Changelog

RAM now includes local AI models. When a session uses Ollama (opencode, ollama run), the sidebar counts the model's memory, measured the way Activity Monitor measures it. Before, a 34 GB model showed as under 1 GB. New: right-click a folder in Finder and choose Services › Open in Shell Pilot to start a session there.

Fixed in-app updates. Clicking Proceed closed Shell Pilot without installing anything: the installer ran as a child of the app, and macOS refused to mount the update once the app had quit. It now runs as its own background job and finishes on its own. If you are on 1.24.0 or earlier, install this version once from the download page; updates work in the app after that.

SSH, rebuilt. Every SSH session is now recognised, including typed ssh, aliases and gcloud compute ssh. The sidebar gets a file browser for the server: browse, download, upload by drag and drop, and edit files locally with changes saved back. Dropped connections offer one-click Reconnect, and Connect to Host (⇧⌘K) opens recent hosts and ~/.ssh/config aliases. The file browser only acts when you click and the server’s prompt is empty, so it never types into a running program.

Fixed the app icon sitting on a black background. Recent versions of macOS put any app icon that does not match the standard rounded-square shape onto a grey plate, which looks black in dark mode. Shell Pilot’s icon had its own corner shape, shadow and glow, so macOS plated it in the Dock, Finder and Launchpad. The icon is now re-cut to Apple’s standard shape and sits in the Dock like any other app.

Fixed the terminal freezing after you leave the app and come back. After closing the window and reopening it from the Dock, the session that had been on screen stopped redrawing. Your keystrokes still reached the shell and commands still ran, but the screen never changed, so the only way out was a new session. macOS’s Metal view permanently switches off its own redraw mechanism when its window closes, and the terminal kept using that dead view in the new window. Shell Pilot now replaces the Metal view when its window closes. Reopening also no longer shrinks the terminal to nothing for a moment, which had wiped the screen above the prompt.

Fixed the window layout breaking when a shell exits. In 1.23.0, once a session’s shell crashed, was killed or exited with an error, the whole window’s content grew taller than the window: the New Session button and the Sessions header slid under the traffic lights, the terminal’s first line went under the title, Settings and the Activity footer fell off the bottom, and the new Restart/Close banner was pushed off-screen. The banner’s text was sized so that its height depended on the width it was measured at, and SwiftUI measures a window’s minimum size at almost no width — one letter per line. The banner now floats over the terminal as an overlay, which cannot change the window’s layout, and its text has a bounded height. Verified on a signed build by killing a session’s shell: the layout stays put and the banner appears at the bottom of the terminal.

Buying Shell Pilot works end to end again. The page Stripe opens after checkout asked the server for the license key by email alone, which the server had stopped allowing, so buyers saw an error instead of a key; and its download button pointed at a file that did not exist. The page now retrieves the key with the checkout session, shows it with a copy button, keeps working if reloaded or bookmarked, and links the current DMG. If the page opens before Stripe’s webhook arrives, the server confirms the payment with Stripe and issues the key itself. The backend also stops issuing keys for unpaid sessions, keeps the license on a partial refund, accepts every key on an email with several purchases, stops rejecting other products’ events, and answers identically for an unknown email and a wrong key. In the app: a License tab in Settings to activate the key; quiet update checks with an “Update to…” link in the sidebar and Check for Updates… in the app menu; a toolbar that no longer wedges a shortcut against the traffic lights or hides the rest in the overflow chevron; a shell that exits closes its session on exit, or shows Restart/Close on a crash instead of leaving a dead terminal; ⌘W at an idle prompt closes without a false “active command” warning and names the job when there is one; closing a session selects its neighbour; the updater swaps the app in atomically instead of deleting it first; the update popover can no longer get stuck; ⇧⌘M toggles the man page. 401 tests pass in 30 suites, up from 390, and the backend has its own suite.

