Baton Changelog: Baton Desktop 0.1.11 — macOS (Apple Silicon)

All releases

Baton Desktop 0.1.11 — macOS (Apple Silicon)

0.1.11 is a consolidation release for interaction modes and agent capability: interaction modes collapse to Agent / Ask / Plan with per-action approvals removed, every turn now carries a project overview and live branch context, MCP tools are admitted by their read-only annotation, Codex interruption and verification are steadier, and the terminal, GitHub workflow, and BYOK image support are all rounded out.

Agent / Ask / Plan: three interaction modes

  • Interaction mode is now the only policy switch; the per-action Auto approval tier is removed end to end, including the "tool approval" row in Settings.
  • Agent mode never interrupts: Codex uses approvalPolicy: never + dangerFullAccess (i.e. --yolo), Claude uses bypassPermissions, OpenCode allows everything and answers always automatically, and ACP runtimes auto-allow.
  • Ask and Plan are read-only by each runtime's own mechanism — Codex's read-only sandbox, Claude denying inside canUseTool, OpenCode deny rules, ACP cancelling non-read requests — not by prompt instruction.
  • Network access stays available in all three modes: read-only no longer means offline, so Ask and the Plan planning phase can fetch docs, reach MCP endpoints, and run git fetch; the network posture follows the /permissions preset.
  • The "+" menu now shows a "Mode" section header above the Agent / Ask / Plan radio group.
  • Follow-up messages queued by an older build that still carried the removed Auto tier are normalized and kept on reload instead of silently disappearing.

The AI knows more about your repository

  • Every turn carries an auto-detected project overview: package manager, package.json scripts, ecosystem marker files, and top-level directories, capped at 1.5KB.
  • The workspace's current branch, base branch, and target branch come from the live workflow status, with the session snapshot only as a fallback; a non-git workspace says so explicitly.
  • New read-only git_log tool (bounded entry count, injection-safe arguments).
  • list_files, find_files, and search_files accept an offset and return nextOffset when the result cap truncates, and report whether depth limited the walk along with total counts.
  • The skill index lists at most 15 entries with an explicit overflow count, truncated descriptions, and user labels.
  • The grep_files alias is removed.

MCP and network access

  • MCP tools are classified by the server's declared readOnlyHint: tools declared read-only are listed in Ask and execute in Plan; unannotated tools stay mutating. openWorldHint no longer vetoes.
  • The built-in web_fetch joins the read-only tools; git_fetch stays mutating (it writes .git).
  • Tool cards no longer show encoded mcp__<hex>__<hex> names — they read as "server / tool", for example exa / web_search_exa.
  • Full Auto no longer adds an extra gate for MCP tools, and a disabled tool returns a readable refusal.
  • Claude Code loads MCP servers itself, so Ask and Plan previously denied every mcp__ tool; the ones declared read-only now work.

Codex

  • Agent mode maps to --yolo (approvalPolicy: never + dangerFullAccess with network); Ask and Plan still force the read-only sandbox.
  • Stopping is cleaner: Stop now awaits turn/interrupt and turn/completed (bounded) before releasing the run, thread/resume retries a busy writer with backoff, and the follow-up prompt no longer fails with already has an active writer; a Stop that outruns turn/start still interrupts the server-side turn.
  • The app-server now answers each request id exactly once, so no duplicate response is sent.
  • The verify lint check runs a real check: the workspace's own package.json lint script when it defines one, otherwise npx eslint . --max-warnings=0 when an ESLint config exists, otherwise an honest skip. A read-only run (Ask, and the Plan planning phase) never runs the workspace's own lint script — it may carry --fix and write files — and keeps only the non-fixing fallback, with the reason stated.

Terminal and GitHub workflow

  • Rename the session branch straight from the branch chip in the header (dialog plus context-menu entry).
  • The GitHub workflow gains an explicit push action showing the destination and sync state, tracks the PR head, moves the branch label inside the split button, and supports multiline tooltips.
  • While that session's AI turn is running, every workflow action shows the disabled "waiting for task" state (the old Create PR queue bypass is removed); the busy spinner inherits the button's ink and the Archive action uses solid violet emphasis.
  • Fixed the rename-branch dialog: if the branch changes elsewhere while the dialog is open (auto-rename, another window), saving no longer renames the new branch back to the old name — the field and Save are disabled and the dialog says the branch changed.
  • Fixed a worktree session where you had checked out another branch yourself: renaming it overwrote the Baton-generated baton/<slug> record, so archive cleanup could no longer delete that branch.

BYOK

  • Image attachments are no longer dropped silently: unsupported or failed images surface an explicit error; the new read-only view_image tool feeds pixels through the model's vision channel; image history is kept by message id so attachments don't leak across turns.
  • If a prior message's image attachment was deleted, or the conversation moved to a text-only model, the attachment is skipped and the text is kept — every later plain-text turn in that conversation no longer fails.
  • read_file can read SVG again (SVG is XML source; it was wrongly redirected to view_image).
  • Saving a model no longer requires passing a tool-calling smoke test first, and stale verified state is cleared when the model id changes.
  • Only worktree-mode sessions treat an empty workspace as unavailable; a local folder may legitimately be empty.

Fixes

  • Composer: the caret now lands after a freshly inserted attachment or @mention chip instead of one chip early.
  • The elapsed-turn timer no longer sticks at 0.0s while the model is only reasoning.
  • Settings: provider name edits are a local draft committed on blur or Enter, and an empty name is never committed; a validation failure on save becomes a readable provider/field summary instead of raw zod JSON.
  • Startup presentation: before the React bundle finishes loading, the window shows a splash with a centered Baton logo — translucent over the native vibrancy on macOS, opaque elsewhere — following light and dark mode and draggable like the window chrome; auxiliary floating and capture windows no longer flash it. The header row's background is also continuous again when the sidebar rail is collapsed.
  • Retired preset models migrate automatically: GPT-5.4 is retired from Codex, so a conversation still on it switches to the default Codex model (GPT-6-Astra) and gets a "the original model is no longer available; switched to the default model" divider; the reasoning effort is clamped to what the new model allows, and retired entries no longer appear in the model lists.

Baton will update automatically the next time you launch it, or you can download the latest version at hecara.com.