Updates

What's new in AI Cockpit.

2026-10-18

Full v2.0.0 · Stand-alone v1.0.0 · builds 307–308

A clean-machine install test, and what it fixed

The installer asks before it sends anything at the end. The Stand-alone installer used to end with “send an install-succeeded line?” defaulting to yes, and in the setup window the question was easy to miss. Now Stand-alone sends nothing after the one “install attempt” line at the very start (which now also notes the desktop and file manager) and asks nothing at the end. Full and Both report progress as before.
The web server’s folder protection is really installed. Three Apache steps (cache headers, hiding Cockpit’s working folders, upload limits) failed with “Permission denied” when the installer ran as a normal user. They now use sudo.
Stand-alone looks like Stand-alone. The start splash said FULL on a Stand-alone install; it now follows the install’s own edition. The first-run Help window no longer opens blank.
Defaults that follow your computer. Piper voices and translation languages now default to the languages of your keyboard layouts and system language, instead of a fixed list. An empty password field no longer shows as dots in the setup summary.
Autopilot Cruise and AutoCognition pause while the account server cannot be reached (Full edition), and the account server now slows repeated wrong passwords.

2026-10-05

Full v2.0.0 · Stand-alone v1.0.0 · builds 187–194

Cockpit’s working folders are private, and uploads stop failing silently

Drop-down lists that match your theme. Every drop-down used to open the system’s own menu, which ignored the theme. Cockpit now draws the opened list itself: your colours and font, a check mark and bold for the chosen entry, group labels, upward opening near the bottom of the screen, full keyboard use, and for the theme picker colour swatches with a Dark / Light / Mixed tag. Checked under all 36 themes.
Every theme is now checked for readability — including your own. Whenever a theme is applied, Cockpit tests each text colour (normal, dim, muted, and the light text of the dark areas in Mixed themes) and each agent and accent colour against the surfaces it is drawn on, and brightens or darkens any that cannot be read. Saving a theme in the Theme Editor tells you which colours were too faint. The 36 built-in themes are checked on every build.
An optional process supervisor for the agent loops (off by default). With a file called use_supervisor in the Cockpit data folder, the three agent loops run as services of a small native program instead of tmux sessions: a loop that dies is restarted (it used to leave a session that still looked “running” and requests nobody answered), Stop interrupts the agent’s process group, and “open session” shows the live log (in the native window too). Tmux stays the default and the fallback. Proven with a real supervisor, the real agent loop and a stand-in CLI: Stop mid-request, a killed loop, and the next request all behave.
A file window and a command window that look and behave like system windows. The toolbar’s Files and Terminal buttons now open two floating windows (drag, resize, minimise, maximise, remembered position). The file window is a small desktop-style file manager: your own Public folder (inside your projects folder) is yours — new folder or file, rename, move, copy, upload by drag and drop, download, delete to a trash — and everything else (your project folders, and areas an admin adds) is read-only, with copy-into-Public. Symbolic links are never followed and every change is recorded. The command window runs one simple command at a time, as you, and the operating system itself (Landlock) lets it write only in Public and read your project folders and the system’s programs; if a machine cannot confine commands, none are run. Both are done by the native engine, hosted by the process supervisor. Not in the web demo. The old system buttons remain one click away in each window’s title bar.
The agent’s markers are carried out by the native engine too. %%CREATE%%, %%READ%%, %%DELETE%%, %%LIST%%, %%FETCH%%, %%SEARCH%%, %%WORKER%%, %%TOOL%%, %%PROPOSE%% and the library markers run inside the native loop, with the same results as the shell and PHP versions (148 checks, including every request sent to Cockpit’s own pages). Found on the way: the loop’s private key was also sent to a catalog entry’s address in the PHP version when that address sat under Cockpit’s own; it is now sent only to the four pages it is meant for. With the native loop on, chat, history and markers need no PHP at all.
The native loop does the chat history itself, in the same process. Whether a prompt needs the earlier turns, which turns are relevant (the same search index as before, SQLite loaded from the system when present) and saving each turn into the chat file now need no PHP. Proven identical to the PHP helper on 1,743 cases (output, log lines, chat files and index rows); the few inputs it does not copy exactly are handed to the PHP helper for that one request. A loop run with no PHP helper at all gives the same answers as the shell loop.
Native loop: variables set by the loop now reach the agent and its helpers. The native agent loop started the programs it runs with only the first part of its environment, so a variable it had just added (the private config folder for the Claude CLI, the loop’s key for the marker calls) could be missing. Found by comparing the Claude config folder the shell loop and the native loop leave behind, eight situations side by side; they are now identical.
Open lists under the chat area (Ollama, LocalAI, Workers, Tools). The pickers of the top cards could be drawn under the chat area in the native window. An open list now uses the browser’s top layer, above everything.
The status bar shows which runtime is really in use. Next to each agent: who keeps its loop alive and which loop runs (sup · native, sup · shell, tmux · shell), read from the running processes, not from the switch files. A chip shows whether the native engine is on and whether the scheduler tick is a supervised job or cron; hover it for the details. Meant for the period while the native parts run next to the shell ones.
No more false “Agent session died mid-response” with the process supervisor. While an answer was still being written, the page asked tmux whether the agent was alive. With the supervisor switched on there are no tmux sessions, so any answer that took more than an instant (a local model loading, a long reply) was declared dead, the prompt was removed from the queue and nothing was answered. The check now asks whichever of the supervisor or tmux hosts the loop. The deploy step that restarts the agents had the same blind spot and reported a failure after every deploy; it now restarts the supervised loops (and recognises the native loop).
The whole agent loop as one native program (off by default). With a file called use_native_loop in the Cockpit data folder (or use_native_loop_ollama and its claude / gemini twins for one agent only), each agent’s queue loop is the engine’s aicengine loop instead of the shell script: request details, supplier and catalog, capabilities and auto-route lists, prompt, the agent run (Claude, a catalog CLI, the free relay, Gemini, local Ollama), clean-up, markers, saving the chat and the done signal, with none of jq, sed, bc, python3 or curl. Proven against the shell loop on thirteen requests (answer, a hash of the whole prompt, saved chat, created files and log lines identical). The capabilities and auto-route step is also available to the shell loop through the engine (69 cases). Delete the file to go back.
The start of every turn is done by the native engine (off by default). Reading the request, the Ollama model file and the supplier controls, putting the effort text in front of the prompt, the whitelist for extra command-line arguments and clearing the queue come out the same as from the shell version (56 cases, plus the whole loop run twice with a stand-in agent). Also fixed: the loop’s message when the engine stepped aside printed “log: command not found” instead of saying so.
The markers an agent writes to use Cockpit’s own tools now work. %%FETCH%%, %%SEARCH%%, %%WORKER%%, %%TOOL%% and %%PROPOSE%% were answered “Authentication required” every time, because the agent loop calls those pages without a login. The loop now carries a private key kept in your data folder, and the pages accept it only from this machine, only for those few actions, and only as a person who exists (with their own role). %%PROPOSE%% also used action names the library page did not know; fixed. A V1 loop now calls V1’s pages instead of V2’s.
The clean-up after an agent answers is done by the native engine (off by default). Stripping terminal artifacts from Ollama and Gemini replies, timing the turn, the Ollama usage line and the “not signed in” hint come out byte for byte the same as from the shell version (304 cases) without sed, bc or GNU date. A backslash in a chat name no longer breaks the usage line.
The prompt for each turn is assembled by the native engine (off by default). Goal, kind and descriptions, COCKPIT.md, your profile, the global directives, the identity line and the layout come out byte for byte the same as from the shell version (156 cases, including cut points, broken JSON files and NUL bytes), without jq. A prompt that was exactly -n or -e used to vanish; fixed in both paths.
Gemini calls without jq or curl, over verified TLS (native runtime, off by default). The engine now makes the Gemini REST call itself with its own HTTPS client, which always verifies the server’s certificate and host name, keeps the API key out of the address and off every command line, and has no limit on the prompt size. Proven byte-for-byte against the shell path on 18 response shapes, with refused-certificate and wrong-name tests. A bug fixed in both paths: a Gemini answer with no text (for example a safety block) showed as a blank reply instead of the reason.
Never two loops for one agent. A second agent loop for the same queue (for example a tmux loop left running next to the supervised one) would have answered every prompt twice. A loop now refuses to start when a live one already serves its queue, and the supervisor start and the autostart installer end leftover tmux agent sessions.
Supervisor extras (optional): cockpit_sup_autostart.sh install starts the supervisor, and with it the agent loops, by itself at every login as a systemd user service (no administrator rights; boot-time start needs one loginctl enable-linger that you run yourself). The Jobs panel’s minute tick becomes a supervised job too, so it runs even without a crontab line.
The Stop button no longer kills the agent. Stopping a generation sent Ctrl-C to the agent’s session, which ended the agent’s loop along with the running CLI. The card still said “session running”, and every later prompt waited unanswered until the session was restarted. The loop now survives the interruption (the partial answer is kept) and serves the next prompt. A test that presses Stop mid-request on a real loop with a stand-in CLI now runs with every build.
Auto Generate knows about colour vision and your colours. New themes can now be generated with a palette type — Normal, High contrast, Protanopia, Deuteranopia, Tritanopia or Achromatopsia — and with a background, panel and accent colour of your own choosing (or random). The colour-blind palettes were checked with a colour-vision simulation: the closest pair of agent colours stays clearly apart where a normal palette can leave two looking identical. Mixed themes are now generated, and saved, as real Mixed themes.
Clock card: the “Loc. TZ” and “Ser. TZ” labels are gone, the server time is bold, and the local zone line ends with the hour difference to the server in bold.
Descriptions for chats and projects. A note of up to 300 characters on every chat and every project — what it is for, or what it achieved — shown under the name in the Chats and Projects lists, with a filter box that searches names and descriptions. It is private to you unless you tick “also send this to the agent”, separately for the chat and the project.
Lists open on the chosen entry. The Workers, Tools, Ollama and LocalAI lists now scroll to the entry you have selected when they open, instead of starting at the top. If it sits in a collapsed group, the group opens first, and a group’s heading now floats on the top row while its entries scroll past.
Kind per project, goal per chat. The kind is set once for a project and every chat in it inherits it; the goal is now each chat’s own. Free chats can have both. The info-bar chips no longer flash “General” and “+ goal” before the real values arrive. Nine general project kinds join the programming ones: Research, Document Creation, Creative Writing, Image Generation, Audio and Video, Translation, Data Analysis, Web Site, Study and Learning.
Workers and Tools lists could stay empty after start-up when the sign-in check answered a little late; they, and a few other start-up loads, now wait for it.
Mixed themes, light areas: the supplier cards, clock, version label and EXECUTE button no longer show light text on a light background; the old single-surface check that wrongly lightened dark text is gone.
Supplier-card lists now wear the card’s own colour, and a short list is only as tall as its entries.
Mixed themes: the Theme Editor’s drop-downs were dark text on a dark background in the nine Mixed themes; fixed.
Project kind picker could open with nothing to choose if its first request ran before sign-in; it now asks again.
Terminal windows opened from Cockpit could appear behind the maximised app window and look minimised; the terminal now raises itself.
Local-model chat (Ollama / LocalAI) can use the native runtime too, with no limit on the size of the prompt.
A very long answer can no longer empty a chat. An agent answer of about 128 KB or more made the step that saves the turn fail, and that step then replaced the whole chat file with an empty one — every earlier turn gone, and the answer not saved. Turns now go through a temporary file and the chat file is left alone if saving fails.
A native agent runtime, off by default. The parts of the agent loop that start the agent, pick earlier turns of the chat and carry out %%CREATE%%-style commands now also exist as small native programs, each checked against the Bash on the same inputs (more than 290 comparisons, your own chats included). Switch on with an empty use_engine file in your data folder; delete it to go back. The Setup and User Guides describe it.
A leak closed. Apache answers on every network interface, and it used to list the queue/ and responses/ folders and serve the files in them — the agents’ replies — to anyone on your network, without a login. Both are now refused, and so are folder listings under Cockpit.
Internal data files (paths, usage log, project state, quotas, lock files) are refused too. Nothing in the app reads them over the network, so nothing changes for you.
How it arrives. The installer adds it on a new install, the update adds it on an existing one, and the Setup Guide shows the one command for a hand-built setup. The change is tested on a scratch Apache before it is applied, and undone automatically if Apache would not start.

