Hecate v0.5.0-alpha.5

Highlights

• Improves the phone chat composer so attachments, dictation, setup state, and
  Send remain readable and usable at narrow widths.
• Makes Return insert a newline on phones, keeps Send as the primary touch
  action, and restores focus after slash-command settings; desktop keyboard
  behavior is unchanged.
• Adds required iOS Simulator and Android debug compile gates to relevant pull
  requests and before tagged releases publish artifacts. A separate manual CI
  workflow produces downloadable validation builds retained for seven days.
• Produces a checksummed four-file release-delivery proposal for maintainer
  review on the protected default branch, verifies the exact deployed updater
  manifest, and prevents Debian package internals from being uploaded as
  release assets.

Security

• Updates the locked quinn-proto dependency from 0.11.14 to 0.11.16,
  which includes the fix for
  GHSA-4w2j-m93h-cj5j.
  Hecate's current reqwest feature set does not enable HTTP/3, so Quinn is not
  in the active compiled dependency tree; this update removes the vulnerable
  0.11.14 version from the lockfile and protects future feature changes.

Breaking Or Risky Changes

• No API, schema, storage, or configuration migrations are required.
• Mobile validation produces an unsigned iOS Simulator app and an Android APK
  debug-signed by the ephemeral CI runner. Neither is attached to the GitHub
  Release or suitable for store delivery.

Verification

• just verify
• Pull-request desktop packaging on macOS, Linux, and Windows
• Pull-request iOS Simulator and Android arm64 debug builds

Known Limitations

Hecate remains public-alpha software. macOS Apple Silicon is the launch-tested
desktop path; Linux and Windows bundles are CI-built but have not yet completed
real-machine installation smoke tests.

The experimental Linux desktop bundles include transitive glib 0.18.5
through Tauri's GTK/WebKitGTK stack. It is affected by
RUSTSEC-2024-0429 /
GHSA-wrw7-89jp-8q8g.
Hecate and dependency usage scans did not find the affected string-variant
iterator path, but that is not a formal reachability proof. A compatible fix
requires the upstream Tauri/GTK stack to move to glib 0.20 or newer.
Operators concerned about the advisory should prefer the standalone Go archive
or Docker image.

See the
complete known limitations.

Hecate v0.5.0-alpha.4

This alpha adds the source-buildable mobile companion and remote-control path,
strengthens External Agent recovery and readiness guidance, and makes Hecate's
operator surfaces work better on phones and with Markdown-heavy project
evidence.

Highlights

• Added iOS and Android companion projects that sign in through Hecate Cloud,
  list hosted runtimes and remote-enabled desktop instances, start eligible
  hosted runtimes, and open the selected runtime's remote-safe Hecate UI.
• Added opt-in iPhone notifications for approval requests and completed or
  failed runs. Notification payloads contain only opaque identifiers and
  generic event kinds.
• Improved the existing desktop Cloud relay with heartbeat and reconnect
  handling plus remotely supervised External Agent sessions that use the
  desktop user's existing Codex, Claude Code, Cursor Agent, or Grok Build
  login. Credential files remain on the computer.
• Made Chats, Projects, Tasks, Connections, Providers, Settings, Usage, and
  Observability responsive and touch-friendly at phone-sized widths.
• External Agent turns now continue after an admitted browser or SSE connection
  closes. Reopen the chat to follow the same turn, use Stop to cancel it, or
  quit Hecate to shut down the runtime and drain active agents.
• hecate acp serve now accepts bounded workspace-local file references while
  rejecting missing files, directories, symlinks, non-local authorities, and
  paths outside the ACP session workspace.
• Cursor Agent container packaging now uses versioned x64 and arm64 release
  artifacts with reviewed SHA-256 pins. Scheduled update automation opens a
  review proposal and fails closed on unexpected artifact mutation.

Coding-agent harness and self-documentation

External Agent discovery remains passive and now refreshes through one
authoritative catalog path. Available means Hecate found an eligible
executable; it does not mean the agent is authenticated or ready. Optional
diagnostics start a disposable session and remain advisory. Every real chat
performs a fresh ACP handshake, and prompt-time vendor readiness remains
authoritative.

Connections and Chat now explain what was discovered, what an explicit
diagnostic may execute, what evidence is advisory, and what a real session will
verify. Project decision notes, collaboration artifacts, work-item evidence,
memory, and memory suggestions render Markdown instead of exposing raw markup,
making dogfood scorecards and tool references easier to review.

