Changelog

Your rules reach every agent, reviews grade against a rubric that ships with toryo, and a run can decide the work is already done.

• AddedYour rules now reach every agent. Codex and Copilot workers used to run without any of your engineering standards while a Claude worker on the same job had all of them, and the rules pack that shipped with toryo described toryo's own code rather than yours. toryo now resolves one layered stack for every job: rules from your library, your project's library, your own global files, your project's files, and nested ones, each layer overriding the one before it. Rules can live in a `.toryo/rules` folder as well as `.claude`, so they are not tied to one agent. You can also print the exact set of rules any job started with, layer by layer, including anything that failed to load.
• AddedThere is one review rubric, and it ships with toryo. Reviews used to point at process and rubric files that shipped with nothing in them; a reviewer that read nothing still produced a review shaped correctly from criteria it invented, and the run reported that as a success. The documents toryo ships are now written into your global library at setup, they survive an upgrade if you have edited them, and a review step stops the run when the rubric is missing or empty rather than grading against nothing. `library get` accepts a name as well as an ID.
• AddedA run can decide the work is already done. A code-task started from ideas now checks each one against a fresh copy of your repository first and dismisses the ones already resolved, backed by a citation that has to point at real code. If every idea is already resolved, the run stops before any work begins. Those runs carry their own outcome summary, so a run that correctly did nothing no longer looks, in every list and notification, exactly like one that planned, built, reviewed and merged. The console shows which ideas are mid-check instead of leaving them looking untouched.
• AddedIdeas now have effort as well as impact, and rank on both. You can set effort when you capture an idea, nightly triage estimates one for anything without it, and each score records whether it came from you or from triage, so triage can revise its own guesses and never overwrite yours. Before this, an idea kept the value a single sighting earned it on the night it was filed, so a backlog of any size stopped ranking usefully. The console sorts by impact per unit of effort by default, shows both scores and where they came from, and can score a whole selection at once.
• AddedYou can check chosen ideas against your code on demand with `toryo ideas verify-sweep`, or the new Verify control in the console, which previews the batch before it runs. The nightly pass only looks at ideas idle for 45 days, which is right when nobody is watching and wrong when you are asking. A sweep also closes what it resolves: a confident verdict whose citation checks out dismisses the idea, and every verdict comes with impact and effort estimates. Nothing is destroyed, the idea keeps its original text and the note explaining the verdict.
• AddedThe console opens on something to do. A first-run chooser offers guided paths, and the one you pick follows you across the app in a dock you can collapse, with each step ticked off by an actual check rather than a checkbox you tick yourself. The paths also live behind the header's `?`, now a Help dialog with the docs site alongside them, so dismissing the first-run prompt is no longer a one-way door. The License dialog gained a Manage license button that opens your account in the portal.
• AddedYou can export a library document as markdown and import it back. The exported file re-imports to an identical entry, and the console's Library panel can copy the markdown or save it to a file. Import also now counts files it rejected for being malformed, which previously reported as a clean success.
• AddedBackground services know what is optional and what is merely busy. ollama is optional now: a machine that declined it reports the service as unavailable rather than failed, so bringing services up succeeds instead of leaving a watcher respawning a missing program every five seconds forever. Restarting a service while it is mid-job is queued and run once it drains, rather than waiting 30 seconds and exiting with no output at all. And the up, down, restart and check commands each print a short plain-English summary naming what failed, what was left stranded and what was queued, without changing the output anything piping them relies on.
• AddedCodex and Copilot jobs now show a cost, priced from the same published rate table Claude already used. It is an estimate of what the work would have cost against the model vendor's own API, not a claim about what your subscription was charged. A model with no published rate is left unpriced rather than shown as free.
• AddedYou pick the model, not just the agent. Each of a code-task's five roles accepts an agent and model pair, and an invalid combination is refused when you file the run, with the valid list, rather than partway through. The console's idea composer gained agent and model pickers with per-role overrides. And on a machine running more than one agent, filing a run, a schedule or a job through your own agent now asks which one to use instead of quietly picking.
• AddedSequences carry a description you can read and edit. It shows in the catalog and in full on the detail panel, both ways of authoring a sequence ask for one, and cloning a sequence lets you give the copy its own description instead of inheriting one it no longer matches. You can also archive a single run from its detail panel, without having to select a second run you do not care about.
• AddedOn the hosted side: the portal has password recovery, emails are properly styled, signing up from the marketing site subscribes you to the newsletter, and there is a signups page in admin.
• ChangedPull request bodies follow one shape. Both the agent writing the change and the one reviewing it work from the same list of things to cover, summary, motivation, design decisions, failure handling, deployment impact and verification with the exact commands and their results, and are told to leave out the ones with nothing to say rather than filling them with N/A. A small change gets a short body.
• ChangedThe session analyzer stops inventing findings. It flagged any read that overlapped an earlier one, while the rule it models only blocks a read entirely covered by what the session already has, and it missed reads done through the shell. Both gaps manufactured findings for reads nothing would have stopped, and the first pattern it ever filed into your ideas queue was made entirely of them. Re-analyzing a transcript you have already analyzed will now report fewer findings, and its default threshold moves from 2 to 1 to match.
