The complete current release notes: notable product changes, new public tools, and the behavior operators need to know before updating. Each version also links to its public GitHub Release record and downloadable artifacts.
Windows job terminals now identify themselves as AI Commander. They show the job ID, the initiating account’s masked email when available, and the local start date and time with UTC offset. The window explains where to view job output and status, and that closing it may stop the job.
Anonymous users and unavailable account details receive explicit labels. Account labels are best-effort and may reflect data cached for up to five minutes; manual linked-account management continues to fetch current data.
Upgrade notes
The terminal notice appears for jobs started after updating the Windows agent. macOS and Linux jobs continue to run without a separate terminal window.
A cancelled job stays cancelled when its exit marker appears during a status check. This closes a remaining race in the 1.3.0 fix that could still report a cancelled job as successfully completed.
Diagnostics distinguish missing helper and autostart files from files they could not inspect. Access and I/O errors are reported with their evidence; they no longer establish that an installation is missing. A confirmed missing helper binary or VERSION marker still fails the check even if another path cannot be inspected. Signature and service-registration checks likewise keep an inconclusive lookup separate from a confirmed failure.
Privileged-helper diagnostics finish within their connection timeout even when an endpoint keeps sending data without answering the handshake. Helper discovery also distinguishes a rejected handshake from an endpoint that does not answer, so an incompatible helper leads to upgrade guidance.
The public agent source snapshot can build and run its tests independently. Tests that require private desktop files stay in the main repository, and the export rejects references to missing files. CI now installs, builds, typechecks and tests the staged snapshot separately on pushes and pull requests.
The hosted relay validates machine hostnames when they arrive and reports a connection only when it has the agent socket used for command execution. These relay corrections are deployed separately from the agent update.
Changed
Job management is split into smaller modules for lifecycle decisions, persistence, process launch and output handling, retaining the existing public interface.
Upgrade notes
On macOS, install the signed 1.3.1 PKG to update both the app and its privileged helper. The built-in automatic app update replaces only the app bundle and does not install the helper-side fix in this release.
Machines report their own hostname and local addresses, so a fleet of similarly named boxes can be told apart — the alias is only what the account typed when it saved the machine. list_machines shows the hostname for every machine, including ones running older agents, because the relay already had it; both list_machines and session_status show the machine’s non-loopback addresses once it runs this version. They are a label for recognising a machine, never a route to it, and an address the relay cannot recognise as an address is dropped rather than shown. A machine that reports none is not claiming to have no network.
A job that ends without recording an exit code now says what was observed about its ending. It still never claims the job succeeded. The agent records, at the moment it settles the job, whether someone asked it to stop, whether it watched the job’s shell die on a signal, whether the job’s own helper scripts had been removed, or whether the process simply vanished — with an empty log, or with output in it. Those last two name a shape rather than a cause on purpose: such a job may have been killed, or may have finished normally after stepping around the wrapper that records exit codes. The note is written to the job’s record, so it still describes the ending after the log has been rotated away.
Removal of a job’s helper scripts by security software is caught after the job starts, as well as before it. Previously only the moment between writing them and running them was checked.
Fixed
A cancelled job can no longer come back as “exit code 0”. On macOS the shell runs its exit handler when asked to stop and records a success code, so a cancel followed by an agent restart inside the few seconds before the job died reported the job as having completed cleanly. The cancellation is now written to the job’s record before the first signal is sent, and survives the restart.
Machines no longer lose their capabilities after sleeping. A laptop or desktop that suspended and woke could have its relay record stripped of the flags that say it can run detached jobs, elevated commands and file transfers — after which remote_job_start refused the machine as “too old to run detached jobs” and advised updating an agent that was already current. It affected healthy, fully updated machines and cleared only when the agent happened to reconnect again. This was a fault in the hosted relay, already corrected there; no update was required to receive the fix.
A healthy installation is no longer reported as damaged. Electron presents app.asar — the archive holding the application itself, and one of the files the integrity check treats as critical — as an empty directory rather than a file. Every launch on macOS and Windows therefore logged the installation as damaged, and the diagnostics raised a warning whose advice was to suspect the machine’s security software. Nothing was ever wrong with those installations. Both checks now read through an unpatched filesystem, so they see the archive as it is.
A registered privileged helper is no longer reported as missing. Windows answers a query about a scheduled task the caller may not read exactly as it answers one about a task that does not exist, and the helper’s task is readable only by administrators. On a standard user account the report therefore claimed the helper had never been registered, named the September 2 incident, and said elevated commands could never run — on machines where they were running. A refused lookup is now reported as undetermined, which is what it is.
aicommander-agent doctor — a self-check that answers, in one command, the questions that previously took an operator an hour: is the installation complete, is its directory writable, is security software interfering, does the relay answer and at which step does it stop, do the autostart entries point at files that exist, is the privileged helper installed and registered. It reports “could not check” as its own verdict rather than guessing, never changes anything on the machine, and --report writes a redacted bundle that is safe to attach to a support ticket or an antivirus vendor submission.
