What's new.

The grid now holds five full decks. The links an agent prints open, and a few everyday controls get simpler.

• Five full decks. Helmsman runs up to sixty sessions: five decks of twelve, counted across every project together. The sixty-first spawn is still refused out loud, and the load heads-up still speaks at each twelve.
• Links that open. Claude Code now prints real hyperlinks in a cell, so a URL that wraps across rows stays one link. Hover shows the real target. Command-click opens it, http and https only. A plain click stays a click.
• Caffeinate, one choice. Off, While agents run, or Always on: a pick replaces the last one. The panel leads with what the Mac is doing now (Off, Armed or Awake) and why. Always on ends at quit and keeps your usual pick underneath.
• Clone from GitHub. The sidebar + menu has a Clone from GitHub row. Paste a repo URL or owner/repo. Helmsman clones it next to your new projects, streams git’s progress and adds the folder. A failed clone removes its half-written folder.
• Usage, your way. Settings, General, Show usage as: percent left or percent used. Every usage surface follows it, and the choice syncs with your profile.
• Skip permissions on every agent. The launch menu’s Skip permissions switch maps to each CLI’s own flag: Codex, OpenCode, Gemini, Antigravity, Grok, Kimi and Cursor, beside Claude Code.
• Codex resume. Resume reads Codex’s own thread store, compressed rollouts included. An archived thread refuses and names codex unarchive, instead of starting a fresh session.

Fixes:

• A cell whose worktree setup fails now starts in the project folder and says so, instead of sitting on its loading skeleton.
• A hand-started claude from the native installer, and a hand-started grok from its native image, are adopted again.
• The cell text-size keys no longer resize a cell while you type in a rename field or the commit box.
• A Codex cell no longer keeps a stale attention state after an MCP tool error.
• The first launch ping waits until the analytics notice has shown, even behind a long first sign-in.

This beta ships for macOS and Linux. Windows remains on 0.12.0-beta.1 while its native-menu terminal journey receives further verification.

Codex gets native settings, instructions, skills, plugins, Apps and usage views in the existing live terminal grid. Claude Code keeps its existing experience. Either CLI can complete first run without the other installed.

• Native settings and continuity. Codex receives the selected model, reasoning, sandbox and approval policy. Saved sessions retain their native home, settings and conversation identity. Titles and completed results come from native records, including after the cell exits.
• Provider-specific libraries. Edit AGENTS.md and overrides, inspect skills and manage native Codex plugins. Helmsman Apps keep each provider’s installation and data separate.
• Honest usage. Native token counts, allowance observations, history and Profile statistics retain provider context. Dollar estimates are labeled; unavailable cost is never replaced by zero.
• OpenAI helpers. Built-in AI helpers can use an OpenAI API key, separately from Codex login. Local models and Anthropic remain available. Live OpenAI API acceptance is still pending.
• Safe first run. Finish native sign-in and trust before copying and submitting the starter prompt. Helmsman no longer types a task into a native setup screen. Provider process failures use the existing focus and notification preferences.

Automatic Codex Fleet follow-up, steer and interrupt remain disabled. Use the visible terminal. Experimental control is excluded from this release. Plugin authentication health, some skill scopes and cold recovery cases still need further work. See Agent support.

Phone pairing remains retired. This release does not extend or deploy the phone companion.

This beta ships for macOS and Linux. Windows remains on 0.12.0-beta.1 while its native-menu terminal journey receives further verification.

Work connects the issue board to the sessions that do the work. This release also fixes a session race: an older login or refresh response could sign you back in after you chose Sign out.

Sign out stays signed out

• Late responses cannot restore the session. A token refresh or profile lookup that finishes after sign-out leaves the app signed out. The deleted refresh token stays deleted, including after an app restart.
• A newer session keeps its place. Results from an older login, refresh, or profile edit cannot overwrite the session you opened afterward.
• Sign out everywhere keeps its result. The app still reports whether the server revoked the other sessions. A network failure does not count as a successful revoke.

Work follows the issue

• Five lanes, one issue record. To do, In progress, Verify, Done, and Won’t do stay connected to GitHub. Cards open the issue editor with the full discussion.
• Send, review, and resume. Send uses the selected provider and opens a real grid session. Reload the app window and the board reconnects to that session. Resume appears only when the conversation remains available.
• Boards stay with the project. Create, select, and rename boards. Window focus refreshes the board, and a notice explains newly observed external closes.
• Agents get the same context. The Work MCP surface has 28 tools for boards, issues, discussions, pull-request checks, and session actions. Writes stay inside the caller’s project. The human keeps control of acceptance and terminal moves.
• Issue content stays inside the reader. Markdown cannot add application CSS. Remote images use links except for authenticated GitHub attachments.

