start even after its one retry, only that call now fails, with a plain reason, and the rest of the Workflow keeps running; before, the whole Workflow ended
• A chat where the start of one turn could not be written to disk (for example on a full disk) can be forked and can open a side chat again; the new chat leaves out that one turn, and Muse says so once
• If a Workflow subagent switches model or has a wake-up refused and you cancel your next turn before it starts, the turn after it still tells you about it
• On an ephemeral muse serve host, replaying the original session/start of a session that session/leave released now answers the original acknowledgement without bringing the removed session back
• After a full disk cancelled a workflow run, a later background result on that run no longer stops checkpoints until a restart
• Failed /feedback uploads now show the reason returned by the server instead of only the status code
• When a chat is stuck retrying a save that failed, /new, /clear and other new sessions from it, local-model setup and a provider key swap now fail at once with the "saving failed … retrying automatically" message instead of waiting quietly or saving a rejection, and the same command works once the chat recovers
• Sessions served by muse serve that use a goal keep saving context checkpoints, so they resume quickly again
• A chat where the start of one turn could not be written to disk (for example on a full disk) can be rewound again; the rewind leaves out that one turn, and Muse says so once
• Workflow guidance keeps large-result details ahead of lengthy research notes
• When a background save to the chat file is cut short by a brief I/O error and never retried, the chat goes back to saving its progress once the problem clears, instead of staying unable to save until restart
• Resume and history show the finished marker for background terminal completions served over the session protocol, matching the live view
• A muse serve chat whose saved view on disk is damaged or unreadable (for example a torn HEAD.json, a missing journal file, or history a newer build wrote) is rebuilt from its session log while it is being resumed, so that resume shows the whole history instead of no history, and the chat never needs reopening
• Reminder checks no longer repeat after their decision when a Stop or PreToolUse hook blocks them
• Side chats retain the original conversation after a checkpoint
• A forked chat where the start of one of its own turns could not be written to disk (for example on a full disk) can be reopened and continued again; that turn is left out, and Muse says so once
• When one save to the chat file fails because the file could not be opened or read (a brief I/O error), the chat goes back to saving its progress as soon as the problem clears, instead of staying unable to save until restart
• Forking a session over the session protocol no longer intermittently reports the new session is already in use
• Quitting the TUI no longer prints internal cleanup or shutdown diagnostics to the terminal; they now go to the local diagnostic log
• Worktree creation and cleanup stay sandboxed in unprivileged containers, using an empty read-only process view where the container refuses a fresh one
• After a one-time storage error leaves a background task's save unconfirmed, the session's periodic context checkpoints keep landing instead of being refused until restart
• A tool result or other chat record whose save failed while the disk was full is saved again at the session's next step if there is room by then, so a restart after that keeps it
• A chat that was never compacted and whose saved log has an unreadable or missing line in the middle now opens for reading in apps that use the session protocol, showing everything that can be read with a notice at the spot, instead of refusing the whole chat; continuing or forking such a chat is still refused for now
• When another agent's start could not be confirmed as saved just as a Workflow starts a new agent call, that call now fails on its own with a plain reason; while session storage is still failing, the Workflow still stops at its next save
• When saving a checkpoint is interrupted twice in a row by a brief I/O error, the chat (and a reminder helper) now cleans up the half-written save and keeps saving its progress once the problem clears, instead of staying unable to save until it is reopened
• Resumed sessions exit after the run finishes instead of hanging when an earlier denied tool approval predates the session's latest checkpoint
• When the same configuration, environment or step-limit error stops two turns back to back with nothing shown between them, it now appears once while the session runs, as it already does after a resume

Performance

• In muse serve, leaving a session and shutting the host down no longer reread the whole chat history to report its final position
• Long sessions store repeated setup blocks once, so logs stay small and resume loads faster

1.4.11

New

• Added session/leave to the session protocol, so a client can hand one loaded session to another host while this host and its other sessions keep running
• Added a built-in web3d skill that guides building single-file 3D web pages and browser games and checking them in a browser before handoff
• The TypeScript and Python SDKs can answer the agent's questions with Session.answerUserInput and Session.answer_user_input, including a question still open when a session is resumed
• Agent plugins can supply MCP servers with per-server review and muse mcp login sign-in
• The TypeScript and Python SDKs accept an approval handler and an approval-failure observer when resuming a session, so an approval still pending at resume reaches the handler and any failure reaches the observer
• muse exec --json prints a run.usage line before each run ends, with the run's token usage per model and your subscription allowance
• muse serve reads three environment settings for its worker threads, command admission capacity, and loaded-session ceiling; an invalid value is reported and the production value is used
• Added /game-3d-visuals to drive 3D models and games from reference images, a visual spec, and a render-vs-reference acceptance loop

Improvements

• Workflow agents receive source and field labels when reading saved results
• /blender now handles general 3D work in Blender, including object modeling, scene recreation from an image, animation and large environments, and ships helper scripts that work on Blender 4 and 5
• The built-in web3d skill now plans each part's shape, surroundings and materials before building, and after the first working build a fresh tester subagent plays the page and writes a critique that must be closed before delivery, with a time guard on review rounds
• ParallelGroup refusals now name the members argument and the .defer correction instead of a generic plain-data error or an internal agent identifier
• Terminals that support program status reports (OSC 7501) now also show each monitor and background terminal a session is running
• /blender can now measure a render against its reference image and check animations frame by frame for pops, sinking and objects leaving the shot, and keeps more refraction bounces so stacked glass renders less dark
• Terminals that support program status reports (OSC 7501) now also show each workflow, subagent and background follow-up turn a session is running, and which one is waiting for you
• Network approval prompts now start on "Yes, don't ask again this session" for that exact host and port, so pressing Enter stops the same destination from asking again
• Auto-review no longer hands you every request to a local server on localhost or 127.0.0.1 just because of its address or port; it reviews them like any other action
• Video file reads guide local frame extraction without uploading the video
• The queued input panel says when message updates fail and that your input still works

