Thoth Files

v4.9.0 - Native Computer Use, Desktop Buddy & Safe Conversation Cleanup

This release builds on v4.8.0 with a rebuilt Browser and native Computer Use boundary, a real Windows and macOS Buddy desktop overlay, centralized and race-safe conversation cleanup, and live xAI image-generation capability discovery. It makes visible automation faster and more truthful about what was delivered or verified, lets Buddy operate the selected Chat, Developer, or Designer thread without creating a second conversation, removes complete thread-owned state without risking repositories or retained project artifacts, and selects xAI image quality only from model-published combinations without weakening local-first, approval, credential, screenshot, or typed-value boundaries.

Managed Browser And Shared Automation Contracts

• Dedicated managed Browser service - moves page ownership, observations, policy, history, runtime readiness, action dispatch, and recovery into browser/, leaving the Browser tool as a provider-neutral adapter rather than the owner of one large mutable runtime.
• Opaque snapshot-bound targets - retains exact ephemeral Playwright handles behind task, context, page, navigation, and snapshot tokens; stale, detached, drifted, cross-page, and cross-thread targets fail before an action can be dispatched.
• Bounded semantic observations - validates at most 1,000 interactive handles and 1 MiB before projecting at most 160 controls and 32 KiB, hides input values, records received and retained counts, and disposes handles when their snapshot expires.
• Truthful thin receipts - returns compact receipts for typing and non-navigating clicks, one observation for navigation, scrolling, and tab changes, and no automatic screenshot, Vision call, fixed sleep, or general networkidle wait after routine actions.
• Approval-bound replay - stages the exact Browser target at the point of risk, re-proves only that target after approval, completes the approved submit in the same tool invocation, and never lets an approval authorize a different element.
• Exact managed Chromium runtime - raises Python Playwright to the 1.62 line, records its matching Chromium revision in an atomic manifest, installs only through an explicit Browser install or repair action, validates an offline page, and retains the prior known-good runtime for rollback.
• No startup downloads - Browser startup, MCP readiness, Designer export, conversation PDF export, and normal app launch perform read-only readiness checks and never install or repair Chromium implicitly.
• Bounded launch fallback - discovers installed Chrome or Edge without probe launches and, after one real selected-channel launch failure, falls back once only to an already-ready version-matched managed Chromium.
• Thread-owned pages and recovery - isolates tabs and popups by task, invalidates every owned observation after context or browser loss, performs one bounded restart without replaying an uncertain action, and cleans up idle or terminal task pages without disturbing active work.
• Small shared automation vocabulary - adds immutable observation, receipt, error, activity, and no-progress contracts shared by Browser and Computer Use while keeping their processes, leases, targets, histories, and persistence separate.

Native Computer Use Reliability And Safety

• Reviewed Cua Driver 0.20.0 - pins the signed upstream tag and commit, full Windows x86-64, Windows ARM64, and macOS universal archives, exact executable candidates, and SHA-256 values; Windows uses mcp while macOS preserves and launches the packaged app with mcp --direct.
• Version-2 telemetry disclosure - requires the expanded acknowledgement introduced after v4.8.0 before the upgraded driver can start. The reviewed telemetry is limited to pseudonymous identifiers and bounded product, platform, client, operation/outcome, duration/output, aggregate usage, permission, and lifecycle categories; tagged event builders exclude prompts, arguments/results, typed text, screenshots, accessibility trees, app/window names, URLs, paths, raw configuration values, and raw errors.
• Function-first native actions - keeps one flat provider-neutral schema for launch, capture, click, double-click, right-click, literal caret type, exact whole-value replace_text, key/hotkey, scroll, drag, menu invocation, state verification, and bounded wait behavior.
• Direct semantic editing - token-bound typing dispatches the issued current token after explicit disabled, read-only, secure, protected, and structural checks; combo boxes, grid/data cells, documents, and unknown interactive roles can reach the reviewed driver without hidden selection, clearing, clicking, or recapture steps.
• One bounded foreground rung - starts with background-safe delivery where supported and permits at most one same-action foreground attempt after an explicit driver refusal, with no separate focus action, effect replay, or silent switch to coordinates, Browser, shell, clipboard, or another engine.
• Selected and document-aware projection - keeps the fixed 80-element and 12 KiB model envelope while preserving selected items and a bounded quota of document, grid, and actionable controls that would otherwise be crowded out by application chrome.
• Exact semantic filtering - can expose one omitted control by normalized label, role, and value prefix without coordinate guessing, refuses ambiguous matches, and keeps the full validated element set ephemeral and unavailable to stale model tokens.
• Current application identity - normalizes packaged and native app identities, prefers the unique active or visible matching window, preserves genuine ambiguity, and keeps platform identifiers such as AUMIDs out of model output, approvals, and logs.
• Action-specific receipts - separates dispatch, native delivery, visual change, and exact-value verification. An accepted but unverified action stays useful and does not create a pending-mutation latch, completion ledger, automatic replay, or final-answer override.
• Bounded verification - default click, type, key, scroll, and replacement actions make no hidden capture; optional replacement readback or visual checking uses at most one fresh capture and never treats a changed screen or free-form Vision prose as proof of the requested outcome.
• Safer stale and no-progress recovery - allows one same-target refresh and one same-action retry only when the structured receipt permits it, keeps candidate lists current, handles scroll and drag foreground delivery, and recommends Take over after the bounded route is exhausted.
• Privacy-safe advisory scanning - narrows prompt-injection detection to explicit role or hijacking signals, reports only bounded advisory categories, and does not turn ordinary UI text into an authorization decision or a hard action failure.
• Permission and lifecycle recovery - attributes macOS Accessibility and Screen Recording to the packaged Row-Bot host, preserves the Cua app bundle, links to the correct panes, and cleans up the private client and exclusive lease on Stop, thread deletion, disablement, uninstall, and app shutdown.
• Tool-owned workflow guidance - adds the twenty-third bundled tool guide for exact Browser-versus-Computer routing, current-generation targets, same-family recovery, foreground escalation, non-replayable mutations, and honest receipt interpretation.