The release where the app tells you what it can do. The menu bar used to list two commands. Now File, View, and Help carry every command with its chord, and the Helmsman menu checks for updates. The focused cell takes a text size of its own. The launch menu gets a Skip permissions switch for Claude cells, and a Claude cell shows its cloud title again. On helmsman.sh, the account model settles on one credential: the inbox.

The menu bar

• Every command, with its chord. File lists New Agentic Session ⌘N, New Terminal ⌘T, New Web Page ⌘L, New Deck ⌘⌥T, Resume a Closed Session…, Add Project…, Close Session ⌘W, and Close Window ⇧⌘W. View lists Toggle Sidebar ⌘B, Find File… ⌘P, Source Control ⌘⇧G, Previous and Next Deck ⌘← ⌘→, Zoom Cell ⌘↩, and the three text sizes. Help lists What’s New, Report a Bug…, Reveal Config File, and helmsman.sh. Before, only Close Session and Settings… were there.
• The keyboard keeps its rules. A chord the page handles never reaches the menu. Each item runs the same guarded action as its chord, so a menu click and a keystroke cannot disagree. The text-size items are plain commands, never zoom roles: nothing can scale the shell.
• Check for Updates… sits in the Helmsman menu, under About Helmsman. A toast says “Checking for updates…” and then the answer, in the words Settings > General already uses: up to date, a build waiting on a click, a download in flight with its percentage, a build ready to restart into, or a failed check. A development build says so.

Text size per cell

• ⌘= grows, ⌘- shrinks, ⌘0 resets. The chord steps the focused cell’s text in whole pixels from the 12.5px base, three steps down and six up. The terminal re-rasterizes its glyphs at the new size and the child process gets one resize, the same path as a divider drag, so nothing blurs and Claude Code never paints into a width it does not know. The step survives a cell restart and lives for the session.
• ⌘- reaches the reader too. The app used to swallow ⌘- before the page saw it, so the reader’s own shrink never fired. It does now.
• A web cell keeps Chromium’s page zoom, and the reader steps its document itself.

Skip permissions, per spawn

• A second row in the launch menu foot. Under Fresh worktree sits a Skip permissions switch, off on every open and never a project default. Its tooltip states the consequence: Claude runs every tool call without a prompt in this cell. A worktree is not a sandbox.
• Spawn without asking joins the Claude row’s context menu, beside Spawn in live tree.
• The tile says so. A permanent “no prompts” fact sits in the tile header, beside the model. It survives a restart and a fleet restore, because the flag is stored with the session the way the model is.
• Human only. The Fleet MCP spawn tool refuses the flag, the coordinator never forwards it, and the planner never copies it. Every other provider ignores it.

Cells get their title back

• The cloud title returns. Since 0.9 every Claude cell read as helmsman-master-cell-4. The peer-name flag that gave a cell an address also counted as a user title, which switched the CLI’s title generator off. The flag is gone, and a cell shows its generated title a few seconds after the first prompt. What goes with it: a session can no longer guess a sibling’s address as <folder>-cell-N. The Fleet MCP tools are untouched.

One credential: the inbox

The account model on helmsman.sh settles on one credential, control of your inbox: a code at sign-in, a mail link for a sensitive action.

• The password door is retired. /login, /register, and /reset redirect to /access. The password config, its hasher, and the reset flow leave the backend. A legacy password row stays inert.
• Delete works for every account. A code or Google account has no password, and the account page asked for one on delete, so most accounts could not delete themselves. Delete now sends a single-use mail link, valid for 30 minutes, and asks for no password. Change password leaves with the door.
• The account page is reachable. The app’s account popover gains “Manage account on helmsman.sh”, and /download shows an Account link when you are signed in. The page opens with an Identity section: your address, the door it opens, and two exits.
• Sessions are one set. Sign out everywhere, in the app and on the web, revokes every desktop token and every web session in one transaction. The web button keeps the browser you pressed it in; the app’s button keeps nothing.
• Two enumeration oracles are closed. The code-check endpoint no longer says whether an address has an account (the library fix in better-auth 1.6.30), and the attempts counter no longer tells the same story for the other code types. The password-reset code routes are refused, an open mail relay on the resend-verification route is shut, and the two anonymous code endpoints get rate limits of their own.