The sidebar reflection now lights only the part of the sidebar level with the colour on screen. 1.22.2 introduced the per-band “tell-tale” gradient that was supposed to do exactly this, but in practice the whole sidebar washed in one colour from top to bottom — a Claude Code logo in the first few rows turned the entire column orange, a block of red errors halfway down turned the entire column red. Two user screenshots confirmed it. The view composited two layers, and the wrong one dominated. Underneath sat the aggregate wash, a single averaged hue spanning the full sidebar height; because the aggregate energy carries the 0.70 presence floor, it painted roughly 0.34 alpha (at the shipped 75% intensity) uniformly down the whole column whenever any colour was on screen. Above it sat the 12-band vertical layer that actually knows where the colour is — but capped at 0.22 alpha and driven by raw coverage, it peaked around 0.165 and was usually well below that. The uniform layer was about twice the strength of the localized one, so the vertical structure never survived to the screen. The sampler and the band maths were already right; only the composition was wrong. The sidebar now draws the band layer and nothing else. AmbientReflectionView gained a Rendering mode: .localized for the sidebar (bands only, falling back to the aggregate wash only for a value that carries no bands) and .uniform for session rows, which keep the aggregate glow because a 40pt row is too short to carry vertical structure. The band layer takes over the full 0.65 alpha ceiling, and its response to per-band coverage is now a square root rather than linear: one error line spanning 40% of a band’s width is about 0.5 coverage, which linearly at the shipped intensity gave ≈0.24 alpha — right where the sidebar’s vibrancy eats it — and now gives ≈0.34, plainly visible; a single coloured glyph (≈0.04 coverage) still comes out around 0.10 alpha and stays invisible, so a lone bullet cannot light a band. A per-band presence floor was rejected for that reason: it would light a band holding one bullet as brightly as one holding a whole line. Bands with no colour stay fully transparent and borrow their nearest coloured neighbour’s hue, so a hotspot fades softly into clear glass above and below instead of ending in a seam. The tell-tale display-lightness moved 0.62 → 0.70: the layer is now the primary one on the sidebar rather than an accent over a pale wash, and at up to 0.49 alpha a 0.62 red read as a stain on the glass rather than light falling on it — 0.70 stays under the 0.78 ambient lightness, so a diff red still arrives as red rather than salmon. Verified live on a signed Release build: a solid red block in rows 18–22 produced a red hotspot at the same height with clear glass above and below, orange in rows 1–4 lit only the top, six lines of mid-screen error text glowed softly at mid-height, and clearing the screen returned the sidebar to plain glass in about two seconds. 390 tests pass in 29 suites, up from 388, with no user-facing regressions.

Two fixes to the sidebar’s ambient reflection, which shipped in 1.22.0/1.22.1 and which people reported seeing nothing of. First, the sidebar glass was tied to terminal opacity and should not have been. A single flag — TerminalAppearance.isTranslucent, meaning terminal background opacity below 0.999 — gated both the terminal’s own background alpha and the whole-window vibrancy backdrop. So a user who set terminal opacity to 100%, a completely ordinary choice, silently lost the backdrop for the entire window: the sidebar had no glass, and with no glass the reflection had nothing to light. That is not how the platform works — a sidebar is glass regardless of the content pane beside it, as Finder, Mail and Xcode all show. The backdrop is now a property of the window (a new isBackdropEnabled, on unless Reduce Transparency), and opacity controls only how much of that backdrop the terminal view lets through. At opacity 1.0 the terminal looks identical to before, but the sidebar is now glass — a deliberate trade of the old opaque-window shortcut for the platform-standard look. Second, the reflection could not show structure. It was a single averaged pastel hugging the divider: red and green diff rows blended to mud, a fixed high display-lightness turned dark-red rows into salmon, and the falloff died a third of the way across so two-thirds of the sidebar never lit. It is now two layers — a presence-floored ambient wash of the screen’s aggregate hue so any colour reads through the glass, and a 12-band vertical tell-tale gradient where colour at a given height in the terminal glows at that same height in the sidebar (a red block near the top makes a red hotspot near the top; a green block lower down glows green there). The tell-tale layer uses a lower display-lightness (0.62) and a clamped chroma boost so a red row reads as red not salmon, with per-band alpha proportional to how much of the band is coloured. Both layers share one horizontal falloff, brightest at the divider and now carrying a trace to the far edge, so they read as one light source. This is also the release in which the earlier presence-floor work (any colour clears a floor of 0.70 energy, past the vibrancy threshold) and the alpha-ceiling raise (0.40 → 0.65) actually reach users — every build before this placed them arithmetically below the visible line. 388 tests pass in 29 suites, up from 371, with no user-facing regressions.