2026-10-03

Full v2.0.0 · Stand-alone v1.0.0 · builds 178–186

Backup and restore, a personal archive, and a standards check for Lazarus

Backup & restore. One button makes a plain .tar.gz of your settings, library, chats and projects. Test restores it into a scratch folder and checks every file against its checksum; Restore first saves the current state, so a restore can be undone. Rebuildable bulk (the Shelf index, Python environments) is left out, and API keys only go in if you tick them. Archives carry a data version, so a later build can migrate older ones.
Personal archive. Add scans, photos or PDFs of your own papers; Cockpit reads them on your computer (text PDFs directly; scans through tesseract or a local vision model), guesses a type and a due date from words like expires and valid until, and files the text in the Library so you can ask about it. Every guess is editable, and nothing is sent to an online service.
Redesign mode. A REDESIGN button beside PLAN: the agent writes a proposal (structure now, structure after, numbered steps, risks) and changes nothing; you approve the steps; then it does one step at a time, with a checkpoint of the project before each and a one-click undo after. Checkpoints are file snapshots — your own repository is never touched.
Easier to read. The project kind and goal in the info bar are now chips with an accent border and your theme’s own text colour (readable on all 36 themes, dark and light), and the text in the Hive section is larger. The Toolbar buttons are kept in alphabetical order. The nine Mixed themes are fixed and less extreme: the dark top bar, status bar and sidebars used to get the dark text meant for the light content (nearly invisible); they now have their own light text, and the light content is a little darker and the dark panels a little lighter.
Standards check. For a Lazarus project: text typed into code instead of a resourcestring, Windows-only code outside an IFDEF, no dark/light switch, thin comments. It is read-only and can hand you a ready resourcestring unit.

2026-10-03

Full v2.0.0 · Stand-alone v1.0.0 · builds 178–186

Lazarus beside Cockpit, project kinds, and a page on what hardware runs what

The file viewer follows the file. When Lazarus, an agent or an applied edit changes the open file on disk, the viewer reloads itself and keeps its place. For Pascal and Lazarus files there is now an Open in Lazarus button that opens the file and its project.
Project kinds. A project can say what it is (Lazarus / Free Pascal, VB6 migration, Castle Game Engine, Godot); a short standing note for that kind goes with every prompt in the project, and Cockpit suggests the kind from the folder.
Fixed: a saved project goal never showed in the info bar after a reload (it was still sent to the agents).
New page what runs on what: measured tiers, from running Cockpit on 4 GB of RAM to local models on a small graphics card. The site now states macOS and Dossier as they really are, and stops quoting free-tier limits that change.
The site’s right-click menu replacement now applies only to the interactive tool pages; guides and docs keep the browser’s own menu.

2026-10-03

Full v2.0.0 · Stand-alone v1.0.0 · builds 178–186

Privacy & spending: a check before secrets leave, and a budget for paid agents

Sensitivity gate. Before a prompt goes to an online agent, Cockpit checks it for private keys, API keys and tokens, passwords, and card, IBAN and US SSN numbers that pass their checksum. You choose: redact and send, use the local model instead, send anyway, or cancel. Or set a standing rule: never send them online unless you explicitly choose to each time (with a second confirmation), redact automatically, or never at all. It does not guess at names or e-mail addresses, so it will not cry wolf. Local agents are never checked.
Free agents only refuses agents that need a paid plan. It is linked with Stay Free in the Suppliers dialog (Stay Free also turns it on, and the dialog then disables paid agents), and you can untie the two in Privacy & spending. It is on for a new install and off for an install that already has history, so an update never takes away the agent you use.
Monthly budget counts prompts to paid agents, warns at 80% and stops at 100% (you can send one anyway). Everything is in the new Privacy button in the Toolbar. A Try the gate box lets you paste text and see what would be caught and what would be sent.