Fixes

• Resuming a session after a checkpoint prune no longer loses MCP tool identity bindings for servers that contribute no tools in the new generation
• A Workflow subagent that names the model your session is running now runs even when that model is hidden or missing from the model list, the same as leaving the model out
• Avoid repeated table-formatting skill loads within a conversation
• Side chats now record their attempts on the source session instead of dropping them, matching gate-off; a contended side still opens and a retry backfills or joins the prior outcome
• When a context checkpoint could not be saved during a compaction, the next turn now saves it without another summary, so reopening a long session is fast again
• Resuming a Workflow after a crash no longer reruns parallel subagents that had already finished at different times, or warns that the saved recovery state was not trustworthy, unless a subagent started before them was still running at the crash
• Service and loop restarts verify every process against an ownership record before stopping it, so look-alike sessions are left running
• After Muse restarts from a crash, a subagent the agent started directly (not from a workflow) that had not started running yet is no longer started again by itself; its parent gets one result saying the outcome is unknown, so it can check and start the subagent again if still needed
• Resuming a session stays fast after a side chat was mid-tool during a compaction, or after a cancelled workflow tool could not be saved; those compactions now save their resume checkpoint
• On Windows, plugins whose hooks start a program by a rooted path such as /bin/bash now install instead of failing with "plugin capability path must stay inside plugin root"
• The Python SDK no longer stops filling a delivery gap early, or reports the session current with events missing, when an earlier gap notice is redelivered after a later one; the repeat now returns IgnoredStaleFrame
• The TypeScript SDK no longer stops filling a delivery gap early, or reports the session current with events missing, when an earlier gap notice is redelivered after a later one; the repeat now returns ignoredStaleFrame, and StaleDroppableMethod gains view/gap, so code that matches it exhaustively needs a new case
• Report tasks that finish during /stop all as already finished instead of failing the stop
• Workflow agents now get a notice when the summary list omits earlier results, even when full results are available
• Long sessions trim covered records at checkpoints instead of growing without bound
• The TypeScript and Python SDKs no longer send feedback on an approval choice that does not accept it, which left the approval open; they report the new feedbackNotAccepted failure kind (listing the choices that accept feedback) and answer with the offered deny or abort choice so the turn goes on, and code that handles every ApprovalFailure kind needs a case for it
• A Workflow subagent that names a model now runs in sessions first started on an older version, when /model lists that model once for your provider, instead of being refused
• Session retention no longer gives up on a session forever when one background read of its log fails; the read is retried on a later pass, so the session still expires once it is past the retention period
• Hook input model_provider is meta again for Muse models on every Meta gateway connection, including the corp Mac launcher, and is still omitted for Claude and GPT models served through the Meta gateway
• Queued input typed while the agent was working now runs after a post-turn context compaction instead of waiting at an idle prompt
• When a subagent runs on the session model because its configured model is unavailable, the agent that started it is still told which model ran
• After resuming a session, /compact now shows its ◆ Context compacted outcome row in the transcript instead of silently leaving the transcript unchanged
• A Workflow resume that is refused or fails after launch now records its terminal reconciliation, so clients no longer show the Workflow as open until the host exits
• Commands run by tools (shell, MCP calls, hooks, background terminals, ! shell) now join the turn's trace instead of starting orphan traces, so downstream spans from tools like meta nest under the tool call that ran them
• Context checkpoints are no longer skipped for the rest of a turn when a monitor or background task reports in while tools are running
• The built-in web3d skill now stops checking a page as soon as you say stop or ask it to just open the page
• When you log in while muse serve is running and your account still needs onboarding, turns now say what to do instead of asking you to log in again
• After a full disk or a failed write clears, the next context checkpoint is saved instead of being skipped once more
• A reopened chat no longer fails every compaction when a subagent delivery was saved late, just before an earlier compaction
• When the model only says what it will do next and calls no tool, the agent asks it to go on (up to twice per run) instead of ending the turn there
• When part of a session's saved history written after a Workflow started is missing, resuming that Workflow now stops with the reason and asks you to run that work again, instead of continuing it
• Resume conversations with pending background results without unnecessary context limit errors
• Tables in assistant replies draw a line between every row
• /fork now works in a forked chat that was branched from a compacted chat, instead of failing with "source Goal state changed or failed validation"
• A session whose compaction checkpoint failed and could not be rolled back no longer re-summarizes the same history on every step; it keeps each compacted summary and continues
• A chat no longer stops saving until restart after a disk error while recording a workflow launch result
• A muse serve chat reopened after a crash cut the end of its session log now shows its history, new turns and approval requests again, instead of looking stuck
• A forked, rewound or side chat opened in the same app run as its source now saves its context checkpoints, instead of skipping them until the app restarts
• A reviewed skill's invocation-grant resolver now survives the post-login re-arm, so reviewed allowed-tools keep their preapproval instead of falling back to an approval prompt after a logged-out start
• /compact works repeatedly in resumed forked conversations
• Paging more sessions into the resume picker now stays linear instead of rescanning every loaded row for each new one, so long session lists keep loading pages at the same speed
• Resume conflict names the holding session server instead of suggesting killing it
• Resume picker notes that sessions with no turns are not kept
• When Muse can't read a session's saved history file, resuming a Workflow from that session now stops with the reason and asks you to run that work again, instead of re-running the Workflow from the start
• Resuming over muse serve a chat first recorded under the muse provider label that also used a plugin recording session events now keeps its earlier reasoning instead of dropping it as another provider's
• The TUI no longer erases the terminal's pre-existing scrollback when session rows arrive, matching gate-off
• Pay-as-you-go sessions restore a saved contributor model remapped at startup once the subscription check answers, instead of staying on the standard-price base
• /compact issued while viewing a background delivery now compacts the newest top-level run instead of the delivery run
• Resuming an Auto-review session with the reviewer explicitly off now proceeds under the recorded human override instead of refusing, matching gate-off
• A saved chat whose tool result could not be written to disk (for example on a full disk) now opens again without a restart
• Rewinding to an earlier turn no longer fails after an automatic history-preserving checkpoint in a conversation created by rewinding with an image
• A session left running through an auto-update now resumes with its history instead of coming back empty
• Gate-on resume settles the session's automatic name like gate-off instead of leaving the reopen unnamed
• A skill reminder prepared before you answered Muse's question or sent it another message is now dropped instead of reaching Muse as current advice, so Muse no longer acts on guidance your answer already settled
• A chat whose tool call could not be written to disk (for example on a full disk) while its result was written now opens again after a restart; only that turn is set aside, and Muse says so once
• Text you type while /new or /clear starts a fresh session no longer loses its first letter
• When the missing part of a session's saved history includes the record of how a Workflow started, resuming that Workflow now also stops with the reason and asks you to run that work again, instead of failing with a bare error
• Retrying session/fork with the same command after the host unloaded the idle fork, or after a host restart, now returns that fork and its history instead of an internal error
• A background task that finishes after you reopen a chat no longer stops compaction from saving checkpoints when the turn that started it could not be restored
• Session rows no longer render twice in the TUI transcript
• /new and /clear now clear the screen immediately instead of leaving the old chat visible for seconds
• /usage totals now include background work and break it out in a separate Observers row
• A failed turn now shows its error once instead of twice when partial output arrived before the failure finished
• Keep background work status available after reopening a side conversation or fork
• Pay-as-you-go sessions keep a saved contributor model from the first request, instead of mapping it to the standard-price base until the subscription check answers
• Reopening a saved chat while a background task it started is still running no longer stops compaction from saving its checkpoint, or the task's result from being recorded, when that task finishes
• Agent no longer repeats a pending question when a background task finishes