The release where a session stops waiting on the network. Every isolated Claude cell used to pay a git fetch before its terminal existed: a second on a good connection, ten on a hung one. The fetch now runs off the spawn path, provisioning runs in parallel, and a standby worktree waits ready for the next cell. Around that, the status bar learns to count work instead of shells, the helm wheel gets one geometry and a designed icon, and the sign-in flow gets a hardening pass.

Sessions that start in a blink

• The network leaves the spawn path. A new isolated Claude cell reads its branch base from the local origin/* refs at once. A fetch older than two minutes renews them in the background, one per repo, and never on the spawn’s clock. Only a repo with no origin refs at all still fetches before it spawns. Measured on one Mac against a repo with a GitHub origin: the first byte from a Claude cell arrived in about 800 ms on 0.9 and arrives in about 250 ms on 0.10. Against a hung network, 10.3 seconds became 0.25.
• Provisioning runs in parallel. The base probe and the heads read share one round-trip, one rev-parse answers the sha itself, and the include copy runs alongside the worktree add. A spawn with isolation off makes zero git calls.
• A standby worktree waits for the next cell. After the first isolated spawn in a repo, one hidden detached tree builds in the background. The next cell claims it: proven untouched, reset only when the base moved, branched at HEAD, moved into place. Any doubt discards it and provisions fresh. The standby owns no branch, so nothing new shows in git branch, and the existing stray scan reaps a leftover at the next boot.
• The worktree badge tells the two stale cases apart. A cell whose base came from local HEAD reads “origin unreachable at spawn”. A cell whose refs are older than a day reads “not fetched in over a day”.
• A field diagnostic. HELMSMAN_SPAWN_TRACE=1 logs one JSON line per spawn phase: the git probe, the base, the worktree add or the standby claim, the PTY spawn, and the first byte.

The status bar counts work

• “2 of 9 running.” The bottom-left readout counted every live shell as running, so nine untouched cells read as nine at work. It now shows the active cells out of the open ones. Active is the agent’s own busy word through the hook courier or its pid file, the same signal that keeps the Mac awake. An idle prompt, a permission wait, and a plain terminal count toward the total only. Nothing is read from terminal output.

The helm wheel

• One master geometry. The site mark, the four brand assets, and the loading dial all scale from the same numbers. Before, three different wheels shipped under one name.
• A large-size material. At loading-screen size the wheel reads as a material object with a rim, a plate ramp, and cell ramps at one falloff rate. Below 48px the flat favicon renders stay as they were.
• A designed macOS icon. A straight-sided plate with continuous-curvature corners, the dial’s ramps, and a 6% rim. The public 180, 192, and 512 icons render from the same source.
• The drift never carries the accent off north. The slow 16-second lap is a small sway that starts and ends at zero degrees, so the settle hands off without a snap.

Sign in, sign out

• A cancel cannot kill the attempt it started. Cancel arms 400 ms after a door click, so a double-click never aborts its own sign-in. After a cancel, focus returns to the gate.
• One clock, one attempt. The browser hand-off has one 180-second ceiling, shared by the app and the door, so the two never disagree about whether an attempt is still alive.
• Honest sign-out. A sign-out whose vault clear fails reads as still signed in, and a missed server revoke says so instead of pretending the session is gone.
• Focus never falls to nothing. After a sign-out the surface that held focus unmounts. The account glyph or the Settings section now takes the focus over, so the keyboard keeps its place.
• No ghost focus ring at boot. On a fresh boot the gate showed a focus ring around “Continue with Google” with zero interaction. The mount focus now lands on the gate root, and Tab enters at the first door.

Around the app

• The account mark goes solid. The user glyph at the foot of the activity rail fills in when you are signed in, in ink alone. Its popover opens without a focus box around your identity, and the email reads in the same mono the Profile pane uses.
• Amber is gone. Every amber status hue in the app is replaced by the neutral attention pattern: muted text, or the accent dot where a state needs a mark.
• A Send-to pick retargets the pill. On the issue board, choosing a provider in the Send-to picker now sets the pill’s target and nothing else. Only the main segment sends.

The release where Helmsman learns who is at the helm. The app now opens with a sign-in door, so every install belongs to an account. Around the door, the fleet gets real names: each Claude cell carries a stable peer name other sessions can address, and a session spawned by another agent lands in the grid every time. And the session lifecycle stops lying: a signed-out agent says so, and a Resume button never points at a conversation that is gone.

