Released versions only, generated at build time from the product Keep a Changelog file. Unreleased work is not listed here: if it is not in a version heading, it has not shipped.
Latest released v3.23.4 · · 61 releases
Currently downloadable v3.25.2-preview.1 · preview channel
Those are two different questions. This page lists versions that have been released, from the product changelog. The download page serves whatever the live preview channel points at, which moves ahead of the last released version with every build. Download the current build from /download. Channel and exact version always come from the live release manifest.
Releases 1–5 of 61
Page 1 of 13
nala version. Installed copies no longer fall back to 3.20.0 and repeatedly offer their own release; missing build metadata is reported explicitly as 0.0.0 instead of silently impersonating an old version.nala update honor that marker after an explicit environment override, so installations from the temporary Railway hostname continue receiving preview notices without weakening origin validation.npm audit --omit=dev.nala update now consume the same strict preview/stable release manifest as the download site, pin the selected version, enforce bounded downloads plus exact byte length and SHA-256, verify Authenticode or macOS trust when the release claims a signature, and launch only the validated native artifact. Update checks stay non-blocking and installation remains an explicit two-step user action.NALA_UPDATE_ORIGIN remains available for HTTPS staging and loopback tests.nala desktop --agent as the combined Desktop-with-active-agent choice advertised by the installer.task_id path-traversal guard (ORCH-008a). taskDirLayout/taskPromptRelPath (A2A reliability file-backed task store) joined task_id into a filesystem path with no validation. The only current caller always mints a safe UUID-based id, so this was latent rather than exploitable today, but any future caller passing a raw id could have escaped .nala/tasks/ via ../path separators. Both now reject empty ids, .., path separators, and null bytes.install.ps1 printed a blank/garbled Authenticode failure reason (CLI-013). The abort path referenced $_.Status/$_.StatusMessage (unbound outside a catch block) instead of $sig.Status/$sig.StatusMessage, the actual signature-check result two lines above.readFileSync for a runtime require('../../../../package.json'), but esbuild bundles every CLI module into one file, and after bundling __dirname resolves to the bundle's own directory (dist/cli-bundle/ / resources/cli-bundle/) for every merged module, not each module's original source path — so the relative require still found nothing in a packaged install. Fixed properly by injecting the version at CLI-bundle build time via scripts/build-cli.js (new — mirrors the already-correct scripts/build-mcp.js esbuild define pattern) as process.env.NALA_VERSION; nala version / nala doctor read that first, falling back to the require only for the dev/vitest path where it's genuinely reachable. Verified against the actual bundled output copied to an unrelated directory (not just the dev tree).nala version's daemon column always showed "(unreachable)" even when the daemon answered. It read ping.version, but daemon.ping has never returned a version field — only spawnedByVersion (see src/daemon/index.ts). Now reads the field that actually exists./crew, /scout, /ship, /review, /operate, /brief, /afk, /stow, /recover; daemon MissionSupervisor + crew.* RPC; progressive skills; status-bar Crew shortcut (hide ≠ disable). Does not alter YOLO. Not always multi-agent — one worker when enough.existing_agent_subscription / byok_api / local_model / nala_managed / hybrid_with_approval), machine-enforced free-product boundary (free routes cannot open credit reservations), integer microdollar credit ledger with reserve/settle/idempotent payment grants, managed inference estimate + receipt types, offline-safe cloud control-plane stub. Core local/BYOK use stays free; NALA charges only for optional NALA-hosted services. See docs/product/NALA_FREE_PRODUCT_CONTRACT.md and src/shared/nala/managed/.nala speak, TUI /speak, bark play fallback); STT via daemon portable faster-whisper host (nala dictate --wav); cross-client speech claims; speech sanitization policy; nala voice status|test; doctor voice section; Pi nala_speak tool. Live mic capture helper and daemon Kokoro deferred (Desktop PTT/Kokoro remain for highest quality).career-profile, direct-job-search, tailored-cover-letter, application-prep) plus a Pi coordinator (/apply, /jobs, /career-profile, /application-review) and shared deterministic library under src/shared/nala/jobs. Supports resume ingest (including minimal DOCX OOXML), hard criteria vs preferences, direct-employer / ATS discovery filters (Indeed/LinkedIn excluded as final destinations when