Performance

• In muse serve, reading the next page of a long agent message, a workflow child's prompt or a raw web-search result no longer rereads the whole chat while nothing new has been saved
• Reduce repeated history scans when opening forked sessions

1.4.10

New

• Added /blender to reconstruct reference images as editable Blender scenes

Improvements

• A background command that runs past 30 minutes now prompts the agent once instead of every 30 minutes; the agent schedules its own later check if it needs one
• The transcript shows "Waiting for background task" when the agent is prompted about a long-running background command, so you can see why it started working
• Computer Use makes fewer tool calls: it skips re-reading its own instructions, opens the app a task clearly points to without listing apps first, answers file and system questions with the shell, and does the task even when the screen already looks done
• Saved sessions can record whether a run was still starting when they were saved; nothing records it yet, so no session opens differently today, and once a later Muse records it, Muse versions released before that one will not open such a session
• Long analysis answers use short sentences and paragraphs instead of dense walls of text

Fixes

• Security: Sandboxed commands can no longer read or change sign-in details, settings, approval rules or blocked apps stored in ~/.config/muse, ~/.config/tbh or the same folders under XDG_CONFIG_HOME
• Security: The git skill now refuses to hide your untracked files with ignore rules or a stash when a task only asks for a clean tree
• Security: Hook input model_provider now names the vendor of the selected model instead of the connection it was routed through: it is meta only for a model the built-in Meta gateway catalog lists as Meta-owned, and is omitted otherwise, so a Claude or GPT session on the Meta gateway no longer reports meta
• A duplicate wait for a background command that is still running no longer holds the chat for its full requested wait
• A Workflow child that stops because its start record can't be saved, or because a different start record was already saved for it, now says in plain words that nothing new ran, that the other Workflow children keep running, and what to do next
• A Workflow task that was interrupted right after it scheduled a retry now resumes with its recorded model and effort instead of being held
• Resuming a session whose log cannot prove its last start is refused with a message naming the broken record instead of opening silently
• SessionStart hooks run on every resumed TUI session whose log proves its last start, reporting resume (or fork for a never-activated clone) as their source; a replayed copy that cannot prove it runs none and says so in its startup notice
• Spawn rejection hints now explain the reason in plain words instead of internal enum names
• Repository-wide Sapling file listings (hg files, hg locate, hg manifest) on EdenFS checkouts are refused before they hang, pointing at search or hg biggrep instead
• muse serve now shows the history of a session that Muse 1.4.8 is still running, instead of failing to read it until that session closes
• Sessions started through the session protocol honor saved reasoning effort
• Workflow messages and exit prompts keep the recorded name after resume
• A monitor you start now appears in the footer and in /tasks right away, even when the machine is busy or the disk is slow
• A forked chat whose history has a background-task notice delivered mid-turn now opens in apps and SDKs in more cases, instead of failing to load
• When a muse serve client resumes a chat whose saved history view file was deleted, the chat shows its history again instead of none
• Manual /compact now compacts sessions with MCP servers configured, instead of answering "no compactable run is available"
• An MCP server whose process stays alive but never responds during startup now fails with the server did not respond during startup instead of the generic operation timeout
• Switching a conversation between the desktop app and the terminal when they run different versions of Muse Code now catches up a short exchange made on the other side instead of rebuilding its saved history from scratch; the first open after updating from a release before 1.4.9 still rebuilds it once
• When a resumed Workflow task's first save fails before anything is written, only that task retries instead of the whole Workflow stopping; if the retry's save fails too, only that task fails and tells you what to do next
• A context compaction no longer skips its checkpoint when another session write lands while that checkpoint is being saved
• Running /compact in a chat whose turns all ended before any model request (for example, a message cancelled before Muse began preparing its model request) now reports that there is nothing to summarize instead of writing a summary checkpoint that could later let the chat skip setting up its developer instructions
• Resuming a thread whose saved history had fallen far behind now brings it up to date in that same resume, instead of showing no history and missing live replies until the next resume
• A session whose model reused a tool call id for two same-length results no longer becomes impossible to resume or compact after old tool results are cleared
• muse serve keeps answering other requests while a long session's history loads for the first time, and resuming a session that is still loading waits for it instead of reporting the session as in use
• Subagents now honor the reasoning effort set in their agent definition
• A turn whose final answer consists only of the "[Previous turn ended without an assistant reply.]" marker now gets one bounded re-prompt for a real reply, and the marker is stripped from run summaries
• Compaction keeps working after you reopen a saved chat, instead of summarizing again at every boundary and eventually failing with "could not prepare the conversation"
• The TypeScript and Python SDKs no longer mark a turn retracted, or drop its completion, when its retract is declined; in the TypeScript SDK, StaleDroppableMethod gains turn/retracted, so code that matches it exhaustively needs a new case
• Workflow control rooms and opened results keep the recorded workflow name
• Retrying a fork with the same command id now returns the original outcome instead of answering command_id_conflict, matching gate-off idempotency; reusing a command id with a different cut still conflicts
• Newly saved workflow history and live updates use recorded names, with "name unavailable" for older runs that have none
• muse serve keeps answering other requests while it resumes or forks a long session, opens a side chat on one, lists its pending approvals or reads one of its tool outputs, instead of stalling every other thread until that session's history is read
• A Workflow subagent that named your session's model keeps running after a restart even when that model is now hidden or missing from the model list, the same as one that left the model out
• Subagents use their definition's model, falling back to the session model with a notice when unavailable
• A long goal run no longer stops early when fresh next-step guidance replaces still-active guidance after new tool work; identical guidance still stops as before
• When muse serve starts with no saved model list and your account still needs a payment method, onboarding or age confirmation, turns now say what to do instead of asking you to log in again
• The transcript no longer shows a "◆ [Previous turn ended without an assistant reply.]" row — a reply containing only that resume marker renders nothing, and a real answer prefixed by it shows just the answer
• The bundled Three.js skill now gives a working WebGPU post-processing example instead of one that imports a file current three.js no longer ships
• Allow subagents to process pending results while the parent waits
• A Workflow resumed after a crash no longer shows a killed agent as still running when its relaunch is refused before it starts; the killed attempt's row now ends Failed and the Workflow completes
• Correct /compact token counts when tool results are cleared or reminders expire