Sign in, once

• The app opens with a sign-in door. On a signed-out launch you see the dial, the wordmark, and two doors: Continue with Google, or Sign in with email. Both open your system browser; the desktop itself renders no password field and no captcha. Sign in once and the door stays out of your way. There is no skip: an install that is not signed in cannot reach the grid. The door needs a connection once. After that the app opens signed in, offline included.
• Your install belongs to your account. After sign-in the app makes one authenticated call that links this install to your account, so we can count how many installs each account has. The privacy page describes the link, and deleting your account deletes it.
• Nothing shows before the door. First Setup, the what’s-new card, and the analytics notice all wait until you are inside, and the keyboard cannot reach the grid before the door decides.

The fleet learns names

• Every Claude cell carries a stable peer name. A worktree cell used to introduce itself by its folder, noise like cell-3-2. The spawn now names the cell after its project and cell id, so one session can find and address another by a readable, stable name. Helmsman checks the Claude CLI version first, so an older CLI that cannot take a name never gets one.
• A spawned session lands in the grid, every time. With the Hail pill open, a session spawned by another agent could time out against the pill window instead of the grid. The grid window is now registered the moment it is created, and every hand-off reads that register: spawns, toasts, notification jumps, and the sign-in focus.

Sessions that tell the truth

• A signed-out agent says “signed out”. A /logout used to exit clean, so the cell read “done” and kept offering Resume. The exit is now classified: the pill says signed out, and the tile hides the Resume button.
• Resume never points at a conversation that is gone. Before offering a resume, the app checks that the conversation still exists at the exact folder it would resume in, through symlinks too. A missing conversation gets a plain refusal instead of a cell that can only print “No conversation found”, and a working resume is never cleared by mistake.

Fixes

• The repair flow now recovers a Claude CLI that a broken update left behind, and an ordinary error from a working install outside your PATH is no longer rewritten as a failed install.
• Sign-up and sign-in submit again: right after the public flip, the captcha on the auth pages could fail to mount, and the form then refused its own submit. Every auth page now renders the widget explicitly, so it mounts on every load.

Around the app

• The beta is open. Registration, sign-in, and the download page no longer need an invite: anyone can create an account and download Helmsman.
• helmsman.sh reads on a phone. Every page you can reach on the site now meets a phone on its own terms: 44px touch targets, readable type, and forms that no longer zoom iOS Safari on focus.
• The license covers every computer. The EULA granted use on Mac computers only; with Windows and Linux builds shipping, the grant now covers every computer you own or control.

The release where the fleet stops being Mac-only. Helmsman 0.8 builds and ships for Windows and Linux alongside the Mac, proves itself on a real Windows machine in CI before any build goes out, and carries the same gated update feed on every platform. Around the port, the permission rail gets strict about which prompt a button answers, the updater stops offering builds that a newer one already superseded, and two features leave the app on purpose.

Windows and Linux

• Helmsman now builds for Windows and Linux. The same grid of live terminals, the same fleet tools, the same projects sidebar. Every platform-specific behavior sits behind one adapter, so a fix on one platform cannot quietly regress another, and the whole app test suite runs on a real Windows machine in CI. The Windows installer is proven in CI too: the built .exe is installed and launched on the runner, not assumed to work.
• The update feed serves every platform. The gated feed that keeps Mac builds current now answers Windows and Linux installs the same way, so the first build you install is the last one you fetch by hand. The download page offers each platform once its build is in the bucket.
• Honest limits, stated up front. The Windows and Linux builds are unsigned for now: there is no Windows code-signing certificate yet, so SmartScreen will warn on first launch, and an AppImage carries no signature by design. Features a platform does not get are hidden there, never left in place to break: Hail voice, terminal adoption, and the guided agent installs simply do not appear where the platform cannot carry them.
• The port is not a veneer. Keyboard shortcuts know which platform they are on, so Ctrl and Cmd land where a native app would put them. Cell PATHs merge on the platform’s own delimiter. A provider’s binary is resolved before it is spawned, because Windows does not walk PATH the way a POSIX shell does. The hook courier that carries agent signals works on Windows. A resize on an exited PTY no longer takes down the main process there. And on a Linux box with no keyring, the token vault fails closed instead of pretending to store.