• ChangedA run's history no longer stores each step's output twice, which was the bulk of what a busy machine kept on disk. Nothing you see changes and there is nothing for you to do.
• ChangedThe console's Sequence screen dropped its table of registered sequences. The Design screen owns the catalog, so it was duplicate reference detail on the screen you open to find out what is running right now.
• FixedA reviewer is handed the diff instead of having to go and get one. A failed attempt to fetch the diff looked exactly like a diff with nothing in it, and one run produced three verdicts on a change none of the reviewers had actually seen, with every check below it passing. The diff is now prepared for the reviewer up front and the run fails if it came out empty. Three separate causes are closed with it: a Codex reviewer was denied the network access its own instructions told it to use, a personal diff tool setting silently replaced the real diff for every agent on the machine, and a reviewer with no reliable way to find its own copy of the code wandered into another run's workspace and graded the wrong branch.
• FixedA review step can now write the file it is required to produce. It was denied every writing tool by name while the thing it had to deliver was a file. Claude worked around it with a trick no rule covered; Codex, which has only one way to write, was refused three times, finished with the review written out in conversation, and failed the step with nothing saved. Writing is now permitted where the file lands inside the job's own output folder.
• FixedA Codex session can record its commits. Neither of the two locations it needed to write to was permitted, so a session could edit files and then not commit them: one run pushed a commit to its pull request while leaving the local copy on the original branch. Those are now permitted for sessions meant to write, and a code-task stops with a clear message when the branch never landed locally, instead of failing four steps later with nothing to review.
• FixedRule files that are symlinks are found. They were silently skipped: one person's global rules resolved 1 of 31, and the Codex and Copilot runs that only ever see rules this way were running with no engineering standards at all.
• FixedAn update brings the database changes and the shipped documents with it, and reports a failure instead of finishing green over a database that was never updated.
• FixedSetup refuses stale files left over from a previous build. Run over an existing install, setup repaired what it could and stopped, leaving a new build sitting beside the old build's database changes, finding nothing to apply, and printing a green tick over a database that was never updated. The health check agreed, because both halves of its comparison were stale together. Every installed set of files now records which build produced it, setup repairs only from a matching one, and the health check reports the staleness before drawing any conclusion from it.
• FixedClaude installed through its own installer is no longer reported as missing. That installer publishes Claude in a way that does not look like a normal program on your path, so setup reported it absent on a Mac running Claude Code every day. It is now found, and workers are started with it available.
• FixedSetup and the service manager say what actually happened. A services failure now reports the per-service detail and the underlying error, which is where a refusal from Docker actually appears, instead of an unconditional "everything else is in place". The startup advice stops guessing. And setup finishes with a still-to-do list built from what each step really returned, including the case of a machine with none of its agents installed, which used to come up green and accept work while every job died at the agent.
• FixedA clean approval no longer kills the run. A reviewer approving a change with nothing to report failed on the empty findings, after the pull request was already open, and retrying hit the same wall again. The check now only fires where it means something: a demand for changes that names none.
• FixedA large run stops running out of room. The list of changed files a worker returns grows with the size of the change, so a sweep touching 1,813 files spent 97% of the run's capacity on it and died after it had already built, reviewed and pushed. The list is now capped where it is passed between steps and kept whole where you read it, so a run already stuck recovers on a plain retry.
• FixedThe check that decides whether an idea is already resolved cannot close one it only partly answered. An agent could cite something narrower than the idea, admit the gap in its own note, and still call it resolved. Every qualifier in the original idea now counts, anything left over goes in its own field, and a resolution that carries one is refused and reported.
• FixedThe console holds its state where it used to lose it. The ideas brief rebuilds when you change the selection, rather than one hand edit suppressing it for the life of the app. An optional selection can be cleared again. The archive control hides on a run that is still live instead of sitting there disabled next to a reason already on screen. A services banner can be dismissed. And a job filed into a project's folder now carries that project, rather than landing under none and failing the run after its pull request had already merged.
• FixedAfter a run merges in the latest code, the agent is told to refresh its workspace links. An ordinary refresh can report no changes while the links are stale, which turns a healthy merge into an unexplained failure at the next check.
• FixedA session that asks for toryo's tools fails when it cannot have them, instead of starting without them and behaving as though they were never meant to be there.
• FixedThe reviewer's instructions read the pull request context they were written for. All four of the conditional sections had been coming out empty in every real run.
• FixedA project's library cleanup reads past the first page, so it no longer stops after 50 entries.
• FixedSigning in to the portal is fast again. It was reported at 10 to 15 seconds; the sign-in itself is measured at 249 to 266ms, and nearly all the rest was the server being started back up after idling. A few sign-ins a day is exactly the pattern that leaves a server idle long enough to be stopped, so signing in once each morning met a cold start most mornings. The server no longer stops, that is pinned by a test, and every leg of the sign-in path is now timed permanently.