Performance

• /btw, /side, and /fork open faster in very large compacted sessions
• Reduce memory use when loading sessions with repeated approval records

1.4.9

New

• --disable-request-user-input (TUI, muse exec, muse serve) withholds request_user_input from the main conversation (side chats keep it), so an unattended run never stops to wait on a question; a call naming it gets an unavailable-tool error instead. --yolo implies the flag on the TUI and muse exec
• Every MCP tools/call Muse sends carries the model's tool-call id in _meta.callId (and the idempotency key when set), so an MCP server can correlate it with the session's tool-call item and dedupe retries
• Session-protocol clients receive an approval/reviewing view event while the built-in Auto-review reviewer holds an approval, so a UI can show that the request is under review without asking the user to decide it
• Tool-call items in muse serve sessions carry the words a tool declares for the call, with running, done and neutral forms, so apps can say what a call does instead of showing the tool name

Improvements

• Session-protocol clients: view cursors are now minted in the v4: spelling; a cursor in the previous v3: spelling is refused once with the standard "reopen without a cursor" guidance, and a view cache saved under the previous generation is rebuilt on first use, so no client silently skips events now that the Auto-review hold folds its own approval/reviewing event into older sessions

Fixes

• Sapling commands now work inside the sandboxed shell on EdenFS checkouts
• Clear interrupt status when the interrupted run ends
• Long sessions no longer summarize the same history again at every turn when a context checkpoint cannot be saved
• Long sessions with an active goal that start more than one subagent compact their context again, instead of retrying a summary on every turn that never takes effect
• Contributor-mode requests with no served model list yet now consistently carry the contributor signal
• When muse serve starts without a saved model list and the provider rejects your saved key or sign-in, turns now fail with a sign-in-required error that apps can act on, and reloading the session works once the key is fixed, with no restart
• On a muse serve host running the native Auto-review reviewer, an approval the reviewer was holding is handed to the human client when the turn ends before the reviewer decides, and one recovered after a host restart is presented instead of staying hidden; a request the reviewer hands over says so (judgeEscalated)
• Rechecks conversation history and restored context before applying a background summary
• When a skill you named cannot load, the agent now stops and asks instead of improvising
• Hooks and MCP servers now receive PROVENANCE_PROVIDER_SCOPE when the app that launched the session set it
• Allow one more attempt to clear old tool results after reopening a session whose required compaction failed
• muse serve now closes the open approval of a subagent that has no session log of its own (for example one started by an earlier version) when a session that has not been compacted is resumed after a crash, so a late decision on it reports that it is already resolved instead of not found
• A /goal replace question now appears even while a run waits for admission, instead of the submit being silently dropped
• muse serve answers plugin/install and the plugin/marketplace* methods for an existing session it has not loaded with sessionNotLoaded, sessionInUse or sessionAmbiguous instead of sessionNotFound, so a client no longer treats a stored session as gone
• After a compaction whose history clean-up was refused, the next model step no longer fails with "Origin read requires valid checkpoint-suffix ..."

Performance

• While idle, muse serve no longer rewrites the lock file of every old empty session it has to keep, or re-reads most sessions it cannot list, every few seconds
• Typing stays responsive in long sessions with many subagents
• muse serve answers a session/resume that carries a known cursor by reading only the events after that cursor, instead of the whole session history. This includes a cursor taken from a streaming delta, which now resumes after the event it streams from. Such a resume of a session whose history exceeds the 64 MiB read limit now gets its new events instead of noneReason: projectionReadLimit