2026-10-02

Full v2.0.0 · Stand-alone v1.0.0 · builds 157–177

Cockpit speaks your language

A new translate button beside the font-size picker chooses the language Cockpit is shown in. English is the default.
Every label, hover hint, placeholder and message on the main screen is now translatable (about 1,600 pieces of text). The first language packs ship but cover only a small part so far; untranslated text stays English, so a half-finished language works fine.
Your language missing, or want to improve one? The menu offers an empty template to translate. Save it in your Cockpit data folder and it appears in the list; developers can regenerate it from the code.
Buttons keep exactly their English size in every language; a translated label that is too long scrolls inside its button instead of stretching it.
The voice Language list now offers every language whisper supports (99), opens as a scrolling menu you can type into, and remembers your choice. English is the default.
The top bar fits a 1920-pixel screen again, with a tidier Settings block.

2026-10-01

Full v2.0.0 · Stand-alone v1.0.0 · builds 148–156

A library that knows when it has nothing, chats that stay where they belong, and voice input you can see working

The library can say “nothing here covers this.” Until now a question about something your library did not hold was still answered with its closest match, so an unrelated chapter could end up in front of the agent. An item now has to cover at least half of what the question is about, measured against your own library — common words count for little, rare ones for a lot. When some items matched loosely but none fits, nothing is added and the chat says so: “Your library has 22 loosely related items, but none covers what you asked.” Request words such as “explain” or “examples” no longer count as evidence. A library of fewer than twelve items is too small to measure, so the check stands down there.
Replies stay in your chat. A small share of replies — in our own testing, about one in fourteen — were shown correctly and then saved to a shared chat file instead of yours, so they were gone after a reload. Cockpit now queues a prompt only once everything it needs to route the reply exists, so that can no longer happen.
The button with your name works again. Pressing it did nothing in either edition for several days. In the Full edition it opens your Cockpit Account; in Stand-alone it opens the local user manager. The build now checks for this kind of slip before it ships.
A tour that covers everything. The guided tour now has a step for every tab on both sides of the screen and for each of the twenty-one Toolbar buttons — sixty-odd steps, each with its own help topic. It opens each tab as it goes and puts yours back at the end, and the tab and button steps come in three sections with a Skip section button, so you can take just the part you want. Two steps — the Toolbar and the Proposals tab — used to be skipped without a word unless you already had that tab open; they show now.
Voice input you can see working. While you dictate, a level bar with a pulsing dot opens to the left of the mic button and moves with your voice, and the button fills as it rises — so a muted microphone, the wrong input and a quiet room no longer all look like “nothing happened.” The menu’s three dropdowns now say what they are (Model, Language, Mic), the model line shows which model “Auto” picks, and the result line names the model that actually ran. A microphone you chose earlier that has since been unplugged is forgotten with a message, instead of breaking dictation for good. And after a reload the mic’s tooltip no longer claims whisper is missing, and the model list is filled in.

2026-09-30

Full v2.0.0 · Stand-alone v1.0.0 · builds 140–147

Capabilities that actually apply, PDFs that are actually read, and a Library you can fold

Turning a capability on now reaches the agent. The step that applies your capabilities was being refused on every prompt, so toggling one had no effect. It now runs, and the switch itself is a clear bordered ON/OFF box — the old one was a 22×28 px icon that was easy to miss, and a near miss opened the card instead.
PDFs are read. An attached PDF used to arrive as a bare file path with no text. Its text is now extracted. PDF Vision also works on scans now: the first six pages are rendered and handed to an agent that can see (they were being rendered and then thrown away). Ask your question in the same message as the attachment.
The Library folds. A book is one row, collapsed, with Remove book on it; unfold it to see its chapters. The toolbar button is now called Bookshelf. Conversion markup left over from a book’s source is stripped when the text is read — about a fifth of every passage handed to the agent had been markup — so books filed earlier read cleanly too.
The Toolbar is in alphabetical order, with full names (Accumulator, Transcriber) and count chips: Jobs shows how many jobs you have, Stop shows how many agent sessions are up (3/3).
Artifacts tells the truth about who made a file. Chat backups no longer appear as things your project produced, saved code snippets sort under Code, and a file reads made by only when a tool reported writing it — otherwise mentioned by.
The file preview refreshes. It has a refresh button, and re-reads itself after you apply a Margin edit instead of showing the old text until you click the file again.
Search says what happened. Public search engines increasingly refuse automated queries, so a search can come back empty on a healthy network. The panel no longer claims no key is needed, and Cockpit says which engine refused.
A tighter lock on your sign-in. A copy of the Claude sign-in that Cockpit keeps for its isolated agent configuration was readable by the web server’s group. It is owner-only again, and is re-checked on every run.

2026-09-29

Full v2.0.0 · Stand-alone v1.0.0 · builds 133–139

Your own books now really reach your answers

Library questions finally use the Library. The step that pulls matching book chapters into a question never ran from the chat box (every prompt carries a Mode/Style prefix, and the step deleted the question along with it). It runs now, and the sources line names the chapter an answer drew on.
Bookshelf finds chapters in books converted by calibre, the Library can remove a whole book, Browse remembers the last folder you used, and leftover markup is cleaned out of book text when it is added.
Cockpit warns when a question about your library lands on a small coding or embedding model, and offers to switch to a suitable one.
The Dossier, Intercom and Margin buttons did nothing because of a single wrong internal id; they now respond. Search says when an engine is throttling it instead of blaming your network, and Intercom no longer sends whisper’s marker for silence as if it were your prompt.
The install integrity check no longer flags COCKPIT.md, which the installer adapts on every machine.

2026-09-27

Full v2.0.0 · Stand-alone v1.0.0 · build 132

Bookshelf takes books from anywhere

Real chapters. The first real test of Bookshelf found four faults (a split that divided nothing, titles taken from the first line of a slice, a non-breaking space that silently defeated every pattern, and pandoc markup leaking into titles). Chapters now come out named properly.
Add books from anywhere: Browse opens the native file chooser, a plain browser can upload, and a typed path asks you to Allow that folder. Cockpit never reads a folder you have not approved.
Profile opens on a sample that says it is one. The sample is never written to disk, so invented facts cannot reach your agents.
The icon font now carries the full Material catalogue (about 4,250 icons) plus 18 Cockpit glyphs.

2026-09-26

Full v2.0.0 · Stand-alone v1.0.0 · builds 126–131

Four dead buttons revived, the editions tidied apart

Bookshelf, Dossier, Profile and Intercom were never loaded by the page (their script tags were missing), so their buttons did nothing. Fixed, and the build now refuses any script or stylesheet the page does not load.
The Stand-alone edition can see and stop its own sessions, shows its own badge and local user, has its own window title, and installs the native window component instead of falling back to a browser. A Close all running sessions button on the edition-clash dialog is the way out when the running edition cannot close its own.
The two editions stop sharing settings and data.
A tidier top bar: Rules, Jobs and Accumulator moved to the Toolbar, Profile to the account card, the font controls into Settings, and the stage badge now comes from the build itself. The frameless window and splash were reworked.

2026-09-25

Full v2.0.0 · Stand-alone v1.0.0 · builds 121–125

macOS passes, and numbers replace guesses

macOS passes the full install test on Apple Silicon, after five portability faults were found and fixed along the way. The guide, the download page and the QA page now say so.
Hardware recommendations are measured, not asserted. About 4 GB of RAM runs Cockpit with cloud agents; 8 GB without a GPU makes small local models usable; 4 GB of video memory is comfortable. Nothing is enforced.
Bookshelf sizes its chapters to your machine (a flat size cost minutes of prompt processing on a small GPU).
Whisper installs and uses the model you chose; the installer used to fetch the large model regardless of your answer.
The last bash-4-only shell constructs were removed, so the agent loop works on macOS’ older bash.

2026-09-24

Full v2.0.0 · Stand-alone v1.0.0 · builds 115–120

Languages, privacy and a demo that caught up

Text-to-speech voices now cover 42 languages and the sound picker 43 (before, only two languages had a voice, and anyone else silently got none).
Your location and the developer’s details are gone from the About panel and the guides; the Terms no longer name a jurisdiction and measure lawful use against the law that applies to you.
Downloading videos (yt-dlp) no longer needs Python.
The public demo had fallen a release behind and was drawing icons as text; it is back in step, and the build now refuses to ship a copy that has drifted. Installer bundles no longer carry a usage log or a developer home path.