Voice dictation could not work, and the reason it could not work was invisible. Dictation did nothing, and Shell Pilot never appeared in System Settings ▸ Privacy & Security ▸ Microphone at all — not even as a denied entry. That second half is the tell: an app that has been refused the microphone is still listed there, switched off; an app that is absent was never asked about, so there was nothing to switch on. Hardened Runtime is deny-by-default over guarded resources, and a process may only reach one if the matching entitlement is present in the signature. com.apple.security.device.audio-input was not, so the request was refused by the runtime before it ever reached TCC — and TCC only creates a permission record when it is actually consulted. No consultation, no record, no row. The usage strings in Info.plist were correct all along, but a usage string only supplies the wording of a prompt the entitlement has to make possible first. The second half of the fix was in the release process. Release builds are signed by hand after a CODE_SIGNING_ALLOWED=NO build, and the signing step never passed --entitlements — so the project’s entitlements plist was never consulted anywhere on the path to a shipped build, and every release went out with hardened runtime and no entitlements at all, including the two declared for SwiftTerm since they were added. Declaring the entitlement alone would have changed nothing a user could see. The signature now carries it, and the release gate fails if it ever stops doing so. This build also carries the ambient-reflection fix that never shipped. It was written as a correction to 1.22.0 but landed an hour after the 1.22.0 DMG was published, so the 1.22.0 people are running is the reflection with the freezing bug — a hard red wash left lit over a shell that had gone back to a bare prompt. A pass that still has somewhere to converge now re-arms 350 ms later with no terminal output required, and the chain stops only once the wash is exactly neutral. 371 tests pass in 29 suites, unchanged — no Swift logic was touched.

The sidebar now catches the colour of the terminal beside it — on purpose this time. Through v1.21.0 the sidebar had no background of its own, so terminal colour leaked through by accident: it only appeared at certain opacity settings, it could not be controlled, and it landed wherever the compositor happened to put it. The effect has been rebuilt as a real, sampled one. Shell Pilot reads the visible cells of the selected session’s terminal — about 1200 of them, resolved through the terminal’s own live palette so a program that recolours itself with OSC 4 is read correctly — discards greys and ordinary body text, weights coloured cell backgrounds above coloured glyphs, and averages what is left in Oklab rather than sRGB, so two hues average to a hue instead of collapsing to mud. Hue and strength are separate: the colour is pinned to a fixed lightness, so only how much of the screen carries colour decides how strongly the wash reads — a make scrolling white-on-black cannot pulse the sidebar. The wash is a clear-to-tint gradient anchored at the divider, drawn behind the selection and hover fills and never over them, capped at 0.40 alpha, held near that peak in a narrow specular core against the divider before it falls away, and added over the split view’s own vibrancy. Background sessions get the same glow, half as strong, on their own sidebar row — a long build glows in the list while you are looking at something else. Sampling costs almost nothing: it is armed from the terminal’s data hook but coalesced onto the run loop at most once every 80 ms, smoothed over elapsed time, republished only past an epsilon, and stopped entirely while the app is hidden. Settings ▸ Appearance ▸ Reflection sets the strength, 0–100% in 5% steps, shipping at 75%; under Reduce Transparency it is not drawn at all. Sampling is armed by output but does not stop there: a pass that still has somewhere to converge arms another 350 ms later, so a screen that goes blank fades out instead of freezing the last colour it happened to be, and the chain stops entirely once the wash is neutral. ⌘Q no longer quits out from under a running command. Quitting now confirms only when a session actually has a live foreground job, listing what would be killed — “2 sessions are still running: build — npm, api — ssh” — with Cancel as the default button, so Return and Escape both cancel. An app sitting idle at a prompt still quits instantly. “Running” means the PTY’s foreground process group differs from the shell’s own, the same question a terminal emulator asks; a job you backgrounded with & does not count. 371 tests pass in 29 suites, up from 355 in 28.