1.4.8

New

• Pick the permission profile when resuming a served session with the permissionProfile member of session/resume (and the SDK resume option); an id the host does not offer is refused before anything is written
• Muse now saves a note when cleanup after a finished turn keeps failing; an older Muse build cannot open a chat that contains this note, so update the app to open it (other chats are unaffected)
• The Linux sandbox helper plants in-namespace loopback listeners for listed local ports and bridges them to host loopback (delivery half of network.local_ports; the profile verdict map itself lands with the agent side)
• Session protocol now serves the model's narration between tool calls as agentMessage items, and every completed agentMessage says whether it is commentary or the final answer (messagePhase); the Python wire-types package has the matching typed field; view cursors saved by an earlier version are refused (-32011 with reason missingAnchor; the resume guide covers the reopen)
• --preset empty starts a session with no built-in tools; the model gets only the tools of MCP servers you configured
• Apps connected to muse serve can follow a running subagent live by subscribing to its session, and unsubscribing from a subagent session no longer fails
• Monitor feed lines are recorded as monitorFeed items; builds older than this change cannot open a chat containing one (updating fixes it)

Improvements

• skill/list rows include an optional title with the name a skill declares for people to read, beside the unchanged displayName
• When a plugin hook finishes, helper processes it left running in the background are stopped so the plugin's installed files can be released; hooks configured in settings keep their existing background-helper behavior
• SessionStart hooks report clear and compact as their source on the runtime's own /clear and compaction boundaries, so a hook that matches only startup no longer runs there
• A permission-profile change made over the session protocol records the client's name on the durable audit fact and in the experimental session/permissionProfileChanged notification; a forked session's own fork entry carries no name until the child records a change of its own, and the fork is refused when the parent's retained history and live state disagree on the recorded name; an older Muse build cannot open a chat whose permission profile a newer build changed, so update the app to open it (other chats are unaffected)
• Auto-review now hands an action to you for approval once the reviewer has used 15 steps without reaching a decision, instead of letting a single review run for dozens of steps and use many tokens

Fixes

• muse serve sessions started after the startup model list finishes loading, or after a login, use the sandbox the server checked at startup instead of checking it again for every session
• Repeated status lines between commands no longer flood the transcript; the commands fold into one row
• Resuming a session after its latest run was interrupted keeps the earlier title and history readable
• Resuming a session keeps earlier run history readable after a later run replaces it
• Paging through a large tool output in a muse serve client no longer re-reads the whole session for every later page while the session log is unchanged
• Resuming a session again in the same muse serve process after its earlier load ended without a clean shutdown now reports the session as in use instead of risking a damaged session log
• Forking a session with no turns yet no longer fails when background cleanup runs at the same moment
• A question asked during goal-carried work without its own timeout now times out after 5 minutes (recorded as timed_out; no answer is chosen for you) instead of parking the run indefinitely; touching the prompt still cancels that safety deadline, and ordinary interactive questions keep waiting with no deadline
• Claude plugins whose command files are up to 256 KiB now install
• The verify reminder no longer pushes the agent past a question it asked you; it nudges only when the agent calls work done without running it
• Sessions keep the selected model's output limit after model changes and reloads
• Resuming a session keeps compaction usable after a later run takes over
• Over muse serve, a session that lost saved records now opens with the rest of its history instead of failing with "projection unavailable"
• The startup trust prompt no longer times out under terminals that report the cursor slowly, such as Zellij
• Preserve measured context usage when resuming a session
• After Muse restarts, a Workflow agent call whose saved start record is missing or incomplete, or whose agent definition is gone or no longer matches how the call started, now fails on its own with a result that says what happened and what to do next, instead of failing the whole Workflow
• Running plugin hooks and MCP servers keep their original installed files available through completion and child cleanup when a newer plugin version is installed
• Workflow subagents that pick their own model keep working when you resume a session with --model and later resume it without the flag (sessions resumed with --model on an earlier version are not repaired)
• Startup notices for MCP servers the managed policy does not admit now appear even when a required MCP server fails to start
• sl and hg commands that use globs or braces, such as sl status *.rs, now ask for approval like git commands do
• Read-only Sapling commands such as sl status, sl log and hg diff are now treated like their git equivalents
• Resuming a workflow after tbh stopped no longer fails the whole run when an agent call was still waiting for a free agent slot; that call now starts normally
• muse resume no longer refuses a session whose journal head was pruned when a checkpoint anchors the suffix; the no-anchor case names the recovery
• Sessions that muse serve recorded under the old muse provider label keep their reasoning after a model change and a restart, instead of dropping it or failing every turn once compacted
• Resuming a workflow no longer requires repeating its name
• Runtime-owned child runs (branches, side chats, subagents) no longer re-fire the root session's SessionStart hooks
• Prompt hints and away recaps wait for a session's SessionStart hooks to finish before they run
• Fix completed workflows reappearing as running after resuming a compacted session
• Plan files under .agents/plans/ no longer raise an approval card — the directory is an ordinary writable workspace path, while the rest of .agents stays protected
• When Muse resumes a Workflow after a restart and the script finishes without waiting for an agent call that Muse held back, Muse now tells you which call did not run, why, and what to do next, instead of reporting plain success
• When a chat is stuck retrying a save that failed, ! shell commands, /compact and new turns over muse serve now fail at once with the "saving failed … retrying automatically" message instead of a busy answer
• muse serve now re-asks a pending approval with approval/request when a multi-stage approval moves on to its next stage, and when a client replays its session/start after a host restart, so session protocol clients see the prompt instead of a turn that waits forever
• muse exec waits for context compaction to finish before exiting, so resumed sessions keep their compacted summary
• On Windows, renaming a session now fails with a plain "not supported on this platform" error (session/rename is not supported on this platform) instead of an internal one, and a client that requests the new sessionRename capability at connect time learns that rename is unavailable there. CapabilityName gains a SessionRename variant; exhaustive matches on it need a new arm
• A session whose MCP startup could not be audited (its open record was missing or unreadable) now shows one startup notice for each MCP server the managed policy did not admit, beside the audit-failed notice; a session whose every server was refused, which showed nothing before, now shows those notices too
• /goal changes no longer freeze the TUI on long sessions; repeat Goal edits now re-read only newly committed run records instead of rescanning every run stream
• Compacting a session keeps the request detail the summary needs, so manual compaction rebuilds the exact prefix instead of falling back to a bounded summary
• Startup selection now skips a PATH-discovered system Bubblewrap copy that does not advertise every required capability and uses the embedded copy instead; an explicit override missing one fails closed naming the flag
• Resending a request after a restart returns the original result instead of running it twice
• With contributor mode ON, requests route to the family's -contributor model as soon as a fresh served catalog shows it — including mid-session logins, background refreshes, and late-appearing siblings — instead of sticking to the base model on a stale list
• A session whose saved images or videos have wider folder or file permissions than the app creates now resumes, and its videos still send
• tbh serve -c settings such as endpoint_transport.base_url now reach the model provider instead of being silently ignored
• Opening the transcript link of a memory-only reminder helper, while its chat is open and the helper ran since the chat was opened, now says the helper kept no transcript and names its chat, instead of "session not found"
• Explain context compaction failures in plain language
• Over muse serve, retrying turn/start with the same command id but a different message or options while that turn is still parked (replacing a running turn, waiting for the running turn to finish, or waiting behind a reminder) now fails with command_id_conflict instead of being treated as the original turn
• Sessions named more than once (an automatic name counts) open with their full history every time instead of sometimes showing an empty transcript
• Keep /side and /btw progress visible while a side chat is starting
• SessionStart hook runs no longer appear as hookRun items in the session view stream
• Concurrent resumes of a muse serve session no longer run its SessionStart hooks twice
• Turning off Contributor mode in settings now fully opts out, including background requests
• Keep pending results from an earlier turn intact when the next model response is cut off
• A compacted chat whose saved history file was damaged or deleted shows its full history again after the next resume instead of staying empty; a forked chat in that state now says why it cannot resume instead of opening with no history
• The permission-profile refusal announced early in the 1.4.6 notes takes effect in this release: profiles the live session cannot enforce are now refused when chosen at launch (--permission-profile or the configured default) instead of silently collapsing to read-only; the refusal names each offending rule with the reason and a remedy (remove or adjust it, or set the temporary escape hatch to run with it unenforced and a warning). Profiles that keep a built-in profile's filesystem rules, :unrestricted included, keep working; profiles that add or change filesystem rules (deny rules included), add workspace_roots, or add Unix-socket rules are refused — most users can delete those rules and relaunch

