What's new

Features and fixes, in plain words. Newest releases appear first. Find the packages behind Fungi on the Open source page.

Fungi 0.6.0 — October 28, 2026

Security

• Oyster’s git door now enforces each key’s App grants: a clone needs App read, a push needs App use.

Making Prints with an Agent

• An Agent can list the saved characters and styles available on its verified Computer before using them in a Print.

• Grove can show a completed tool result’s picture alongside the conversation, including when the tool also opened an image viewer.

• The Prints tool guides an Agent to make panels one at a time, with separate request IDs and one shared composition; its read-back names the result.

• If AI Gateway runs out of credits during video generation, Prints says so plainly instead of offering a retry that cannot work.

• Local distinguishes a provider usage limit from rate limiting, rather than reporting every refusal as an unavailable service.

• A finished Print in Grove offers Open in Prints; a refusal is shown instead of pretending the Print opened.

• Grove offers Open in Prints for each completed panel in an Agent’s result, skipping any panel that was refused.

• Prints uses the same keyboard-driven slash menu in its prompt. When no command matches, Tab and arrows stay with the text field.

• Chat keeps its Caps Send control in place as a run starts and stops.

• Image info puts a Print’s generation facts in labelled rows and groups its actions as equal keys in one panel.

• Prints keeps Activity in the window footer instead of the composer.

• KeycapButton remains a native button that labels its shortcut, with a status light when pressed.

Opening Apps

• Opening an App window no longer repeats the installation-directory read for the same launch; a shared read is reused while it is in flight.

• Oyster verifies a Release once for concurrent requests and retries a failed verification on the next request.

• Oyster serves verified App UI bytes from an edge cache keyed by digest. A failed cache write leaves the next request a miss, not a false hit.

• Tourtois keeps its desktop layout owner while the App directory changes, rather than rebuilding that owner for each read.

• Local answers unchanged Agent profiles from memory and rereads the store after a write.

• A new conversation on standalone Oyster starts through the Agent route: the new Session can be listed and read even when its forwarded response has immutable headers.

• Oyster keeps an App guest warm after a finished frame and runs verified reads together while writes wait their turn.

Goals and delegated work

• A Goal can wait for child work with goal.wait. When a new delegated Session starts with a Goal, that Session adopts it rather than repeating the send.

• When a delegated Session becomes idle, its result is reported to the sender once, even when a later turn finishes the work.

• When the offline prompt slot is occupied, the web composer says one prompt is already queued rather than implying more can be sent.

• Questions can take over an empty chat composer on the web and in the terminal. A non-empty draft is kept, and Esc can leave the question for later.

• Multiple-choice questions in the web composer now show Caps checkboxes for selected options instead of literal checkmark text.

• Tool approvals now appear in the composer with Approve once, Deny and Deny-and-say-why; Always allow needs a separate confirmation.

Finding Fungi and its tools

• The docs front door now routes readers to Shiitake in the terminal, Oyster on their own Cloudflare account, and the Hub for Teams.

• A new guide compares Oyster with Workers Builds, including what the local Oyster trial cannot run.

• The release command now has a resumable final docs-deployment step after the package and App steps. This does not claim that this release is deployed yet.

• The CLI version display says Spore, including --version, so it does not confuse the command’s package version with Fungi’s release number.

• Local reopens the Anthropic sign-in paste dialog when the browser flow needs it, and reports a blank paste as a failure.

• The terminal keeps a draft editable while recovering from a lost connection.

• App menu commands use a typed namespace and id, so a namespace with colons still dispatches the intended action.

• Repeated provider failures show one headline, with the latest raw response available in Details instead of repeated in the conversation.

• The Board is an opt-in terminal program extension. It appears in Open pane and binds its key when that key is free.

Builder tools

• Builder worktree setup now rolls back a failed install or build so the same destination can be retried without treating a partial setup as ready.
• The builder pick list shows work backed by repository evidence. If npm is unavailable, publication is marked unverified rather than quietly landed.

Fungi 0.5.0 — October 27, 2026

This minor release adds offline Agent reply handling, new Prints creation tools, and clearer Local and terminal controls.

Offline Agent work

• When a Computer stays offline, held Agent mail remains in custody for up to seven days. On expiry the sender gets one undeliverable reply; the retry budget does not shorten that window.
• The machine-link receiver accepts one staged reply and refuses duplicate or forged live relay dispositions.

Goals and delegated work

• A Goal waiting on delegated work waits for unsettled child commands, without letting a later turn from an older Goal overwrite a replacement.
• An Agent can resume or clear its own stalled Goal. It cannot override a Goal a person paused.

