Features
-
MCP resources and prompts — Agents can now list and read what an MCP server publishes besides tools: resources such as guides and schemas, and prompts such as reusable playbooks. Four new tools cover this on Claude and Pi sessions. A source that offers either says so once in the session, together with the server's own instructions.
-
Shared project notes stay complete — Agents add to a project's memory with a new append-only tool instead of rewriting the file. A session that rewrote it from its own outdated copy dropped notes other sessions had added meanwhile.
Improvements
-
Stop ends only the reply — Stopping a reply no longer kills the background agents, workflows and commands it started. They keep running and report when they finish, as in Claude Code.
-
Browser control that works on hidden windows — Clicks, keys and dropdown selections reached the agent's browser only when its window had focus, which it rarely has. Clicks on tabs, cards and menus were often ignored, and dropdown options couldn't be selected. They now work on hidden windows. A click on an element that is covered, or that the click never reaches, falls back to a direct element click, and the agent is told why.
-
Current screenshots of hidden browser windows — Screenshots of a background window could show an old frame. The window is now briefly shown, invisibly, to render a fresh one; on Linux it is moved off-screen instead.
-
One sign-in for parallel sessions — When several sessions need the same sign-in, one serves them all. Sessions waiting on the same source share one login: clicking another session's card joins the sign-in in progress instead of opening a new window, and finishing it resumes every session that was waiting. Google, Slack and Microsoft sources refresh an expired token before asking you to sign in again. Browser windows that open the same website sign-in share one popup, since they share cookies.
-
Fewer false security checks — Ordinary dropdowns, page changes, consent pages and error screens no longer trigger "security verification detected". A check now needs clear signs of a real challenge and is confirmed a moment later, and the window comes forward when you actually need to act.
-
Quieter browser output — Annotated screenshots list the elements on screen in short lines instead of about 15,000 tokens of data. Network and console logs no longer include the app's own requests or the previous site's. Text with apostrophes, like "Don't", works in browser commands.
-
Passwords stay out of transcripts — Passwords the agent enters in a browser are no longer echoed in its output, and they are replaced with a placeholder in the stored transcript, exports and shared copies.
-
Reading guides with shell commands counts — Reading a source or browser guide with
catorheadnow satisfies the "read the guide first" check, not only the Read tool. -
Task subtasks generate reliably — Generating subtasks for a task timed out after three minutes, every time. It now uses moderate thinking, writes the plan without exploring the project, and only gives up on a turn that has stopped making progress.
Bug Fixes
-
Interrupted task steps no longer count as done — Stopping a step to steer it marked it done with no output, and the next steps started without it. A stopped step now waits for you and finishes with the reply that completes it. Steps that wait on their own background agents finish only when those agents report, and every dependent step now receives the reply of the steps it depends on.
-
Clear message for attachments that are too large — Sending files over the size limit used to fail with "Connection lost". Sizes are now checked before sending, with a message that names the file and the limit.
-
API keys sent the way you entered them — An API key saved under a header name other than the source's default went to the server as text like
{"x-goog-api-key":"…"}and failed to authenticate. It is sent under the name you entered again. A service-account JSON is still never split across headers.