2026-09-23

Full v2.0.0 · Stand-alone v1.0.0 · builds 98–114

Cockpit reads books, pages, images and sound — and shows its working

Bookshelf. Converting a book was never the hard part — scale was. Over ~50 KB of extracted text an agent only gets a file path and a preview, which is useless to a local model. A book is now split into chapters and filed in the Library, so retrieval pulls the one chapter that matches the question and Receipts names it: a 400-page book works with a 7B model because it never sees more than the chapter it needs. The chapter list is shown before anything is written, because a bad split is obvious in a preview and invisible afterwards.
Dossier. A researched answer with a numbered source list you can check. The gathering is deterministic, so the same question fetches the same pages whichever agent writes the report, and a small local model can do the writing without driving a search loop it would get lost in. It reads the first pages a search engine returns — a fast survey, not a literature review — and the report says so itself.
Margin. Select lines, say what should change, approve a diff. The agent never touches the file: it returns only the replacement for the selected lines, and the splice happens here against the file as it is on disk. The anchor travels with the request, so it cannot drift onto a similar-looking passage further down — an early version matched on text alone and would have corrupted a file whose neighbouring line had just been edited.
Intercom. Hands-free: it listens, notices when you stop talking, transcribes, sends, speaks the answer and listens again. Silence ends the turn rather than a timer, and the voice reads the answer, not the markup.
PDF Vision and vision dispatch. PDF pages can be rendered and read as pages, not as the text scraped out of them. Each agent now receives an image the way it can actually take one; where an agent cannot see, Cockpit says so rather than accepting a description it quietly invented.
Sound. Measured audio facts — tempo, key, loudness — computed by local tooling, not guessed by a model. Sheet music works both ways: a hummed melody becomes engraved notation, and notation plays back with a piano-like voice. Transcription follows one melodic line, and a photo of sheet music is refused with an explanation rather than confident nonsense.
Receipts, Profile, and your own agents. Answers cite the retrieved passage they used. A Profile carries who the agent is working with, capped and sized because it rides on every prompt. And the agent catalog is editable in-app: describe how a new CLI is invoked and test it before putting it on a card — no rebuild.
Machines have names. The relay listed rigs by a 32-character id. Each machine now carries a name you choose, sent with every heartbeat, so nothing is re-paired when it changes.
macOS — the pass that wasn’t. The weekly Apple Silicon run was reporting success while the installer was aborting part-way through: it exited with status 0 after dying, so the job went green. Made to assert completion instead, it exposed three real faults — stat -c is GNU-only and a failed command substitution under set -e kills the script; the Homebrew httpd.conf was looked for at two paths that do not exist, so the port move, the Cockpit alias and the PHP module were all skipped; and ${var,,} is bash 4 syntax while macOS still ships bash 3.2, which killed the install and would have killed the agent loop. All fixed, and the build now refuses to ship bash-4-only syntax at all — but the confirming end-to-end run has not happened yet, so macOS stays listed as unfinished.
Correction, 1 October. This entry described these features as working when several were not. Bookshelf, Dossier, Intercom and Profile had no way to open until build 131; library retrieval — and so Receipts — did not fire from the chat until build 134; Margin, Dossier and Intercom were silently broken until build 137; and PDF Vision could not read scanned pages until build 147. All of that is fixed. Dossier is paused again, because public search engines now refuse its automated searches. And macOS passed its full run on 25 September (build 124), so it is no longer unfinished.

2026-09-22

Full v2.0.0 · Stand-alone v1.0.0 · builds 89–97

Everywhere works, the cron tick runs, and your agents stop inheriting your terminal

Everywhere relay — proven end to end. A prompt typed on a phone now runs on the rig and the answer comes back to every device watching. It had shipped, been entitled and never once run: the poller looked for a path that the edition merge deleted, read a data directory it could not open, wanted an account password in plaintext, mistook a successful login for a failure (PHP 8 stopped flushing cookie jars on curl_close), and reported its liveness into a table the phone's rig list does not read. All five fixed; the poller now authorises with a revocable token and no password is stored anywhere.
An answer is no longer eaten by whichever device asks first — a phone and a desktop can both follow the same run, and a prompt sent from one appears on the other.
Scheduled jobs actually fire. The minute tick had three faults stacked on each other: no crontab line was ever installed, the tick was refused by the session gate, and a lock bug stopped the sweep after the first data directory. The installer now installs the tick, and the Jobs panel can install it with one click.
Agents no longer inherit your personal CLI setup. An agent the cockpit starts used to read your own hooks, plugins, skills and global memory — on the developer's machine a terse-style hook was quietly rewriting every answer while the Style selector said otherwise. Cockpit's agents now run against an isolated config holding only your login (so you never sign in twice); switch on Use my global CLI config if you want the old behaviour.
RAG Search does something. The capability toggled nothing before: matching snippets, library notes and sources are now put in front of the agent, and the chat says what was added.
New: an Artifacts tab listing everything a project produced with its provenance, a per-project Goal, autonomous goals with a visible budget and per-step progress, a recovery token you can actually obtain, and an A2A switch so another Cockpit can call this one.

2026-09-20 — 21

Full v2.0.0 · Stand-alone v1.0.0 · builds 63–77

Six Linux distributions, then Windows through WSL2 — all as a stranger would

Debian 13, Manjaro, openSUSE Tumbleweed and Arch (MATE) joined Ubuntu and Fedora on the hand-tested list, every option on, zero hand patches after the fixes: Debian’s CD-only apt source and PHP package names, Manjaro/Arch keyrings, mirrors, php-apache wiring and the expired http account, openSUSE’s SELinux and wwwrun:www, KDE and MATE shortcuts, the terminal and file-manager launchers of every desktop. A machine with no browser, file manager or terminal is offered them on a setup page; with no browser at all the Cockpit window itself becomes the system browser (cockpit_shell --browser).
Windows 11 through WSL2 — tested for real. install_windows.ps1 had never run on a Windows machine; the first run found it unreadable by Windows PowerShell (UTF-8 quotes), then blind to wsl.exe’s UTF-16 output, then it wiped the distro’s systemd switch. Fixed, plus what the run taught: zstd for Ollama’s installer, .wslconfig so WSL does not stop Cockpit a minute after the last terminal closes and so localhost reaches it from Edge (mirrored networking), a reboot offer, the exact next command printed, and an AI Cockpit shortcut in the Start menu and on the Desktop. The Cockpit window, the setup wizard, gnome-terminal and Nautilus all open as ordinary Windows windows through WSLg.
The window: frameless is a setting (live on X11, on Reopen under Wayland), position and monitor are remembered, deploys reload or reopen the running window, the sessions card holds Reopen / Reload / Refresh / fullscreen; a two-minute freeze that appeared in build 69 was WebKit’s own signal handler being replaced — found with gdb, gone.
Remote administration page in the setup: optional SSH from one address or network; inside a KVM machine the QEMU guest agent is installed so a host can drive it.
A full pass over the app, as a user (every card, mode × style, toolbar tool, sidebar panel, proposals, export/import, attachments, TTS, whisper, translation) found and fixed: Card 2 set to opencode was still running the Gemini CLI (the daemon read the shared settings once at start, never the per-user file); a turn’s Mode · Style was never saved (every reload read “· Submit”); Claude Code’s own file writes landed at the shared projects root instead of the project; a sub-second duration written as .9 made PHP call the chat corrupt (export failed, history skipped it); image generation died on the 4 GB card while an Ollama model was loaded — Ollama is now asked to drop it first; the transcriber never found whisper (an undefined variable); proposal cards, the chat list and history hits showed server time; scratch chats leaked into history; tool inputs typed as relative paths; right-to-left answers left-aligned; and the About window still said AGPL (the licence is Apache-2.0 with conditions).
Also: the build number shows in the version (v2.0.0:87); the setup window is dark on MATE too; the rig line names the OS, desktop, terminal and file manager; the account and clock cards explain themselves on hover; response labels and the status pills name the supplier actually in the slot (opencode, Dual) instead of the slot’s old name; an installed CLI whose version probe fails under the web server (opencode) no longer reads “not installed”; the help, tour and User Guide describe the sessions card’s window controls.