The permission rail gets strict

• A permission button answers only the prompt it was sent for. Buttons used to press whatever the cell currently asked, so a stale button from an earlier question could approve a newer, different one. Every button is now bound to its prompt, and a button whose prompt has passed does nothing at all.
• Nothing types into a cell that is blocking on a prompt. Text sent to a busy cell used to land inside the permission dialog and answer it by accident. A blocked cell now refuses writes until the prompt is resolved.
• A plan approval never grows an Allow button. Approving a plan and allowing a tool are different decisions, and the rail no longer conflates them.
• A compacting cell reports as busy, not idle. The fleet view and the wait tools treat compaction as the work it is, so a lead agent no longer piles work onto a cell mid-compact.

Updates that hold

• The updater never offers a build that is already superseded. When a newer version ships while an older download is still pending, the older offer is withdrawn instead of racing you to the button.
• A broken transfer falls back to the staged build. When a superseding download dies midway, the updater installs the build it had already staged and verified, instead of stranding you on the version you started from.
• The changelog became What’s new. The in-app release card and the site changelog now share one recast surface, so what changed reads the same in the app and on the web.

Fewer features, on purpose

• The Activity Center is gone. The needs-you notification does the one job that mattered, with none of the drawer’s machinery. Nothing you relied on is lost: a cell that needs you still raises the system notification, the notification still jumps you to the cell, and the unread dot on its tile stays.
• The Prompt Enhancer is gone. It rewrote prompts nobody asked it to rewrite, and its seat in the composer implied the raw prompt was not good enough. Your keystrokes go to the agent untouched.

What a hostile repo can no longer do

• Helmsman runs the git found on your PATH, never one a scanned repo ships. A repository carrying its own git binary could otherwise have it executed the moment the app scanned the folder.
• Trust decisions read the real path. The known-root check resolves symlinks before it votes, so a link inside a trusted folder cannot smuggle in a target outside it.
• Marketplace installs show their origin. Installing a skill opens a trust dialog naming exactly where the code comes from, an updated skill asks again instead of riding in on old trust, and a skill edited on disk shows a reload banner instead of silently running the new code.

Fixes

• The bottom row of a terminal cell is never clipped again: the geometry that sizes a cell waits for the fit to converge instead of trusting the first measurement.
• The issue board opens instantly on a re-visit: a passive snapshot cache serves the last synced state while the fresh sync runs behind it.
• Whole-app zoom is off: Cmd+Plus belonged to the terminal, and a stray pinch could leave the entire window scaled with no way back.
• A cell whose agent exited keeps a dim presence on its sidebar row instead of vanishing, so an exit is visible without being loud.
• Closing the last empty tab closes it honestly: the stale name is reset and the phantom close button is gone.
• Closing a deck lands the view on a deck the dots can actually address, never on a blank canvas.
• Branch badges on the sidebar are live, a worktree that is gone says so instead of masquerading as clean, and a file shadowed by a worktree copy is marked as such.
• The Claude repair flow stays reachable when a provider misbehaves, and the app never swaps your provider silently.
• Fleet Restore counts only real terminal cells against the session cap, so a saved layout heavy on web and reader cells restores whole.
• The config store writes atomically, so a crash mid-write can no longer wipe your settings.
• A CLAUDE.md that is really a FIFO is refused before it can wedge the main process, and a huge terminal resize is capped before it can exhaust memory.

The same app as v0.7.0-beta.1, cut again under a new number so the release card can take its first turn. The card ships in 0.7.0, but the release that introduces it can never show its own card: the app you updated from predates the feature, so the first launch after the update read as a first run and stayed deliberately silent. Updating to this build shows the 0.7.0 highlights as a card in the app itself. Nothing else changed; the full story of what 0.7.0 brought is in the v0.7.0-beta.1 entry below.

A fix release, and the fix is the whole story: if you started your first session on 0.6.0 and saw Helmsman windows open and close behind your work, this is the release that stops it. Upgrade if you are on 0.6.0-beta.1.