requested), cover-letter factuality gates, form field plans with voluntary demographics left blank, and a review queue that never auto-submits. Synthetic portal fixtures cover Greenhouse/Lever/Ashby/Workday-style forms, CAPTCHA blockers, and expired postings.kimi / kimi-code binary, YOLO via --yolo when NALA policy allows, optional -m model selection (including Kimi K3 when the runtime exposes it), plan mode via --plan, and Windows KIMI_SHELL_PATH injection when Git Bash is present. No second YOLO switch.docs/missions/NALA_PACKAGED_DOGFOOD_AND_RUNTIME_MISSION.md, packaged dependency map, managed Node 24.18.0 policy, Windows dogfood protocol, and Windows/macOS signing decision docs. Canonical NodeRuntimeResolver + integrity-gated managed installer (no PATH mutation). missionCapability context builder, MCP tool map, permission preview, and spawn-path enforcement via the evaluator (YOLO preserved). MCP registration writes absolute Node when resolved. nala doctor reports node source/version, capability health, and signing mode. scripts/verify-packaged-resources.mjs + packaged self-test helper. Signing modes: dogfood unsigned vs release fail-closed (NALA_SIGNING_MODE).scripts/mission-baseline-harness.mjs under docs/missions/. Runtime Mission 2: hidden-pane retention default on, leading-edge PTY/daemon batching, 15s liveness, snapshot force backstop, lazy Playwright connect, packaged hook bridge paths, detector/OSC hardening, windowed notifications. Mission 3: shared rpcHelpers, src/shared/atomicWrite, unified logSinkCore, renderer nalaRpc helper, nala method-set contract test. Mission 5.2 pure capability intersection evaluator. Mission 7.1 FanOut per-task prompts[]. SystemProfile gains agent concurrency tip, scrollback lines, watchdog RSS soft ceiling. Gate: passed with limitations; release decision: blocked pending packaging dogfood/signing (see docs/missions/08-release-decision.md).SystemProfile, F2.1/F2.2). src/shared/systemProfile.ts profiles host CPU count + total RAM once per process and derives a low/medium/high tier. PTY pool cap (PTYManager.MAX_PTY_INSTANCES), spawn-scheduler concurrency (SchedulerService.DEFAULT_LIMITS.maxConcurrent), and the default scrollback ring-buffer size (daemon/config.ts bufferSizeMb/bufferMaxMb) now scale with the tier instead of a fixed constant. Medium tier matches the prior fixed values exactly, so typical hardware sees no behavior change; a low-end device (≤2 cores or ≤4GB RAM) gets a smaller pool/buffer instead of thrashing under workstation-sized ceilings, and a high-end machine (≥8 cores and ≥16GB RAM) gets headroom to use more of it.nala on PATH after every install. The Squirrel install/update hook now writes a nala.cmd shim next to the existing wmux.cmd (<root>\bin, already PATH-registered), so nala works from any terminal and directory — bare nala opens the agent, nala desktop / nala sit open or focus the full app, exactly as the site's install one-liners advertise. Launching from the home directory, its parent, or a drive root prints a peer-CLI-style warning ("⚠︎ NALA works best when run in a project directory…") and continues.…/logs/diagnostics/diag-YYYY-MM-DD.jsonl) for boot, memory pressure, renderer-gone, child-process-gone (GPU/utility), unresponsive, and uncaughtException/unhandledRejection — with RSS/heap/free system memory, never PTY text or tokens. Complements the daily main-*.log tee so a hard kill still leaves something greppable. Heartbeat interval only logs when under memory pressure (healthy runs stay quiet).~/.wmux/tts-cache (F9.3). Kokoro / transformers.js downloads are pinned to a NALA-owned directory (instead of scattering across package-relative + HF hub caches with no ceiling). After each successful model load, stale Kokoro dtype siblings (other model_q* / model_fp* weights) are pruned when the tree exceeds ~1.5 GiB, while the active dtype is protected so the next speak does not re-download it.src/shared/safeJson.ts is the single reviver used by company templates, configIO, PipeServer, DaemonPipeServer, and DaemonClient — the CHANGELOG promise to "manage in one place" is now actually landed for the hot parse paths..buf dump when the DATA-007 canonical-path fallback was used. Previously only the persisted meta.bufferDumpPath was unlinked, so fallback-restored sessions left their scrollback dump behind on disk.0.0.0 (CLI-008). nala version and nala doctor resolved the version by reading package.json from disk relative to the bundle, which fails in packaged installs; the version is now inlined into the CLI bundle at build time.main/index.ts now also accepts nala-icon.ico when icon.ico is missing, so the taskbar icon registrars can no longer disagree.nala-agent provider button (and every other ProviderLogo render site: Settings, launch cards, approval dialog) previously drew a made-up italic "n"; it now renders the actual >n mark from the