Buddy Desktop Overlay

• Drag-to-undock companion - replaces the old floating-window behavior with a native Windows and macOS overlay that tears off from the sidebar, stays on top, supports multi-monitor and negative-coordinate placement, and can be repositioned by its header.
• One canonical placement model - migrates legacy visibility and floating settings into docked or desktop placement plus visible and collapsed state, keeps old mirrors compatible, and returns Buddy to the dock on a new app launch without reviving a saved hidden preference.
• Selected-thread messaging - sends to the named Chat, Developer, or Designer conversation with its existing model, tools, approval mode, and surface context; sending with no selected thread creates one normal Chat conversation.
• Draft and turn continuity - shares each thread's saved draft with the full composer, captures the selected thread and surface when Send is pressed, never retargets an in-flight request after a UI selection change, and never adds implicit screenshots or attachments.
• Live progress and scoped Stop - projects current progress before tokens, the latest plain-text answer afterward, and sanitized errors without starting another turn; Stop cancels only the active generation for the selected thread.
• Approval handoff - resolves well-described simple approvals directly in the overlay, routes complex or incomplete approvals to the full thread, and synchronizes pending approval dialogs between Buddy and the main UI without permitting a stale or cross-thread decision.
• Focus hand-back - tracks only the last external foreground application, excludes Row-Bot windows, restores a minimized window once when needed, and makes one non-retrying activation attempt before the overlay sends.
• Recoverable native lifecycle - hides the main window instead of quitting while Buddy is torn off, exposes Open full thread, Collapse or Expand, Dock, and Hide actions, and adds tray recovery for both the overlay and the main window.
• Compact visual polish - uses an opaque fixed rectangular layout, three direct action buttons plus a menu, stable flex sizing, compact status bubbles, softened approval motion, state crossfades, and quieter idle-video replay.
• Reliable terminal drag gesture - prevents native snapshot interception, stale dock geometry, and window-local drag coordinates from turning one docked drag into duplicate, cancelled, or wrongly positioned gestures.

Conversation Cleanup And Bulk Selection

• Central deletion service - replaces scattered thread deletion paths with one idempotent service for Chat, Designer, Developer, workflow, channel, and Agent-owned state, including metadata, checkpoints, writes, drafts, media, summaries, activation state, approvals, notifications, and cached UI state.
• Race-safe producer cancellation - marks a conversation as deleting, stops generation and active child Agents, blocks late checkpoint, event, media, draft, summary, and child-start writes, and keeps the guard until any in-flight producer has finalized.
• Recursive Agent cleanup - removes direct and nested child conversations, approvals, events, edges, locks, and runs while preventing a child-creation race from recreating state after its parent is gone.
• Preserved workflow audits - removes queued and thread-owned pipeline state while retaining workflow and run audit records with deleted thread, approval, message, and channel links scrubbed.
• Designer ownership rules - deleting a conversation detaches it while retaining the design; deleting the design removes its assets, history, published copy, cached session, and every linked conversation.
• Developer recovery rules - never deletes the real repository or selected folder, removes only safe clean managed worktrees, and retains dirty worktrees or sandboxes with unimported changes as explicit recovery workspaces.
• Path-safe cleanup and repair - rejects managed-path escapes and root deletion, removes only provable idle orphan artifacts and stale temporary files, and performs thresholded SQLite compaction when meaningful space can be reclaimed.
• Accurate conversation library - hides Agent child conversations, removes the obsolete Agents filter, assigns each user-managed conversation to one of Chat, Designer, Code, or Workflow, and reconciles visible counts from the same canonical dataset.
• Filter-aware Select all - selects or clears every item in the active filter without disturbing selections from another filter, keeps checkbox and destructive-target state synchronized, and includes collapsed Code rows while excluding hidden children.
• Responsive bulk deletion - paints a persistent progress dialog before offloading cleanup from the UI event loop, awaits asynchronous confirmation callbacks, always removes progress on failure, and reports retained recovery workspaces or partial failures.