The ghost windows

• A hook no longer boots a second Helmsman. Every Claude Code lifecycle event ran the courier as ELECTRON_RUN_AS_NODE=1 "<the app binary>". A packaged build cannot honour that: the release build disables the runAsNode fuse on purpose, so Electron ignored the variable and started normally. A first prompt fires four events, so a first-time user got four apps. The courier is a curl one-liner now, which cannot become the app under any fuse, and macOS always ships curl, so the zero-node-dependence the old form was reaching for finally holds.
• Your session tokens survive. Helmsman clears its per-cell token directory on every start because that directory belongs to exactly one running app. Each ghost boot therefore deleted the live instance’s per-cell MCP tokens and hook settings, once per hook event.
• Agent state comes back. With the courier never running, Claude cells silently degraded to a coarser fallback signal and Codex cells, which have no fallback, had no state or resume at all. Distillation moved to the app side of the wire, so the payload a hook posts is now parsed by code that has tests.
• Prompts stop stalling. Each event sat out its full ten-second hook timeout waiting on a courier that could not answer.
• Helmsman refuses to run twice. Whatever the route, a second instance does not merely duplicate the window: it deletes the first one’s live tokens, rewrites the fleet manifest and orphans every PTY. The second launch now quits and hands focus to the window you already have. The curl courier closes the specific hole; this closes the class.

Fixes

• A text selection in a running agent cell stays on the text it highlighted. xterm anchors a selection to a buffer row, and Claude Code repaints its frame in place on the alternate screen, so the orange highlight stayed where it was while new text was drawn underneath it. Copying handed you something you never picked, and Cmd+E enhanced it. The repaint is held while you drag, and released the moment the selection is.

Under the hood

• The deck’s swipe stage binds from a ref callback, so mounting a page costs the app one render instead of two.

The release where the app stops handing you to the docs. Helmsman now installs and repairs the Claude Code CLI itself, a security pass closes the renderer’s reach into your filesystem, and the ruled design system finishes its walk through Settings, Config and Source Control.

The app installs its own CLI

• A missing claude used to end at a link to the setup docs. Every install action now opens one confirm showing the exact command verbatim, then runs it in a real repair cell whose output stays on screen. The docs link survives only as a last resort on a failed install.
• The install is judged by a probe, never by an exit code: a curl that dies inside a pipe still reports success, so Helmsman re-queries your login shell and smoke-tests the binary before it says installed. A binary that is present but broken gets a name (a quarantine xattr, an x86_64 build with no Rosetta) and a copyable fix.
• A tool that is installed but off your PATH no longer blocks a spawn. Helmsman pins the absolute path it found, prepends its directory to every cell’s environment so your own hooks find it too, and scans nvm installs, picking the highest healthy version instead of a stale copy in /usr/local/bin.
• To make the fix stick, the Environment panel offers an append-only edit to your shell profile, previewing the exact file and the exact block before it writes anything. Fish gets the fish-correct line to copy.
• Helmsman’s own hooks stopped needing your node: they run on the Node inside the app. A missing node surfaces once as a dismissible notice that explains what it costs you, instead of failing quietly.
• Re-check re-reads your shell before it probes, so a CLI you installed after launching Helmsman is found. The welcome screen carries a quiet status strip: the facts when healthy, the install prompt when not.

A security pass across the boundary

• The renderer got a trust boundary. files:*, reader:*, config:*, projects:reveal and server:start now refuse any path outside the folders you added or the worktrees the app itself provisioned, checked at the IPC boundary rather than inside each handler. server:start no longer takes a command string at all, and the generic bridge that sat beside the curated API, making it decorative, is gone. A golden journey reproduces the old exploit against an unfixed build and proves it dead against this one.
• Untrusted repo content can no longer run code. A Procfile line is accepted only as a plain command, a repo’s .git/config can no longer execute through core.fsmonitor or diff.external on any git call the app makes, a catalog entry cannot traverse out of its own directory, and a symlinked .helmsman is refused.
• Issue and PR text arrives marked. What gh issue view returns now lands inside a fence that names it as third-party data and lists what it may never talk an agent into. The title moved inside that fence, so a crafted title can no longer close the quoting and read as your own instruction.
• Pre-approving a worker needs your hand. A lead agent asking for acceptEdits or allowedTools is asking for a worker that never prompts. That now requires a per-project opt-in you set in the project row’s menu, and a spawn without it fails loudly instead of downgrading in silence.
• Installing a skill from a pasted URL asks first, validates the git URL (closing an ext:: remote that could run a command), stages the clone so no dotfile lands in a directory Claude Code loads from, and refuses a repo with no SKILL.md.
• Nine production dependency advisories clear with a lockfile refresh.

