1.0.0

published 29 October 2026

The Computer tool reads a screen as a short numbered outline and acts by row number, so a model finishes a desktop task in a handful of calls instead of dozens; Mercury serves its own tools to other agents over MCP; and mercury tune trains a model on your own sessions and installs it locally. Local images and video run on x64 Windows and Linux, with SDXL and Pixel Party XL, reference images and masks, your own checkpoints and LoRAs, and ControlNet with batches and palettes; a project's MCP servers start only once you approve them, the update notice is yellow and stays until you update, and a repository's own git helpers never run inside Mercury's git commands. Every model reads documents, the Document tool writes them, and a run sends less with each request, makes fewer requests and asks less often in flow mode, with every capability kept; Mercury leads with the answer and acts on a result in the turn it arrives. Fixes land for small local models, headless runs, crewmates, /compact, and /imagesetup and /localsetup on Windows.

• Added the Computer tool's outline: tree and find return numbered rows, an act names ref: 7 instead of pixels, root: scopes a read to one dialog, a result's second line says what is on the screen after the act (changed · now: window "…" · focus …), an ambiguous target lists its candidates and nth picks one, wait takes a text, a window title, a URL or gone: true, and read returns a labelled value or the clipboard under its own card; a desktop task that took 44 calls takes 7 (docs/COMPUTER-USE.md)
• Added Mercury as an MCP server: mercury mcp-server serves run, session rows, sessions, send and recall to any MCP client over stdio or token-protected HTTP on the loopback, so another agent can hand Mercury work and read what it did (docs/MCP-SERVER.md)
• Added mercury tune: export your own sessions as a scrubbed training book, have a model write the reasoning for each turn, train an adapter on a rented GPU through /llmhost with a money pause that never terminates the machine, bake your charter into the chat template and install the result into the Bank for /localsetup; the page states the developer's own results plainly (the mercury-tune extension's TUNE.md)
• Added local images and video on x64 Windows and x64 Linux: /imagesetup pulls the Vulkan build of the runtime, or the CUDA 12 build on Windows with an NVIDIA card, and the runtime row names the build (docs/MEDIA.md)
• Added document reading on every model: a PDF opens as numbered text with page markers, and pages gives page pictures on an image-capable model; office documents keep their headings, lists, tables, notes, comments and formulas; scanned pages and images read through the system's OCR (macOS Vision, Windows OCR, an installed Tesseract), Arabic among the languages; Grep searches documents with page and sheet labels; a fetched PDF comes back with its saved path and its first page; native PDF input rides OpenAI, Gemini and Mistral (docs/DOCUMENTS.md)
• Added the Document tool: it creates DOCX, PDF, PPTX, XLSX, HTML and Markdown from Markdown or structured content, converts between them, merges, splits and rotates PDFs, writes a bibliography in APA, IEEE, Chicago or Harvard with DOI lookup through Crossref, and inspects a document's structure without reading its body; every write rides the usual permission check (docs/DOCUMENT-TOOL.md)
• Added four debug adapters: Flutter, CodeLLDB (preferred for Cargo projects), PHP with Xdebug, and Bash with bashdb; CodeLLDB and PHP Debug download once on your approval
• Added /copy: the last reply goes to the clipboard whole, with its line breaks, emoji and right-to-left text; /copy 2 is the reply before, /copy code the last code block, and ctrl+x y runs it or copies a focused message
• Added browser frames and forced clicks: frame reaches an element inside an embedded map or form, and force: true clicks a covered target the model has read
• Added batch fetch: WebFetch takes up to three URLs in one call, with a result for each
• Added SDXL and Pixel Party XL to /imagesetup: the sdxl-base-1.0 and pixel-party-xl rows pull from Hugging Face with the licence on the card, a pull joins the model's four parts into one checkpoint on your machine and says what the download needs while it runs, pixel-party-xl's card asks for its . in pixel art style suffix, and downsize saves a pixel-art picture at its native size beside the full render (saved at 128×128) (docs/MEDIA.md)
• Added reference images and masks on every image model: reference_image with a strength from 0 to 1 (0.75 by default) starts a render from your own picture, mask (white paints, black keeps) repaints part of it through the model's ordinary weights, the engine centre-crops and resizes both to the render, and the Local image card names the reference, strength and mask (docs/MEDIA.md)