The same diagnostics without a terminal — from the tray (Run Diagnostics…), and on Windows from an AI Commander Diagnostics Start Menu shortcut that runs from a separate directory, so it still works when the app’s own folder has been emptied.
A rotating diagnostic log written by both the desktop app and the headless agent, covering connection attempts and their status codes, job lifecycle, and file-access errors. It is capped and rotated, and deliberately contains no session codes, tokens, command text or job output. Its location is documented on the troubleshooting page.
Detection of a gutted installation, from inside the app at startup and — because the app may be too damaged to start — from the Windows watchdog, which now stops relaunching into an installation whose files are missing and says so in its log.
A named failure when security software removes a job’s helper scripts between writing and running them. Previously that produced an empty log and an unexplained failure; it now says what happened and links to the fix.
Changed
The relay says WHY elevated execution is unavailable on a machine — not installed, installed but never registered, not answering, protocol skew — instead of omitting the capability and leaving callers to guess between “no helper”, “agent too old to report” and “offline”.
An offline Windows machine gets the right hypothesis. Callers are told that an abrupt disappearance shortly after a job ran can mean security software removed the app’s files, and are given the one question that settles it in ten seconds. The message is unchanged on every other platform.
The Windows installer explains an over-the-shoulder UAC elevation instead of exiting silently, replaces a gutted prior installation rather than layering over it, verifies its own work after extraction, and records all of it in %ProgramData%\AICommander\install.log.
Fixed
Cancelling a job in the moment between its record being written and its process starting now ends the job, releases its GPU reservation and frees its concurrency slot, and every surface reports the same outcome the cancel reply gave.
Documentation corrections found by measuring three Windows machines rather than trusting the docs: the installation directory is C:\Program Files\AICommander, without a space, so the antivirus exclusion previously recommended pointed at a folder that does not exist.
Licence.@aicommander/agent (and the internal @aicommander/priv-helper, whose code ships inside the agent tarball) moves from MIT to the Elastic License 2.0. 1.0.56 and earlier are MIT; 1.1.0 and later are Elastic License 2.0 — the MIT grant already made for those published versions is irrevocable and unaffected. You may still use, copy, modify and redistribute the agent; you may not offer it to third parties as a hosted or managed service. @aicommander/mcp stays MIT, and so does @aicommander/protocol, whose code is bundled into it. The full picture is on the licensing page.
The agent is now published from public source, with provenance. Releases come from the mirror AICommander-dev/aicommander-agent and carry npm provenance attestations, so the package's repository field resolves and its build is publicly auditable. Every signing secret stays in the private repository.
The published bundle is no longer minified. It grew from 33 KB to 269 KB, and each section names the source file it came from. Behaviour is unchanged; the point is that a package which runs shell commands received over a network should be readable by whoever is deciding whether to trust it.
The agent's README now opens with a plain dual-use disclosure — what the package does, that a session code is a root-exec credential, that installing it starts nothing, and that the agent is host-locked to the canonical relay. The npm packages and the desktop installers also ship licence texts and third-party notices, which they previously did not.
The Windows exec launcher in the npm tarball is signed with the same Ed25519 release key that signs the agent binaries and the install script, published at aicommander.dev/install.pub. The mirror verifies that detached signature, the launcher's PE structure and its Authenticode certificate table before every publish, and refuses to publish if any of it fails. Anyone can repeat the check with openssl.
Fixed
Detached jobs now survive an agent restart on Linux. Each job is launched into its own transient systemd scope (aic-job-<jobId>.scope), outside the agent service's control group, so the systemctl restart that every upgrade performs no longer ends running jobs. This needs a systemd host with the agent running as root; without both, jobs stay in the service's control group as before and the agent says so at startup. It also covers only jobs started after an agent with this feature is installed — a job already running when you upgrade to it is in no scope, and that upgrade's own restart still ends it, so check remote_job_list before that first upgrade.
aicommander-agent uninstall stops leftover aic-job-*.scope units before deleting job directories, since stopping the service no longer takes running jobs down with it. A scope that will not stop within the budget is SIGKILLed and that is reported as it happens; if any scope survives or cannot be enumerated, job workspaces and logs are kept rather than deleted from under a root process still writing to them. aicommander-agent disable warns about still-running job scopes and prints the command that stops them, but deliberately does not kill them.
MCP tool titles, safety annotations, and transport-specific security schemes now come from one shared metadata source. The stdio package is bundled for publication and no longer depends on workspace TypeScript source files at runtime.
Release version 1.0.56 is aligned across the macOS and Windows desktop apps, Linux agent, npm/MCP Registry package, privileged helper, and public software metadata.
Fixed
Linux service installation now fails before creating accounts, directories, binaries, or unit files when systemctl cannot reach a running systemd manager. Foreground mode remains available for temporary use on non-systemd hosts.
The privileged helper accepts only its argument-free service mode and the side-effect-free --version diagnostic. Unknown arguments fail before IPC, watchdog, or privileged execution components are initialized.