2026-09-18 — 19

The installer became a setup window, and was run by a stranger on fresh machines

A setup window instead of forty questions. On a desktop install_cockpit.sh opens a wizard (ckdialog: Free Pascal + GTK 3, ~1000 lines, in the bundle): edition, install user, projects folder, optional CLIs, models sized to the hardware it detects, media tools, desktop shortcut, logins — every choice first, a summary, one Install. The system password is asked once, in a dialog; a progress window then follows the install log phase by phase and says Done. Light or dark to match the desktop, with a ☾/☀ switch. Over SSH the same questions are asked in the terminal, up front.
Interrupted, or run again later? It remembers every answer (never passwords) and asks Continue or Start anew. Components already on the machine — Node, Ollama, LocalAI, LibreTranslate, Piper, whisper.cpp, Aider, the companion tools — are listed on a Keep page: ticked ones are left alone, unticked are redone. Re-running over a finished install is the upgrade path. Everything goes to ~/cockpit-install.log.
First run in the Full edition: the account comes first. The first local login on a machine takes the Cockpit account name (an existing one, or a free registration with the human check, inside the setup or the app), so the person in the chat is labelled by their own login.
Tested as a stranger would on fresh Ubuntu 24.04 and Fedora 44 virtual machines, every option on, twice each. What that found, all fixed: no agent sessions on any fresh install (the shipped paths.json had no home), the human check blank in the native window, a hidden prompt that hung the install, a fresh install that named the Card 3 model picker “Dual mode off”, a Keep list that was never read back, LocalAI pulls that aborted the run on an already-present model, and the terminal buttons doing nothing on Fedora (Ptyxis, GNOME Console and the rest are now recognised, and a missing terminal is reported).
Fedora is a first-class install now: dnf package set, httpd/apache account, home-folder bits, a posix_* polyfill for PHP builds without it, and one SELinux change — only the web-server domain (httpd_t) is made permissive so it can run your agents; everything else stays enforcing. The Ollama card pulls a model the first time it is asked for it and shows Ollama’s own error instead of an empty bubble. The boot splash follows light/dark like the window.
Also: the BETA badge shows site-wide; the stats page counts finished installs and first accounts; the Setup Guide names the LocalAI gallery ids that actually exist in 4.7.

2026-09-16 — 17

AI Cockpit is a program now, not a browser tab

Cockpit now opens in its own native window (cockpit_shell: GTK 3 + WebKitGTK, 400 lines of Free Pascal, Apache-2.0 — sources in the bundle and on the Download page). The window’s close button, Alt+F4 and the dock’s Quit all open the same Leaving Cockpit dialog as the Exit button: kill jobs, stop sessions, wait, or leave. The window closes only when you say so. Outside links open in your browser; F11 fullscreen, F5 reload; the local login is remembered. Machines without the WebKitGTK runtime fall back to a browser window.
Panels detach into their own windows. The title bar of every sidebar panel has an open-in-new button: Preview on the second monitor, Code beside the chat, Attachments while you work. Escape or Ctrl+W closes a detached window; the main one is untouched.
The window does desktop work itself. Open folder / open file / open a terminal here, agent sessions in a real terminal, files pasted from the file manager attached by their true path, and a GPU meter read straight from the driver (hover for GPU, VRAM, CPU, RAM). Opened when nothing is running, it starts the web server and the agent sessions itself and says what it is doing.
Ctrl+Alt+C from anywhere brings the Cockpit window up (again to put it down), and starts Cockpit when it is not running (the installer offers the desktop shortcut); the window remembers its size, can run fullscreen without decorations (COCKPIT_KIOSK=1), and checks the shipped files against the build manifest before loading the app — a changed index.html means it refuses to run rather than trusting the page to report on itself.
Real file paths, notifications, tray. In the native window a file dropped on the prompt or chosen with Attach is attached by its real path (native file dialog, nothing uploaded); a file dropped elsewhere opens in the floating editor. Finished jobs raise real desktop notifications with an Open Cockpit action, and a tray icon offers Show / Minimise / Exit (GNOME: with the AppIndicator extension, which the installer enables).
Signed in, without typing. In the native window the local login has Keep me signed in on this computer: a per-device sign-in token kept in your OS keyring (GNOME Keyring / KWallet via libsecret) — not in Cockpit’s files — revoked by Sign out, expiring after 90 days. And Fill from Bitwarden buttons on Cockpit’s own login forms, through the official bw CLI: the master password is typed into bw’s own prompt, never into Cockpit.
It can bring itself up. Opened when nothing is running — at login, from the dock, with the shortcut — the window shows a boot screen, starts the web server and the agent sessions, and loads the app when it answers; if that takes too long it says so and offers Try again. It remembers its size, runs fullscreen and undecorated for a dedicated screen (COCKPIT_KIOSK=1), and verifies the shipped files against the build manifest before loading the app.
Fixed. Chat turns showed UTC while the lines beside them showed local time (the agent loop wrote a timestamp with no zone); the second clock in the hardware row now says when this Cockpit window was opened; the saved theme applies at start (it used to show only after a change); the settings card keeps its width and a long theme name scrolls; Files, Attachments and every other chat-scoped panel follow a chat switch; the Code panel’s Propose toggle no longer spills its markup; account card and settings block padding.

2026-09-13

Open source, integrity, guard, and a lot of polish

AI Cockpit is open source — Apache License 2.0. Read it, change it, redistribute it. Three conditions: a modified version ships under another name, says it is based on AI Cockpit wherever it is presented, and runs its own server. The account client (cockpit_auth) and the live server stay proprietary. Full text on the Licence and terms page, and in the app (logo → Terms). The Terms of Use name no jurisdiction and measure lawful use against the law that applies to you.
Build integrity. Every bundle carries a manifest (sha256 per shipped file + a build id). The app checks itself on first use and on demand (logo → Integrity), lists changed or missing files, and can restore the shipped files from the bundle the installer keeps. The live server answers account services to official builds only.
Lockdown and guard. The installer makes the shipped files root-owned and read-only (sudo to edit — a deliberate act) and starts cockpit-guard, a small service that logs any change to a shipped file, flags it in the app at once and puts the file back.
Chat context, done properly. A gate decides whether a prompt needs history; a full-text index over every chat picks the turns that matter; Claude gets a pointer and reads the chat file itself. Workers (REST) and Tools runs are now recorded in the chat too.
Tools. Runs are jobs in a cockpit_tools tmux session (the card’s open button shows them live), with an installed-check before Run, a long-run watchdog, Stop that stops everything, output files with the tree’s permissions and open-folder / open-file buttons in the chat. The local file chooser now uploads the file and fills the server path.
Interface. Every emoji replaced by monochrome Material icons; hover hints drawn by Cockpit itself (never cut off), a First-use mode with summaries from the guide, and a 26-step guided Tour; chat turns are foldable cards with a sticky title row; Enter sends, Ctrl/Shift+Enter add a line; an Exit procedure; a four-row clock with the live server’s time; the account card, sessions and settings blocks tidied.
Workers. Groq’s retired llama-3.x models replaced by gpt-oss-20b / 120b and qwen3.6-27b; a stale cascade order no longer blocks the cascade; the Delegate classifier picks an installed model and no longer asks on every prompt.
Fixed. The bundle had been shipping the developer machine’s paths.json; ftpush’s progress percentage was always 0 %.