The coding-tool posture is unchanged in this release: bounded grep and
glob, optional semantic inspection through gopls or TypeScript 7+'s native
LSP, and optional structural search through ast-grep. Hecate still does not
bundle those optional language servers or ast-grep; Tree-sitter, a native
rg tool, and additional semantic language providers remain follow-up work.

Operator and accessibility improvements

• Added explicit Read aloud controls for settled Hecate and External Agent
  responses when the browser or desktop webview reports a local speech voice.
  Hecate flattens Markdown, omits fenced code and non-response activity, and
  does not send speech text through a model, adapter, or backend route.
• Project Markdown now renders headings, lists, emphasis, links, code, task
  lists, and tables, while timeline previews use readable plain text.
• Narrow-screen navigation, menus, pickers, draft focus, overflow behavior,
  touch actions, keyboard visibility, live status announcements, and reduced
  motion received dedicated coverage.
• Delayed notifications, reconnects, and terminal settlement can no longer
  overwrite newer durable chat state.

Verification

• The full local just verify gate passed on the release tree: documentation
  and environment checks, Go unit tests, vet, race tests, Docker-backed E2E,
  2,690 UI unit tests, all 112 browser E2E tests, and the production
  embedded-UI build.
• The exact source tree passed required CI, including Linux race tests, Windows
  and macOS bootstrap coverage, Docker smoke, TypeScript unit and browser
  tests, Tauri Rust and mobile-shell tests, fake-upstream and Ollama E2E,
  documentation checks, and the macOS, Linux, and Windows desktop bundle
  matrix.
• The non-publishing GoReleaser snapshot built all four archive targets and
  both release-image architectures.
• The compatible Hecate Cloud control plane was deployed with a verified
  production schema marker, and its authenticated post-deploy smoke passed with
  disposable invite mutation and tester rehearsal.

Known limitations

• Hecate remains alpha software. APIs, remote contracts, and persisted schemas
  may change before v1.
• The standard Hecate release publishes Go archives, Docker images, and desktop
  bundles. It does not publish signed iOS IPA or Android AAB artifacts. The
  mobile projects are source-buildable; store credentials, metadata, privacy
  declarations, production signing, and real-device release smokes are separate
  gates.
• Mobile sign-in is memory-only and requires browser approval again after the
  app process terminates. Android FCM notifications and resource-specific
  notification deep links are not implemented. Production APNs delivery has
  not yet passed a signed real-device release smoke.
• A desktop instance is reachable only while Hecate remains open with Remote
  access enabled. The phone does not run agents, workspaces, provider
  credentials, or a Hecate sidecar.
• macOS Apple Silicon remains the manually exercised desktop path. Linux and
  Windows bundles are experimental; Windows is not code-signed and may show
  SmartScreen warnings.
• The experimental Linux desktop bundles include transitive glib 0.18.5
  through Tauri's GTK/WebKitGTK stack. It is affected by
  RUSTSEC-2024-0429 /
  GHSA-wrw7-89jp-8q8g.
  Hecate and dependency usage scans did not find the affected string-variant
  iterator path, but that is not a formal reachability proof. A compatible fix
  requires the upstream Tauri/GTK stack to move to glib 0.20 or newer.
  Operators concerned about the advisory should prefer the standalone Go
  archive or Docker image.

See the
complete known limitations
and
mobile companion guide.

