Trust Mode

A fourth security level in the composer, at the far end of the dial, for when you have decided to let an engine finish a job and do not want to be asked again. It answers every approval request from every engine with no card: writing and deleting anywhere its shell can reach, pushing, publishing, merging a pull request, resolving a thread on GitHub, and a request to widen this app's own permissions. Entering it asks you to confirm once, and tells you what you are turning off.

What it does not change. Commands the app runs unattended stay sandboxed. Every answer still appears in the transcript, naming the level that gave it. And nothing is remembered: the level writes no rules and touches none of the ones you made, so leaving it takes every answer back from the next request onward.

A question a model asks you still comes up as a card at every level, including this one, because there is no answer the app could invent on your behalf.

Auto Mode can ask a model before it asks you

Set an OpenAI API key in Settings, and a shell command Auto Mode cannot place inside your repository goes to a model for an assessment instead of straight to a card. If it comes back safe enough, that one call is allowed; anything less, an error, or an unreadable answer still shows you the card. Nothing is remembered either way, and every assessment appears in the transcript with the result it gave.

What never reaches the model: any program the app already has a rule about, so no assessment can allow curl, sudo, git push or a package install; anything whose arguments reach outside the repository; and any command line carrying something that looks like a credential. Leaving Auto Mode while an assessment is in flight withdraws its authority — the card comes back.

This does nothing until you set the key. Assessments are also written to a diagnostic log in your temporary directory; the switch for that is in Settings, beside the key, and it is on.

Far fewer approval cards with Claude Code

A cd or a PATH= in one command used to leave every command after it in that thread asking for approval, on the assumption that the shell carried on. It does not: each call gets a fresh shell at the repository root. Commands after one of those are now answered by the rules of the level you picked, like any other. A cd within a single command line still counts, because there the shell really is shared.

Fixed

Switching between pull request branches in the review panel could spin the app into a beachball and then quit it without warning. The inspector still keeps its width across a thread switch, as before.

Requires macOS 26 with Apple Intelligence, and claude, codex and agy installed on your login PATH and logged in.

Acqui Agents is now Kulula. Same app, new name and icon.

If you have Acqui Agents installed, this update will not reach it on its own. Download the image below and install Kulula by hand, then drag the old app to the Trash. Your threads, settings and approval grants are picked up automatically on first launch, and updates after this one arrive the usual way.

You choose how much the broker answers for you

A security level in the composer sets what gets approved without a card: Always Ask, the default, through Auto Mode, which answers anything confined to the workspace. Switching back to Always Ask also cancels any standing permission an engine is holding on its own, so the level you picked is the level in force. Permission escalations, pull request merges and releases always ask, at every level.

Shell commands are granted by what they run

Approving a command once no longer leaves a rule that a differently-spelled version of a different command can slip through — a grant now covers the program and the paths it touches, not the text you approved. Commands that only read need no approval at all. Every grant stays listed and revocable in Settings.

Review loop

• The findings picker shows what is still open, and keeps up as findings close.
• A fix you completed stays marked fixed.
• When Auto Fix cannot start, it tells you why and offers to create the branch instead of stopping without a reason.

Threads

Switching to another thread and back no longer loses the transcript or what the inspector was showing.

Requires macOS 26 with Apple Intelligence, and claude, codex and agy installed on your login PATH and logged in.

Approval grants

Standing "always allow" rules for tool calls, commits, pushes and GitHub comments — scoped to a tool and the exact paths it can touch, granted only from a click on the confirmation or card that would otherwise have asked. Revocable from Settings, which lists every grant in force. An auto-approved call still shows up in the transcript, naming the rule that allowed it.

Commit and Push

Their own buttons above the findings list: Commit drafts a message and previews it before running, Push confirms the destination first. Auto-push cannot be granted without auto-commit, and revoking commit revokes push with it.

Auto Fix

Runs fix → build → test → commit (and push, if granted) unattended, inside whatever the workspace already allows and granting itself nothing further. Stops on a round cap, a deadline, a failing build or test, or a round that changed nothing. With re-review on, it waits for the findings to actually arrive rather than declaring victory immediately.

Findings tracking

Findings from review comments, replies and review bodies are tracked individually and survive a restart. Threads resolve automatically once their findings are fixed and reopen — reappearing as unseen — if GitHub shows them reopened.

Question card

Claude's AskUserQuestion is now answered properly instead of being silently reported to the model as unanswered.

Safety hardening

This release closes a long list of races between the picker, the checkout and an in-flight approval, commit or push — the kind that let an action land on the wrong pull request, the wrong branch, or (for a fork-backed PR) the wrong repository entirely:

• Fix, Confirm, Commit and Ship all verify live, immediately before acting, that the checkout is really on the selected pull request's own branch and descends from its known head — not a same-named branch from an unrelated fork or history.
• A push destination is checked against the pull request's actual repository, including its host, right before the push subprocess runs — not just once, earlier.
• Stop reliably cuts off in-flight approvals: a standing grant or auto-allow decision made microseconds before Stop can no longer still reach a cancelled turn.
• Auto Fix cancels cleanly when its workspace is removed mid-run, and its own findings poll now actually respects its deadline instead of blocking on a slow network call.

Also

• The app icon and logo artwork were redrawn.

Per-thread model selection

Each thread can now pick the model its engine runs, instead of inheriting one global choice.

• Models are discovered from the engines at runtime (claude, codex model/list, agy models) rather than hard-coded, so a newly released model appears without an app update.
• The choice is persisted per thread and survives a restart. Changing it reopens the engine session so the next turn actually runs on the new model.
• Controls live in Settings (the default for new threads) and in the composer (this thread). A leading @provider:model mention overrides both for a single turn.
• Settings inheritance and "use the engine default" are distinct states, so changing the global default no longer silently overwrites a thread that asked for the engine's own default.

Codex model handling

• model/list is paged; every page is read before the list is treated as complete, so models past the first page are no longer invisible.
• A pinned model that the CLI has since retired is detected before the turn starts and demoted to the advertised default, with the resolved choice written back to the thread and the transcript metadata.
• Custom Codex model entries are restricted to models the CLI actually advertises.

Also

• The app icon and logo artwork were redrawn.
• Distribution moved to the public ricruss/acquiagents repository; the update feed and downloads are served from there.
• Documentation: current UI and layout, the self-hosted development loop, and how Codex permission approvals are answered.

First release of Acqui Agents: one chat window for Claude Code, Codex and Google's Antigravity CLI, routed by Apple's on-device model, with approval cards for every tool call and a pull request review loop in the inspector.

Requires macOS 26 or later with Apple Intelligence, and the claude, codex and agy command line tools logged in.