A real v1.29.4 session recorded off a terminal and replayed frame for frame — 2× speed, long model pauses cut, nothing on screen rewritten.
Laintas CLI combines a normal interactive shell with an agent runtime. Shell commands still run directly in a real PTY; natural-language tasks enter an iterative agent loop that can inspect the workspace, call tools, delegate work, and continue from the results.
It is designed for developers, server operators, and remote workspaces that want an AI agent close to the filesystem and terminal—not isolated in a separate chat window.
Current release: Laintas CLI beta v4 (1.32.5b4). Existing users can run /v update.
Highlights
- Direct shell commands bypass the model and retain normal PTY behavior.
- Natural-language tasks run as observable, interruptible tool-use loops.
- Named sub-terminals support interactive programs and long-running processes.
- Agents, HWO workflows, and durable HWG graphs support parallel or staged work.
- Built-in tools, skills, MCP servers, and extensions share one tool registry.
- Modes, roles, workflow phases, policy, trust, and hooks constrain execution in layers.
- Project memory, plans, events, traces, tasks, and workflow state survive restarts.
- Official, custom, and local backends have separate credential boundaries.
- Browser automation, Helpwo, shared storage, and Enterprise integrations are optional.
Install and Start
Linux standalone releases target 64-bit glibc systems on x86_64 and
aarch64; the installer selects the matching binary automatically:
curl -fsSL https://cli.laintas.com/install.sh | bash
laintas-cli
On Windows 10 or 11 (x86_64), install laintas-cli-windows from PowerShell,
then open it from the Start menu:
irm https://cli.laintas.com/install.ps1 | iex
It is this same CLI in a terminal window of its own. It needs no WSL and does
not use the Windows console, so the interface, colors and keys match Linux and
macOS. Commands run in the bundled bash environment, where drives appear as
/c/Users/...; account data stays in .laintas in your user profile. The
script verifies the installer's size and SHA-256 before running it, and
$env:LAINTAS_INSTALL_SILENT=1 skips the wizard. You can also download the
installer
directly. This first beta is not code-signed, so Windows may ask before
running it: choose More info, then Run anyway. No administrator rights are
needed. Ctrl+click opens a link, Ctrl+C copies when text is selected and
interrupts otherwise, and Ctrl+V pastes.
The macOS build is a native terminal CLI for Apple Silicon (arm64) and Intel
(x86_64). The installer detects the architecture automatically and verifies
the archive's SHA-256 checksum. It does not include Helpwo Kernel or Helpwo
machine sharing:
curl -fsSL https://cli.laintas.com/install.sh | bash
laintas-cli
The Mac installer writes to ~/.local/bin; add that directory to PATH if
your shell does not already use it. The installer downloads and verifies the
Mac package from cli.laintas.com/releases/latest/. See the release guide
for the Mac build and verification steps.
On Linux, check the host architecture and glibc before installing:
uname -m
getconf LONG_BIT
ldd --version
For unsupported native targets, development, or auditing, use the source package:
unzip laintas-cli_source.zip
cd laintas-cli-source
python3 -m pip install -r requirements.txt
python3 laintas_cli.py
Optional browser, MCP, and advanced web-fetch dependencies are documented in requirements.txt.
Launch options
Options given at launch apply to that run only. They never write your saved
preferences, so --model x today does not change what a plain launch uses
tomorrow; /model, /mode, /config and /theme remain the way to save a
choice.
laintas-cli "fix the failing test" # opens a session with this as the first message
laintas-cli "summarize the diff" > notes.txt # piped output: runs once, like --execute
git diff | laintas-cli -e - # - reads the task from standard input
laintas-cli -e "run the checks" --model ID --mode review --max-loops 10
laintas-cli -e "apply the plan" --yes --output-format json
| Option | Effect for this run |
|---|
--cwd DIR | Work in DIR |
--model ID, --route NAME | Model, or a direct model route |
--mode NAME, --plan | Working mode; --plan starts in PLAN mode |
--auto-approve none|writes|commands|all, --yes | What is approved without asking. The command policy still applies |
--effort LEVEL, --max-loops N, --config KEY=VALUE | Any /config setting; --config repeats |
--theme NAME, --no-color, --verbose | Text colors, colorless output, detail recording |
--append-system-prompt TEXT, --append-system-prompt-file FILE | Extra instructions after the system prompt. The product prompt is never replaced |
--tools LIST, --disallow-tools LIST | Narrow the tools offered (comma-separated names or globs). Applies to sub-agents too |
--mcp-config FILE | Load MCP servers from FILE |
--resume [SESSION_ID] | Resume the latest session here, or one by --session-id name, saved id or prefix, or its number in /resume |
--output-format json | With --execute: one JSON object on standard output (success, result, error, exit_code, session_id, model, mode, cwd, duration_ms); everything else goes to standard error |
Standard input is read only when the task is -, so an unattended caller that
leaves a pipe open cannot stall a run.
Use from an ACP editor (Zed & friends)
The CLI speaks the Agent Client Protocol
over stdio, so any ACP-compatible editor can drive it:
python3 -m pip install agent-client-protocol # once
laintas-cli --acp
Point the editor's ACP/agent setting at laintas-cli --acp on Linux or
macOS. Each editor session maps to one agent conversation in that
workspace; tool calls stream back as ACP tool-call updates, and anything
the approval policy gates — a command, a write, a delete — becomes a
permission request in the editor instead of a terminal dialog. Without the
SDK installed, --acp prints the one-line install hint and exits; nothing
else in the CLI depends on it.
Architecture
Laintas CLI is a modular monolith: latency-sensitive UI, policy, state, and tool dispatch remain in one local process, while model inference and optional integrations cross explicit boundaries. The public customization surfaces are configuration files, project files, skills, MCP, extensions, and hooks; internal Python modules are not all stable plugin APIs.
flowchart TB
U[Terminal input] --> R[REPL and command router]
R -->|PATH command| P[PTY execution]
R -->|slash command| C[Built-in or extension command]
R -->|natural language| A[Agent loop]
A --> X[Context assembly]
X --> B[Official, custom, or local backend]
B --> A
A --> T[Unified tool registry]
T --> G[Authorization pipeline]
G --> BI[Built-in tools]
G --> SK[Skills]
G --> MC[MCP servers]
G --> EX[Extensions]
G --> WF[Agents and workflows]
P --> E[Event and session state]
C --> E
BI --> E
SK --> E
MC --> E
EX --> E
WF --> E
E --> UI[Rich and prompt_toolkit UI]
E --> FS[Global and project storage]
Request lifecycle
- Classify input. The REPL distinguishes slash commands, executable commands on
PATH, and natural-language tasks.
- Route locally when possible. Direct commands run in a PTY. Slash commands are resolved from the built-in registry and loaded extensions.
- Assemble agent context. The runtime combines stable instructions with the active mode, project prompt, rules, memory, plan, role, workflow phase, and current terminal state.
- Call the backend. The active backend profile decides the origin, authentication boundary, billing label, and model request.
- Dispatch structured tool calls. Built-in, skill, MCP, and extension tools are exposed through one registry and namespaced by source.