Ask for a command in plain English and get a command line back. Typing #goback — “go back to the directory I was just in” — used to return nothing useful: run-together words were never split, so goback hit the vocabulary entry go and answered with the Go programming language; the catalogue held command names when the real answer is a whole line; and the single-letter entry c matched by substring, dragging clang, gcc and make into any query containing that letter. The # search is rebuilt on all three counts. It segments run-together words (goback → go back, undocommit → undo commit), tolerates typos (gobak, previus), expands synonyms on whole words only — the c entry is gone, and the v1.20.0 known limit with it — and ranks by tokens weighted by how much of the query each result explains, rather than by substring. New: 209 command recipes, concrete macOS-correct command lines paired with several phrasings of the intent, covering navigation, files, search, processes and ports, system health, network, archives, text, shell, git, package managers, macOS niceties, docker and kubectl. So #goback → cd -; #kill port 3000 → lsof -ti:<port> | xargs kill -9; #computer health → uptime, vm_stat, top -l 1 | head; #whats my ip → ipconfig getifaddr en0; #undo last commit → git reset --soft HEAD~1; #disk space → df -h; #extract tar → tar -xzf <file>; #install package → brew install <package>. Tools that do not exist on a stock Mac (ip, strace, apt, systemctl and the rest) are ranked lower for plain-English questions but kept and still found when named outright, because Shell Pilot is used over SSH. Ranking is deterministic and stays under 5 ms. 342 tests pass in 27 suites, up from 321 in 26.

Sessions spent inside a tool are now named after the tool. A session that was nothing but the pi agent used to be titled “Working On Update” — naming neither the tool nor the work. Two causes: an unknown verb fell through to the generic “Working On” headline, and the subcommand word of pi update was mistaken for the subject, because grammar words were only skipped for verbs the analyzer already knew. The commands an agent runs happen inside its own process and never reach the shell, so the launch line is all there is to go on. Now, when the dominant verb of a session has no known activity, the session takes the tool’s name: 31 tools carry a display name — coding agents (pi, claude, codex, aider, opencode, gemini, copilot, cursor, goose, amp), ollama and llm, REPLs (python, node, deno, bun, irb, psql, mysql, sqlite3, redis-cli, mongosh) and TUIs (tmux, htop, lazygit, nvtop) — and anything else is title-cased from its own name. A subject is appended only when it is specific enough to read: pi update → “Pi Agent”, claude --continue → “Claude Code”, ollama run llama3 → “Ollama · llama3”, aider src/main.py → “Aider · main”, python3 scripts/health_check.py → “Python · health_check”. Sixty generic subcommand words are now skipped as subjects under any verb, while ordinary shell work keeps its titles — brew install jq still reads “Installing Jq”. Ties in the activity and verb counts resolve deterministically, so an evenly mixed session no longer gets a different title on identical runs. 321 tests pass in 26 suites, up from 313.

Git, documented in the terminal. The command catalogue gains 48 git <subcommand> pages — init, clone, add, status, commit, push, pull, fetch, branch, checkout, switch, restore, merge, rebase, reset, revert, log, diff, show, stash, tag, remote, cherry-pick, bisect, blame, grep, mv, rm, clean, reflog, worktree, submodule, config, apply, format-patch, am, archive, describe, shortlog, rev-parse, ls-files, gc, fsck, notes, range-diff, sparse-checkout, maintenance and help — each with a usage line, four to ten options and five to eight worked examples, taking the catalogue from 127 commands to 175. Every flag was checked against git <sub> -h and man git-<sub> on git 2.50.1, which also caught two wrong entries on the general git page: --dry-run and --verbose are per-subcommand flags, not top-level ones, and have been replaced with git’s actual top-level set. Help now reads the whole line. The inline description capsule and the man-page panel (auto-show and ⌘⇧M) resolve by longest prefix, so git rebase -i HEAD~3 shows the git rebase page and deleting back to git swaps to the git page — previously any space in the line switched help off entirely. Leading sudo, env, command, nohup, time, nice and VAR=value assignments are skipped. Plain-English search knows git too, with 42 new vocabulary concepts and 13 expanded ones covering undo, amend, squash, staging, stashing, branching, merging, rebasing, conflicts, cherry-picking, bisecting, blame, tags, remotes, diffs, history, worktrees, submodules, the reflog and more. Panel titles now fit two-word names on one line. 313 tests pass in 26 suites, up from 300.