The ruled design system, everywhere else

• Settings, the Config view, Source Control, Profile, the Marketplace’s Apps half, the sidebar’s + menu, the cell cost popover and the web-cell error states all move onto the ruled system, most of them through a critic loop run on top of the redesign.
• Source Control loses all three spinners (the brand wheel is the app’s only loading indicator), gains a real sign column and word-level emphasis in the inline diff, and gives every armed destructive action the same vivid danger treatment.
• Every markdown surface now renders the same document the same way. Five per-surface dialects became one: h4 through h6 had never been ruled at all and fell through to weight 700, the accent was spent fourteen times a document instead of once, and links were identified by colour alone.
• The reader family retires its eof lines and old-register chrome, and the residue left behind by retired scales is swept out of the shared chrome.

Providers

• Codex wore an invented hexagon and Grok a diagonal slash. Both are gone: every provider resolves its own real mark, and a new provider with no logo fails typecheck instead of quietly wearing a generic robot. Identity renders in the ink ramp, so the accent stays the app’s.
• Providers with no lifecycle model, Cursor among them, are readable through read_session at last. Their output never reached the capture buffer, so an orchestrator saw an empty screen where an authentication prompt was waiting.
• Opus 5 sessions show a real price instead of a hedged estimate. The money was already right and only the label was wrong, and two guards now stand against a third occurrence of that bug.

Fleet and the grid

• A supervised worker stays visible after its tile is gone. A close, a restart, a resume or a removed project used to drop the row outright, so a lead could not tell “my worker died” from “you made that id up”. Retired cells now keep a place in a bounded ledger, and a restarted or resumed cell inherits its parent link so its lead can still steer it.
• “Run as goal” starts an actual goal run. It used to ask the spawned session to compose one, which no session can fire, so it behaved like a plain send: no armed goal, no evaluator, no loop.
• A tile you grab right after a two-finger swipe stays under your pointer. The deck strip has two position writers and the drag pin was watching only one of them.

Fixes

• Toasts count down on the app’s own clock. The toast library keeps one provider-wide pause flag that could be stranded true, leaving the next toast with no timer at all, and an Undo offer could outlive the session it belonged to.
• A file drag entering the window closes any open menu, so a drop cannot land underneath an open card. The menus are also non-modal now, so the drag reaches the cell in the first place.
• The Activity and Hail history drawers close on an outside click.
• Screenshots pasted into an issue or PR render in the app. Main fetches the bytes with your own authenticated gh and hands the renderer a data URI, behind a host allowlist and a magic-number check.
• “Report a bug” opens a real mail draft again. It was building a mailto: in the renderer and handing it to a guard that allows only http and https, so the click did nothing at the exact moment a session had failed to launch. It was also addressed to nobody and carried 5 of its 11 diagnostics fields.
• Extra usage shows only on positive spend, in the payload’s own currency units.
• A failed spawn’s re-probe now reaches the Environment panel instead of being computed and thrown away.

Under the hood

• Typecheck runs on the TypeScript 7 native compiler: 32.7s down to 6.3s in CI.
• The five zones under src/ are enforced by lint instead of by discipline.
• The signed DMG builds on a Node that is still supported, and the stated Node floor now points at the single .nvmrc pin.
• Three more pieces move out of the App() god-file: the deck-paging swipe, the recent-files store, and the critic-loop findings on both seams.

The issue board stops assuming Claude, and the cost pill stops lying. This release makes sending an issue multi-provider, closes a real accuracy gap in cost tracking, and carries the ruled design system into the app’s empty states.

Send an issue to almost any agent

• The issue board’s send action was hardcoded to Claude on three seams: the label, the spawn, and the timeline copy. It is now a split pill: the main segment sends to your remembered default provider in one click, and the chevron opens a full picker with the same tiers, health facts, and typeahead as the launch menu.
• A muted auto tag marks an inferred default, which re-arms itself if your explicit pick ever breaks. Kimi Code is left off the picker, since its CLI cannot take an argv prompt.

A real cost number

• The cost pill was undercounting actual spend by roughly 26% against /usage. Four bugs, now fixed: subagent transcripts were never read at all; a keep-first dedup mispriced growing subagent duplicates; claude-sonnet-5 was missing from the pricing table; and web-search fees went uncounted. The popover now shows a main/subagent split and discloses a small ~2% floor for internal calls that never hit disk.

The file finder learns your worktrees

• The ⌘P file finder only ever searched the main checkout, so files that landed in a cell worktree were invisible to search. It now searches the union of the main checkout and your registered worktrees, tags worktree-only files with a branch badge, and shows a quiet banner (with a one-click pull) when the checkout has fallen behind origin.