- Authorize every action. Deny rules are evaluated across mode, workflow phase, agent role, global or organization policy, trust state, approval state, and pre-tool hooks.
- Execute and observe. The tool runs locally, its structured result is recorded, and relevant output is returned to the model for the next iteration.
- Persist and render. Events, history, trace details, usage, tasks, plans, memory, and workflow state feed both recovery and the terminal UI.
The runtime policy—not the prompt—is the security boundary. Prompt instructions shape behavior, but cannot grant a tool that a policy layer denied.
Subsystems and module boundaries
| Subsystem | Principal modules | Responsibility | Supported customization surface |
|---|
| Entry and routing | laintas_cli.py, command_parse.py | REPL, slash command registry, input classification, authentication, PTY routing | Runtime config, project commands, extensions |
| Agent runtime | agent_loop.py, precheck.py, critic.py, redactor.py, stuck_signals.py, tokenizer.py | Iteration, context budgeting, response parsing, safety checks, completion evaluation | Prompt, modes, rules, skills, policy |
| Terminal UI | resource_ui.py, detail_trace.py, agents_mode.py, agent_ui_events.py, repl_mirror.py, symbols.py, terminal_preferences.py | Browsers for resources and traces, agent events, terminal rendering, theme preferences | /theme, terminal preferences, extension command metadata |
| Tool runtime | tools.py, agent_tools/, patch_adapter/, format_adapter/, diagnostics_adapter/ | Unified registry, filesystem/process/browser tools, patching and normalized results | Skills, MCP, extensions, policy |
| Authorization | policy.py, trust_store.py, durable_rules.py, hooks.py | Layered allow/deny decisions, executable trust, persistent constraints, lifecycle interception | Policy, project trust, rules, hooks |
| State and recovery | paths.py, json_store.py, event_log.py, session_store.py, snapshot.py, usage_tracker.py | Secure paths, atomic state, replayable events, sessions, snapshots, usage | Global and project data files |
| Memory and context | memory_system.py, mem_extract.py, mem_recall.py, mem_signals.py, rag_signals.py | Typed memory capture, retrieval, relevance signals, prompt injection | /memory, project memory, project prompt |
UI architecture
The normal REPL uses Rich for streamed output and prompt-toolkit for input. Resource-oriented commands use a shared full-screen browser model:
resource_ui.py owns list/detail navigation, responsive split or single-pane layout, search, focus, and common key handling.detail_trace.py records assistant output and tool request/result content so /detail trace can inspect what the model received or changed./told, /plan, /memory, /skill, and related resources adapt their domain data to the shared browser instead of reimplementing navigation.agents_mode.py and hwo_ui.py remain specialized workspaces because their live event and input semantics differ from static resource browsing.
This separation keeps interaction behavior consistent without forcing every command into the same screen model.
State layout
Signed-in runtime state is account-scoped; project state travels with a workspace. Private directories and files are created with restrictive permissions, and executable customization rejects unsafe ownership or symlink conditions. Account directories use the SHA-256 of the verified userId, independent of display names.
| Location | Examples | Scope |
|---|
~/.laintas/accounts/<id-hash>/config.json | Runtime preferences and feature settings | Account |
~/.laintas/accounts/<id-hash>/session.json | Authentication credentials | Account, private |
~/.laintas/accounts/<id-hash>/policy.json | Tool and command policy | Account |
~/.laintas/accounts/<id-hash>/backends.json | Backend profiles and credential references | Account |
~/.laintas/accounts/<id-hash>/mcp.json | MCP process definitions | Account |
~/.laintas/accounts/<id-hash>/hooks.json, hooks.py | Declarative and Python lifecycle hooks | Account |
~/.laintas/skills/ | User-installed skills | User |
~/.laintas/accounts/<id-hash>/extensions/ | Installed extensions | Account |
~/.laintas/accounts/<id-hash>/memory/, plans/, agents/, sessions/ | Durable runtime data | Account |
~/.laintas/instances/, writes/, session_locks/ | Instance discovery, conflict detection and account-aware session locks | Shared between accounts |
~/.laintas/sessions/ | Unassigned legacy tasks | Explicit adoption required |
.laintas/cli.prop | Project system instructions | Project |
.laintas/memory.json | Project-scoped memory | Project |
.laintas/rules.json | Persistent workspace rules | Project |
.laintas/modes.json | Custom modes | Project |
.laintas/commands.py, loop.py | Executable project callbacks | Project, trusted |
.laintas/extensions/ | Workspace-local extensions |
Project extensions shadow global extensions with the same name. User skills likewise override bundled skills with the same declared skill name.
Customization Model
Use the narrowest surface that solves the problem:
| Need | Preferred surface | Executes code? | Trust required? |
|---|
| Change general behavior | config.json, /config | No | No |
| Add project instructions | .laintas/cli.prop | No | No |
| Preserve facts or constraints | Memory and rules | No | No |
| Restrict tools for a working style | .laintas/modes.json | No | No |
| Add a small project slash command | .laintas/commands.py | Yes | Project hash trust |
| Handle a project loop command | .laintas/loop.py | Yes | Project hash trust |
| Add reusable guidance | SKILL.md | No | No |
| Add reusable in-process tools | skill.py | Yes | Skill hash trust |
| Connect an external tool server | mcp.json | Child process | MCP config trust |
| Add commands, tools, and lifecycle logic | Extension | Yes | Signature or hash trust |
| Intercept runtime events | Hooks | Maybe | Executable hook trust |
| Use another inference endpoint | Backend profile | Remote service | Explicit profile config |
1. Project prompt, memory, and rules
.laintas/cli.prop is appended to the project instruction context. It is data, not Python, and is the right place for repository conventions such as test commands, formatting rules, or architectural constraints.
Use /memory for durable facts and /rule for recurring constraints. Keep instructions concise: they consume context on every relevant turn, and they are behavioral guidance rather than an authorization mechanism.
2. Custom modes
Modes combine instructions with a restrictive tool posture. Built-in modes include act, review, study, auto, and step; plan mode owns a separate plan lifecycle. Project modes live in .laintas/modes.json and can also be created interactively through /mode create.
Use /mode to switch or manage modes:
/mode <name> switches to any built-in or project mode (e.g. /mode review, /mode act)./mode list lists all available modes./mode create <name> [flags] creates a custom mode with tool and permission boundaries:
--tools <tools>: comma-separated tool names or glob patterns allowed by this mode (auto-completed from registered tools).--deny <tools>: comma-separated tool names or globs explicitly blocked (denials take precedence).--read-only: restrict strictly to the built-in read-only tool suite.--auto-approve <none|writes|commands|all>: execution approval policy for this mode (default none).
/mode delete <name> removes a custom mode.