• AddedYou can write your own sequences. The three that ship with toryo used to be fixed parts of the product: if one of them did not fit how your team works, your only option was to ask for it to change. A sequence is now a plain file you can read, copy and edit, describing the steps a run takes: fetching a fresh copy of your repository, copying in the files a project needs to build, running a command, reshaping data between steps, branching on what the run was asked to do, and stopping for a human. Your own file can stand in for a shipped sequence by name, so you customise rather than fork. `sequence import` brings a file in behind a review, and `sequence validate` refuses one that could never run.
• AddedThe console can design a sequence with you. There is a Sequence Design screen where you lay out the steps, decide which of the run's inputs each step uses, and, if you would rather describe what you want than draw it, talk to an agent that writes the file as you go. Working outside the console, you can ask your agent for the same help.
• AddedApproval steps are proper forms now. A step that stops for you can show you the files it changed and the questions it wants answered, and you reply by clicking a named decision instead of typing a verdict and hoping it was understood. The form for starting a run hides fields that do not apply to what you are asking for, groups what is left, explains each field, and only insists on the ones your run will actually use. A run is titled from what you wrote, not from a generated string.
• AddedYou can edit a queued run before it starts. Previously, spotting a wrong input after filing meant cancelling the run and filing it again from scratch.
• AddedA worker can stop and ask you a question mid-run instead of guessing. The question appears on the run as it happens, and the bell badge reflects how urgent the waiting item is. An unanswered instruction is escalated rather than left sitting, and anything still outstanding is handed to the worker when it next picks up, so an answer you gave between turns is not lost.
• AddedThere is a Usage screen with a gauge for each coding agent. Claude's weekly windows for your tier sit alongside Codex and Copilot, headroom you have paid for counts as headroom, and a marker shows where your budget runs out. The strip fits the window you have, moving the rest into a flyout rather than cutting it off.
• AddedRuns that failed or escalated can be repaired instead of refiled. Fix your sequence file and a failed run can be re-pinned to the corrected version and resumed. An escalated run now waits, paused, with an explicit control to release it, rather than ending somewhere you cannot restart it. Runs also carry a triage stamp, and the Sequence screen lets you select several at once and archive them together.
• Addedtoryo installs on more machines. Linux and Intel Mac builds are published and signed, and the updater offers each Mac the build for its own chip, so an Intel machine is no longer handed an Apple Silicon one. `mcp install` now sets up Codex, Copilot and Cursor as well, and can set Codex's approval mode at the same time.
• Added`toryo ideas drain-followups` empties a followups file into your ideas queue, so notes a worker left behind end up somewhere you will see them after the run is over.
• Changedtoryo is no longer a Claude tool that also runs other agents. Codex and Copilot are first-class choices you pick per job, each with its own usage gauge and its own rules about when it is allowed to start work.
• Changedcode-task, review-task and research-task are now files on your disk, and the built-in versions are gone. Setting up installs them and updating upgrades them; from there they are yours to read, copy and override. Each step was checked against the old built-in version before it was removed, so runs behave as they did.
• Changedcode-task plans against a freshly fetched copy of your repository rather than whatever state your checkout happened to be in, and it writes its planning notes beside the run instead of into your work. Those notes are named so you can spot them in a diff and ignore them in one go.
• ChangedA retry is told why the last attempt failed. Retries used to start over with no memory of the previous attempt and often made the same mistake again.
• ChangedWhen a run merges, the checkout you are sitting in moves forward with it.
• ChangedA run whose checkout is behind the branch it builds on is refused up front instead of failing later, and the check costs nothing on a busy queue.
• ChangedRuns process their steps in parallel, so a queue with several things ready moves faster.
• FixedFiles a project needs to build now actually arrive in the working copy. The step that copies them in ran after the fresh copy was made and then looked for them inside it, where they had never been, so they silently failed to appear and the build failed for reasons that pointed nowhere useful.
• FixedA sequence file that no longer works says so, and can be repaired. It used to fail somewhere further down with an error that blamed the run rather than the file, and there was no way to move the run onto a fixed version.
• FixedInstalling a new build while the background services are running now tells you they are still serving the old code. Nothing used to say so, which is the same quiet mismatch the app itself stopped having in v0.3.1.
• FixedCodex works properly as a provider rather than almost working. It starts in the right place, can see the run's files, tells you immediately when it is pointed at something that is not a repository, and no longer stalls waiting on an approval prompt nobody can see. Commands you have denied stay denied: one could previously be slipped through as the second line of an allowed command. Copilot's own exclusions and denies now take effect too, where before they were quietly ignored.
• FixedA check whose failure was being hidden is now treated as a failure. A step could report itself as passed when it had not actually run.
• FixedCommand output no longer gets cut off partway through when you pipe it somewhere.
• FixedA run is no longer blocked because the branch it started from was deleted after a merge.
• FixedThe console keeps its place. Switching views no longer resets the screens you had open, run descriptions render properly and stop repeating their own heading, worker detail shows which agent and model is running, clicking an idea selects one idea (with ctrl and shift for ranges), and a field label no longer steals the click meant for the control next to it. You pick a project by name; nothing asks you to type an ID.
• FixedTwo things setting up the database at once no longer collide, and `doctor` now checks a real install correctly rather than only a developer's copy.