Hotfix. v1.19.0 crashed for anyone whose sidebar tree was rooted at a directory they had reached with different capitalization than the folder has on disk — cd desktop rather than cd Desktop was enough. macOS volumes are case-insensitive but case-preserving, so zsh reported /Users/you/desktop while the directory listing came back as /Users/you/Desktop/…; the tree worked out each child's position by a case-sensitive prefix match that could never succeed, so every child got an empty relative path. That path is a node's identity, so the sidebar drew the same folder over and over, and expanding it nested the root inside itself until the stack ran out. The broken state was then saved, so the app crashed again at every launch. Fixed in five places: child paths are built from the parent's path plus the child's name instead of being inferred, path comparisons resolve to the file system's own spelling, the shell's working directory and restored sessions are canonicalized on the way in (the window now reads ~/Desktop however you typed the cd), the root can no longer be marked expanded, and saved expansion state is sanitized on load — which repairs an already-broken install on first launch. The tree view also refuses to render a node into itself and stops at 32 levels. 300 tests pass, up from 292.

Autocomplete acceptance works again — Right Arrow had been dead since v1.17.0, because our custom ZLE widget was wrapped by zsh-autosuggestions in a way that cleared the ghost text before the widget could see it. Right Arrow is back on zsh's stock accept path, and Tab now accepts too (Settings › Assistance › Accept with Tab). Accepting from the overlay no longer doubles the line. The overlay itself is redrawn: anchored to the caret, one line per suggestion, the typed prefix dimmed, a ⇥ key cap on the highlighted row. Voice dictation is rebuilt after v1.18.0 proved largely unusable — the mic button's text handler lived on a toolbar item that is never created when it collapses into the overflow chevron, so on a narrow window dictation typed into nothing. It now has a microphone picker, a level meter, working permission prompts, genuinely enforced on-device recognition, and shell-aware formatting. The terminal draws at 120 Hz on ProMotion displays (new Settings › Terminal › Frame Rate), closing a running session asks once instead of showing two different dialogs, automatic window tabbing is disabled (it blanked the terminal), and every animation in the app now runs through one Reduce Motion-aware system.

New voice dictation — speak a command and it appears at the prompt. On-device speech recognition, so nothing you say leaves your Mac. Enable it in Settings › Assistance › Voice Dictation, set a hotkey (default ⌃⌥D) and press it to start and stop; there is also a toolbar mic button and a Terminal › Dictate menu item. Dictated text streams into the selected session as keystrokes and never runs on its own — Return stays deliberate. First use asks for microphone + speech permission, and denial surfaces a one-line status in Settings pointing to System Settings › Privacy & Security. Partial results forward as deltas so the prompt never shows duplicated characters.

An interface pass built on macOS 26. The window is now translucent — the terminal background is drawn at an adjustable opacity over a real behind-window vibrancy layer, so your desktop blurs through. Settings › Appearance has an opacity slider and a backdrop picker, shipping at 85%; drag it right for a solid window. Transparency survives the automatic switch to the Metal renderer that happens whenever a full-screen terminal app runs. The sidebar is a real NavigationSplitView, which brings the system sidebar toggle, a resizable divider and the system's own sidebar vibrancy that the old hardcoded gradient was covering up; the working directory moved to the window subtitle so it stops competing with the toolbar for width. The find bar, both suggestion lists, the inline help and the man-page panel are Liquid Glass, and the two suggestion lists now merge into one pane instead of cross-fading as separate cards. Settings is a real ⌘, window with six tabs, replacing the 180° card flip. Scrolling is smooth: deltas accumulate instead of being bucketed into 1 / 3 / 10 / page jumps, so a trackpad tracks 1:1 with your fingers. Autocomplete now accepts with → rather than Return. Reduce Transparency and Reduce Motion are both honoured, live.

If you are on 1.15.1, install this one manually — in-app updating was broken and cannot fix itself. Builds through 1.15.1 shipped in Debug configuration, which embeds Apple's XCTest frameworks in the app; those fail the signature check the updater runs before installing, so every update aborted silently. 1.16.0 is a verified Release build and updating works from here on (it is also 6.1 MB instead of 15.1 MB). This release also switches five features back on that were disabled in every install since 1.14.3 — autocomplete, semantic search, inline help, man pages and smart auto-rename all depended on command tracking that nothing ever enabled. Fixes a hang that would have frozen the app on the first command containing a space, a crash on closing the window after backgrounding, nested shells losing all integration, and the app writing its own install path into your shell startup file. Adds find in scrollback (⌘F) and session shortcuts (⌘T / ⌘W / ⌘1–9). The suggestion overlay no longer steals keyboard focus from the terminal, the toolbar directory label no longer collapses to a sliver, the file tree uses the full sidebar and can drive the terminal, and suggestions stop reshuffling between identical queries. Running the test suite no longer overwrites your real toolbar shortcuts.