Command-line creation example:
/mode create docs-review --tools "fs.read,fs.grep,fs.glob" --deny "shell.*,fs.write,fs.edit" --auto-approve none
Modes can also be declared directly in .laintas/modes.json:
{
"version": 1,
"active": "docs-review",
"modes": {
"docs-review": {
"description": "Review documentation without modifying the workspace",
"instructions": "Check correctness, structure, examples, and broken references.",
"allowed_tools": ["fs.read", "fs.grep", "fs.glob"],
"denied_tools": ["shell.*", "fs.write", "fs.edit"],
"auto_approve": "none"
}
}
}
denied_tools wins over allowed_tools. A missing allowlist means “all tools allowed by this mode,” not “bypass other controls.” The effective set is still intersected with workflow, role, global/organization policy, and trust decisions. Tool names may use supported glob patterns.
3. Project slash and loop commands
For small workspace-only behavior, define .laintas/commands.py:
def handle_extra_command(action, parts, ctx):
if action != "/project-status":
return False
ctx["console"].print("Project checks are ready.")
return True
.laintas/loop.py may define handle_loop_command(command, ctx) for project-specific loop handling. Both files execute inside the CLI process with the current user's permissions. Review them, then approve their exact hashes with /trust allow; changing either file invalidates that approval.
Use an extension instead when the command needs metadata, reusable packaging, multiple tools, installation, or teardown.
4. Skills
A skill is a directory under ~/.laintas/skills/<name>/ or the bundled default_skills/ tree.
my-skill/
├── SKILL.md # name, description, version, instructions
├── references/ # loaded only when the skill needs them
├── skill.py # optional get_tools()
└── extension.json # required for executable skill capabilities
The lightweight frontmatter in SKILL.md is indexed at startup. Full instructions are loaded only when the skill is activated, and references can be loaded on demand. This progressive loading limits startup time and context usage.
Documentation-only skills do not execute code. An executable skill defines get_tools() in skill.py, declares capabilities in extension.json, and passes hash trust before registration. Its tools are tracked as skill:<name> so unloading can remove them transactionally.
5. MCP servers
MCP is appropriate when tools already run as a separate service or should have their own dependency environment. Configure servers in ~/.laintas/mcp.json:
{
"servers": {
"example": {
"command": "/absolute/path/to/example-server",
"args": ["--stdio"],
"env": {"EXAMPLE_TOKEN": "..."},
"cwd": "/absolute/path/to/workspace",
"enabled": true,
"call_timeout": 30,
"capabilities": ["fs.read"]
}
}
}
The MCP manager owns a background asyncio loop and bridges stdio JSON-RPC tools into the synchronous registry as mcp.<server>.<tool>. It starts child processes with a minimal environment plus explicitly configured variables. Trust is tied to the server configuration hash; edit the launch configuration and it must be reviewed again.
6. Extensions
Extensions are the broadest supported customization unit. They may register slash commands, tools, loop handlers, and teardown logic. A project extension lives at .laintas/extensions/<name>/; a global one lives at ~/.laintas/extensions/<name>/.
example/
├── extension.json
└── main.py
{
"schemaVersion": 2,
"name": "example",
"version": "0.1.0",
"entrypoint": "main.py",
"description": "Example Laintas extension",
"author": {"name": "Your Name"},
"license": "MIT",
"toolPrefix": "example."
}
main.py exports setup(ctx) and may export teardown behavior. The context exposes narrowed registration and backend-call helpers; raw official authentication material is not handed to the extension. This reduces accidental credential leakage, but Python extensions still run with the full permissions of the local user.
Installation and trust paths:
| Source | Command | Trust mechanism |
|---|
| Official extension | /extensions install laintas/<name> | Official registry hash plus explicit approval |
| Community package | /extensions install @author/<name> | Immutable artifact hash, fresh static and AI source review, explicit approval |
| Local package | /extensions install <path-or-url> | Explicit content-hash approval |
| Evolution Lab candidate | /evolve | Test, activation, and rollback workflow |
Browse the marketplace with /extensions available, narrow it with
/extensions available official or /extensions available community, and
search both sources with /extensions search <keyword>. /extensions list
continues to show only extensions installed on the current machine.
Use /extensions create to scaffold a package and /extensions pack to produce a distributable .lext archive. An installed extension can be published with /extensions publish <name>: the CLI uploads extension.lext and publish.json under Extensions/<name> in Laintas Storage, then commits an immutable community-registry version. Community packages are never presented as official packages and cannot use the laintas publisher namespace.
Every community installation verifies the published SHA-256, extracts within strict size and file-count limits, runs deterministic checks, and submits the source to a fresh tool-less AI review. The report is advisory rather than a sandbox: community Python still executes with the local user's permissions, every installation requires confirmation, critical findings are blocked, and scanner failure stops installation.
toolPrefix must be lower-case and dot-terminated. Without a custom prefix, the runtime assigns an extension-owned namespace. Legacy manifests without an install block remain loadable for backward compatibility.
7. Hooks
Hooks observe or gate events such as command/tool execution, session start/end, errors, and memory changes.
- Declarative hooks in
~/.laintas/hooks.json run an argument vector with shell=False, receive event JSON on standard input, and support conditions, timeouts, and block_on_failure.
- Python callbacks in
~/.laintas/hooks.py provide richer in-process behavior and require executable trust.
Use declarative hooks for audit forwarding or deterministic checks. Use Python only when the event requires local program logic. A blocking hook fails closed when configured to do so.
8. Backend profiles
Backend profiles live in ~/.laintas/backends.json and divide inference endpoints into trust domains:
- Official — exact Laintas origins; may receive the Laintas session and use managed billing.
- Custom — an explicit HTTPS endpoint with a separate
env:VARIABLE or keyring:service/user credential reference; external and unmetered by Laintas.
- Local — loopback development endpoint without authentication.
Custom endpoints cannot declare themselves official. Authenticated calls refuse unsafe cross-origin redirects, Laintas credentials are never forwarded to custom hosts, and custom tokens are never sent to official origins. Configure profiles with /backend instead of embedding secrets in URLs or checked-in files.
9. Workflows, agents, and UI behavior
Agent roles and workflow phases can narrow tools and specialize instructions for a stage of work. HWO handles live multi-agent orchestration; HWG compiles durable, resumable work graphs. Their state is persisted separately from ordinary chat history so a failed terminal session does not silently complete a workflow.
For new domain behavior, prefer composing roles and workflows with registered skill/MCP/extension tools. Editing hwo_runner.py, workflow_engine.py, or UI internals directly is core development, not a compatibility-stable customization path.
Theme and terminal behavior are user preferences exposed by commands such as /theme and /config. /theme only chooses text colors and never repaints the terminal: auto (the default) asks the terminal for its background once and picks text made for a dark or a light one, dark and light set that choice by hand, and mono uses no color. The fixed lines that commands print are recolored to stay readable on that background; tool rows, thinking notes, model output, the prompt and menus keep their established styles. Resource screens inherit shared styles and key bindings; specialized live workspaces add only interactions required by their domain.
Security Boundaries
Customization is intentionally split into declarative and executable surfaces:
- Prompt files, memory, rules, modes, and backend metadata do not execute local code, though untrusted project text can still influence model behavior.
- Project callbacks, skill tools, extensions, MCP launch definitions, and Python hooks require trust tied to the reviewed content or configuration.
- Symlink and ownership checks protect executable project customization from path substitution.