2026-09-11 — later

The account check moved to the server, and modes can now run durably

The Full edition’s account check is now the server’s answer, not the app’s. Cockpit asks cockpit.ruggi.site whether this machine is registered to an account, and the server replies from its own records. Two things follow. An install that cannot prove it has an account is asked to sign in, whatever its local files say. And when the server cannot be reached at all, that counts as no answer rather than no — a paid install keeps working offline exactly as before.
Fixed: the check used to pass when it failed. If the account service errored or could not be reached on first load, the app treated “could not tell” the same as “signed in” and took the panel down. Unknown is not permission; it now asks.
Fixed (security): the account endpoint had no local authentication. Every other Cockpit backend requires you to be logged into the app; this one did not, and the app is served on every network interface. Anyone who could reach the machine on port 80 could read the signed-in e-mail, licence mask and tier — or sign the install out with a single request. It now requires the local session like everything else. Worth updating if you run Full on a shared or office network.
New: ⛓ Durable. With Pipeline or Broadcast selected, a button in the mode strip turns that exact selection — your prompt, the agents you ticked, their current models — into a checkpointed chain that resumes at the step that died instead of starting over. Enter is unchanged and still runs the mode in the page; durable is something you press, never a hidden setting.
Docs. The Setup Guide’s contents worked for none of its twelve steps — every link was dead. Fixed. Both guides now also cover the account requirement, what the installer sends and how to switch it off, the companion tools it installs (ftpsuite, secrets), and the new button.
Corrected on this site: the Free tier was described as “no registration”. That is true of Stand-alone (V1) and not of Full, which registers the install once with a free account. The pricing page now says which is which.

2026-09-11

Version check at install, and what No Phone Home actually covers

The installer now checks for a newer release when it starts. If one exists it says so and points at the download page — then carries on with the version you have. That check sends one anonymous line: OS, distro, architecture, package manager, coarse hardware, and the installer's own version. No username, no file paths, no files, no IP. Opt out entirely with COCKPIT_NO_TELEMETRY=1 before running.
Why it happens before you choose anything. One installer serves every edition, so at that moment there is genuinely no choice yet to respect — the decision you would be making has not been offered. Rather than guess, the installer tells you what it is about to send, sends one line, and gives you something back for it.
No Phone Home starts at your selection. Choose V1 and that boot line plus the record of your choice are the last things sent. No progress, no errors, nothing. At the very end you are asked once — knowing the install worked — whether to send a single anonymous “it succeeded” line. Decline and nothing is sent, and nothing asks again.
Your choice is now recorded for every option, including V1. That sounds like more data; it is actually less guesswork. Previously, an install that reported nothing might have been a V1 user or someone who closed the terminal — indistinguishable. Now the absence of a selection means “walked away”, and V1 users stop being mistaken for failures.
V2 and Both are unchanged: install progress and errors are reported so broken installs can be found and fixed, with the same opt-out.

2026-09-10

The Hive moves into the sidebar

A Hive section in the left sidebar — Autopilot Cruise and AutoCognition now share one home, with a live view of which agents are up and which chains are running. Buttons for Agents, Chains and Broker open the panel scoped to just that concern instead of one long scroll
flight PLAN acts on the normal prompt box — one place to type a goal. Press Enter to dispatch to the agent you picked, press PLAN to hand the same text to the Hive as a durable chain
The Autopilot Cruise mode toggle is gone — it was a checkbox that silently changed what the Enter key did, and it defaulted to on, so the same prompt could dispatch or plan depending on a setting you could not see from the chat. Planning now happens only when you ask for it. Nothing was lost: Cruise is still there, behind an explicit button. Any saved preference is cleared automatically on first load
Interrupted chains are visible without opening anything — the sidebar status line turns amber and tells you how many stalled and where to resume them. The floating hive button that used to carry that badge was retired, since the sidebar section replaced it

2026-09-05

Autopilot Cruise, AutoCognition, and a new tier lineup

Autopilot Cruise — state a goal in the main chat and Cockpit plans it into steps, picks the best agent/model for each, and runs it as a durable, resumable workflow (survives a crash or a closed tab), then posts the result back. A fast-path skips planning for trivial messages, and Manual Override is always one toggle away
AutoCognition — a local multi-agent bus: agents advertise presence and can see, message, and call each other; durable task chains with a board, checkpoints, and auto-resume-on-kill; capability routing (route a step to the best-fit agent), quorum voting (several models answer, a judge picks/synthesizes), a consent-gated broker, and one-click turn any Power Combo into a durable chain
New tier lineup — Free (no account, all local) · Starter (free account + Marketplace + unlimited combos) · Basic (Autopilot Cruise) · Pro (AutoCognition) · Ultimate (Pro + Everywhere), plus Everywhere as a standalone add-on. Everything except Cruise, AutoCognition, and remote access stays free with your own keys. All paid tiers are open free during beta
Site + home moved to cockpit.ruggi.site — the product now lives at its own domain (old maestro.ruggi.site links 301-redirect over, with a short history page), and the pricing/landing/features pages were rebuilt around the two new capabilities
Leaner download — trimmed ~46 MB of unused art from the bundle; the app itself is unchanged by that

2026-09-01

Account recovery, Workers Auto-cascade, and a full launch experience

Account recovery tokens — a one-time code shown when you first create your account restores your paid account and tier on a reinstalled or new machine. Recover right from the app; admins can reset a token
Workers — Auto (cascade) — pick this and free-tier workers are used in a priority order, automatically advancing to the next when one hits its daily quota (or a rate limit), for constant free AI. Reorder the priority in Workers settings
Marketplace — restore your content — a "my downloads" filter plus a one-click restore that re-downloads everything you previously downloaded and everything you published, so a fresh machine is quick to set up again
Auth reliability — fixed a case on newer systems where sign-in/validation could report "server unreachable" and leave a paid account stuck on Free
Desktop launch experience — the installer adds AI Cockpit to your applications menu (under an "AI" category) plus cockpit-start / cockpit-stop commands; launching shows a branded splash, then opens Cockpit in a clean app window. Install both versions and AI Cockpit V1 (No-Account) gets its own menu entry and cockpit-v1-start — only one version runs at a time
Browser/launch polish: opens a fresh window reliably (no more hijacking the app tab), and a login guard keeps the browser's display flags in place across browser updates

2026-08-24

Downloads refreshed to the current build — please re-download

The install bundle now ships the current install_cockpit.sh. The 2026-08-23 overhaul (V1/V2/both, offline, hardware-aware, telemetry, guided prompts) was already written, but the download had kept serving a pre-overhaul installer — so anyone who downloaded before today got the old one. Fixed: re-download to pick it up
New bundle shape (dist-based): extract → cd cockpit → sudo bash install_cockpit.sh, which installs from the bundled dist/cockpit_v2.tar.gz / cockpit_v1.tar.gz. Both the automated and manual-copy paths in the Setup & Manual guides were updated to match
Tool downloads brought in line with fixes that had only been live in the browser: Drive Migration Calculator (per-drive transfer time now honors per-drive rates), Palette Generator (WCAG luminance threshold), Subscription Sleuth ("Semi-Annual" label), and Veil-10 (large-input encode fix)
Every downloadable archive on the site was audited to confirm it contains the latest version of each file it bundles

2026-08-23

Installer overhaul — V1/V2/both, offline installs, hardware-aware, guided prompts, and install telemetry

One installer, your choice of version: pick V1, V2, or both at the start. "Both" installs V2 at /cockpit and V1 at /cockpit-v1 side by side. The edition is now derived from the version instead of a separate question — V2/both use the full account edition (needs at least a free account, no card), V1 uses the fully-local stand-alone edition
Every prompt now explains what each option means and its implications in plain language, shows the default (Enter = …), and supports proper line editing — backspace, arrows, ctrl-u — so typos are fixable
Offline installs: the installer detects no connection and skips every download gracefully (packages, CLIs, Ollama/LocalAI, models, account) while still deploying the local app + web files — ideal for a private, offline V1 setup. V2 warns that its account and models need a connection later
Hardware-aware: detects your CPU model + cores, RAM, and GPU/VRAM and recommends a local-model size that actually fits (so a 4 GB card isn't handed a model it can't run)
Cross-distro package completeness: the package lists no longer assume a fresh Linux Mint — every tool the app shells out to (unzip, ping, lspci, and GNU coreutils/grep/sed on Alpine, etc.) is installed explicitly on apt/nala, pacman, dnf, zypper, and apk, plus the Docker image
Ollama now keeps its own default model location instead of being forced to a custom path, and detects a pre-existing custom location to warn you before continuing. One consistent per-user npm location for the agent CLIs (no more root/user split)
New: anonymous install telemetry so we can find and fix installs that fail and see where they stop — reports only OS/distro, your version+edition choice, coarse hardware, and any OS error, with usernames and file paths stripped out; never your name, files, or IP. On for V2 (opt out with COCKPIT_NO_TELEMETRY=1), opt-in for V1 (superseded 2026-09-11 — see the entry above)
Verified end to end on a real Linux Mint 22.3 machine: V1 + V2 both installed and serving, the 50 open Power Combos seeded, all three agent sessions running, and the Claude + Gemini CLIs authenticated and responding