Changelog

• 98cf40f chore(tauri): stamp version 0.5.0-alpha.3
• 07b899e test(ui): assert agent launch disclosure
• 4498c70 fix(agents): disclose and bound process launches
• ef2a2e6 test(agents): mirror supervised launch context
• 730300a feat(agents): harden external app discovery
• 5a53f85 feat(ui): add browser dictation routes
• 8bca2b1 fix(ui): render update release notes as markdown
• 79b8d5b fix(models): fence dashboard catalog refreshes
• 1500d4b fix(models): order concurrent catalog refreshes
• 2315f1c fix(models): preserve verified catalog state
• 23d279e feat(models): verify configured tool support
• 46d4784 deps(ui): refresh bun lockfile
• 0075289 deps(ui): bump @testing-library/jest-dom from 6.10.0 to 7.0.0 in /ui
• 9477827 deps(ui): refresh bun lockfile
• 6819673 deps(ui): bump oxlint-tsgolint from 0.24.0 to 0.25.0 in /ui
• 8992cca deps(ui): refresh bun lockfile
• ff07abd deps(ui): bump oxfmt from 0.58.0 to 0.59.0 in /ui
• 6b1ad7a deps(website): refresh bun lockfile
• 7915ccd deps(website): bump oxlint-tsgolint from 0.24.0 to 0.25.0 in /website
• 9acf0da deps(website): refresh bun lockfile
• 97fc197 deps(website): bump oxfmt from 0.58.0 to 0.59.0 in /website
• 71c2588 deps(go): bump modernc.org/sqlite from 1.53.0 to 1.54.0
• 037cdd3 deps(go): bump golang.org/x/image from 0.41.0 to 0.44.0
• 99950af deps(go): bump mvdan.cc/sh/v3 from 3.12.0 to 3.13.1
• 279c398 ci: bump actions/setup-go from 6 to 7
• ec8e3e5 feat(chat): support frozen agent preset snapshots
• 4c01eee ci: run PR checks when drafts become ready
• ce63a63 fix(ui): preserve scheduled filter during refresh
• ba02b9e fix(ui): restore focus from hidden row actions
• a55f47a fix(tasks): preserve scheduled approval provenance
• a0ae2d1 feat(tasks)!: add durable schedules and shared workspaces
• f46c3bc docs: update release references [skip ci]
• 5c910d8 publish updater manifest for v0.5.0-alpha.2
• 63a0a77 chore(tauri): stamp version 0.5.0-alpha.2
• c044907 test: stabilize chat restore fence
• a6c01a9 test(codeintel): synchronize lifecycle fixtures
• 4fdd778 fix(codeintel): normalize Windows provider paths
• 5324db4 fix(ui): require complete approval summaries in chat
• 110afb4 fix(runtime): preserve approval provenance across resumes
• 02c20b8 fix(sandbox): preserve exact executable selection
• 462fee2 fix(codeintel): harden cross-platform tool execution
• 65bc65d fix(ui): preserve chat drafts across rapid navigation
• a4c30ef fix(runtime): harden code intelligence and agent recovery
• 958d302 feat(runtime): add native code intelligence tools
• 9fcb6ac docs(release): generalize alpha train
• 5bd4f63 feat(acp): serve Hecate as a local ACP agent
• 4d25317 test(agentadapters): refresh cursor installer checksum
• a319976 fix(docker): refresh cursor installer checksum
• ddc5274 docs: remove Go Report Card badge [skip ci]
• 55aeba1 fix(tauri): remove local-first splash positioning
• 86dcba6 fix(tauri): clarify splash positioning
• e74e5d7 fix(ui): improve dictation readiness accessibility
• 36ed3bd feat(dictation): surface route readiness
• 9ebd6e0 fix(projects): restore project deletion
• f87c36e docs: update release references [skip ci]
• b4233b6 publish updater manifest for v0.5.0-alpha.1

Hecate v0.5.0-alpha.2

This alpha expands Hecate's coding-agent harness and tightens the runtime boundaries around supervised tool execution.

Highlights

• Added native read-only code intelligence for Go and JavaScript/TypeScript: capabilities, definitions, references, hover, document/workspace symbols, and diagnostics through gopls and TypeScript 7's native LSP.
• Added optional structural search through ast-grep, while keeping native bounded grep for workspace-confined text search and glob for file discovery.
• Added hecate acp serve, allowing ACP-compatible clients to use Hecate as a local agent backed by its gateway and operator controls.
• Hardened agent-loop recovery, cost-ceiling enforcement, approval provenance, action summaries, executable selection, subprocess cleanup, and cross-platform code-intelligence execution.
• Improved the operator experience with durable chat drafts during rapid navigation, sanitized pending-action summaries with explicit incomplete warnings, restored Project deletion, dictation-route readiness and accessibility, and clearer desktop startup behavior.

Breaking or risky changes

• Resumed or retried tool calls now fail closed when approval or dispatch provenance is incomplete or ambiguous. Some legacy/incomplete runs may require a fresh approval instead of being replayed automatically.
• Reaching a task's exact cost ceiling now stops consequential processing before final answers, approvals, or tool dispatch. Raise the ceiling and resume when additional work is intended.
• Code-intelligence providers are trusted local executables. Hecate accepts only allowlisted providers discovered from a trusted global PATH or configured by exact operator-owned path, with bounded protocols and results.