- Tool authorization is deny-first and evaluated at execution time, not only when the model receives its tool list.
- MCP and extension namespaces prevent accidental tool-name collisions and make cleanup source-aware.
- Evolution Lab provides testing, activation, and rollback; it is not a hostile-code sandbox.
See SECURITY_CUSTOMIZATION.md for the threat model and exact trust behavior.
Command Map
Run /help for the authoritative list for your installed version, including extension commands.
Context compaction starts silently in the background at 70% of the usable
message budget. At 90%, the agent waits for that result or uses foreground
compaction. /compact still forces compaction; /compact status shows the
thresholds and worker state. See background compaction
for configuration, cancellation, and how new messages are preserved.
/resume [N|all|latest] switches to an existing session without creating a
branch. --resume and --continue do the same. Selecting a historical row
resumes that session's latest saved state; use details to inspect the older
snapshot. A session open in another terminal cannot be resumed concurrently.
/fork [name] explicitly creates an independent branch from the current context.
In the resume picker, deleting a session node deletes its saved snapshots and
all descendant branches; deleting a historical snapshot removes only that
snapshot. A tree containing an open session cannot be deleted: switch away or
close its terminal first. Deleted sessions cannot be recreated by stale autosaves.
Explicit --execute --session-id retains its logical-session continuation behavior.
/agent <name> switches the foreground conversation; each persistent agent
has its own /resume history. Switching back preserves work completed in the
background. A working agent can receive updates in /agents; switch the
foreground to it after its task finishes.
Agent Isolation vs. Shared Configuration:
- Isolated per Agent: Chat conversation history, local state variables, message queues, PTY/execution terminals, base model/provider bindings, and individual tool policies.
- Shared across all Agents: Working directory filesystem, persistent project memory, tool registry, and runtime configuration (
_runtime_config). Adjusting iteration limits (e.g. /config max_loops <n> or /max) lifts or modifies boundaries globally for every agent in the process.
/agents selects an agent to view or address without changing the foreground
conversation or terminal ownership. Enter sends an update to a working agent,
continues the current foreground agent, or starts a new task for another
idle employee. The input hint shows which action applies. To continue another
agent's existing conversation, leave the panel and use /agent <name>; use
/resume there to choose its saved history. /agents --plain distinguishes
the foreground agent and current conversation from older saved records.
/station opens the live agent/terminal manager. Press v to switch between
delegation and terminal views, Enter for details, e to open the existing
terminal/dialogue view, and a to enter a management command. Commands include
task <work>, auto <work>, suggest <work>, bind <terminal>, cancel,
and unstation. In terminal view, close shows affected resources and
close confirm closes them only if the confirmed resources are still current.
Closing Station itself leaves running work alone.
Outside the manager, /station <agent-id> [terminal] --task <work> assigns an
employee; /station suggest --task <work> previews routing and
/station auto --task <work> starts an isolated child. Existing Auto-Pilot
auto-execution uses the same service when auto_pilot_auto_execute is enabled.
Independent tasks exceeding auto_pilot_max_parallel queue without being
discarded. auto_pilot_budget_tokens stops remaining work after reported usage
reaches its threshold; in-flight calls may exceed it, and unavailable provider
usage cannot be counted. Automatic writing tasks require Git worktree isolation.
Role selection and routing never broaden the parent's tool permissions.
| Area | Commands | Purpose |
|---|
| Session | /account, /login, /handoff, /fork, /resume, /told, /detail | Account profiles, task handoff, context branching, conversation and trace inspection |
| Behavior | /mode, /plan, /model, /config, /theme | Working posture, planning, model override, preferences |
| Knowledge | /memory, /rule, /skill | Persistent context, constraints, progressive skills |
| Execution | /term, /spawn, /agents, /task | Terminals, delegated agents, and task tracking |
| Workflows | /hwo, /hwg | Live orchestration and durable graph execution |
| Plugins | /mcp, /extensions, /evolve, /reload, /trust | External tools and executable customization |
| Connectivity | /backend, /web, /identity, /helpwo, /shared | Inference, search/fetch, browser identity, the cloud folder, and Helpwo sharing where a kernel is available |
| Applications | /app | Run a registered application in its own sub-terminal with its own agent |
| Administration | /policy, /usage, /training, /v, /org | Policy, allowance, data preference, updates, Enterprise |
Add another verified login with /account add B, name the current one with
/account alias A, and inspect /account list. /account switch B saves the
outgoing tasks and restarts into B's last open task in this terminal. It does
not take over a task open in another terminal. Finish or pause running Agents
before switching. A refresh of the current login keeps its task; a login as a
different account switches environments instead of changing a running task's
credentials. Run laintas-cli --account A and laintas-cli --account B in
separate terminals for concurrent work. Separate Git worktrees are appropriate
when both tasks edit code. Helpwo linking still requires the kernel and CLI to
use the same account.
Account switches validate the restart executable before saving or shutting
down the current runtime. A preparation error cancels the switch and keeps
the prompt usable. If restarting fails after shutdown, the previous account
selection is restored unless another CLI has updated it; this process exits
with a recovery message and the saved tasks can be opened with --resume.
An interactive switch drops launch-only task/application arguments and resumes
the destination account. Restarting immediately after the first login retains
the original launch task and its arguments.
Embedded Python entry points must call paths.configure_account(user_id)
before importing runtime stores. For an anonymous/custom backend, explicitly
use paths.configure_account('') or LAINTAS_ACCOUNT_MODE=anonymous. An
embedded entry can also inherit LAINTAS_ACCOUNT_ID for a verified local
profile. Uninitialized stores fail explicitly; once a store binds its paths,
changing profiles requires a process restart. JSON writes to managed private
stores also check the selected profile.
File locks serialize callers per canonical file path. Nested acquisitions
follow the enforced order: profile/handoff/legacy-receipt stores (STORE),
session lifecycle (SESSION), then session lease claims (CLAIM). Locks of
equal rank follow canonical path order; reacquiring a held lock is allowed.
Inverted acquisitions raise before waiting. Lock sidecars must remain on disk
while any process can use them.
During a signed-in task, /handoff new <title> --to B captures its objective,
constraints, recent conversation, native message thread and plan. B can be a
saved account alias/email/userId. For a recipient not saved locally, use
--to-user-id <userId> instead. The checkpoint
excludes credentials and runtime approvals; recognized secrets in text are
redacted. Large contexts must be compacted before exporting. Exchange the
project's .laintas/handoff/ through Git, or use /handoff export <id> [file]
and /handoff import <token|file>. Sync the code and environment separately.
The recipient runs /handoff accept <id>: its primary Agent opens a new owned
session and begins verifying and continuing the remaining work. Repeating
acceptance retains the receiving session's progress. A's original session is
preserved. Legacy handoff envelopes without task checkpoints remain readable.
Tokens have a corruption checksum, not an account signature; cloud /handoff sync remains scoped to one account and is not cross-account delivery.
Old tasks are not assigned to whichever account happens to be logged in during
an upgrade. Use /account legacy in their project and explicitly choose
/account adopt <session-id>. Adoption keeps the original files, creates an
owned receiving session, and records the chosen account to prevent a second
account adopting the same source. Legacy configuration and memory remain at
the old root rather than being silently attributed to an account.