Updating from the app now finishes the job.

• FixedUpdating from inside the app now restarts the background services, so they actually run the new version. Before, the new tools were installed but the already-running services kept serving the old ones, and the app reported itself up to date.

The app notices when its tools are out of date, and an install that gets stuck now says so.

• AddedReplacing the app now updates the command-line tools. It never did: dragging in a new version replaced the console and left the tools as they were, so an update to pick up a fix showed you the old version’s errors, with nothing saying why. The app now compares the two and offers to update in one click.
• FixedAn install using the embedded database no longer reports itself healthy while it is only half running. If the database was interrupted while shutting down, some parts kept serving and others stopped, and the console showed everything green while screens failed. It now checks every database rather than one of them, and names the ones that are not serving.
• FixedA database left in that stuck state is now repaired rather than adopted. Starting the services used to see the false green and do nothing, so the console stayed broken until the process was found and killed by hand.
• FixedStopping the database now waits for it to actually stop, instead of reporting success while it was still running and losing track of it.
• FixedA leftover service from a crash is cleared the next time toryo starts. The cleanup only ever matched how services run in a development checkout, so on a normal install it silently did nothing.
• AddedYou can stop and start the background supervisor from the console — click the supervisor indicator — or with `toryo supervisor`. There was previously no way to stop it: stopping the services simply let it start them again, which is its job.
• ChangedTwo toryo installs can now run on one machine without disturbing each other’s files, services or ports.