Performance

• Long sessions no longer spend more time on every frame keeping the session token totals up to date
• Large batches of parallel tool calls now land their results without rescanning the transcript for each one
• Bash command results no longer repeat the command back to the model, so a long inline script takes up context once instead of twice
• Task panel refreshes stay fast in long sessions with many finished tasks
• Opening a long older session for the first time now rebuilds its history many times faster

1.4.7

New

• muse serve now tells session protocol apps on initialize whether this machine can enforce the shell sandbox and, when it cannot, why; the Python wire-types package has the matching typed fields
• A skill can set metadata.display-name in its SKILL.md; the transcript's skill rows and the /skills list then show that name instead of the skill's id
• Terminals that support program status reports (OSC 7501) can now show whether a session is working, waiting for you, or done
• The agent can now generate and edit images when your model catalog includes an image model

Improvements

• /goal cancel and /goal stop now clear the goal like /goal clear, and /goal subcommands ignore case
• /goal <objective> now asks before replacing an unfinished goal; Esc keeps the current goal and your typed text
• Menus consistently use ⟩ to mark the focused choice

Fixes

• Resuming a session saved by an older version no longer sets aside one earlier turn's history on the next resume, including sessions an affected version already resumed
• Manual /compact on a short conversation now summarizes the full history instead of installing an empty summary beside it
• Stopping a subagent the agent is waiting on no longer makes the agent report the stopped result again in an extra turn
• session/list now includes a session that another Muse Code process, such as an open TUI, is using; its details catch up as that session settles, and resuming it is still refused as in use
• Long-running muse serve sessions no longer use a little more memory with every turn
• A context compaction now always saves its resume checkpoint together with it; if the checkpoint cannot be written, the compaction is skipped and retried at the next step instead of leaving a session that resumes slowly
• Clarify known turn errors while preserving sign-in guidance
• Preserve pending tool results when a model rejects a large request
• When a turn dies and its failure cannot be saved, a message sent after the quick retries run out (about 30 seconds) now returns a clear "saving failed: <cause>; retrying automatically" error instead of being silently held, and the chat unlocks by itself as soon as a retry (once a minute) saves the failure
• When a tool panics with a text message while the turn waits on it, its failed result now includes that message (tool task panicked: <message>) instead of only tool task panicked
• Forked conversations can continue after their first compaction
• muse serve refuses a session whose permission profile needs the automated reviewer up front, with the reviewer-unavailable reason, when it starts without a saved model list and then falls back to logged-out mode, as it does on a logged-out start
• After /goal resume, the agent can start workflows again when your settings allow them, instead of being refused
• Forking a session whose earlier turns were folded into a summary, or one forked right after its rules were updated past a compaction, now gives a fork that every client can open
• Closing stdin on a muse serve --no-session-log host while a turn is running now sends that turn's turn/completed (cancelled) before session/closed, instead of leaving the turn without a terminal
• Retrying Stop while a workflow is recovering preserves its original acknowledgement
• Workflow subagents that pick their own model now start in sessions launched with --yolo or with approvals off

Performance

• Resuming a session no longer re-reads every finished agent, so sessions that ran many agents open much faster
• Resuming or running a session with many workflow agents spends less time refreshing the workflow control room
• Resuming a session whose workflows ran many agents starts its runtime much faster