Migration notes

• No storage migration is required.
• gopls, TypeScript 7 tsc, and ast-grep are optional, operator-managed dependencies; Hecate does not auto-install them. Native grep remains available when semantic or structural providers are absent.
• Existing TypeScript 5 project tooling is not replaced; TypeScript 7 is required only for Hecate's native TS/JS LSP integration.

Verification

• Pull request CI passed on Linux, macOS, and Windows, including Go race tests, Docker smoke tests, model/upstream E2E tests, 2,434 UI unit tests, 103 browser tests, and all three unsigned desktop bundle builds.
• All just verify gate components passed across the umbrella run and an isolated UI rerun, followed by a successful local GoReleaser snapshot. Under concurrent host load, the umbrella command itself hit four fixed 10-second UI deadlines; the complete 2,434-test suite was rerun with four workers and passed.

Known limitations

• Hecate remains alpha software. APIs and persisted schemas may change before v1.
• macOS Apple Silicon is the manually launch-tested desktop path. Linux and Windows desktop bundles remain experimental.
• Semantic code-intelligence calls under restrictive read-only or network-denied policies require a compatible OS sandbox wrapper; otherwise Hecate fails closed.
• ACP v1 is local stdio and operates in the client directory in place. It accepts text prompts only; file/media transfer, client MCP servers, preset selection, session reload, and remote runtimes are not yet supported. Approvals are resolved in Hecate's console.
• See the known limitations for the complete current list.

Hecate v0.5.0-alpha.1

This alpha makes Hecate substantially more useful as the place where coding agents are supervised, handed off, and improved through real project work.

Highlights

• Remote access through Hecate Cloud. The desktop app now signs in through the system browser, registers the supervised computer, and maintains the outbound Cloud connection without a separate hec process. Runtime-host identity makes it clear which machine owns a supervised run.
• Richer Chat input. Hecate turns can include PNG, JPEG, and WebP images with previews and accessible controls. Dictation creates an editable draft and works independently of the selected model or External Agent.
• Report-only QA workflows. Native tasks can use workflow_mode="qa" for isolated, read-only inspection. The run records the workflow manifest and a structured report that distinguishes agent claims from evidence verified by Hecate.
• Exact Chat-to-Task handoffs. A task can be created from an exact Task Run, and canonical Chat, Turn, and Message references survive retry and resume paths.
• Approval-gated browser evidence. Native project-assignment tasks can inspect a configured, allowlisted static page through a narrow evidence tool. This is bounded text retrieval—not general browser automation—and every call requires approval.
• Operator polish. This release adds live provider slash commands and input hints, a desktop update center with notes/progress/retry states, and a more complete mobile shell and Projects review experience.

Safety and privacy

• Cloud credentials use the operating system credential store. The desktop connection is outbound-only, and each sidecar launch receives an ephemeral secret. Remote routing denies local terminal, credential, shutdown, reset, and workspace-dialog operations.
• Image bodies and URLs are omitted from Task conversation artifacts. A final dispatch fence pins rich input to the exact provider generation and route selected for the turn.
• Browser evidence uses a fresh profile, disables scripts and service workers, permits only exact-origin GET/HEAD requests, and retains no cookies, downloads, screenshots, or browser profile.
• QA v0 blocks shell and terminal execution, writes, MCP tools, native network/search/browser access, and Git metadata. Unknown workflow contracts remain untrusted raw data.
• Update notes are rendered as bounded plain text, and update payload signatures are verified before installation.

Breaking changes and migration

Compatibility aliases removed in this release require operators and custom API/event consumers to update:

• HECATE_TASK_AGENT_LOOP_MAX_TURNS becomes HECATE_TASK_AGENT_LOOP_MAX_MODEL_CALLS.
• HECATE_RETENTION_TURN_EVENTS_MAX_AGE and HECATE_RETENTION_TURN_EVENTS_MAX_COUNT become HECATE_RETENTION_MODEL_CALL_EVENTS_MAX_AGE and HECATE_RETENTION_MODEL_CALL_EVENTS_MAX_COUNT.
• POST …/retry-from-turn with {"turn": N} becomes POST …/retry-from-model-call with {"model_call_index": N}.
• turn.started and turn.completed become model.call.started and model.call.completed.
• Event field turn_index becomes model_call_index.

There is no fallback for the removed aliases.