The automatic macOS 13+ update path is restored for the final v1.0.54 client when CFNetwork proves a compatible Darwin version. New clients also send an explicit validated macOS version for future minimum-OS transitions.
Security
Signed macOS release builds now run on the repository's private Apple Silicon runner with fail-closed capability checks, isolated notarization credentials, and cleanup of temporary keychains and verification mounts after every run.
The minimum supported macOS version is now 13.0, allowing installer recovery to use the kernel's audit-token-bound validation category when proving a live tray process identity. The final v1.0.54 client can cross the transition with its automatic helper when CFNetwork reports Darwin 22+ (macOS 13 or newer); older clients use the manual PKG path, and macOS 12 remains on the last compatible release, v1.0.54.
The trusted CoderAI feedback widget is restored on public pages, including the ?feedback=dashboard handoff, while remaining outside the authenticated dashboard. The privacy notice documents the integration and its data flow.
The Pro plan summary now says “Unlimited devices” instead of “All saved devices”.
Release version 1.0.55 is aligned across the macOS and Windows desktop apps, Linux agent, npm/MCP Registry package, privileged helper, and public software metadata.
Fixed
macOS PKG tray recovery now binds live signing identity, CDHash, executable path, launchd ownership, and TERM/KILL signals to one process audit token. It remains valid after an atomic bundle replacement and refuses ambiguous or reused process identities.
A duplicated PackageKit postinstall invocation no longer repeats successful tray recovery, but a controlled first-pass failure or missing recovery script still gets a second attempt.
Clients older than v1.0.54 are prevented from automatically installing a v1.0.55+ ZIP because they cannot report whether the host meets the new macOS 13 minimum. Their tray presents the explicit manual PKG download; v1.0.54 uses the automatic helper only when its CFNetwork User-Agent reports Darwin 22+ and the matching immutable ZIP exists. Builds made from the current source after public v1.0.55 send a validated explicit OS version for future transitions; the already-published v1.0.55 may omit it and remains accepted by the Worker.
The v1.0.41–v1.0.53 Squirrel compatibility bridge remains scoped to the v1.0.54 release: it selects manual PKG recovery only when the exact immutable, architecture-matched v1.0.54 PKG exists; otherwise it uses the v1.0.54 ZIP.
Security
Dashboard responses receive an additional same-origin-only HTTP CSP. It is enforced together with the public-site policy and each dashboard page's strict meta CSP, so public pages may load CoderAI while the authenticated dashboard cannot.
Stripe-hosted Pro billing is available from the dashboard: subscription Checkout, promotion-code entry, current-plan synchronization by signed webhooks, and Customer Portal access for managing payment details or cancellation.
The dashboard shows clear Free/Pro plan state, Upgrade and Manage subscription actions, and plan-limit badges on restricted machines.
Changed
Free accounts keep every saved machine record but can use only the 10 oldest by creation time and stable ID; deleting an older record promotes the next one. Pro restores access to all saved machines up to the existing 100-record ceiling.
Starting file uploads, pulls, or pushes requires Pro. Existing blobs and download links keep only their original 24-hour and one-hour lifetimes after a downgrade.
The stdio MCP bridge validates and forwards the complete hosted tool result, including text and image content, isError, and structured refusal reasons and messages, for both ordinary and streamed tool calls.
Release version 1.0.54 is aligned across the macOS and Windows desktop apps, Linux agent, npm/MCP Registry package, privileged helper, and public software metadata.
Fixed
Recovery is narrowly scoped for macOS clients left running from a recognized Squirrel .ShipIt temporary path. A v1.0.54 client hands a later launch request to the canonical /Applications app after releasing its single-instance lock.
For affected v1.0.41–v1.0.53 clients, the update feed selects the browser/PKG fallback only when that exact immutable release has an architecture-matched PKG. With an existing registered job, the installer uses exact recovery/kickstart and returns a controlled diagnostic failure if recovery cannot be proved safely; it does not open an unsupervised app. Canonical open is reserved for a fresh install with no registered job and no conflicting candidate.
remote_pull(code, path) and POST /api/v1/pull copy one regular file from a connected machine into a temporary relay blob and return a download link.
Account-only remote_push(code, blob_id, dest_path) and POST /api/v1/push write a stored blob onto a machine.
POST /api/v1/files uploads caller-owned bytes, and GET /api/v1/files/{blobId} downloads an authorized blob.
Changed
Transfer calls use a roughly 55-second request deadline, returning a clear failure before the MCP client's usual 60-second timeout.
Security and limits
Each transferred file is limited to 100 MiB. A download link expires after 1 hour, and blob access expires after 24 hours; an hourly, retrying sweep removes inaccessible expired bytes afterward.
Caller uploads and pushes require a signed-in account. Anonymous callers may pull only during a session code's first-hour access window.
Push writes are atomic. Directories must be archived into a regular file, and larger artifacts should use user-controlled object storage or an artifact registry.
Choose the right plan
See how Free machine access and Pro file transfer work, then manage billing from your dashboard.