Approval decisions

• Terminal approval cards now use the shared modal. A person can choose Deny and say why with a bounded, one-line reason. The Agent’s next turn begins Denied by <person>: <reason>: Local calls the person “the user”; Teams use the member ID.

Grove conversations

• Grove shows interrupted turns with a Retry button. When a safe reason is available, it explains why in plain words without exposing credentials or internal IDs.

Making Prints

• The selected model owns its prompt limit. Prints shows the count and refuses an over-limit prompt before sending it for generation.
• Save and rename style blocks or use built-in starters. The selected style is added before your prompt, and its text counts toward the model limit.
• Save named characters and use @name in a prompt to reuse their descriptions and reference images. Prints checks those additions against the chosen model limits.
• GPT Image 2 takes up to 16 reference images; a seventeenth is refused rather than dropped. Its references count at the image-input rate in cost estimates.
• Image info shows the recorded model and reference images and offers actions for making another Print from the image.
• Reuse restores the recorded draft; Remix adds the Print as a reference; Animate starts from it when an image-to-video model is available. Prints explains when a recorded model is gone.
• Prints composer simplified: one row, settings in one tray, and a tap to set each reference’s role.

Terminal controls

• Terminal confirmations for Archive, Remove extension and Stop loop keep the existing choice on Enter; the destructive choice needs an explicit selection.
• Model and Home pickers keep the current choice marked and highlighted in the shared dialog, and the resume and fork pickers join it with a time column; sign-out defaults to Keep, and raw IDs stay out of the choices.
• Alt+D opens dialog details while you are filtering a picker or typing an answer.

Local extensions

• An old Local extension registry is archived rather than loaded. A foreground notice appears once and names the extensions without showing their stored credentials.

Upgrading Local

• On an upgrade, Fungi archives only home Agent stores and extension activations that the current readers refuse. Readable files and earlier archives stay in place.
• If an older Local service is running, Fungi stops it before archiving. It does not stop a current service just because the home has no version marker.
• On an ordinary CLI command, Fungi reports “Upgraded …” once and names any archive path. When old extension records are set aside too, their notice names extensions without revealing saved sources or credentials.
• Interim upgrade from published 0.2.1: Fungi opens in a new project. The old project still refuses its incompatible Agent store with one plain, path-specific line and leaves the store untouched; existing Agents and Sessions are not migrated.

AI Gateway media

• Flux 2 images and first-frame image-to-video work with Oyster’s AI Gateway configured. Stream and frame inputs go directly to Workers AI; compatible inputs still use the gateway.

Oyster Agent keys

• Security — BREAKING: Named Oyster keys now need an explicit agents.use grant covering each Agent they access. Keys issued before 0.5.0 no longer have Agent access. To restore access, the owner must issue a replacement key under a new name with the required Agent grants.

Standalone setup

• The standalone Wrangler example connects Prints to the account AI Gateway by default.

• Standalone hosts can use an Agent’s own store for a host-provided Channel binding. One visitor turn reaches the Agent; replay does not add a second turn, and changed, suspended or unmapped work is refused.

Fungi 0.4.1 — October 26, 2026

App boots and builds

• App boot checks start their short-lived capability lease after loading the page’s asset metadata. Slow metadata checks no longer use up the page-check window.
• When a Computer’s build result is unknown, the App build stays running so a later builder report can finish it. A build that expires without a result becomes retryable as interrupted; a definite refusal fails rather than waiting for expiry.
• Failed App source builds report bounded, redacted diagnostics, including up to two causes when the builder provides them. The failure is not reported as a successful build.

Installing starter Apps

• The Trellis package now includes the source files that a packed Bonsai App imports, rather than depending on files from a sibling checkout.
• Bonsai’s Tailwind source path now points inside its installed Trellis package, not to the neighboring Trellis source checkout.
• A failed starter App no longer stops Oyster from seeding and installing the other Apps in the set.
• Oyster’s install-apps command reports installed and failed Apps, prints a final count, and exits non-zero if any App failed. Its packaged CLI bin now dispatches to that handler.

Command approvals

• Approve once is the default on a command approval card; Enter approves just this request. Always allow appears only when a reviewed command prefix is available and saves a rule only when you choose it. Deny remains available.

• A saved Always allow git commit rule can now also match a direct git commit -am "message" command. Shell-form commands do not get an Always allow offer; they still ask once.

• The approval card offers Always allow only when the rule it would save can match the reviewed command, and shows what that rule covers. Otherwise, Details explains why no reusable rule is available. The project-hook warning stays visible before you answer a hook-capable Git approval, even when no rule is offered.