SQLite and Postgres gain preset browser fields, a Chat command-catalog authority field, and automatic turn_id assignment for new Chat data. Hecate performs the schema migration automatically; taking a backup before upgrading is still recommended.

The runtime now creates HECATE_DATA_DIR/hecate.runtime-host.json. Preserve that file in backups to retain the machine's runtime-host identity. Existing Chat rows are not backfilled with turn_id; their source Chat remains available, but exact historical Turn focus is unavailable for those rows.

Verification

• just verify passed, including formatting and documentation checks, Go tests and vet, the full Go race suite, Docker-tagged end-to-end tests, 2,412 UI unit tests, 102 Playwright tests, TypeScript project builds, the production UI build, and the embedded Go build.
• Native desktop validation passed all 39 Rust tests.
• A GoReleaser snapshot cross-built Darwin and Linux archives for AMD64 and ARM64 and built the local multi-architecture container image.
• Test and link workflows are green at the release commit. macOS, Linux, and Windows desktop bundle builds were also green on the preceding release-candidate pull request.

Known limitations

• QA v0 is an inspection workflow, not a test runner; it cannot run commands or use Git or browser tools.
• Browser evidence is static text only, requires a configured Chromium installation and exact-origin preset, and is unavailable in Hecate Chat, External Agent tasks, remote tasks, and manual tasks.
• Remote access requires a Hecate Cloud account and the desktop app to remain open; there is no tray or background relay yet.
• The desktop path has been exercised manually on Apple Silicon macOS. Linux and Windows bundles are CI-built rather than real-machine tested, and Windows artifacts are unsigned.
• Subprocess isolation is best-effort same-user isolation, not a container, VM, or full browser/network sandbox. Multi-node operation is not yet a primary deployment target.

See the known limitations for the complete operational boundary.

Hecate v0.4.0-alpha.3

Highlights

• Makes External Agent file and image inputs usable end to end. Hecate selects
  an inline image, embedded resource, or private resource link from the exact
  live ACP capabilities. Built-in Codex and Claude additionally restage local
  links through the embedded bridge into readable prompt-scoped paths; direct
  Cursor and Grok integrations receive the capability-selected ACP block
  directly, including Hecate's private resource-link fallback when used.
• Embeds the two Hecate-owned ACP adapters as Go libraries. Hecate no longer
  launches separate adapter binaries for those integrations; the separately
  installed and authenticated upstream provider CLI remains the supervised
  provider runtime.
• Adds explicit workspace execution choices for tools-enabled Hecate Chat.
  Managed workspace provisions a Hecate-owned clone/copy; Current folder
  deliberately permits direct writes. External Agent chats do not expose this
  control and continue to operate in the selected workspace in place.
• Enables dictation in secure browser contexts and the desktop apps. Desktop
  microphone capture uses the platform webview media path while keeping the
  same provider-routed transcription contract introduced in alpha.2.
• Recovers a command-backed External Agent session with one
  transcript-authorized retry when every earlier assistant turn lacks agent
  output, completed tools, file changes, and compacted history. Hecate persists
  and displays the replacement session before retrying; established or
  ambiguous history still fails closed.

Safety And Privacy

• Local file links are validated, bounded, and privately restaged for the
  originating turn. The embedded bridge removes its temporary stage before
  advancing bridge prompt count or history, and later provider turns replay
  neither temporary paths nor attachment metadata. Prompt-stage cleanup removes
  only temporary copies; the original Hecate Chat attachment remains subject to
  the normal attachment-store lifecycle and is retained with its session until
  chat deletion. Hecate and the bridge do not fetch remote resource links.
• Embedded provider processes now have bounded startup and shutdown, process
  group or job-object containment, cancellation propagation, and stale-session
  recovery. Hecate still treats the upstream CLI as trusted local software.
• On Linux desktop, WebKitGTK grants only audio-only requests from the exact
  active loopback sidecar origin while the owned gateway child is running;
  mismatched origins, stale sidecars, camera, and pre-readiness requests fail
  closed. macOS uses its native microphone purpose-string prompt, while Windows
  uses WebView2 site permission.
• Dictation audio is bounded to 10 MiB and two in-process requests. It remains
  in transient request/provider memory and is not written to attachment
  storage, transcripts, usage events, traces, metrics, logs, or artifacts.
  Returned text is editable and is never auto-sent.
• Managed workspaces remain isolated runtime-owned clone/copy directories;
  they are not linked Git worktrees. Current-folder execution remains explicit
  because it can modify operator files directly.
• This release adds no Projects coordination or storage. Cairnline remains the
  authority for portable coordination intent; Hecate resolves and enforces
  execution.