xAI Image Capability Discovery

• Live image-model discovery - queries xAI's /image-generation-models catalog alongside its general and language catalogs for both API-key and xAI OAuth providers, allowing newly advertised media models to enter the normal provider catalog without a model-name-only guess.
• Generation-parameter metadata - normalizes published quality and resolution options, defaults, and valid combinations into the shared model capability snapshot and preserves them through OAuth and catalog caches.
• Capability-aware request planning - sends xAI quality and resolution only when the selected model published a complete valid combination, chooses the highest supported tier for a High request, and otherwise uses provider defaults with a clear result note instead of inventing an unsupported pair.
• Safer long-running media calls - separates connect, pool, write, generation-read, and download-read timeouts, gives image generation up to ten minutes, refreshes OAuth once after a 401, and never retries an uncertain timed-out generation request.
• Provider-contract coverage - extends model serialization, capability resolution, media-model classification, API-key discovery, OAuth cache restoration, generation, editing, timeout, and download tests for the new metadata path.

Cross-Surface Reliability, Documentation And Validation

• Generation-wide Stop semantics - wakes queued work, closes matching approvals, stops generation-linked child Agents, cancels Browser, Computer, shell, and Buddy activity for the selected generation, and prevents a stale approval callback from resuming work after Stop.
• Approval synchronization - lets the full UI display an approval raised from Buddy, hands modal ownership between connected local UI clients, and keeps unrelated thread or generation approvals isolated.
• Managed export rendering - uses the exact reviewed Chromium runtime for Unicode and Markdown-aware conversation PDFs plus Designer PDF, PNG, and PPTX rendering, with deterministic load completion instead of an unbounded network-idle wait.
• PowerShell result accuracy - treats an emitted PowerShell error record as failure even when a later statement succeeds, retains native nonzero exit codes, preserves successful warnings and persistent working directories, and releases shell locks after cancellation or detached launch.
• Stable tool-guide prompting - discovers guides from the effective active tool set, injects them into a stable prompt section for provider cache reuse, and preserves the compact custom-endpoint policy that omits all skills and guides at context windows of 32,768 tokens or less.
• Safer compact tool traces - groups Browser and Computer activity without exposing private JSON, renders structured failures truthfully, settles automatic skill loads into bounded plain labels, and keeps transcript export free of hidden activation metadata.
• Protected documentation capture - suppresses model-settings writes during authorized real-data screenshot capture, refreshes Buddy and Computer Use public guides and screenshots, and republishes generated reference and searchable site artifacts.
• Changed-lane completeness - makes the test matrix include committed branch changes, current working-tree edits, and untracked files so local and CI changed-source selection cannot silently omit new release work.
• Deterministic architecture coverage - adds shared automation contracts, managed Browser subsystem tests, extensive Computer Use action, privacy, targeting, focus, performance, and driver-verdict coverage, Buddy overlay and drag fixtures, thread cleanup and bulk-selection coverage, export and cancellation tests, and updated source-to-test ownership.

Breaking Changes And Caveats

• No public CLI break or mandatory application-data migration is introduced by v4.9.0. Legacy Buddy settings migrate in place, and existing conversations, designs, repositories, workflows, and provider credentials remain local.
• Existing Computer Use installations from v4.8.0 use Cua Driver 0.7.1 and the version-1 disclosure. They must install or repair the reviewed 0.20.0 full archive and accept the expanded version-2 disclosure before Computer Use can start; no driver download occurs during ordinary startup or readiness checks.
• Browser Automation now requires the Chromium revision matching the installed Playwright 1.62.x package. A mismatched or missing managed runtime fails closed and must be installed or repaired explicitly; an already installed supported Chrome or Edge channel can still be selected.
• Conversation and design deletion remain irreversible and approval-gated. Dirty Developer worktrees, real repositories, selected source folders, and sandboxes with unimported changes are retained rather than deleted; workflow audit rows remain with sensitive live links removed.
• The Buddy desktop overlay requires the native Windows or macOS app. Linux, server/browser mode, compact mobile presentation, and remote browsers keep Buddy docked inside Row-Bot.
• Computer Use remains beta, local-interactive-only, off by default, and unavailable to schedules, channels, background workflows, child Agents, plugins, external MCP callers, mobile clients, and headless/server sessions. Browser and Computer remain separate engines and never silently substitute for one another after a structured refusal.

:::manifest
schema: 1
files:
  Row-Bot-4.9.0-Linux-x86_64.tar.gz: sha256=21f1f4189847494e01d1b09fc0fd0c762fc17b22593fb77a562c0d5ab9b4f6e1
  Row-Bot-4.9.0-Windows-x64.exe: sha256=d93cc865216c16138cfba5d5246cc6dcb9eff6d7345f8d2ef9f0753672b3895b
  Row-Bot-4.9.0-macOS-arm64.dmg: sha256=2032504a47039fd4b70c9883463ed6e2ba4ad784618c0b64ab1b8eb2652f60fb