1.4.6

New

• Session protocol clients can install plugins and add, update, or remove marketplaces, with change notices after each success
• muse serve runs its own reviewer, honors a configured permissions.default_profile: ":auto-review", and a host with no default permission profile configured and no sandbox flags now starts new sessions on Auto-review instead of Ask me when a reviewer is available (a --disable-sandbox or --sandbox-network host keeps human approval; set permissions.default_profile: ":ask-me" to keep it everywhere)
• A named toolset (run.toolset) can now select a server's MCP tools with a trailing *, such as mcp__docs__* for every docs tool or mcp__docs__search* for tools whose names start with search
• task/list reports the session's running background tasks over the session protocol
• Contributor mode is subscribers-only and routes each model family to its served contributor model; without an active subscription or a served contributor model the toggle stays hidden and requests go out unchanged
• A PostToolBatch hook now runs once after each committed tool batch with the ordered tool calls; a handler can block the batch with a reason, stop the turn, or add context that is held until the turn's completion hook settles
• A StopFailure hook now runs once when a turn ends in a final model failure and receives the failure category and safe details
• Choose the permission profile for a served session at start with the permissionProfile member of session/start; an id the host does not offer is refused before the session exists, and a session served without a signed-in provider now lists the profiles the host policy excludes as unavailable, as a signed-in host does
• Managed background shell launches under Linux proxy-only networking now carry a note that ports they bind are reachable only inside that launch, naming --sandbox-network enabled for serving the host
• Apps using the session protocol can resume a paused workflow and replay the same receipt when retrying
• Turn retry notifications now include the failing provider attempt's details (provider system, error kind, and HTTP status) for clients that read them
• Approval prompts point to /permissions for changing approval defaults
• Contributor mode is now on by default for subscribers, and after your first login inside the app the contributor-mode notice shows right away, before any request is sent in contributor mode; turn it off any time in /settings

Improvements

• The "Worked for" line shown after a long turn now ends with the date as well as the time, such as Worked for 2m 29s · 9:34 AM · 8/Oct
• If you come back while a run is still going, the automatic recap now appears once that run finishes instead of being skipped
• The host-network sandbox mode is now spelled unrestricted (--sandbox-network unrestricted, network.mode: unrestricted); enabled still works as a deprecated silent alias
• The automatic recap shown when you come back now appears after 2 minutes away (was 3) and once the session has 2 of your messages (was 3)
• session/read and view/page on a finished subagent's session now return its history instead of no history or a refusal
• PostToolBatch hook feedback that ends a turn reaches the model on the next user turn, exactly once and in handler order
• Pressing Esc before the model answers now gives back your message together with every message you queued after it, as one draft in the input box, images included, instead of returning only the newest queued message
• Chat answers now favor diagrams drawn with text characters over raw Mermaid source
• After an interruption, a Workflow task whose model and effort choice was never recorded is held with a reason instead of restarted, and recovery keeps the recorded effort even if settings changed
• Agent definitions can choose a model and reasoning effort for delegated Workflow tasks
• When /goal replaces an earlier goal, the agent is now told which goal was replaced, so it no longer mistakes the replacement for a cancellation