/t opens the terminal browser even when no child terminals exist. Press n
to create the next available termN, e to enter the selected terminal,
o to observe, or x twice to close it. /term <name> creates a named child.
If the local pairing service is unavailable, it creates a local shell and
reports that Agent pairing is unavailable. Ordinary terminal registration
does not contact the kernel or gateway. An adopted executor still cannot
create a third terminal level, including through the local-shell fallback.
Inside a child CLI, /back (or /q) returns to its parent without stopping
the child; Ctrl+\\ is the force-detach shortcut. The prompt and Agents view
show the child's name. LIVE OUTPUT reconstructs the current terminal screen
instead of concatenating redraws, and refreshing preserves preview scrolling.
Two independently running CLIs can establish the same controller/executor
relationship through /term. Run /term peers in controller B, then
/term adopt <terminal-id> --name A. In executor A, explicitly run
/term accept <invitation-id>. B now hires A's persistent Agents as direct
employees named A/primary, A/scout, etc., with A's primary stationed in A.
Use B's /station to assign work; execution uses A's workspace, credentials,
and the intersection of both sides' tool permissions. Agents in A do not
become managers of one another. /term A creates a child and attaches it
automatically, using the creator's consent.
Only two terminal levels are permitted: an executor cannot acquire execution
children, and a controller with children cannot itself become an executor.
Local pairing permits different accounts with explicit acceptance; remote
pairing requires the same account and updated Helpwo kernel/gateway support.
/term release A in B, or /term release in A, revokes the relationship
without terminating an independently started CLI. Lost contact expires the
execution lease after 30 seconds and requests cancellation of delegated work;
the relationship remains reserved until explicitly released. Status updates
carry bounded result summaries; full execution history stays with A.
Progress reports during a task: /progress
Press Alt+P, or type /progress and Enter, while an AI task is running.
A separate AI call summarizes completed work, current activity, remaining work,
and known blockers in English; the main task continues. Alt+P preserves your input draft.
Reports use the model selected by /model aux (or the main model when aux is
unset), consume an additional AI call, and show the time of the evidence snapshot.
Repeated requests share the report already in progress. A failed or timed-out
report does not interrupt the task. Reports do not become instructions or history
in the main model's conversation.
Set the report output budget before starting a task with
/config progress_max_tokens 4096; inspect it with /config progress_max_tokens.
The default is 2048 tokens. Set it to 0 to use the provider/window limit.
This setting is separate from /config max_tokens for the working model.
Password vault: /password
/password opens the shared full-screen entry browser. Use / to search by
description, site or entry ID, Enter for public details, a to add, v to
reveal locally, e to edit and d to delete. Actions that need secrets ask
you to unlock and then continue with the selected entry. u unlocks, l
locks, c changes the passphrase, and q exits and locks the vault.
Secret input is masked and has no saved input history. Multiline secrets
preserve blank lines: Enter adds a line, Ctrl+D finishes, and Esc cancels.
In the field editor, select only the fields to change, then choose Save
changes; Cancel discards the draft. An empty username or note clears that
field; secret entries can also clear their optional site list.
Descriptions and sites are public metadata. Secret values appear only in a
private local full-screen view, bypassing terminal mirroring; Enter or Esc
closes that view. Protected browser autofill remains unavailable.
Hosted applications: /helpwo and /app
The CLI no longer installs, starts or communicates with Helpwo Kernel.
/helpwo retains its hosted-application entry point; remote machine sharing
is unavailable without a separately supplied host adapter. The Helpwo
desktop application for Windows is a separate product with its own kernel
integration and chat UI; it is not laintas-cli-windows.
/app runs other applications the same way, from manifests in
~/.laintas/apps/*.json or ./.laintas/apps/*.json:
{"name": "notes", "description": "…", "command": "node server.js",
"app_url": "http://127.0.0.1:3000",
"prompt": "What this app's agent is for.", "persistence": "none", "port": 8123,
"session_tools": ["shell.exec"], "auto_approve": false,
"max_sessions": 10, "session_idle_minutes": 30}
A manifest must be trusted (/app trust <name>) before it starts, and again
after it changes. The command runs with LAINTAS_APP_BRIDGE_URL,
LAINTAS_APP_TOKEN, LAINTAS_APP_AGENT_ID and LAINTAS_APP_NAME in its
environment, logs to the app's state folder, and stops with the sub-terminal.
Set app_url to the project's actual HTTP(S) address. Startup prints this as
Project URL, separately from Bridge API and Bridge login. The port
field configures the bridge; app_url only advertises the project address and
does not change its listener or check readiness.
Agents manage the full lifecycle with app.manifest.put, app.list,
app.manifest.get, app.start, app.stop, app.trust.request and
app.trust.revoke. Start requests trust once per manifest digest; subsequent
starts and stops need no extra approval. Agents can write manifests directly.
The bundled app-hosting skill documents
all fields and the bridge contract.
Manifests also support agent (primary configuration), agents (named children
with parent, prompt, role/profile, model/provider, tool policy and terminal),
and terminals (name, command, cwd). Startup creates these resources using the
same agent registry and deployment service as /station; failed setup rolls
back newly created resources. Each user session instantiates the same topology.
Many users. The CLI does not know the application's users, bill them or
define a protocol for them — the application does all of that. What the CLI
provides is isolation: the application asks for a session per user id and gets
a temporary sub-terminal with its own agent.
Send to the app bridge (POST /api/agents/<id>/send) | Result (final event in /updates) |
|---|
{"kind": "session-open", "payload": {"user": "alice"}} | {"user", "url", "token", "agentId", "persistent"} — alice's own bridge |
{"kind": "session-close", "payload": {"user": "alice"}} | closes her sub-terminal and agent |
{"kind": "session-list"} | open sessions |
The application talks to url with token using the normal authenticated
bridge APIs, including files, shell, terminals, proxy, chat and approval replies.
Each session is a nested CLI with its own LAINTAS_HOME and working directory,
sharing the billing login. session_tools accepts registered tool names or
["*"]; its default is ["shell.exec"]. agent.tools overrides that fallback.
auto_approve: true automatically grants approval requests, including deletes;
false uses needs-approval / approval-response instead of rejecting all work.
Other runtime policy denials still apply. Slash commands in messages are text.
Sessions close after session_idle_minutes without requests and close with the
application. Protect the bridge token: it grants the runtime's file/shell access.
Every session runs as the operator's OS user. Separate homes keep agents from
loading each other's data; they do not stop a shell command from reading
another folder. If end users are untrusted and have shell.exec, run the CLI in
a container or under a dedicated account.
With persistence: "workspace" the token and port are kept per folder, and each
user's session folder and conversation survive restarts.
Development
python3 -m venv venv
source venv/bin/activate
python -m pip install -r requirements.txt
venv/bin/python -m pytest
The download site is a separate Vite application:
cd laintas_cli_download
npm install
npm run dev
The package manifest is intentionally explicit. When adding a runtime module, bundled skill, or adapter, update package_manifest.json and verify both source and standalone distributions—not only execution from a repository checkout.