• Added your own checkpoints and LoRAs: /imagesetup <file or link> registers a safetensors checkpoint with its family read from the file's header, and loras applies LoRA files or Hugging Face and Civitai links at explicit weights, matched to the model's family (docs/MEDIA.md)
• Added ControlNet, batches and palettes: SD 1.5 and SDXL control rows in /imagesetup (canny from a PNG's edges, depth and pose from prepared maps), count renders up to 16 frames on consecutive seeds, sheet lays them out as a PNG grid, and palette maps a pixel-art picture to its most-used colours or a .gpl or .hex palette file (docs/MEDIA.md)
• Added GPT-6.1 Terra to the model picker with its window, output ceiling, effort words and prices from OpenAI's page, where an unlisted model had run on a 200,000-token fallback and its usage went unpriced
• Changed the update notice: vX.Y.Z available: mercury update shows in the warning colour on the boot screen and in the chat, and the chat line stays until you update instead of fading after five minutes, so a support update is not missed
• Changed project MCP servers to start only once approved: a server in .mercury/mcp.json joins a run after you approve it on the card an interactive start shows, or with kit.trustProjectServers in your own settings; a changed definition asks again (docs/TRUST.md)
• Changed MCP details, hooks and the SDK: an environment placeholder in a server definition (the env:NAME form) shows as written in mercury mcp get, mercury mcp list and the /mcp cards; hooks and MCP servers inherit your exported environment, minus provider keys, and never Mercury's own session variables (Bash keeps your exported shell as it is); an MCP file loads its first 64 servers and says so; the MCP consent card opens on its single server's row; the Python SDK's tool server compares its token in constant time
• Changed the git commands Mercury runs to ignore a repository's configured diff helpers and file monitor and to replace its ssh command, credential helper and askpass program with your own, so a cloned repository cannot run commands through Mercury's git; a read-only git command the model runs carries the same settings
• Changed the read-only shell boundary: a read-only command's file-valued flags (xargs -a, grep -f, tree, fd and more) are path-checked like cat, xargs with a reading target fed by a pipe asks, credential-shaped values in a shell result read as [redacted] so env and cat .env no longer hand your keys to the model, and a path with a control byte is refused by every file tool
• Changed the automatic local context window to fit the memory the computer can give, never capping a window you set by hand; a local runner killed mid-request is reported as probably out of memory with the figures
• Changed API error rows: the "near the window" line follows only a request that overflowed or failed for an unknown reason, and a provider's wait shows as a time (5 d 12 h, 3 h 6 min, 12 min), an OpenAI rate limit's wait included
• Changed session start, exit and the updater: a project's MCP servers start once per session (the screen and the spare runner no longer start their own copies), a session's exit runs every cleanup even when one throws, so no child process or scratch folder is left behind, and mercury update accepts a release candidate updating to the final 1.0.0
• Changed hosted requests that carry many images: the oldest images are elided before the send with a visible marker instead of being dropped silently past the provider's media bound (100 on 200k-window models, 600 above), and a vision Read keeps its OCR text, so a reader never re-reads a crop it already has
• Changed Eval's file reads: read_file returns raw text or bytes, a Bash output persisted to a file loads whole into the cell, and a JavaScript runtime recreated after a cut is named on the next cell
• Changed an unattended run's requests to carry less with the same tools, effort, thinking and output ceiling: the discovery rosters name only callable tools, the run rides a stable work contract instead of the screen's sentences, the core tools ride short contracts with the full manual delivered on first use, and the close note no longer asks for a repeat of the tool output; a session recorded before this keeps its exact prompt on resume until it compacts
• Changed the documentation skill to load its pages on first use instead of at start, so an idle screen holds less
