What changed in each release

Hooks Tools

Your commands run before and after tool calls, prompts and sessions. A hook can stop a call; it cannot approve one the gate refuses.

mnemo schedule Agents

Run a prompt on a timer. A scheduled run is read-only unless the job says it may act, and its logs are redacted.

A code index Tools

code_* tools over a per-project index (tree-sitter, embedded in the binary) for TypeScript, JavaScript, Python, Rust and Go. Calls are tied to a definition only when the code says which one. It can be switched off per project.

Language-server diagnostics after an edit Tools

The result of an edit shows the compiler's errors, so the agent sees them at once.

Skills from marketplaces Tools

mnemo skills installs a plugin's skills from owner/repo, an https git address or a folder. Nothing runs on install, and a skill whose files changed after install does not load.

/remote Interface

A read-only view of the session on this machine only, with a token for each start. Off until the remote setting allows it.

Plan mode can ask Interface

Plan mode tells the model it is planning, and an ask_user tool puts a question to you.

--model, and settings for limits and compaction Interface

maxTurns, subMaxTurns, subSpend, autoCompact, compactReserve and compactKeep.

Faster start Install and update

Every command used to take about 400 ms because one bundle held everything; pi, Ink and the memory client now load only for a session.

A folder's resources live in .agents/ Tools

Skills, hooks and extensions are read from .agents/ instead of pi's .pi/.

An allowlisted environment Safety

Commands and MCP stdio servers get an allowlist, not your whole environment. MCP over HTTP stays off unless the server's entry says allowNetwork.

Egress rules Safety

net rules test the host of a command, a Python cell and an MCP HTTP server; cloud metadata addresses are refused in any spelling unless a rule allows them.

A managed policy Safety

An administrator's file that user and project settings cannot widen: models, tools, MCP servers and a mode ceiling. A broken file fails closed.

Deny rules hold inside the Python tool Safety

An audit hook asks before a cell starts a process or opens, removes or renames a file. It is a filter, not a sandbox.

No network habits of pi's Safety

No ripgrep or fd download, no model catalog, no attribution headers: Mnemo calls only your provider and the places you name.

The gate filters; it is not a sandbox.

mnemo --rpc Interface

Mnemo as JSON lines for an editor or another front end. A tool call that would ask becomes a dialog the client must answer; nothing answers for it, and a client that disconnects leaves every question answered no. Protocol in docs/RPC.md.

VS Code extension Interface

A panel with chat, approvals with diffs, agents, memory and every setting, with its own themes. If Mnemo is missing or older than 0.1.8 it offers to download this release, checks it against SHA256SUMS and keeps it in its own storage.

MCP servers as tools Tools

Servers from ~/.mnemo/agent/mcp.json (and a trusted folder's .pi/mcp.json) load as tools, found with tool_search so their schemas stay out of a small model's prompt. Every call goes through the permission gate, with an always grant per tool.

A dollar budget for a prompt Safety

A prompt that crosses it stops, sub-agents' calls counted. A -p run prints one line of calls, tokens and dollars on stderr.

/rewind covers shell commands Tools

In a git repository it now puts back what bash and Python cells changed, not only the agent's own edits.

Nothing a folder chose runs before it is trusted Safety

A downloaded folder can no longer run a command through core.fsmonitor, a git hook, or (on Windows) a program named like a system one.

Recalled memory is data Memory

It reaches the model inside a boundary a fact cannot close, marked as data, and is scanned again on the way out.

Secrets and symlinks Safety

A project's .env, private keys and .netrc are refused by the read tools; a grant for git --version no longer allows git push; an approved write is refused if its path became a symlink while the question was open.

The extension's download and launch code has not yet been run inside a real VS Code.

/settings Interface

A menu of everything you can tune: type to filter, enter to change. /settings hops 20 sets one in a sentence, /settings reset undoes them, and mnemo settings does the same from a shell. Choices are kept in ~/.mnemo/config.json, and a value that does not fit is refused with the reason.

Agent limits you can set Agents

The message chain (12), the woken-turn budget ($0.50), sub-agent depth and counts, message length and rate, held messages, and how long message_agent waits for a reply. 0 for the budget means no message ever starts an agent.

Rebindable keys Interface

Fourteen chords: the palette, sidebar, find, expand, clear, thinking level, hub, playground, project switch, new agent, split, next layout, and previous and next agent. The footer, the ? panel and /help show the chords you set; a key the prompt needs for editing, or one another action holds, is refused.

Look and feel Interface

Animation, the launch sequence, whether the sidebar starts open and how wide it is, the split layout, wheel speed, expanded output, and how long toasts stay.