Release Artifacts
.github/workflows/release.yml publishes:
- Linux amd64 standalone archive
- Linux arm64 standalone archive
- macOS Intel (
amd64) native CLI archive
- macOS Apple Silicon (
arm64) native CLI archive
- Linux amd64 Debian package
- Source archive
- SHA-256 checksums and source-update manifests
The download page offers Linux and macOS installers that select the CPU
architecture, and the laintas-cli-windows installer. CLI archives, Debian
packages, source ZIPs and checksums are mirrored at
cli.laintas.com/releases/latest/.
laintas-cli-windows is built separately by the manual
.github/workflows/windows-build.yml workflow from build/windows/: a
terminal window (Tauri and xterm.js), a bundled POSIX runtime with bash, git
and Python, and this repository's CLI sources unchanged. The workflow installs
the result on a Windows runner and drives the real window before anything is
published. Installers live at cli.laintas.com/windows-cli/<release>/, and
windows-cli/download.json names the one install.ps1 installs. A newer
version is installed by running its installer; the window does not update
itself yet.
cli.laintas.com/windows/ belongs to the Helpwo desktop application and its
signed updates; CLI releases must never overwrite that channel. Historical
release notes below describe the builds shipped at the time.
The current public release is laintas-cli-beta v5
(tag laintas-cli-beta-v5). It is an ordinary GitHub Release, marked latest;
its Python package version is 1.32.5b5. The Mac package is an initial native
CLI build without Helpwo Kernel. See the release guide for
build and verification details.
Version History
The history below is curated from the repository tags and changes, following an Added/Changed/Fixed-style release-note structure rather than reproducing raw commit messages. The tagged public history currently represented in this repository begins at v1.3.0.
Added
/theme auto|dark|light|mono: text colors made for the terminal's own
background. auto asks the terminal once; nothing repaints the terminal.- Launch options that apply to one run without changing saved preferences:
model, route, mode, approval level, effort, loop limit, any
/config
value, tool filters, MCP config, extra system instructions and --resume.
A task given on the command line opens a session with it as the first
message; - reads the task from standard input.
- One progress display for CLI updates, extensions and the install scripts.
Changed
/agents uses one color meaning per state, a shorter side panel, and a
list-first layout in narrow terminals./resume no longer adds a duplicate checkpoint when nothing changed, and
long rows scroll while their tree prefix stays in place.- With
--execute in text mode, start-up notices go to standard error.
- The Windows and WSL code paths were removed from the CLI package. Windows
is now served by laintas-cli-windows, which runs the unchanged CLI in its
own terminal window (first beta, installer not yet code-signed).
Added
- Type and submit append messages while an Agent is thinking; successive
messages remain visible as branches of the Thinking line.
- Account profiles with isolated sessions and settings, terminal-local account
selection, safe switching and explicit task handoff or legacy-task adoption.
- Two-level terminal adoption through
/term, exposing the executor's Agents
to its controller after explicit acceptance. Local pairing supports separate
accounts; cross-server pairing needs matching-account Kernel/Gateway support.
- Optional ACP integration for compatible editors through
laintas-cli --acp.
Fixed
- File locking now uses independent per-file locks and rejects nested lock-order
inversions instead of globally blocking unrelated lease and storage work.
- Profile stores require explicit initialization and reject cached-profile
hot-swapping or writes to another profile.
- Account switching validates restart commands before shutdown, saves tasks
once, restores account selection on failed restarts, and separates interactive
switch arguments from first-login launch arguments.
- Snapshot ownership conflicts leave a debug diagnostic. Local
/term creation
can fall back to a shell when pairing is unavailable without bypassing the
two-level terminal restriction.
- Linux standalone builds install the complete declared core dependency set.
Added
- Native macOS CLI archives for Apple Silicon and Intel, with an installer that
detects the architecture and verifies the archive checksum.
- Mac downloads mirrored on
cli.laintas.com; no Helpwo Kernel in the Mac build.
Fixed
- Hardened terminal rendering of injected text and improved per-agent resume,
terminal attachment, vault and Windows screenshot interaction behavior.
Added
- Added secondary flag completions for
/mode create (--tools, --deny, --read-only, --auto-approve) with live tool registry candidate prompts.
- Subcommand listing for
/mode now cleanly surfaces command capabilities (list, create, delete) while maintaining direct mode switching.
- Introduced
child_registry.py and persistent child agent lifecycle tracking.
Fixed
- Stopped unnecessary per-keystroke DrvFs work that slowed shell execution under Windows WSL environments.
Changed
- Release documentation and assets distribution updated to prioritize
cli.laintas.com as primary channel.
Added
- Integrated blindpick v3.2.0: directory follow behavior and
--dir override for target repository analysis.
Fixed
- Billing refusal copy is English-only in the source; CN turns keep their
localization through the gateway's
lang pass-through (the v1.29/v1.30
mechanism), and a build-breaking f-string escape from the v1.31.0 cycle was
removed with it.
Added
- AI-PoW moved out of the core into the
ai-pow extension: the four core
modules (3,053 lines) become a vendored extension kept byte-identical to the
ai-pow checkout, core emitters go through extension_runtime.emit, and the
new observe capability gates ctx.on subscriptions. laintas pow ...
stays a launcher entry point so git post-commit hooks survive updates.
- A unified prompt-budget tree (
prompt_budget.py + context_policy/budget.json)
replaces the scattered size configs (output_truncate, compact ratios,
auxiliary-model shares), exposed via /budget.
- Coded billing refusals: an empty wallet, a spent membership allowance, a busy
ledger and an unavailable billing service each get their own headline and a
page to check, instead of all arriving as "Payment authorization failed".
Changed
- Compactor: first folds go out tagged like every other fold, with a closing
instruction after ledger evidence that a majority of first folds came back as
conversation continuation;
/compact status records per-owner failure
reasons instead of reading "idle" through every failed summary.
Added
- The official
canvas extension, a password vault (/password) with
encrypted storage and fill, and a recorded-terminal replay on the download
site (real session, frame-for-frame).
- Live per-model context parameters reported by the gateway, and larger
summarizer slices for heads split into many folds.
Changed
- Memory capture gained a budget with archival eviction and usage
de-duplication, and
/model completion no longer lists concrete model ids.
Changed
- Hosted-app startup prints the bridge login and the manifest's
app_url as
Project URL, and get_url() accepts a path so the bridge answers on one
port; /station no longer wedges and the default port no longer collides.
Fixed
- The disk-formatter deny rule now matches program position only, so
docker ps --format and git log --format stop being denied; saved configs
are migrated off the superseded rule.
/v source updates verify that newly declared pip dependencies are
importable and tell the user exactly what to run when one is missing, instead
of crashing later with ModuleNotFoundError.
Added
- Hosted-app operations exposed as agent tools (
app.manifest.put,
app.start, app.stop, trust management); the PPOS integration retired.
Fixed
/helpwo --remote goes online as a runtime environment instead of failing
its local-only check.