Choosing a model

• If no signed-in model provider is available, Fungi points first to your own Claude or ChatGPT subscription: use /login in a Session, or fungi login --provider anthropic --auth-type oauth for Claude or fungi login --provider openai --auth-type oauth for ChatGPT in the CLI. Hosted Fungi sign-in is offered second.
• Fungi account, Team and balance commands still describe your hosted Fungi account. Signing in to a separate model provider does not sign you in to hosted Fungi.

Fungi 0.4.0 — October 26, 2026

Before you upgrade

• Existing Local Agent conversations from 0.3.x are not readable in this version. The Local Agent store format changes alongside the service protocol change from 3 to 4. There is no migration; this version refuses the old stores. Keep a copy before starting fresh.

Agent permissions

• Full access runs commands as you, without the sandbox. It can use your files, network and credentials on Linux and macOS. Choose it with --yolo or --full-access; --workspace and --read-only select the sandboxed modes instead. An unavailable sandbox refuses those modes rather than silently running commands with Full access.
• On Linux, Workspace can write your Agent’s folder and temporary files, use the network and reach ssh-agent. Existing package caches selected from your host environment can be writable too; project settings cannot add writable cache paths. Fungi’s own cache stays protected.
• On Linux, Read-only commands can write only temporary files. They cannot write the project or package caches, use the command network or reach ssh-agent.
• On macOS, Workspace and Read-only now have different Seatbelt profiles. Workspace commands can write the Agent’s folder and temporary files; Read-only commands can write only temporary files. Neither profile grants network access, writable package caches or ssh-agent access yet.
• Read-only refuses file edits, patches and writes. It tells the Agent to switch to Workspace to edit, instead of asking you to approve an edit.
• Approve a command that needs more access. A sandboxed Agent can ask permission to run a command outside the sandbox. Approving runs that command once; answering the same request again does not run it twice.
• Workspace protects existing Git administration, including a linked worktree’s Git directories, from ordinary sandboxed writes. Git changes need an approved command or a matching Always-allow rule outside the sandbox.
• Always allow saves a narrow command prefix, not permission for all Git commands. A git push rule does not allow git commit. Git rules apply only to the protected repository and reviewed options; they reject local-path remotes and options that can widen the command. Shell-form commands never match a rule.
• Rules are shared by Workspace Agents in the same project; Read-only Agents do not use them. A matching command runs without another approval card. Use fungi permissions list and fungi permissions remove '<json-prefix>' to inspect or remove rules.
• A saved rule still runs code as you, outside the sandbox. Git approval cards now warn that project hooks can run under the grant. An Agent can create missing hooks at an already configured hooks path or change a writable fsmonitor hook. A push grant can also force-push or delete remote branches. The warning explains that risk; it does not prevent it.
• Extension-install approvals no longer offer Always allow. An Agent’s fungi extension add command cannot reuse a saved rule. Enabled extension code runs in the Local service, outside the Agent sandbox; treat it as code you trust with your credentials and every Agent on that service.

Live updates

• A model request that stops responding ends with a timeout instead of hanging indefinitely. You can send another message in the same conversation; failed assistant turns are not sent back to the model as conversation context.
• Watching a conversation no longer makes every watcher recalculate its context-use figure. The figure is reused until that conversation’s history changes, and an older calculation cannot replace a newer one.
• Updates in one conversation no longer wake unrelated idle conversation watchers. When an Agent becomes available, only its queued conversations need the activity update. A queued conversation also keeps an update received while it is catching up on history.
• An Agent waiting for another Agent now waits for the requested command’s result, rather than watching and rebuilding its conversation. Completion, failure and cancellation are returned for that exact command, including over HTTP. Stopping the wait does not cancel the work.

Release notes

• Fungi has its own release number, separate from Oyster and the other packages. Release notes have source references for their individual claims, with behavior, descriptions and known issues recorded separately.
• Release review builds a clean proof checkout before checking claims. Corrected older entries are checked against their original release, not today’s code. A historic review stays valid when Integration advances only if the reviewed entry, claims and original release stay the same.

Known issues

• The sandbox does not hide all your readable secrets. Both sandboxed modes hide Fungi’s credentials and service record, but files such as ~/.ssh and ~/.aws remain readable. Web, MCP and delegation tools are outside this command sandbox.
• Long-running Local service freezes remain under investigation. The live-update fixes above are not a promise that every cause has been removed.
• The terminal’s service-recovery notice can keep the conversation covered when you press Escape.