Behaviour you can turn down Tools

Learning after runs, the check after changed code, the escalation model and how many failed checks it takes, how long a Python cell may run, the desktop notice and its delay, and the daily update check.

No setting loosens the gate Safety

The default mode can be default or plan, never yolo or accept-edits. Values are checked against fixed ranges, flags and environment variables still win for a run, the model has no tool that changes a setting, and an edit to config.json from the agent asks like any file outside the project.

Animation, the launch sequence, the sidebar's starting state, the default mode, the desktop notice and the update check are read at launch.

Keys that belong to one screen (the hub's l and u, the sidebar's panes) are not rebindable.

Ask and wait Agents

message_agent with wait holds the question open for up to two minutes and returns the reply as its result, so an agent can ask a sibling something and use the answer in the same turn.

Messages between agents appear in the conversation Interface

Marked ✉ with who sent them and 'another agent, not you', so an agent that starts on its own shows why. The playground feed says when a message woke an agent or was held.

Type to a running sub-agent Agents

In a split, alt+, and alt+. move through every pane, sub-agents included. A focused sub-agent pane has a prompt: what you send reaches it after its current step, as your words.

Links survive a restart Agents

Two projects you linked are linked again when both are open, in a later run too. Unlinking is remembered.

A conversation view in the playground Interface

c shows the selected agent's messages with one other as a thread; tab goes to its next partner.

A message wakes an idle agent Agents

A sibling or sub-agent no longer waits for you to prompt the agent it wrote to: the agent reads it at once and can answer, and the answer wakes the sender in turn. You no longer have to ask 'did you get it?'.

Your messages stand out Interface

What you typed is drawn on a raised band with an accent rule down its left, not just after a ❯.

Sub-agents join the split by themselves Interface

A sub-agent that starts while its agent is in the split takes a free pane, or the pane of one that finished. ctrl+s fills spare panes with the active agent's sub-agents.

A sub-agent whose model call fails says why Agents

It used to finish 'without an answer' and no reason. Now the tool fails with the model's error, so you and the parent agent can see it (a rate limit, say).

A chain of messages is bounded Safety

Each message counts one more than the one that led to it. After 12 in a row since you last prompted, messages wait for your next prompt, so two agents cannot keep each other busy, and spending, forever. The agents page shows '✉ 2 waiting for you' on the agent holding them.

An allowance for woken turns Safety

Turns that messages start may spend $0.50 per agent until you next prompt it. The call that crosses it stops the turn and the agent waits for you, so siblings left talking cannot run up a bill.

The spending allowance counts what your provider prices: a local model that reports no price is bounded only by the chain of 12 messages.

Links come back when both projects are open; Mnemo does not open a linked project for you.

In yolo mode, a message can now start an agent working without you: it runs commands the way any yolo turn does. In the other modes, its edits and commands still ask you.

Sub-agents can start sub-agents Agents

Down to three levels, four at a time per agent and sixteen per conversation. A read-only agent can only start read-only ones. Give one a name with spawn_subagent's name field.

Sibling agents Agents

Press l on one agent in the agents page, then l on another, and the two can see what the other is doing and message each other. A sub-agent can reach its parent's siblings. u unlinks. Only you can link agents; no tool can.

list_agents and message_agent Agents

A message is delivered as another model's text, not yours: it grants nothing, does not skip the receiver's approvals, and never starts a turn on its own.

Split layouts, never more than four panes Interface

alt+l cycles columns, rows, grid and main + side. f in the agents page splits an agent with its linked agents and its busiest sub-agents, and the bar says '4 of 9' when more are related. A sub-agent is a read-only pane.

The playground (ctrl+y) Interface

Every agent, sub-agent and message between them, live, to supervise. It cannot steer: no prompt, no stop, no message. Enter takes you to the agent.

The agents page draws the tree Agents

Each card says who it is linked with and how many sub-agents it has; below, the selected agent's family as a tree with each sub-agent's task and steps.

Who may message whom is enforced in code; what agents write is cleaned and redacted Safety

Control and bidirectional characters are removed and credential shapes redacted before anything an agent writes is shown or delivered. Limits on size, rate, depth and fan-out. See SECURITY.md.

Sub-agents are watched, not typed to: you talk to top-level agents only.

A message never wakes an idle agent, so a sibling reads it at its next prompt.

Links last for the session; they are not restored when Mnemo restarts.