Added
- Per-user app sessions: the application asks for a session per user id and
gets an isolated sub-terminal with its own agent, auto-approve policy and
session limits (see "Many users" above).
Added
- App sub-terminal hosting:
/app runs a registered application in its own
sub-terminal with its own agent, from trusted manifests.
- A unified station dispatch service with auto-routing, and
/resume now
forks a new branch instead of taking over the source session.
Fixed
- An atomic session-lease claim removes the
/resume dual-instance race; a
zip-slip guard protects /v source bundles; an SSO open redirect is closed;
/help layout survives over-long usage strings.
Removed
- The deprecated
/focus command.
Added
- Slash-command argument contracts and completion providers: commands declare
their argument shapes and completions come from the contract instead of
hard-coded lists.
Added
- Retask: work handed to the person as
.retask checklists.
Changed
- The code-map extension is removed: Laintas Code Map is discontinued.
- Each release is announced through the official messages inbox.
Added
- Handoff as a portable file and token: hand the work over through any
channel, not as a conversation; the AI-PoW modules and an HWO effort pin
landed with it.
Added
- Arrow-key cursor movement in the main input (left/right move by one char,
up/down via history), gated off while the rprompt slot modal owns those keys.
/extensions untrust subcommand and completion descriptions for the new
/mode / /plan / /task subcommands (/task mine, /task agent).
Changed
- The usage/purchase checkout link now points at
market.laintas.com.
- cli.laintas.com redesigned with a live rendered terminal demo, agent copy,
and a pricing section.
Changed
- Rebuilt the cli.laintas.com terminal demo from real laintas-cli visuals
(real thinking spinner and case) and re-added the missing
Layers3 import
that had caused a runtime ReferenceError.
Added
- Wheel-style scrollable viewport for sub-terminal output, with a
terminal_read cursor walk and hand-rolled paging detection.
/mode step runs one model iteration at a time; Esc now reaches everything
the turn started.- The CLI can install and start the Windows kernel from
/windows, reaching
the Windows machine through the kernel that already runs on it.
Changed
- The CLI asks before a command reads a secret and explains why; ANSI escapes
are stripped in
/told rendering; <sub_terminals> injection is deduped
with a monotonic session-memory step counter.
Added
- Windows now ships as a single NSIS installer on GitHub that bundles a real
terminal (conhost could not deliver a click) into a private WSL
distribution, instead of an empty directory.
- The built-in
code-map extension, repair signals, and policy hardening
with an agents-mode overhaul.
- Learned, project-scoped skills with a lifecycle, plus evidence-backed
memory assertions with idle consolidation.
Changed
- Project switched to FSL-1.1-MIT licensing (see
docs/LICENSING.md), with
English throughout the CLI source/tests/release docs and fs.write gaining
mkdir -p.
- Storage gained cloud folder tools plus usage/billing tools, with a tty-depth
fix; Windows interop was hardened.
Changed
- CLI source, tests and release docs are now in English throughout.
- Branches became a decision tree walked once whose path selects the workflow,
so a refactor and a fix get different workflows.
- A new terminal starts from the settings last used and remembers the agent.
- Alt+A picks another agent while a task is running, with stable indices and
tree order for terminals and agents.
Added
- Intent anchoring: the spec is built on turn zero, the agreed reading is
pinned, and subsequent work is compared against it with three verdicts —
the honest end when nobody can win the argument.
L> message mark, a mailbox, and configurable rprompt slots in the prompt.- Built-in
code_map replaces the code-atlas extension.
- The working-directory session survives the directory being deleted under it.
Added
- Ctrl+Z / Ctrl+Y undo-redo; Ctrl+X Ctrl+S / Ctrl+X Ctrl+O selection segments.
Changed
- Improved turn robustness, context cost, and parallel read dispatch.
Added
- A soft-interrupt propagated into every long-running tool wait, and a guard
against the Playwright sync-API spinning forever.
- Critic nudges are persisted with a cooldown, and its failures are visible;
free-form critic scoring was replaced with five anchored bands.
Changed
- Periodic output repetition is detected via a rolling-window match and warned
about once before a repetition force-exit; blanket number/path normalization
in output fingerprints was dropped.
reasoning_effort is now shown in the spinner and rprompt.
Added
- Added an evidence-bound second-pass review for compaction summaries: an
independent reviewer model decomposes the candidate into atomic claims,
checks each against the source transcript, and applies minimal corrections.
- Added chunked summarization (
summary_chunk_tokens) so long sessions compact
without truncation, plus dedicated summary_model and
summary_review_model settings in context_policy/policy.json.
- Added stream salvage: a transport that dies mid-answer now produces a
truncated-but-usable turn instead of silently losing the whole reply.
- Added a terminal watchdog that detects launch-directory loss at startup and
recovers instead of failing every subsequent command.
- Added silence-based budgets for shell, remote (WebRTC), and MCP tool calls:
commands are bounded by output silence, not a fixed wall clock, so long
builds and slow-but-streaming servers finish instead of being killed
mid-run. Per-server MCP
call_timeout still overrides (clamped to 300s).
- Added bounded ranking-result caches to memory recall and skill routing,
collapsing per-loop rank calls into roughly one per run even with many
concurrent agents.
Changed
- Hardened sub-agent supervision: failed children, denied writes, and silent
children are now surfaced and harvested instead of disappearing; approval
ancestry is tracked across agent generations.
- Raised the compaction protection window to 40k tokens so loaded skills,
memories, and rules survive context pruning.
- Shared
/tmp cleanup commands now pass an explicit safety check, and
os.ttyname absence is guarded on platforms that lack it.
- Registered
hwg_view, hwo_view, and workflow_viz in
package_manifest.json so the interactive workflow viewers ship in every
release artifact.
Added
- Added an API contract store where backend and frontend agree on endpoint
shapes through propose/agree/implement/verify states with drift detection.
- Added local-runtime loopback so spawned runtimes answer on a local port,
git attribution recording which agent produced each change, and fork
lineage hardening for worktrees.
Fixed
- Self-healed the stale asyncio running-loop flag that froze the REPL after
certain interrupts, and stopped the background input reader before
restoring the SIGINT handler.
Removed
- Removed Mail mode entirely: the
mail mode, the /mail command, the
mail.send_to_user and mail.check_inbox tools, the new-mail watcher, the
send-a-report-on-task-complete hook, and the email approval channel that stood
in for a terminal prompt when nobody was watching. The gateway side went with
it — the mailbox, the inbound-mail webhook, the approval links, and the whole
notifications module. Outbound mail was the only consumer of the Resend
integration, so those credentials are now unused.
Added
- Added a unified resource browser for conversation, trace, plan, memory, skill, and related detail views.
- Added detailed assistant/tool trace capture while keeping normal chat output compact.
- Added peer coordination and resume leases for safer multi-agent ownership.
Changed
- Reworked Agents and HWO into purpose-built terminal workspaces with clearer input, event, action, and status regions.
- Moved shared resource screens to a green/red palette with purple accents, responsive list/detail layouts, and consistent search/navigation.
- Reduced redundant raw tool output stored in short-term memory logs.
