한국어Download

Changelog

What changed in each version, from the repository’s CHANGELOG.md, as a headline and short points per change. The newest version is at the top.

Ave starts at 0.14.0; earlier versions belong to its predecessor app.

v0.14.0

2026-10-16

  • Ave’s website and distribution addresses
    • The website is ave.agent-connector.ai; downloads and updates come from downloads.agent-connector.ai.
  • Ave’s identifiers and paths
    • App ID ai.agent-connector.ave, data folder ~/.ave, environment variables AVE_*, link scheme ave://.
  • Extension authors move to host protocol 3
    • Protocol 3 uses the ave/* wire and is the only protocol Ave supports.
    • Re-vendor the contract (contract/) from the app’s release tag, declare requires.hostProtocol: "3" and requires.minAppVersion: "0.14.0" in the manifest, and publish again.
    • Extensions built for protocol 2 are rejected before they start.
    • This version’s protocol schema is published as schemas/plugin-host-protocol/3/v0.14.0/protocol.schema.json.
  • A signed contract bundle to download and verify
    • Each release publishes, at https://downloads.agent-connector.ai/contract/v0.14.0/, the plugin contract source, the manifest schema, the protocol 3 schema, the marketplace checker and the agent-plugin component extractor, with bundle.json, SHA256SUMS and its Sigstore signature.
    • The release workflow makes the signature, so extension authors and marketplaces can check manifests and the protocol with this bundle, without Ave’s source.
    • A tag’s files never change once published. (#113)
  • Plugin contract identifiers moved to the Ave domain
    • Ave-specific plugin.json fields live under extensions["ai.agent-connector.ave"]; a package’s prompt, agent, hook and routine files go in an ai.agent-connector.ave/ folder.
    • A skill package’s $schema is https://ave.agent-connector.ai/schemas/skill/1/skill.schema.json; the manifest and marketplace schemas are published under https://ave.agent-connector.ai/schemas/plugin/3/ and https://ave.agent-connector.ai/schemas/marketplace/2/.
    • The earlier address (sdk.former-site.invalid) is not recognised.
  • Every extension runs in its own process
    • The same for every install path: marketplace, custom source, folder or direct install.
    • With the OS sandbox on, an extension that reached the network without hostFetch is blocked; one that used home-relative paths or internal app APIs fails on those calls and needs an updated version.
    • Diagnostics show each extension’s process and isolation state.
  • On Windows, extension work runs inside the sandbox when it is on
    • Extension child processes, workers, hooks and MCP servers run inside the Windows sandbox.
    • Windows does not isolate extensions from one another, and the app says so.
    • Extensions that start their own executable through a process entry still do not run on Windows.
  • Model facts come from the bundled model catalog
    • Context window, image input and tool support come from the catalog and what the provider reports, instead of a hand-kept table.
    • Some models may show a different context size and compact at a different point.
  • Skills load when needed
    • The prompt carries only each skill’s name and description; when the agent uses a skill, skill_load reads its body and shows it in the conversation as a tool result. (#83)
  • The agent’s file and shell tools changed
    • A file must be read before it is edited, and a file that changed after it was read must be read again.
    • Paths that apply_patch changes go through permission review.
    • Reading a long file returns what fits and where to continue.
    • A cd in the shell carries over to the next command in the same conversation, and a running command’s output appears in its tool card as it arrives.
    • Background processes a sub-agent started end when that sub-agent ends. (#72)
  • Search, web and memory tools are built in
    • File search runs on ripgrep.
    • web_fetch returns a page as Markdown and marks its content as untrusted data for the model.
    • memory_search, memory_read and memory_delete let the agent find and read what it remembers, and withdraw a memory it proposed by mistake.
    • Images returned by MCP tools reach the model as images, not base64 text. (#72)
  • Project instructions and command files
    • From the repository root down to the project folder, each folder’s AGENTS.md (or CLAUDE.md when that is missing or empty) is read as instructions.
    • Markdown files in <project>/.ave/commands and <Ave home>/commands become /<name> commands; a built-in command wins a name clash.
    • /model changes the model for this conversation only, or returns it to default. (#72)
  • Repeated prompt prefixes are read from cache
    • The time, environment and memory notes that changed every turn moved out of the system prompt, and Anthropic requests carry cache breakpoints.
    • OpenAI and Azure Foundry receive the session ID as the cache key.