Fixes

• Security: Ask me and Auto-review now ask before running find -delete, find -exec rm (such as find -exec rm '{}' \;) or find -exec '{}', as they already did for find | xargs rm, instead of running it without asking; find -exec with plain programs such as grep or chmod still runs, while some other launches such as find -exec sudo rm -rf '{}' + or find -exec sh '{}' \; now ask too; a find -exec sh -c '…' script can still run without asking, even one that deletes files
• Security: Ask me and Auto-review now also ask before running a find -exec that reaches rm or the matched file through sudo, env, setsid, nice, nohup, timeout, stdbuf, time, command or xargs (for example find -exec sudo rm '{}' \;), instead of running it without asking, and before a find -exec sudo whose options it cannot read, even when the launched program is not rm (for example find -exec sudo --bogus cat '{}' \;); a known wrapper that launches a program such as cat (find -exec sudo cat '{}' +) still runs, and so does the matched file itself ('{}') behind another wrapper such as ionice or doas
• Security: Ask me and Auto-review now also ask before running a find -exec that launches rm behind a wrapper they do not otherwise know, such as ionice, doas, flock or chrt (for example find -exec ionice rm '{}' \;); find -exec chmod, mv, sed -i and grep still run without asking unless the command itself would ask (an argument named rm alone does not make them ask), and so does such a wrapper launching the matched file itself (find -exec ionice '{}' \;)
• When another program replaces a session's lock file while Muse is running (for example a sync between machines), side chat and fork now explain what happened and that restarting the Muse process holding the session fixes it (the message names it), instead of a cryptic lock error
• Sessions with an active /goal now save their resume checkpoint at compaction instead of losing it to goal usage tracking, including after the goal is paused, resumed, or replaced. If goal usage truly cannot be recorded, that compaction skips its checkpoint with the reason in the session log, and the next compaction tries again
• Subagent rows, queued counts, and child views now stay in sync when the experimental TUI client is on — foreign assistant turns no longer stamp the live answer, sent input feeds the same queue the counts read, and resumed sessions reseed their child threads
• Keep an image tied to its original message when background compaction drops a video that could not be sent with it
• /plan on a small change now returns a plan instead of making the edit
• Resuming a long session no longer marks an already-finished turn as cancelled, and the session keeps saving resume checkpoints afterward instead of replaying ever more history
• When compaction cannot safely keep part of a conversation, such as a video, it now reports a normal compaction failure that tells you to start a new session with /new or /clear instead of an internal error
• Keep an image tied to its original message when older tool output carried over from earlier turns is cleared from context
• A logged-out muse serve host now gives new sessions your configured permission profile and sandbox flags instead of silently starting them as Ask me; an Auto-review profile is refused with the reviewer-unavailable reason
• A skill already read in an earlier run of the same session is no longer reminded again in the next run; the reminder observer and admission now honor prior-run reads
• The published session protocol schema now accepts the null the host already sends for session/goalChanged.goal, session/branchChanged.branch, session/modelChanged.providerId, session/modelRouteUnserved.providerId, session/tokenUsage.modelId and a failed skill import's id, so clients that validate host messages against it no longer reject them; in the generated TypeScript and Python types these members are now required and may be null
• Messages sent during a reply still run after /goal pause or /goal clear
• Stop automatic continuation when a reminder is rejected, snoozed or fails without fresh guidance
• Resuming a session with a very large saved snapshot now reports the snapshot size when it cannot be read
• After a rewind or a return from /side, a finished subagent hidden from the current subagent tree view no longer reappears when its workspace cleanup is reported
• Permission profiles with filesystem rules the session cannot enforce (extra file or home-directory paths, workspace subrules, deny patterns, altered temp or root accesses, missing minimal read set, added workspace roots, or socket rules) are now refused at selection with the reason, instead of silently running read-only; setting MUSE_PERMISSION_PROFILE_FAIL_OPEN=1 restores the old read-only fallback with a startup warning
• Limit retries when saving a Monitor's final state and report when it cannot be confirmed
• In containers where the sandbox cannot start, trusted workspaces can create session and subagent worktrees again, and untrusted workspaces get a clear refusal instead of a Git error
• A network request that arrives while an identical request from the same tool call is already waiting for your answer now joins that prompt instead of opening a second one and running a second Auto-review; a different command in the same run keeps its own prompt
• Long sessions that get a scheduled or background notification at almost every step now resume quickly from their latest compaction instead of rereading most of the session log
• Queued /goal edits now deliver in the order they were accepted even when the system clock moves backward between them, instead of replaying newest-first
• A workflow launch that was cancelled before it started is now recorded as cancelled; a saved session whose history leaves such a launch in doubt refuses to open with an error naming the launch instead of guessing, and a session whose cancel hit a storage error part-way reopens and finishes that bookkeeping instead of refusing to open
• When picking up a handed-over or resumed plan, the agent re-checks the plan's next step against evidence that arrived after the plan was approved before starting long work on it
• Clear leftover spaces when loading and indexing messages disappear from the session picker
• The published session protocol schema now accepts the null the host sends for a root session's sideFrom and an unnamed session's snapshot name; both stay optional in the generated TypeScript and Python types
• Closing the terminal while a hook is still running now stops the hook and the processes it started, instead of leaving them running after Muse Code exits
• Continue unfinished work after a failed goal check only when usable guidance remains
• Stopping or backgrounding a task that already finished before the session was reopened now gets the already-finished answer instead of invalid_target
• TUI /export falls back to the OS temp dir when the target directory is unwritable, and transcript failures name the intended file
• Starting with no model configured and a cold model cache now resolves the default model from the freshly fetched catalog instead of stopping with a missing-default error
• A renamed session now updates in an open session picker right away
• When a turn fails while draining hook continuations after a PostToolBatch commit and the first write of its Failed terminal does not land, the run is now closed with exactly one durable Failed terminal instead of being left open
• After a rewind or a return from /side, a finished subagent hidden from the current subagent tree view no longer reappears when a new subagent with the same role starts or a late message to it is settled
• Clearing a goal whose store cannot be read now reports the store as unavailable instead of claiming no goal is set
• Escape returns directly to the composer from a workflow opened below it
• Resumed older sessions and subagents now save a resume point at every compaction, and sessions holding an older-format resume point reopen without rereading the whole log
• If Muse cannot read a chat's session log when the chat starts, the chat now fails to open with an error that names the failed read, and reopening retries it. Before, the chat opened but /new, /clear, /resume, fork and rewind failed until Muse restarted, and the next resume wrongly reported that the previous run had ended abnormally
• When a disk fault left a live permission-profile change half-written, Muse could fall back to the old permissions even though the change might already be saved. Muse now finishes the interrupted write first: the change completes normally when that works, and otherwise the session stops accepting permission changes instead of falling back to the old permissions
• -c session_retention_days=N sets retention for one run
• Approval prompts open at the first choice instead of inheriting a previous Abort highlight
• Session lists no longer fail after an interrupted update
• File tools accept relative paths with .. that resolve inside an allowed workspace root instead of refusing them
• Improve context compaction timing across turns and after clearing old tool results
• The file-tool watchdog row no longer promises "Esc to cancel" while an async question owns Esc; the hint hides until the question editor closes
• Stopping a background task on the first reopen after the app closed unexpectedly now gets the already-finished answer instead of invalid_target
• web_fetch now honors a live Unrestricted permission profile on every fetch — fresh, switched, and resumed sessions skip the per-host approval like --yolo — and reads profile static network targets before session rules, matching the shell order
• Editing or pausing a goal no longer resets its progress-reminder timing
• muse serve now prints a line naming any session whose saved view could not be brought up to date at shutdown, instead of exiting with no sign of it
• Under muse serve, a running or finished subagent or workflow child's conversation is now readable over session/read and view/page from any client
• Monitor watches over the new session connection now show their end marker (Monitor "name" — ended / — failed with the reason) and resume without doubling rows
• Changing a muse serve session's permission profile while it runs now keeps the approval mode the client selected
• Session lists stay available after an interrupted upgrade
• Transcript rows left in-progress when a turn ends now settle as failed instead of hanging
• Final answers report only the quantities asked for; extra accounting goes to a linked file instead of the chat answer
• A workflow child that the model provider rejected as rate limited, overloaded or with a server error now reports that as its error kind
• Opening /permissions immediately after session start no longer fails with "Session permission state is incomplete."; the picker waits for permission state to load
• Gate-on /new and /clear no longer stall ~30s on sessions that start no MCP servers; the fresh-session handoff settles as soon as the host reports no startup task instead of waiting out the full settle bound
• muse serve answers the app right away on a machine with no saved model list, instead of waiting for the model list download; the model picker and new sessions wait for the list
• A session whose Workflow launch was cancelled before its owner bound it now shows the same "history unreadable" state whether it is read from the session cache or loaded in full
• Resumed workflows keep their recorded names
• A Notification hook no longer freezes the session while an always-allow rule is being saved to a stalled disk; the approval reports the save timeout instead

Performance

• muse serve answers initialize without first scanning every retained session
• Resuming a session whose workflows ran hundreds of agents spends far less time rebuilding the workflow view