desktop/app icon (assets/icon.svg) as currentColor strokes, so it inherits the button accent in every theme.CompanyTemplateManager used readFileSync / readdirSync / writeFileSync from async pipe RPC handlers (company.save / company.restore / company.templates), so listing N templates cost N sync reads on the main process (IPC dispatch + PTY forwarding stalled for the duration). Fully async via fs/promises, with parallel load on list. Corrupt JSON is now logged instead of vanishing silently; oversized import files throw (the size guard used to collapse into a null that looked like "not found", defeating the security check).AppendOnlyLog fd; main before-quit explicitly stops DaemonNotificationRouter / RemoteInboxBridge / WorkspaceContextRouter / bark bridge (previously only cleaned via onUninstall, which DaemonRespawnController.dispose() skipped) and disposes the metrics aggregator; TUI adapter closes its poll timer after app.run().src/company/main/ and src/company/mcp/ had no live importers — the production paths are src/main/company/* + src/main/pipe/handlers/company.rpc.ts and src/mcp/index.ts. Deleting the forks ends the second CompanyTemplateManager / WorktreeManager / PID-walk that had already drifted from the real implementations.TimeLimitEnforcer.recordActivity re-armed the idle timer without the onIdleExceeded callback, so a long-running delegation could run forever once any activity was recorded. The callback is now stored on the timer and re-bound on every reset.canDelegate() now atomically claims the single half-open probe slot (previously multiple concurrent callers could all pass before startHalfOpenTest()).redeem() is now raced with a 120s timeout so inFlight always clears.resetKeys remounts cleanly; budget resets after 5s of healthy render.ptyProcess.write() in the SessionPipe input path was unguarded — an EPIPE from a dead PTY threw synchronously and could kill the daemon (taking every other session down with it). Now logs a warning and continues.registerHandlers's teardown was calling removeHandler(IPC.RPC_INVOKE), opening a gap during daemon reconnect/respawn where renderer invokes failed with "No handler registered for 'rpc:invoke'" (16 occurrences in one production log) instead of the graceful {ok:false} response the handler itself returns while the bridge is down. The register site already removeHandler-then-handle's, so re-registration never double-registers — the teardown-side removal was unnecessary and harmful.scrollback:dump wrote every open terminal's buffer synchronously (atomicWriteTextSync) on the renderer's 5-second crash-safety tick. Now writes asynchronously, with in-flight coalescing per surface so a slow disk can't stack up overlapping writes to the same file — a dump that arrives mid-write replaces the queued payload instead of racing a second concurrent write.squirrelShortcuts.ts) that retargets any NALA.lnk with a dead target, a target inside a versioned app-*\ directory, or a missing icon back to the version-independent stub launcher.registerSessionLifecycleRpc.ts's state-dir resolver and the credential vault's storage dir fell back to process.cwd() when NALA_STATE_DIR was unset; the packaged daemon can spawn with cwd=C:\WINDOWS\System32, which is not writable. Both now fall back to getWmuxHomeDir() instead.SchedulerService.tick() awaited each redeem() call inside its dequeue loop, so maxConcurrent never had any effect — the next launch couldn't start until the previous one finished. Now builds and starts every eligible proposal in a wave before awaiting any of them, so redemptions genuinely run in parallel up to the configured limit.require('./relative-module'), which is invisible to the Rollup bundler that packs the main process into a single-file bundle — the call resolved relative to the bundle's own directory in production, where the target file doesn't exist, threw MODULE_NOT_FOUND, and was swallowed by a best-effort catch. Converted to static imports (all three modules are side-effect-free at load time, so there's no added per-launch cost).dist/cli-bundle/index.js: (1) the nala banner read its wordmark .txt assets from __dirname at module load, but they were never copied next to the bundle — ENOENT killed every nala-routed command; the build now ships them and a missing asset degrades the banner instead of aborting. (2) update-signed was statically imported and its module graph requires electron, which throws under plain Node/ELECTRON_RUN_AS_NODE — now lazily imported only when update --signed actually runs.expiresAt draft/pending proposal to expired; list()/listPendingApprovals() now reap them lazily on every read.taskRuntimeSec age) rather than the full boot-time recovery path, since the latter also resets every still-alive agent's session status and would wrongly clobber a live agent if run on a plain timer with no actual restart/suspend.