Migration Notes

• No manual data migration is required.
• Built-in External Agents still require an installed and locally authenticated
  upstream provider CLI. Hecate itself no longer requires a standalone ACP
  adapter binary or adapter-specific Node/Volta runtime; install each provider
  CLI through its vendor-supported method.
• Existing sessions retain their stored workspace mode and can change it only
  before a backing task exists. API requests that omit workspace_mode retain
  the legacy in_place behavior. For new tools-enabled Hecate Chat sessions,
  choose Managed workspace for an isolated runtime-owned clone/copy, or
  Current folder only when direct writes to the selected folder are
  intended. External Agent chats continue to use the selected workspace in
  place.
• Browser dictation requires a secure context. Desktop dictation requires a
  live Hecate sidecar and operating-system microphone permission. Audio is sent
  only to the transcription provider selected in the composer.
• Private resource-link staging intentionally fails closed on unsupported local
  filesystems or unsafe paths. Hecate and the embedded bridge leave remote
  resource links as unfetched metadata; the selected trusted CLI may still act
  on metadata it receives.

Verification

• The complete local just verify gate passed on the release tree:
  documentation and links, Go tests and vet, the full race suite, Docker-tagged
  E2E, 2,296 UI tests, 100 browser E2E tests, lint, typecheck, production UI
  build, and Hecate binary build.
• just verify-desktop passed all 26 Rust tests, including the
  origin/media-policy checks and the child-process liveness probe used by the
  Linux microphone gate.
• Authenticated text and staged-file turns passed through all four supported
  External Agent adapters on the same prepared native sessions.
• Hosted checks passed across Linux race, Docker smoke, fake-upstream and
  Ollama E2E, macOS and Windows bootstrap, and the shared ACP toolkit's native
  Linux, macOS, and Windows resource-security suites.
• The implementation heads were independently reviewed. Actionable
  cross-platform, cleanup, privacy, and test-validity findings were fixed and
  the final heads were re-reviewed clean.

Known Limitations

• External Agent CLIs remain trusted local subprocesses. Hecate contains,
  supervises, and redacts the integration boundary but does not sandbox vendor
  internals.
• Remote resource links are not downloaded by Hecate or the embedded command
  bridge. Operators must attach a local file when the provider needs its bytes.
• Dictation sends audio only to the selected endpoint. Operators requiring
  local-only processing must verify that endpoint and enforce egress policy
  outside Hecate.
• Hecate remains public-alpha, local-first, and single-operator shaped.
• macOS Apple Silicon remains the manually launch-tested desktop path. Linux
  and Windows bundles are CI-built but remain experimental on real machines.
  The Windows MSI is not code-signed, so SmartScreen warnings are expected.
• See the known limitations
  for the current operator boundary.

Hecate v0.4.0-alpha.2

Highlights

• Adds provider-routed dictation to Chat. Record up to two minutes of audio,
  transcribe through an explicitly selected OpenAI, Groq, LocalAI, or
  env-configured OpenAI-compatible endpoint, then edit the inserted text before
  sending.
• Unifies the message composer into one surface with file attachment and
  dictation controls in a compact bottom action rail. Attachment previews grow
  upward and unavailable actions retain accessible setup guidance.
• Fixes desktop External Agent launches when an upstream provider CLI is
  installed in a common user location outside the GUI process PATH. Hecate now
  resolves the typed provider command and prepends only its executable
  directory for the local launch.
• Keeps native Go ACP adapters independent of Node package managers. The
  adapter remains the ACP bridge; the separately installed and authenticated
  upstream provider CLI remains the provider runtime it supervises.

Safety And Privacy

• Hecate revalidates the same configured provider instance immediately before
  sending audio and never fails over to another provider.
• Audio never enters Hecate persistence. Returned text remains an editable draft
  until sent; once sent, normal chat retention applies. Hecate does not log
  audio or transcript bodies, credentials, or raw upstream errors.
• Dictation audio is limited to 10 MiB. Hecate admits at most two concurrent
  dictation requests per process, applies a 60-second body-read deadline, and
  bounds the provider call to five minutes.
• Desktop launches do not import shell startup state. Remote launch environments
  keep their separate fail-closed PATH policy, and provider version diagnostics
  do not fall back to local per-user candidate paths.
• This release adds no Projects coordination or storage. Cairnline remains the
  authority for portable coordination intent; Hecate resolves and enforces
  execution.