The console stops erroring on an install that does not use Docker.

• FixedScreens in the console no longer fail with errors about prepared statements. On an install using the embedded database, everything shares one database session, and two requests arriving together could overwrite each other. Installs using Docker were never affected.

A fresh install now finishes on its own, with no manual steps.

• FixedSetting up no longer stops needing a hand. v0.2.2 could still fail to start Ollama on a machine where it had just found it, and wanted you to start it yourself before setup would finish.
• Changedtoryo now records where your tools live when you set it up, and reads that back afterwards. Before, every part of toryo worked out where to find tmux, Ollama and Claude from whatever it happened to inherit, which differed depending on whether it was started by you, by the app, or by the background supervisor, and was wrong in some of those cases.
• FixedSetup no longer restarts itself endlessly when your toryo folder sits behind a symlink.
• FixedUninstalling now tells you the app itself is still in Applications. It does not delete applications, and the one left behind will reinstall everything the next time you open it.

A fresh install now starts its services, not just install them.

• FixedThe background services start on an install that does not use Docker. They were trying to launch a Docker container regardless of the database you chose, which failed on the machines that had deliberately chosen not to have Docker.
• FixedThe background supervisor can find the tools you have installed. Launched from the app rather than a terminal, it was left without Homebrew on its path, so the agent sessions it runs could not start.
• FixedSetup finishes rather than restarting itself when your toryo directory sits behind a symlink.
• FixedSetup now tells you when it skipped installing something, and gives you the command to finish it later. Declining the Ollama models used to leave a "missing" line and no explanation.
• ChangedThe first-launch screen says what declining the Ollama models costs, search across your brain, memory and library falls back to plain text, instead of only its download size.

First-run setup works from the app, and there is finally a way to uninstall.

• FixedSetting up from the app now finds the tools you already have. Launched from Applications rather than a terminal, toryo could not see Homebrew, Docker, tmux or Ollama, and reported a machine with none of them installed.
• FixedSetup no longer fails at its last step when the background supervisor is already running. Everything before it had already worked, so the install was usable and said otherwise.
• FixedRunning setup again keeps your data where it is. It used to pick the database runtime afresh each time, which could move an install onto a different one and leave everything it had learned behind.
• AddedThe app asks how to set itself up. Choose the embedded database or Docker, and which extras to install, instead of getting whatever your machine defaulted to.
• Added`toryo uninstall` removes toryo properly: the background services, the binaries, the shell PATH entry, the skills and the MCP registration. It keeps your databases unless you pass --purge, and tells you what it kept.
• ChangedThe download page now says Docker is optional. It never was required, the embedded runtime needs nothing else on the machine, and the page did not mention it either way.

Activation, settings and crash reporting land in the desktop console.

• AddedActivation lives in the app. The console asks for your email and key on first launch, and the same dialog shows which version you are running and signs you out again.
• AddedA settings screen covering every service in one place, with a detail rail per setting instead of a card per app.
• AddedStart any registered sequence from the console, and watch its cost and elapsed time climb while it runs.
• AddedCrash reporting, off with a single toggle. A report carries no source code, no prompts, and no agent output, and the privacy notice states exactly what is in one.
• ChangedOne screen failing no longer takes the window with it. Every other screen stays reachable, and the failure is reported rather than swallowed.
• ChangedInstalls re-check their license daily and at startup, so a revoked seat stops working on its own and a purchase reaches the machine without anyone retyping a key.
• FixedDatabase notices no longer mix into command output, so what toryo prints is parseable again.
• FixedAn interrupted write can no longer quietly un-configure an install.
• FixedDetail panels scroll on a short window, and opening an external link no longer leaves a stray process behind.

The first public release.

• AddedOne download. Toryo.dmg carries the desktop console and the whole command line, and provisions everything on first launch.
• AddedFour built-in sequences: ship a change, review a pull request, research a question, and grade a codebase.
• AddedThe knowledge plane: memory, an authored library, a resolved code index, and directives, all reachable from a Claude session.
• AddedA headless install for CI hosts and servers, verified against SHA256SUMS.
• AddedPostgres on Docker, or an embedded pglite runtime for machines without it.