The website is built and checked on every pull request Website

Agents page: n starts a new agent, s and ctrl+s split the chosen agents Interface

n then Enter used to jump to the first agent. Ctrl keys also fired the page's single-letter keys; they no longer do.

esc during a running tool says Interrupted Interface

It said "The operation was aborted."

An approval no longer covers the form of a command that runs something else Safety

A grant for git bisect, git submodule, npm install, bun add, cargo install or go get is for the plain subcommand. git bisect run, git submodule foreach, git filter-branch and installing a named package are asked about each time.

Plan mode no longer writes to memory Safety

memory_remember and memory_steer are refused in plan mode. Reading memory still works.

The Windows binary is not code-signed, so SmartScreen may warn on a browser download.

Keys typed in the first second after the prompt appears can occasionally be dropped.

The binary reports its version to MCP servers as 0.0.0.

Memory: distrusted is a difference, not a ratio; skill nodes are global by label; a write that times out on the client can still be applied later.

A downloaded mnemo.exe installs itself on Windows Install and update

It asks once, copies itself and memsrv.exe to %USERPROFILE%\.mnemo\bin and adds that folder to your user PATH. mnemo install [--yes] does the same without a question.

mnemo doctor checks memory Install and update

It starts the sidecar, times its answer, and names the embedder and the log file. It warns when the mnemo on your PATH is a different file from the one running.

A changelog, download, roadmap, security, privacy, terms and shortcuts pages on the project site Website

The Windows instructions lead with irm https://mnemo.atmanmishra.dev/install.ps1 | iex.

Remote embeddings are opt-in Memory

Set MNEMO_EMBED_URL and MNEMO_EMBED_MODEL. An OPENROUTER_API_KEY alone no longer sends memory anywhere, and the sidecar starts without your provider keys.

Subscription /login works in the downloaded binary Install and update

On v0.1.0 to v0.1.2 it failed with Cannot find module './anthropic.js'. Bedrock models and image reads failed the same way. Release builds now fail if a flow would not load.

Memory no longer reads off after a while Memory

The footer shows off only when the memory sidecar is not installed. Installed but slow to answer is busy, and the last count stays.

mnemo uninstall on Windows removes everything at once Install and update

A running mnemo.exe is moved out of the install folder, so the folder and, with --deep, the data folder go immediately. What it cannot remove is named and the exit code is 1.

Esc with a message queued no longer crashes the screen Interface

The message goes back to the prompt. A login waiting on the browser can be cancelled with esc.

mnemo -p exits 1 when the model call fails Tools

It prints the reason. It used to exit 0.

A malformed grants.json no longer switches the gate off Safety

It fails closed. Plan mode is no longer beaten by an allow rule.

Deny rules resist wrappers Safety

Quotes, sudo -u, env -u, bash -e -c, eval, timeout, xargs and find -exec no longer get around them.

The agent's tools cannot read the process environment, .env, models.json or grants.json Safety

Memory redaction catches more credential shapes Memory

hf_ and ya29. tokens, Basic and Digest auth, webhook URLs, *_PASS= and "password is".

The Windows binary is not code-signed, so SmartScreen may warn on a browser download. The irm | iex and Scoop paths avoid it.

Keys typed in the first second after the prompt appears can occasionally be dropped.

git bisect run, git submodule foreach and npm install* grants are not yet covered by the gate's option checks (see SECURITY.md).

mnemo update Install and update

Installs the latest release with the same checksum-checked installer as the one-liner. --check only says whether there is one; /update does it from inside Mnemo.

A daily update check, off by default Install and update

mnemo update --auto on tells you at launch when there is a new version and never installs on its own.

mnemo uninstall, and --deep Install and update

Removes the program and keeps what it learned. --deep also deletes ~/.mnemo (memory, sessions, credentials, skills, logs, settings) after you type delete. The install scripts do the same: --uninstall / --deep, or MNEMO_UNINSTALL=1 and deep on Windows.

Installers that draw themselves Install and update

On a terminal: the wordmark, a pulse per step with the download counting up, and Mne at the end. Plain lines when piped or with NO_COLOR.

Provider API keys stay out of commands the agent runs Safety

Bash, the Python kernel and best-of checks start without the model-provider keys. MNEMO_PASS_ENV=NAME hands one back.

A bounded Python kernel Safety

A timeout per call (up to 600 s), stopped by esc, and an 8 GB memory cap on Linux.

Rewind Agents

esc esc on an empty prompt (or /rewind) goes back to an earlier message: the conversation, the files the agent edited since, or both. A checkpoint is taken before each edit.

mnemo memory tidy Memory

Finds duplicate facts and pitfalls, facts about files that are gone, and what you marked wrong. --apply retires them.