Major reliability, performance, and security release — fixed terminal output being swallowed by the hidden-echo filter, escape-sequence forging and the command-tracking payload cap, autocomplete model being wiped on every command, and stale zsh history parsing; SSH injection and remote tree listings hardened (single subprocess, backoff, hidden from history); metrics sampling moved off the main thread and paused when backgrounded; SSH readiness scans only the buffer tail; autocomplete retrains only when history changes; Metal drops to 30 fps when idle; session persistence debounced; semantic-suggestion acceptance no longer corrupts input; suggestions are keyboard-navigable; custom shortcuts can't hijack system keys; updates are codesign-verified; licenses revalidated on launch and stored in Keychain; backend now requires the license key, handles refunds, and prevents open redirects.

Bug fix release — fixed Stripe webhook raw body handling in Firebase Functions v2, fixed license creation race condition, added license status filtering and rate limiting, added CORS headers and input validation to API endpoints, fixed n-gram autocomplete dead code caused by inverted cursor guard, fixed NGramModel async loadModel race condition, fixed remote directory listing for paths with spaces, fixed zsh extended history parsing, fixed semantic suggestion cursor position, fixed space encoding in directory URL resolution, fixed escape sequence parser ordering, and fixed injected SSH bootstrap commands triggering onCommandComplete.

Removed the pill frame from the toolbar's activity indicator and Shortcuts dropdown — the active/idle status dot and Shortcuts menu now sit cleanly in the toolbar without any enclosing capsule.

Battery life release — added Low Power / Full Performance mode, paused background timers when the app is backgrounded or the screen is locked, coalesced metrics publishes, debounced session saves, and gated per-second terminal scrollback copies on active SSH bootstrap sessions. Should eliminate the "Using Significant Energy" warning.

Fixed Metal terminal cursor drift by vendoring SwiftTerm and aligning Metal glyph placement to terminal cell columns.

Fixed Metal terminal cursor drift by vendoring SwiftTerm and aligning Metal glyph placement to terminal cell columns, while keeping the opt-in renderer toggle, CPU fallback, and 60 fps cap.

Fixed sidebar directory tree freeze and flicker — file tree loading moved to background queue to prevent beachball, fixed race condition during filesystem events, replaced LazyVStack with VStack to eliminate layout flicker, and restricted FileTreeWatcher to only run for explicitly pinned codebase roots.

Added independent sidebar text size controls — adjust sidebar font size separately from the terminal via Cmd+Shift++ / Cmd+Shift+- or in Settings. Also added Git commit history viewer in the sidebar directory tree.

Fixed SSH directory tree refresh so the sidebar updates when you change directories on a remote host without exposing background helper commands in the terminal.

Implement SSH directory tree detection — when connected to a remote server via SSH, the sidebar displays a remote directory tree built by parsing ls output in the background when idle. Automatically restores local file tree when SSH connection ends.

Fixed macOS folder permissions — app now uses proper code signing and security-scoped bookmarks so folder access prompts persist across launches

Added update confirmation popover — users are now prompted before downloading and installing updates, with a clear warning that the app will shut down immediately to complete the installation

Enhanced plain text command search with semantic vocabulary expansion and 38+ new macOS commands

Fixed macOS folder permissions — app now uses proper code signing and security-scoped bookmarks so folder access prompts persist across launches

Added plain text command helper

Added the ability for the fire directory tree to auto update when file changes are made in the terminal or elsewhere.

Added Integrated Man Page Viewer

Add command josn discription for when a user types a command a small discription is added under the text

Added advanced machine learning auto complete

Add padding on the left side of the terminal window

added ability to hide terminal session sidebar and fix the resource monitor

Added file structure tree to a sidebar (sidebar 2)

added terminal session activity status to the sidebar

Added a setting menu and abilty to add custom shortcuts

changed UI layout

Basic functionality for Shell Pilot