Migration Notes

• No manual data migration is required.
• Dictation requires microphone permission and a configured transcription
  route. To keep audio on the operator's machine, use a loopback LocalAI
  endpoint; the local label is configuration metadata, not an egress firewall.
• External Agents still require their upstream provider CLI and its local
  authentication. The native ACP adapter itself does not require Volta or npm.
• File and image attachment contracts from v0.4.0-alpha.1 are unchanged. The
  desktop launch fix makes those inputs usable when a provider CLI was
  previously hidden from the desktop process PATH.

Verification

• The complete local just verify gate passed: documentation and links, Go
  tests and vet, the full race suite, Docker-tagged E2E, 2,280 UI tests, 99
  browser E2E tests, lint, typecheck, production UI build, and Hecate binary
  build.
• Across the implementation PRs, all applicable hosted checks passed, including
  Linux race, Docker smoke, fake-upstream and Ollama E2E, macOS and Windows
  bootstrap, and Linux, macOS, and Windows desktop bundle builds.
• The implementation heads were independently reviewed. Actionable runtime
  environment-boundary findings were fixed and the updated head was re-reviewed
  clean.

Known Limitations

• Dictation sends audio only to the selected endpoint. Operators requiring
  local-only processing must verify that endpoint and enforce egress policy
  outside Hecate.
• External Agent CLIs remain trusted local subprocesses. Hecate supervises and
  redacts the integration boundary but does not sandbox vendor internals.
• Hecate remains public-alpha, local-first, and single-operator shaped.
• macOS Apple Silicon is the manually launch-tested desktop path. Linux and
  Windows bundles are CI-built but remain experimental on real machines.
• See the known limitations
  for the current operator boundary.

Hecate v0.4.0-alpha.1

Highlights

• Adds secure Chat attachments: Tools-off direct-model turns can send PNG,
  JPEG, and WebP images to models with confirmed image capability.
• Adds arbitrary local file inputs for External Agents. Hecate selects inline
  images, embedded resources, or private staged resource links from the live
  ACP session capabilities, then bounds and cleans up every transport path.
• Makes attachment turns durable and reviewable with typed metadata, atomic
  claims, retry-safe submission, bounded storage, file-only messages, queued
  draft recovery, and body-free transcripts and telemetry.
• Hardens agent execution around preset tool and sandbox policy, approvals,
  terminal supervision, task/run state transitions, workspace coordination,
  cancellation, shutdown, and provider/model readiness.
• Improves the Cairnline-backed Projects cockpit with overview-first guidance,
  focused attention, selected-work kickoff, assignment continuity, atomic
  handoff follow-up, accessible narrow layouts, and more truthful recovery.
• Preserves curated GitHub release notes while desktop bundles are attached, so
  substantive releases no longer fall back to the older raw commit changelog.

Breaking Or Risky Changes

• Chat attachment storage adds automatic backend migrations and new retention
  pressure. Each message accepts at most four files, 5 MiB per file, and 12 MiB
  combined; per-session and backend-wide quotas also apply.
• Direct-model attachments are deliberately limited to Tools-off image turns.
  Task-backed Tools-on turns reject attachment IDs rather than silently
  discarding them or changing execution mode.
• External Agent file delivery depends on live ACP capabilities. Resource-link
  fallback creates a private temporary local copy and withholds transcript
  publication until cleanup is proven; unsupported or unsafe staging fails
  closed.
• External Agent CLIs remain trusted local subprocesses. Hecate supervises and
  redacts the integration boundary but does not sandbox vendor internals.
• Project deletion and other destructive coordination operations now fence
  overlapping Hecate runtime mutations. Cairnline remains the sole authority
  for portable coordination records; Hecate resolves and enforces execution.

Migration Notes

• No manual data migration is required. Hecate applies the attachment schema on
  startup for the configured memory, SQLite, or Postgres backend.
• Existing providers, Agent Presets, chats, tasks, approvals, and Cairnline
  Projects remain in place.
• API clients can adopt the new attachment upload, content, and message metadata
  contracts under /hecate/v1/chat/sessions/{id}/attachments.