Recall weighs trust Memory

What helped ranks higher; what you marked wrong twice is no longer recalled. In the memory pane + and - vote, e edits, d forgets, and Recalled this session lists what came back.

Your own embedder Memory

MNEMO_EMBED_URL and MNEMO_EMBED_MODEL point search at an Ollama (or any OpenAI-compatible) embedding server. The address must be https or local.

ctrl+k: one list of commands, agents, sessions and files Interface

ctrl+f finds in the conversation; ctrl+o expands output that was already printed Interface

/resume shows titles, cost and how each session ended, and searches everything said in them Interface

/stats: this session, the last seven days, and which tools failed Interface

Clickable links Interface

File paths in tool calls and links in answers open from the terminal (OSC 8). MNEMO_LINKS=0 turns it off.

A desktop notification when a long turn ends or an approval waits while you are in another window Interface

MNEMO_NOTIFY=0 turns it off.

Full-terminal animations Interface

The launch, the introduction and the goodbye screen fill the whole window. Engram, the dither field Mne settles out of, also appears in the welcome card and the empty transcript.

Eleven themes (/theme) Interface

Mnemo Night, Dracula, Nord, Gruvbox, Tokyo Night, Catppuccin Mocha, Synthwave, Amber CRT, Game Boy, Paper, Solarized Light. Each is checked for readable contrast.

The mouse wheel scrolls the conversation Interface

/mouse (or MNEMO_MOUSE=0) gives selection back to your terminal.

mnemo doctor --fix Install and update

Tightens permissions on Mnemo's files, sets a broken settings file aside, and reinstalls a missing memory sidecar.

Every screen fits the terminal, at any size and across resizes Interface

A long answer streaming in quickly could crash the workspace Interface

The error was "Maximum update depth exceeded".

On Windows the installer can replace a running mnemo.exe Install and update

So mnemo update works from inside Mnemo. The PowerShell installer also forces TLS 1.2 and no longer crawls behind PowerShell's progress bar.

A fresh install made ~/.mnemo readable by other users Install and update

It is now private (mode 0700).

Stale height measurements left a gap or an overlap in the workspace after a resize Interface

The Windows installer and the Windows build of the new features have had less real-machine testing than macOS and Linux. If something fails on Windows, run mnemo doctor and open an issue with its output.

The background curator (a model that tidies memory and proposes skills while you are away) is not part of this release. It lives on the feature/background-curator branch.

Engram variations in the boot sequence and the welcome card Interface

Engram in the empty transcript, a dither while the model thinks, and a pulse while it writes Interface

The project site at mnemo.atmanmishra.dev Website

A prerendered page with a working demo for every feature, neutral light and dark themes, and figures from Hairline.

The release script installs dependencies before its checks, shows why a check failed, and gives the app tests the timeout CI gives them Tools

The --demo --dump frame now waits for the turn it dumps Tools

The terminal agent Agents

An Ink interface on the pi SDK: transcript with diffs and tool output, a multi-line prompt, slash commands, @file mentions, dialogs, sessions and compaction.

Memory that learns Memory

A local journal in a Rust sidecar (memsrv). After each run Mnemo writes down what it learned, recalls it next session, steers on failure and keeps the fix.

Memory for other agents Memory

mnemo memory ingest, setup claude-code and setup codex share the same memory with Claude Code (hooks) and Codex, Cursor and opencode (MCP).

Skills Mnemo writes and revises for itself Tools

A Python kernel and in-process sub-agents Tools

Best-of-n attempts in separate worktrees, and escalation to a stronger model after failed checks Agents

Several agents in one window Agents

A hub, split view and a project switcher.

Permission modes: default, accept-edits, plan and yolo Safety

Plus permissions.json rules, per-project grants and an approval dialog. /yolo and /accept-edits toggle the last two.

One-line installers and release archives you can verify Install and update

SHA-256 checksums, GitHub build-provenance attestations, and manifests for Homebrew and Scoop.

Permission-gate bypasses found in a security review are closed Safety

Deny rules look through spacing, VAR=x prefixes, directories, sudo/env wrappers and sh -c; allow rules end on a word and never cover a compound command; accept-edits stays inside the project.

Memory-layer issues found in a security review are fixed Memory

Facts that look like instructions are refused at write time, and recalled items are labelled as candidates, not facts.

The installers and the release workflow were hardened after a supply-chain review Install and update

Pinned actions, truncation-safe scripts and a downloader check.

Pre-alpha: expect rough edges, and check the permission mode before you point it at a repository you care about.