Sandbox startup

• Native helpers are verified once when the Local service starts. Agents share the service’s verified private copies instead of rechecking installed helper bytes for each command. A missing, tampered or mismatched native package refuses service startup before discovery, even without selecting a sandbox mode.
• Startup reports the native package problem with the exact reinstall message: Fungi's native package for <platform-arch> is missing or doesn't match this version. Reinstall: npm i -g @fungi.computer/spore@<version>

Fungi 0.3.2 — October 25, 2026

A security and fixes release: Oyster 0.3.2, Spore 0.2.1, Truffle 0.2.2 and Knapsack 0.2.1, plus patch releases of the packages that depend on them.

Security

• Spore refuses to start if its own CLI or launcher JavaScript lives inside the Agent’s project or Git’s internal folders, or has another hard link. It won’t run without protection instead. This check does not cover other host JavaScript.
• Spore stops loading an Agent project’s Bun settings and .env file into its own process.
• An Agent can no longer point your own Git at a folder it controls. The sandbox now protects each repository’s .git/commondir file. When a repository has none, Fungi writes one that contains just ., which means the same thing to Git as having no file, so your Git works as before.
• Oyster’s MCP server asks for confirmation before an MCP client changes a Workspace’s Computer, and the client can say no. Knapsack has a new confirmCalls option for the same behavior.

Fixes

• The sandbox starts quickly in big repositories. It asks Git where the repositories are instead of searching every folder, so a large project no longer fails with “Sandbox Git discovery exceeds 100000 directories”.
• A standalone Oyster refuses requests from an unexpected address before it sets anything up, and says how to fix it.
• An Oyster App’s build status shows only that installation’s jobs.

Fungi 0.3.1 — October 24, 2026

A fixes release: Oyster 0.3.1, Computer 0.2.1 and Cordyceps 0.3.1, plus patch releases of the packages that depend on them.

Fixes

• An Oyster first set up on 0.1 or 0.2 now says its data comes from an older Oyster, instead of showing a plain server error. The old data is left untouched, and the Oyster README has the steps to start fresh.
• Cordyceps 0.3.1 fixes the Linux arm64 cross-build of the bubblewrap sandbox helper, and the release now builds that helper for every Linux target; the built helper ships in Spore’s Linux native packages.

Fungi 0.3.0 — October 23, 2026

Highlights

• Use your own subscription in the terminal. Install Spore from npm, run fungi in a project folder, and choose a Claude or ChatGPT subscription to sign in without a Fungi API key.
• Answer an Agent’s approval request. Approval cards in Grove let you approve or refuse a request from the conversation. Unanswered requests expire after a day.
• Link your own machines. Connect a computer you own to Fungi with a one-time key. The link reconnects after a restart; signing out closes it.
• Build an App from its repository. A standalone Oyster builds on its own Computer, not a disposable build Computer.
• Build a Team App on one of your Team’s Computers.
• Use oyster install to install a built App Release without starting a new build.
• A standalone Oyster warns when an installed App’s screen check failed or could not be run.
• Start a published workflow later. Trellis workflows retain their installation target when scheduled.
• An authenticated webhook can start your published workflow.
• Arrange your terminal. Choose a named pane layout and place a pane beside or below the focused pane.
• Search terminal lists by approximate match.
• An explicit update restart waits for a composer draft checkpoint before it resumes.
• Press Up in an empty composer to recall a queued message before sending it.

Also new

• One home for all the docs: every guide and every open-source package lives here, and old links still work.
• Access keys move into the shared Settings screen’s Keys section; model keys keep their own page.
• In Prints, choose a video size supported by the model before generating it.
• With cloud browsing set up on your standalone Oyster, your Agent can use a hosted browser.
• Hosted cloud browser use is billed by time used.

Fixes

• Disabling an App now stops its work right away instead of finishing the request in progress first.
• An expired Team key is refused as a sign-in problem, not reported as a service outage.
• A workflow’s Git access lasts only for its running command; Fungi checks that access again on every request to the Team.
• Choosing a reserved Team handle like “admin” is caught in the form, before you submit.

Known issues

• If Spore is installed inside the system temporary folder (/tmp) on Linux, Agents can’t edit files with the patch tool. Normal npm and npx installs are not affected. A fix follows in a 0.2.x patch.
• An Oyster created on 0.1 or 0.2 can’t be upgraded in place to 0.3, and 0.3.0 answers with a plain server error. Its data is left alone. Start a fresh Oyster or stay on 0.2.x.

Package changelogs

The details for developers live in each package’s changelog: Oyster, Shiitake, Spore and Truffle. Every other package is on the Open source page.