Verification

• The complete local just verify gate passed: documentation and links, Go
  tests and vet, the full race suite, Docker-tagged E2E, 2,271 UI tests, 99
  browser E2E tests, lint, typecheck, production UI build, and Hecate binary
  build.
• Attachment PR CI passed 19 hosted checks, including Linux race tests, Docker
  smoke, fake-upstream and Ollama E2E, macOS and Windows bootstrap, and unsigned
  Linux, macOS, and Windows desktop bundle builds.
• The release-blocker documentation fix passed macOS and Linux Oxfmt 0.58.0,
  independent review, Markdown, Mermaid, and link checks.

Known Limitations

• Direct-model file input is image-only; arbitrary non-image direct-model files
  are not yet supported. Task-backed Tools-on turns do not accept attachments.
• External Agent chats accept arbitrary files, but the exact ACP representation
  depends on the agent and adapter capabilities. Some filesystems cannot safely
  host the private resource-link fallback.
• Hecate remains public-alpha, local-first, and single-operator shaped.
• macOS Apple Silicon is the manually launch-tested desktop path. Linux and
  Windows bundles are CI-built but remain experimental on real machines.
• See https://github.com/hecatehq/hecate/blob/master/docs/operator/known-limitations.md
  for the current operator boundary.

Hecate v0.3.0-alpha.1

Highlights

• Makes embedded Cairnline the sole authority for portable Projects coordination while Hecate remains the operator cockpit and execution/orchestration layer.
• Completes the Projects V1 journey across onboarding, guidance and skill discovery, roles, work items, assignments, launch readiness, worktrees, evidence, reviews, handoffs, memory candidates, and closeout.
• Renames Hecate Agent Profiles to Agent Presets and keeps provider, model, tool, write, network, approval, memory, and adapter posture under Hecate runtime authority.
• Hardens External Agent support around the standalone Go ACP adapters, including capability discovery, authentication and logout, approvals, MCP configuration, terminal activity, session metadata, and cleanup behavior.
• Adds opt-in operator terminal tools and native web search with bounded Tavily and Exa results.
• Moves the UI toolchain to stable TypeScript 7 and refreshes desktop, Docker, and dependency coverage.

Breaking Or Risky Changes

• Portable Projects data is now stored only in <HECATE_DATA_DIR>/cairnline/embedded/projects.db. The removed Hecate-native Projects stores, backend selector, mirror, migration routes, and sidecar transition controls are no longer available.
• Disposable Projects records created by earlier alpha builds are intentionally not migrated. Recreate project setup in this release; system reset also removes the embedded Cairnline database.
• The Hecate API surface /hecate/v1/agent-profiles* has been replaced by /hecate/v1/agent-presets*.
• Cairnline assignment metadata expresses coordination intent only. Hecate still enforces model/provider policy, approvals, sandboxing, writes, network access, and External Agent launch behavior.
• Terminal tools remain opt-in, and External Agent CLIs remain trusted subprocesses whose own internals are not sandboxed by Hecate.

Migration Notes

• Operators without disposable pre-release Projects data need no manual migration.
• Recreate any project roots, roles, work items, assignments, skills metadata, and project memory that must survive from an older alpha.
• Update API clients from agent-profiles to agent-presets.
• Existing provider credentials, chats, tasks, approvals, Agent Presets, and Hecate-owned runtime history remain in the configured Hecate store.

Verification

• All just verify components passed. The local Docker health/bootstrap smoke used 127.0.0.1:18765 because local operator tooling occupied the canonical port; pull-request CI passed the unchanged 8765 smoke.
• Pull-request CI: Go race tests, Go vet/lint, TypeScript tests, browser E2E, Docker smoke, macOS/Windows bootstrap, Tauri Rust tests, and unsigned Linux/macOS/Windows desktop bundles.

Known Limitations

• Hecate remains public-alpha, local-first, and single-operator shaped.
• macOS Apple Silicon is the manually launch-tested desktop path. Linux and Windows bundles are CI-built but still experimental on real machines.
• A separately installed Cairnline connector is future work; this release embeds Cairnline in the Hecate process.
• See https://github.com/hecatehq/hecate/blob/master/docs/operator/known-limitations.md for the current operator boundary.

Changelog

• e963fce chore(tauri): stamp version 0.2.0-alpha.4
• f4455bf fix(ui): resolve provider aliases in model picker
• 2fbb41c docs: update release references [skip ci]
• 9f5c13d publish updater manifest for v0.2.0-alpha.3