2026-08-18

Fixed the install counter showing zero; Windows installer hardened; Card 2 defaults to Gemini

Found and fixed the real reason the stats page showed zero installs despite real downloads: the first-run setup ping sent edition: "full", but the endpoint receiving it only accepted "v2" — every real install's completion signal was silently rejected. New installs now register correctly; installs completed before this fix were never counted and can't be recovered retroactively
install_windows.ps1 hardened: added a Windows-build preflight check (fails with a clear message instead of a confusing error three steps in on unsupported Windows versions), wrapped both WSL detection calls so a never-initialized WSL install no longer crashes the script, fixed the Linux-user-exists check to key off the actual exit code instead of output text, and switched the generated sudo password to a cryptographically secure generator
Card 2 now defaults to Gemini CLI (Google's free-tier API key works directly, no subscription required), restricted to Flash models only. Groq remains available as a background/fallback option but is no longer the default
All of the above CI-verified: install_windows.ps1 syntax-checked on a real Windows runner, install_cockpit.sh --unattended run end-to-end on a disposable Linux runner (exit 0)

2026-08-08

Full account and Stand-alone unified into one download; real installer bugs fixed; Everywhere relay activated

Full account and No-Account (Stand-alone) editions are now one codebase and one download (cockpit_install.tar.gz) — the installer asks which you want partway through instead of shipping two separately-maintained tarballs. Stand-alone's zero-network-calls promise is now enforced by a runtime flag file, checked before the one call that used to be edition-specific (an anonymous first-account-created ping)
Fixed real installer bugs found during testing: a nala update flag mismatch, a home-directory permission bit that could block service accounts (ollama) from starting, and a missing group membership that could deny ollama write access to its own models folder
New: a manual-install .zip for anyone who'd rather hand-copy files than run the install script — includes a new step-by-step Manual Install Guide for Linux, macOS, and Windows, plus the existing Setup/User guides. The install scripts are still bundled inside in case you change your mind partway through
Everywhere relay (remote phone/tablet access) is now actually wired up and reachable — was previously sold but had no activation path. The local rig now auto-starts the relay poller on cockpit_start.sh (self-gates on entitlement), and the Account panel has a real "Everywhere — pair a device" button linking to the phone-pairing page
Scope doc for Everywhere relay corrected — it was marked "NOT BUILT" but the backend/client were already real and functional, just not connected to the install flow or UI; that gap is what got fixed
All of the above CI-verified end-to-end (both editions, install to a running server) on Linux Mint/Ubuntu, ARM Linux, and macOS; Windows installer syntax-checked (full WSL2 run still needs a human on real hardware)

2026-08-03

New: Local AI Models Guide, complete Power Combos catalog, Marketplace title fix

New: a Local AI Models Guide, in plain language — real ollama pull/local-ai run commands and Hugging Face URLs for every model in the pool, organized by RAM/VRAM tier and what each one is good/weak at. Published on both ruggi.site and maestro.ruggi.site (Backups pages and its own dedicated page)
New on maestro.ruggi.site only: the Power Combos paper — how Parallel/Sequential/Judge patterns work, why Dual Mode on Supplier Card 3 is AI Cockpit's real differentiator, and multiple real usage examples per domain (coding, office, language, image, learning, data, creative, accessibility)
New: a complete combo catalog page — all 705 combos across all three backends, each with its description, what it's good for, and a worked example, browsable by backend/category
Fixed: several combo packs had 2-3 entries sharing the same name (same task, different underlying models) — Marketplace listings and downloaded combos were indistinguishable. Renamed by total model size (e.g. "... — Lite / Standard / Pro") across titles and the actual downloadable payload
Model files themselves are no longer hosted on the server — the guide instead points to the real upstream sources (Ollama's registry, Hugging Face) directly

2026-08-01

Pre-release pass: sitewide polish, QA infra, live demo, account management, real Marketplace pool

New QA infrastructure: temporary test accounts across all tiers, a re-runnable manual test plan, and real per-OS install CI runs (Linux, ARM Linux, macOS, Windows)
New: right-click is now suppressed sitewide (ruggi.site + maestro) except the browser's own title bar — copy/open-in-new-tab etc. are handled by a themed menu instead. F12 devtools unaffected
New: ruggi.site tool upgrades — Drive Migration Calculator (unit selector, custom transfer types, per-drive rate), Palette Generator (per-color pickers, Save-as, Saved Palettes with import/export), Media Subtitles (ARM Linux/macOS/Windows sections), a proper HTML page for the Claude Code Linux Mint guide (previously PDF-only), VeilStream's source-view link now opens a Download/View modal instead of a blank page
New: the live Web Demo's Supplier Slots now offer real predetermined options (Claude/Gemini/Codex/Groq/Qwen Code, Ollama/LocalAI/Dual), default to Claude · Groq · Dual, and Card 3's model/combo lists are populated for both backends. Unscripted prompts get Lorem Ipsum filler instead of a meta "not available" message. Workers and Tools panels also ship with real sample entries
Fixed a real bug in Card 3's Supplier Slots (v2 and demo): picking "Dual — Ollama + LocalAI" wrapped the long name into garbled-looking text on the collapsed card — now shows a short "DUAL" label with the full name as a tooltip
maestro.ruggi.site: renamed "Open on phone/tablet" to a distinctly-styled "Everywhere Relay" button; the homepage download counter now only counts real app downloads (v2/v1/Docker), not per-platform helper binaries; Q&A gained search and sort (by date/author/topic); the Account page is now a real account manager — editable profile, a Subscription tab, and a payment-method flow that's wired up but stays inert until billing goes live
New: the Marketplace page on maestro.ruggi.site now browses the same live content pool the in-app Marketplace uses — real titles, kinds, and download counts, no login required to look. The in-app Marketplace's kind filter also gained the "User Combos" option it was missing
Download page: the old per-platform cockpit_auth binary buttons are gone — that section now just explains the manual (non-scripted) install path and links back to the real tarball/zip downloads. Fixed a spacing bug that pinned the Docker card too close to the section above it
Fixed: Quick Utils' search icon overlapped the placeholder text — moved to the right side like a normal search field

2026-07-31

Dual Mode + Power Combos: real feature parity, mixed-backend combos, and a real bug hunt

New: the Ollama and LocalAI panels on Card 3 are now structurally identical — same master row (total count, filter, "+ new", collapse/expand-all), same categorized combo groups (Code, Office, etc.), same "Needs both backends" section, same model list with a sort control. Only the accent color and the model curation depth differ (Ollama's Tier 1-4 is hand-curated; LocalAI's is one real group, since it has no equivalent per-model data)
New: "Needs both backends" combos are now merged across both catalogs — a dual combo saved while Card 3 was set to Ollama shows up in the LocalAI panel too, and vice versa, instead of only appearing wherever it happened to be saved
New: missing-model combos are unselectable and disabled, but a combo you authored yourself stays editable even while it's missing a model — the whole point of opening Edit is to fix that. Hovering a missing combo now says which backend each missing model is missing from (e.g. "foo:3b (Ollama), bar:7b (LocalAI)")
New: the Combo Editor's model fields are now real dropdowns built from your actually-installed models (Ollama + LocalAI), not free-text — a newly authored combo can no longer reference a model you don't have. Model lists are alphabetized. Switching a step's backend correctly resets the model pick instead of carrying over an incompatible one
New: engine-level support for vision/multimodal steps (LocalAI's vision-capable models) — an images field now flows end-to-end from the combo API through to both Ollama's and LocalAI's actual wire formats. No shipped combo uses it yet; this is the plumbing a real one needs
Simplified: Card 3's Supplier Slots now only offers Ollama, LocalAI, or Dual — LM Studio and llama.cpp were listed but never actually wired up for Power Combos or the model picker. Either is still usable as a custom Worker. Also removed the dead "Custom..." option, which had no handler and silently broke Power Combos if picked
Fixed a real bug: the Combo Editor's Ollama model list could show up empty — dual_model.php's model-listing endpoint was gated behind Dual mode (so it errored whenever Card 3 wasn't literally set to "Dual") and, underneath that, used shell_exec('ollama list'), which silently fails under most web-server users. Both fixed — model listing now works regardless of Card 3's provider, via Ollama's own HTTP API
Fixed: saving/deleting/publishing a combo only refreshed the Ollama panel — an edited combo's row stayed stale on the LocalAI panel (or in "Needs both backends") until a hard reload. Both panels now refresh together
Fixed: a dual (mixed-runner) combo's missing-model check used to validate every referenced model against only one backend's installed list — a model genuinely installed on LocalAI could wrongly show as missing when checked from the Ollama catalog. Each model is now checked against its own step's actual backend
Installers: Ollama and LocalAI model suggestions now come with "Good for:" notes, and pressing Enter installs the whole suggested set by default (previously required typing "all"). Linux installer now also installs ffmpeg/pandoc, matching macOS
Fixed: the cockpit_auth licensing binary was missing from every downloaded tarball (see the notice above) — also added .zip downloads and Docker edition selection (v2/v1) this week