    • Compaction summaries stay in the conversation, and /compact <focus> says what the summary should keep.
    • Earlier conversations move to the new format when they are opened. (#72)
  • Suggestion cards gather in a Suggestions conversation
    • Suggestions from extensions, alerts and routines no longer break into the open conversation.
    • A card can continue in a new conversation; the Suggestions conversation cannot be archived, and comes back empty if deleted.
    • Onboarding suggestions still show inside the conversation. (#57)
  • Chat input and the conversation view
    • Pasted text up to 500 characters goes into the composer as is; longer text becomes a chip that opens to the original (the first 32K characters shown, all of it sent).
    • Code blocks show their language and a copy button.
    • Up and Down recall earlier input, and each conversation keeps its draft.
    • Attach files by dropping them or with @file; Enter does not send while Korean input is still composing.
    • Long conversations no longer rescan the whole history every turn. (#70, #82)
  • The workspace terminal shows command blocks
    • Each command’s location, exit code, duration and output form one block, which can be attached to the chat.
    • The agent reads terminal output in the same window with terminal_read, as untrusted data.
    • On macOS a sandboxed terminal shell controls only its own terminal device, so commands are not echoed twice, job control such as Ctrl-Z and fg works, and other terminal windows are out of reach. (#59, #106)
  • Side-panel browser and multiple windows
    • Downloads in the side-panel browser go through the system save dialog and are never saved or opened automatically; full screen is not allowed.
    • Several main windows can be open; approvals and questions appear in the window that asked, and answering in one closes the copies in the others. (#60)
  • Terminal and web panels in the main area
    • Open terminal and web panels in the main area beside the chat, and move them between the side panel and the main area without reloading.
    • Split the main area into up to four panels; move panels by dragging the header or with keyboard commands, maximise them, or reopen a closed one.
    • The first window’s panel layout comes back on the next launch: terminals reopen in their last folder with a new shell, pages at their last address.
    • The side chat works on the terminal or page last brought into view.
    • A shell’s notification sequence (OSC 9, OSC 777) marks that terminal as asking for attention, and Cmd/Ctrl+Shift+U goes to it; inside a terminal, AVE_TERMINAL_ID names its own tab. (#104)
  • The agent works browser pages directly
    • In the conversation’s window, the agent reads side-panel and main-area web pages (browser_snapshot, browser_screenshot) and clicks, types, presses keys, navigates, and opens and closes tabs.
    • Page content reaches it as untrusted data, and it never types into password, payment card or verification code fields.
    • Actions that change a page ask on an approval card, and a tab you opened asks per site even to read it; approvals last until Ave restarts, per site or within the tabs the agent opened, and page-changing actions in a tab you opened ask every time.
    • Tabs and panels the agent opened carry a marker and a stop button; clicking or typing in the page yourself stops pending actions, and navigating with the address bar, back, forward or reload ends the agent’s control.
    • Routines and headless runs do not use the browser tools. (#102, #114)
  • Remote connections are steadier
    • Remote A2A shows the other agent’s answer and follows the task to the end.
    • The app starts and reports status even when an enabled gateway is not ready; a gateway that failed to start shows as failed rather than off, and one whose settings changed shows as waiting for a restart.
    • Telegram confirms the connection to the phone that used the pairing code, reconnects after wake or network recovery, and keeps to rate-limit waits.
    • Tailnet errors show on collapsed rows too, and --serve keeps running when Tailnet does not start. (#86)
  • Permission checks changed
    • Shell commands that send file contents over the network (curl uploads, remote scp or rsync, nc and the like) count as high risk and always ask, in every mode.
    • A damaged permission rules file blocks instead of being ignored.
    • Approvals are remembered per scope rather than per exact call: web_fetch per scheme://host:port for public addresses, and only the exact URL for private-network addresses.
    • When the arguments change within the same scope, the call is reviewed again and goes through without asking only when its risk is not higher. (#88)
  • Cost chip and audit statistics fixed
    • The cost chip of a model without price information says “pricing unknown” instead of “TBD”.
    • The Audit tab in Settings counts permission records by decision, such as allowed or denied, and its top types no longer show undefined. (#106)