Re-check stops lying about a missing CLI

• The cell Re-check button used to loop on “not installed” forever if you installed the Claude CLI after Helmsman launched, because the shell PATH was only read once at startup. Re-check now re-reads your shell before probing, and shows a “Checking…” state so a real re-probe doesn’t look like a dead button.

The ruled design system spreads further

• Empty states, keycaps, and option cards drop to the design system’s weight ceiling and give up their stray accent fills: hover states now move by border and ink instead of a color wash.
• The truncated cell-name tooltip is now the same gated Tip primitive used everywhere else in the app, replacing a hand-rolled pill that could get stuck open after a resize.

Fixes and hardening

• The Usage chip gains a linked-no-data resting state, so a freshly linked Claude subscription reads as “linked, no data yet” instead of sitting in the same dim state as a fetch failure.
• The provider picker’s fact column no longer overlaps long provider names, Codex and Grok get their own glyphs instead of sharing one, and every broken row (missing CLI, bad PATH) is now keyboard-reachable and teaches its own fix.
• The file-viewer overlay’s earlier fixes (focus trap, find/goto affordances, an outline rail with type-to-filter) are now ported onto the pinned reader cell and re-verified there.
• The Issues rail label reads “Threads”.

The skill switchboard tells the truth now, and the surfaces around it go quiet. This release makes per-project skill toggles real, sweeps the Skills library and Marketplace onto the ruled design system, and teaches the ship’s log to mail itself.

Skills, per project

• Turning a skill off for a project now writes Claude Code’s own mechanism, so new sessions actually honor the choice. The old toggle kept a private map that changed nothing; the library could say “0 enabled” while every skill loaded anyway.
• The library reads truthfully: switches default to on, the header says “all available” or “N off in this project”, and startup sweeps away the symlinks the retired system left behind.

The ruled design system spreads

• The Skills library becomes a quiet two-line row list with a single-axis reader page: three working grays, ghost pills, hover-revealed row meta, and one weightless accent.
• The Marketplace recasts from the card grid to the same directory register: 56px two-line rows grouped by space, a quiet search field, hover-revealed Install, and the single accent spent on the update dot.
• The full-window reader now renders in the pinned reader cell’s design language, so reading a file looks the same whether it is pinned in the grid or filling the window.

Release notes that sail themselves

• The changelog entry carries the release email as reviewed frontmatter, and a workflow mails every accepted member automatically when a build reaches the download page: same suppression, unsubscribe headers, and idempotency as the admin console, and a re-run can never double-send.
• A campaign CLI backs it up with preview, canary, and blast modes for hand-run sends.

Fixes and hardening

• A grid showing a single cell drops the focus ring; the highlight returns the moment a second cell joins the deck.
• The caffeinate hold and the status bar answer different questions, and the full running-vs-busy state matrix is now pinned by tests: cells idle at their prompts keep “N running” on the status bar while the display hold releases on time.

The grid stops being Claude-only. This release seats other agent CLIs as first-class cells, adopts sessions you started by hand, and rebuilds the issue board into a real workspace.

Run more than Claude

• OpenAI Codex and opencode now run as first-class cells: spawn them from the launch menu and they get the same lifecycle state, cost surface, and grid controls as a Claude cell.
• Gemini, Grok, Kimi Code, and Cursor join as provider rows, honest about what each one can and cannot report.
• The launch menu adapts to the providers actually installed on your machine, and every ⌘N surface now means the same launch.

Adoption

• Start an agent CLI by hand in any cell and Helmsman adopts it in place: it is recognized, badged, and supervised with the same fidelity as a cell Helmsman spawned itself.

The Issues workspace

• The single-pane issue board is gone. In its place: a two-pane workspace with threads, review comments, and pull requests, plus guided issue creation and direct agent handoff - point an issue at a cell and watch the after-state come back.

Quality of life

• Web cells load visibly behind an opaque cover, so first paint is three to seven times faster.
• Web and reader cells sit in a real card shell: proper viewport, scrolling, and drag shadow.
• A cell drag can start from its title, and worktree cells no longer paint at 80x24 before snapping to their real size.
• The usage dashboard now shows the Fable weekly limit alongside the session meters.

Fixes and hardening

• The trust gate for codex project hooks now recognizes every TOML spelling of a hooks key, so a repository cannot slip its own unreviewed hooks past Helmsman’s scan.
• The settings cog is symmetric again, sign-in code digits sit centered in their cells, and the focus ring follows the ruled style app-wide.