Gentle AI v4.3.1 is a minor release over v4.2.0. It supersedes the v4.3.0 tag, whose release run stopped in preflight on an untidy go.mod before publishing anything; v4.3.0 has no release or assets. Gentle Shell now installs, manages and updates from the TUI on Linux, macOS and Windows: Linux stable delivery lands with its own installer experience, macOS gains TUI installs with CodeGraph and Main preview, and every platform updates only the components that changed while keeping operator state. It also adds the GitHub Copilot CLI agent adapter, advances the reviewed boundary on acknowledgement, and fixes a Windows upgrade regression that would have hidden existing Gentle Shell installations. The provider contract stays byte-frozen at 1.4.0.
Provenance
- Previous stable:
v4.2.0→4acaf4241beae1e0c977c92dfe406a270f8d40de - Release target:
v4.3.1→2dba7784114fff57864519c4c0d067e952a8c98b - Release workflow: run 40559437366
- Verification: preflight, release, and verify jobs all succeeded.
- Provider contract:
1.4.0
What's new
Gentle Shell on Linux
Linux stable delivery begins with an opt-in installer UI. The TUI hands the embedded installation off after restoring the terminal, binds preference profiles to a physical confirmation, stages private canonical preferences before bootstrap, and composes verified private installation and MCP stages. Root installs require an explicit opt-in with a typed risk warning, and the private kernel check names its refusal causes.
Included work: #5558, #5559, #5562, #5563, #5564, #5567, #5570, #5574, #5582, #5585, #5596, #5644, #5730 (issue #5727), #5716 (issue #5713).
Gentle Shell launchers and PATH
Installs publish the gs and gentle-shell launchers, report occupied names instead of overwriting them, and show the publication result and a PATH hint on completion. ~/.local/bin is put on PATH after the launcher is published, and install.sh and install.ps1 put the gentle-ai install directory on PATH.
Included work: #5742, #5743 (issue #5740), #5760 (issue #5758), #5759.
Gentle Shell from the TUI on macOS
The TUI installs Gentle Shell on macOS and applies canonical preferences, installs CodeGraph on macOS arm64, and installs and switches to the Main preview SDK. The existing-Pi target sets Pi's own fd/rg aside and restores the agent exactly on uninstall.
Included work: #5748, #5752, #5754, #5756.
Scoped updates that keep operator state
Installations record component pins and the update check compares them, so an update or a Manage toggle rebuilds only the components that changed and reuses the rest. Channel-only changes swap the SDK in place on Unix and overlay it on Windows, and operator state is carried across rebuilt agents and Windows updates.
Included work: #5776 (issue #5775), #5778 (issue #5777), #5719 (issue #5718), #5695.
GitHub Copilot CLI adapter
GitHub Copilot CLI joins the agent catalog with its own adapter.
Included work: #5656 (issue #273).
Acknowledgement advances the reviewed boundary
Acknowledging an approved review now advances the reviewed boundary, so the next review starts from the acknowledged candidate.
Included work: #5654 (issue #5638).
Breaking changes
No breaking changes are declared for v4.3.1. The module path stays at /v4, the provider contract remains byte-frozen at 1.4.0, and no review CLI flag changed. Installed Engram protocol and orchestrator guidance changed (high-risk item 1 now covers only data that cannot be rebuilt), so run gentle-ai sync.
Upgrade now
brew upgrade gentle-ai
gentle-ai syncWindows and other source installs:
go install github.com/gentleman-programming/gentle-ai/v4/cmd/gentle-ai@v4.3.1
gentle-ai syncRun gentle-ai sync after upgrading so managed agent, reviewer, and runtime assets match the installed binary, including the updated Engram protocol and ODD routing wording.
What was fixed
Upgraded Windows Gentle Shell installs stay discoverable
The component pins added to the Windows manifest had no omitempty, and the manifest reader requires the on-disk bytes to equal their canonical form. A manifest written by v4.2.0 would no longer validate, so an upgraded Windows installation disappeared from Manage, Update and Uninstall. Every pin is now optional in the serialized form, and a regression test pins the pre-pin layout. This had not shipped in any release.
Included work: #5785 (issue #5784).
Gentle Shell install, reconfigure and provenance
Unix installs are registered and unlaunchable publications are refused before any effect; the existing-Pi target fails before mutation and restores on failure; the Unix channel overlay is verified like a fresh Main install and unwinds fully; Manage applies component changes with the selected profile. On Windows, managed reconfigure can replace the installation, the reconfigure intent reaches the worker, and the confirmation stays publication-bound. Supervisor provenance accepts user-private-group ancestors and binaries and reports the cause when it refuses, the private kernel check tolerates unrelated nsfs mount entries, and a refused Main publisher response is named instead of opaque.
Included work: #5753, #5750, #5749, #5751, #5755, #5681, #5692, #5728 (issue #5726), #5697 (issue #5696), #5702 (issue #5701), #5706 (issue #5705), #5734 (issue #5733), #5757, #5731.
npm provisioning bounds and private umask
npm provisioning was killed at a fixed 180-second deadline; the outer install bounds now derive from the npm provision budget. Private global provisioning pins umask 022, and the Engram download directory stays traversable under a strict umask.
Included work: #5707 (issue #5704), #5717 (issue #5714), #5686 (issue #5685), #5622 (issue #5620).
Windows PATH and Git for Windows layouts
The Windows user PATH keeps its registry value kind, expanded PATH entries are matched, and GGA admits the ucrt64 and clang64 Git for Windows layouts.
Included work: #5625 (issue #5581), #5632, #5783 (issue #5782).
Review
The committed-range base derives from the branch upstream first, and artifact path admission skips host:port literals. The published review-integration/v1 schemas required rctx1_ repository-context handles while the runtime emits rctx2_, so consumers validating against them rejected valid output; the pattern now admits both. Authority mutations refused for outdated managed assets now return a typed refusal whose narration matches the agentless continuation.
Included work: #5635 (issue #4639), #5765 (issue #5624), #5677 (issue #5255), #5540 (issue #4379).
Agents, permissions and guidance
Kilo Code routes delegated work to native subagents; existing Claude deny rules are preserved; Claude allows xhigh effort for Sonnet; GGA keeps configured providers during install and sync; the Engram protocol documents mem_save content as a single JSON string; CodeGraph worktree placement is disambiguated for nested layouts; and routing's high-risk item 1 is limited to data that cannot be rebuilt.
Included work: #5260 (issue #5254), #5629, #5639 (issue #5603), #5626 (issue #5556), #5663 (issue #3698), #4151 (issue #3927), #5683 (issue #5682), #5684.
Tidy go.mod for the release preflight
A Linux PTY test imports github.com/charmbracelet/x/term directly while go.mod still listed it as indirect, so the release preflight's module-immutability check refused the v4.3.0 tag. It is now a direct requirement.
Included work: #5787 (issue #5786).
Numbers
248 non-merge commits, 79 merged pull requests, and 7 unique GitHub PR authors since v4.2.0.
Install
brew install Gentleman-Programming/tap/gentle-aior
go install github.com/gentleman-programming/gentle-ai/v4/cmd/gentle-ai@v4.3.1Windows remains supported through the Go installation path. Official Windows binary archives and Scoop publication remain unavailable; Windows upgrades fail closed to Go-based guidance rather than downloading unsigned binaries.
Signed platform archives below: linux_amd64, linux_arm64, darwin_amd64, darwin_arm64, with checksums.txt and its minisign signature.
Full changelog: v4.2.0...v4.3.1