2026-07-29

Ollama + LocalAI together in regular chat, not just Power Combos

New: Card 3's model list now shows every Ollama model and every LocalAI model together — pick one of each and both stay loaded side by side (VRAM permitting)
New: a real fit-check runs every time you pick a model while the other slot is filled — if the two wouldn't fit in your detected VRAM, the other slot is freed automatically instead of silently over-committing
New: with both loaded, sending a prompt first asks both models to rate their own confidence (a quick 1-10, not a full answer), shows both scores, then lets you pick a winner or run the two together — parallel, sequential, or judge, the same patterns Power Combos already use
Picking just one model (either backend) works exactly like before — nothing changes unless you actually use the new dual slot
Known limit, shown right in the UI: LocalAI has no confirmed reliable "unload model" API, so freeing its slot updates the app's own state honestly but can't guarantee the model actually leaves memory yet

2026-07-28

Dual-mode Power Combos, CI-verified installers, real AMD GPU detection

New: Power Combos can now mix Ollama and LocalAI in the same run — both servers run genuinely in parallel (not switched back and forth), each step tagged with which one it uses. A pre-flight check confirms every server a combo needs is actually reachable before it runs, instead of failing partway through
New: the Docker bundle now installs and runs LocalAI alongside Ollama too, matching what the native install already did
New: hardware detection rewritten as a plain shell script — no compiled binary, no recompile needed for tweaks — and extended to detect real AMD GPU VRAM too (read straight from the kernel's own driver, not a vendor tool), not just NVIDIA
New: install scripts gained an unattended mode, and our CI now runs the real installers end-to-end on Linux, ARM Linux, and macOS — a genuine install, not a hand-rolled approximation of one, so a failure there means a real bug. Windows gets a lighter syntax check for now (WSL2 can't run end-to-end on cloud CI without nested virtualization)
Fixed: 7 real installer bugs this new CI caught and closed the same night — a text-editor package missing on plain Ubuntu, a file-permission ordering bug on Linux, an Ollama startup race, a wrong Homebrew path on Apple Silicon macOS, PHP never actually loading into macOS's web server, and two Windows-script timing/verification gaps

2026-07-27

Real hardware detection, LocalAI support for Power Combos

New: AI Cockpit can now detect your actual CPU cores, RAM, and GPU/VRAM (NVIDIA only, for now) and use it to raise the local-model auto-load ceiling past the old fixed 4B default — safe fallback to the original limit whenever hardware can't be read. Built and CI-compiled for Linux, macOS, Windows, and ARM; only Linux has actually been run on real hardware so far
New: Power Combos now work with LocalAI as Card 3, not just Ollama — same 50 free combos, translated to LocalAI-compatible model identifiers (same underlying models, different naming convention). Combos correctly hide themselves if Card 3 is set to anything else (LM Studio, llama.cpp) since those aren't wired up yet
Fixed: switching Card 2 to Groq showed a false "not installed" warning — Groq doesn't use a local binary at all, it routes through the encrypted Workers key store. The Supplier Slots picker now correctly shows key status instead of a misleading binary check
Fixed a real (if narrow) bug before it could ever affect anyone: installing a LocalAI combo pack would have silently overwritten Ollama's encrypted combo files — each backend now writes its own file

2026-07-26 – 2026-07-27

Bug sweep, Q&A board, Docker option, and honest beta labels

New: a Q&A board — ask a question with no account (guest posts stay up 7 days), sign in to answer or keep yours permanent
New: a Docker option for Windows/macOS — one bundle, Cockpit and Ollama share a container since the app talks to Ollama on a fixed local address
Fixed a real bug: the Power Combos panel was silently empty on every install (a response-shape mismatch between the backend and the UI) — the 50 free bundled combos now actually show up and have been tested working
Fixed: fresh installs could end up with the app looking in the wrong folder for your projects (the installer created one folder, the app defaulted to a different one) — Linux, macOS, and Docker installers all corrected
Fixed: the Supplier Slots picker (Card 1/2 alternate CLI choice) now correctly shows which CLI is actually configured after a normal page load, not just right after changing it
The Everywhere relay is now clearly labeled Beta in the app itself, not just announced
Labeled the macOS installer, Windows installer (since tested, 2026-09-21), and Docker bundle Not Tested Yet on the download page — all written and reviewed carefully, but not yet run for real on their target platform. If you try one, please tell us how it went
Assorted site accuracy fixes: stale terminology, broken/incomplete stats tracking, and several documentation gaps found and closed

2026-07-25

Live Demo — try it before you install

New: a browser-based Live Demo — the real UI, real themes, real chat flow, no install and no signup, hosted right on our server
Agent replies are canned/scripted (no real Claude/Gemini/Ollama calls, no local-machine access) so it's safe to host publicly, but every screen, panel, and interaction is the genuine app
Linked from the homepage, Features, Pricing, Docs, and every guide page — look for the "play_arrow Live Demo" button

2026-07-24

Live Beta is here

AI Cockpit is out of "under development" and into open beta — download it and use it today, free
New: a No-Account Edition download alongside the registered build — same local app, zero SaaS account, ever, no network calls to our server, no Marketplace/remote-control features
The registered build now asks for a free account once at first run (no card) — local features stay free forever either way
Platform downloads added: native binaries for Windows, macOS, and ARM Linux / Raspberry Pi, alongside the existing Linux package
Q&A page, Marketplace, and Setup/User Guides all fixed and verified live
Paid tiers marked "Free during beta" until monetization actually launches

2026-07-10

Combo catalog expanded to 235, Delegate task routing, in-app guides

Power Combo catalog grown from 50 to 235 recipes across 30 categories
New Delegate feature — set keyword/phrase rules that auto-route matching tasks to a chosen worker, combo, or Ollama model, regardless of active mode
User Guide and Setup Guide now open inside the app itself (searchable, with back/forward navigation) instead of an external browser tab
Collapse/expand added across all supplier dropdowns (Ollama tiers, Workers, Tools, Power Combos)
Full theme editor — every palette color is an editable swatch, export/import as JSON

2026-06-27 – 2026-07-02

Marketplace and per-user data separation

Community Marketplace: browse, download, and publish Skills/Tools/Capabilities/Combos, with compatibility badges before you download
Multiple local users on one machine now get genuinely separate data — own tools, skills, combos, and SaaS account per login
Account Portal — profile and subscription management (registered-machines panel)

2026-06-19 – 2026-06-25

SaaS layer goes live

Cockpit Account system launches, with free and paid tiers
Lemon Squeezy billing integration (test mode)
Cross-platform compatibility metadata — every downloadable item shows whether it'll run on your machine before you get it
Cloudflare Turnstile bot protection on registration

Earlier — v1.0 / v2.0 foundation

Core application

Five supplier classes: configurable paid CLI, free REST, and local LLM server slots, plus cloud Workers and local Tools
Single / Pipeline / Broadcast / Plan multi-agent modes
Full local RAG — Library, Snippets, Accumulator, semantic search
36 themes including 18 Protanopia-safe Dalton variants
Smart attachment routing (PDF/DOCX/audio/video/image), scheduler, chat export/import