- Hardened training-data capture defaults and HMAC signing behavior.
Fixed
- Fixed search focus, match highlighting, result positioning, empty-history selection, and detail-page content regressions across resource UIs.
- Fixed trace views so assistant replies and full tool results—including complete edited-file content where recorded—remain inspectable.
Added
- Added centralized SSO through
accounts.laintas.com.
- Added HMAC-signed event/training records and persisted critic assessments.
- Added keyless Tavily search fallback and skill unload cleanup.
Changed
- Stabilized prompt prefixes to improve cache hits and PTY echo behavior.
- Made Enter consistently submit input while preserving explicit multiline behavior.
Added
- Added allowance recovery countdowns to
/usage.
- Added the last assistant output to
/resume context.
- Added clearer diff and block styling for tool output.
Fixed
- Fixed plan work session-ID scope mismatches.
Added
- Added a secured PPOS agent client with tool, skill, and workgraph integration.
- Added gateway skill coverage and integration tests.
Fixed
- Fixed Rich prompt flows that required an extra Enter or mishandled confirmation input.
Added
- Added the generic extension manager and
/extensions lifecycle for custom and community packages.
- Added extension trust approval, command metadata, multilevel completion, and
/help integration.
- Added Enterprise module packaging.
Changed
- Unified Enterprise installation and update handling under
/v enterprise and /v update.
Added
- Added the shared-storage channel and
file_push tool for Laintas Storage and Helpwo.
- Added Enterprise installer extension roots.
- Added organization policy and CLI call-pack configuration.
Added
- Added
/v enterprise installation and command-configurable custom backends.
- Added on-device organization-policy chain verification.
Changed
- Hardened command authorization using parsed shell structure instead of shallow string checks.
Fixed
- Fixed Rich rendering of literal brackets and symbol placeholders.
Changed
- Restricted the Helpwo local bridge to loopback by default and separated explicit remote exposure.
- Added HTTPS support and reuse of CLI account, model, and usage state for Helpwo.
Fixed
- Fixed non-streaming chat proxy behavior, browser expectation validation, and damaged/truncated tool-call detection.
Added
- Added a configurable search-engine chain, proxy support, cookie handling, and
laintas_search.
- Added PySocks to the core distribution.
- Added per-model output budgets.
Changed
- Hardened web fetching and browsing-identity isolation.
v1.9.8 — 2026-08-03
- Changed
/v download progress to a stable single-line display written directly to the controlling terminal.
v1.9.7 — 2026-08-03
- Added study mode and raw terminal read/send output.
- Added browser-egress tests, VNC fallback, and plan-listing guards.
- Centralized UI symbols and fixed multi-terminal scheduling, browser behavior, and resume autosave.
v1.9.6 — 2026-07-27
- Improved context-compression reliability.
- Fixed task-management priority issues, loop warnings, and skill cleanup.
v1.9.5 — 2026-07-25
- Fixed SSL CA hook registration in frozen standalone builds.
v1.9.4 — 2026-07-25
- Maintenance release and artifact repackaging; no separate user-facing feature delta is recorded between adjacent tags.
v1.9.3 — 2026-07-25
- Maintenance release and artifact repackaging; no separate user-facing feature delta is recorded between adjacent tags.
v1.9.2 — 2026-07-25
- Improved update-download progress visibility.
v1.9.1 — 2026-07-23
- Added the offline Helpwo runtime bridge.
v1.9.0 — 2026-07-21
- Added full-screen Agents mode, auto-pilot, triggers, agent switching, cascade abort, and multi-agent working-directory handling.
- Added WebRTC security controls, update-integrity checks, Markdown themes, the
/told browser, Helpwo commands, and Esc soft interruption.
- Hardened concurrency, state corruption recovery, memory cleanup, tool rendering, and slash-command handling.
v1.8.8 — 2026-07-19
- Restored the full-screen Agents experience with a single foreground-terminal UI model.
v1.8.7 — 2026-07-17
- Added cross-device CLI login and stabilized runtime/terminal UI behavior.
v1.8.6 — 2026-07-16
- Improved reliability of CLI restart and replacement flows.
v1.8.5 — 2026-07-16
- Updated download-site builds and release packaging.
v1.8.4 — 2026-07-16
- Mirrored the complete release asset set to the self-hosted distribution channel.
v1.8.3 — 2026-07-16
- Release maintenance; no distinct source delta is recorded between adjacent tags.
v1.8.2 — 2026-07-15
- Included skill documentation in source-update packages.
v1.8.1 — 2026-07-14
- Release maintenance; no distinct source delta is recorded between adjacent tags.
v1.8.0 — 2026-07-11
- Added Mail mode, mail send/inbox, email approvals and reports, and rate-limit retry.
- Added self-hosted
/v release channels and download progress.
- Added mode allow/deny policy, auto-approval behavior, and Esc interruption.
- Fixed packaged-module coverage and Act-mode execution behavior.
v1.7.4 — 2026-07-10
- Introduced the green/red terminal theme, direct terminal-like command behavior, a static caret, and framed diffs.
v1.7.3 — 2026-07-10
- Improved installer progress and archive layout.
- Moved public downloads to
cli.laintas.com and documented platform compatibility.
v1.7.1 — 2026-07-10
- Fixed Debian release packaging through
fpm.
v1.7.0 — 2026-07-10
- Added architecture-specific Linux packages, the HWG runner, durable workflow state, and HWO improvements.
- Added per-agent HWO model selection with
#name@model# syntax.
- Hardened slash/browser approvals, worktree coordination, and patch application.
- Consolidated the supported standalone platform around 64-bit Linux; Windows support had been removed in the preceding untagged development interval.
v1.5.0 — 2026-07-03
- Added secure customization runtime, unified modes, consolidated selectors/dialogs,
/told, and improved paste/mouse behavior.
- Added destructive-action approval, session recovery, structured failures, prompt self-optimization, and persistent-memory/tool hardening.
v1.4.0 — 2026-06-29
- Added typed agent errors, parameter validation, a centralized UI theme, and more durable event logging.
- Fixed Python 3.11 compatibility.
v1.3.0 — 2026-06-28
- Established unified packaging and the CI release pipeline.
- Fixed source manifests, release artifacts, context re-read retention, null debug billing, and malformed-JSON false positives.
- Consolidated native tool calling and the self-update/version command into the tagged release line.
Tags v1.6.x and v1.7.2 are not present in the repository, so they are intentionally not invented here. For exact code-level differences, compare the corresponding tags in GitHub.
License
Laintas CLI versions that include the top-level LICENSE file are available
under the Functional Source License 1.1 with an MIT future license
(FSL-1.1-MIT). The software is source-available rather than OSI open source
during the first two years after each version is made available; competing
commercial products and services are not a permitted use. Each version receives
an additional MIT license on its second anniversary.
See LICENSE for the controlling terms and
docs/LICENSING.md for scope, exceptions and the status of
earlier distributions.
Contributors
Laintas CLI is maintained by its contributors. Parts of the release packaging and documentation workflow were developed with OpenAI Codex assistance.