• Changed flow mode's asks: a pipe or a redirection never changes a command's verdict; writes under the session's own scratchpad, the paths the run itself created and the project's .mercury working folders never ask; Mercury's own Test, Eval, Launch, Debug, Journey and Structure tools are admitted where Bash is; heredoc bodies, glob loop items and integer arithmetic are not a reason to ask; a ChangeSet anchor refusal names exactly what did not match, and a member whose anchor misses a file the session read whole and never changed is handed the file's real anchor; a line-printing sed -n is a read in implement mode as it is in the other modes
• Changed the shell safety check so a value the command itself spells out needs no ask, and a note or plan under a project's .mercury/ is not treated as a sensitive file
• Changed the debugging loop: a failed test result keeps its assertion values and diffs, references and definitions carry a source line each, Debug reports the program's exit code from its child session, stack takes a depth, and .mercury/dap-adapters.json in a trusted project registers adapters
• Changed browser sessions to a five-minute idle lease with a slot reserved for the lead, so crewmates that leave browsers open cannot lock the lead out
• Changed WebFetch failures to name their cause (a reset, a timeout, DNS, TLS, the HTTP status) and the hosted-reader decision, with a host's back-off shared by every agent in the session; content a shell curl returns carries the same unverified marking
• Changed the API dispatcher to give every request its own connection unless MERCURY_MAX_CONNECTIONS sets a bound: a crew fan-out past sixteen requests had queued with nothing sent and reported a provider that never answered
• Changed a transport retry the connection heals by itself (a reset, a broken pipe, a first-byte timeout, a reconnect) to show nothing; a 429, 529, 5xx or final failure keeps its row
• Changed the composer's notice row to keep a notice's way out whole when it must shorten
• Changed the Moonshot effort words to step as Kimi documents them (xhigh and ultra ride as max, medium as high, minimal as low), the chip and the receipt saying the word that rides
• Changed --lean to offer Write beside Bash, Read and Edit
• Changed the tools a model is sent: every text-form route (Z.AI, Gemini, xAI, Mistral, Groq, Cerebras, Fireworks, Together, Cohere, MiniMax, Nous, Meta, Hugging Face, Qwen, a custom endpoint) now receives the core tools in full and the rest by name, loaded when the model asks, as OpenAI and local models already did; the four long tool manuals ride as short contracts with the manual delivered once on first use
• Changed how Mercury answers: it leads with the answer or the result, then how it got there and what it means for the work; it keeps answers clear and concise, stays candid, never defers work once it is scoped and authorised, and reports a finished task's scope, outcome, what was verified and any unresolved limit; an unattended run gives the result, the checks and any blockers in plain language
• Changed the calls a run makes: an unattended run ends on the model's final answer with no separate closing-note request, Mercury acts on a tool result in the turn it arrives and runs an edit and its check in one turn, and a session stops repeating its context reminders after the first turn while the full tool manuals still arrive once
• Changed two hints: the message for a page that cannot be read by OCR names the Windows way to enable it (an OCR language added in Settings or with Add-WindowsCapability), and the PHP debug hint says check that php -m lists xdebug
• Fixed a small local model's tool call written as plain or fenced JSON being shown as the answer: it runs through the same approval and diff as every other tool call
• Fixed headless run outcomes: a run whose answer is an unexecuted tool call or an empty reply ends failed, a stream cut shows as a notice row, and mercury run --max-time cuts a reply or tool still running when the limit passes
• Fixed a local model's context window: Mercury checks against the window it sends, so an Ollama model with a 4,096-token default no longer refuses every prompt, and a window change applies without a restart
• Fixed compaction on small local windows: a compaction that cannot fit is skipped instead of failing every turn, the first check waits for the model's own window, and a follow-up that fits is sent
• Fixed two Ollama faults: requests carry your output ceiling, and a mid-stream error carries the server's own class, so a server error is retried once and a 429 reads as a rate limit
• Fixed /imagesetup on Windows: esc and a click outside close it, and the runtime unpacks when Mercury was started from a PowerShell 7 window, which before failed with only powershell.exe exited 1
• Fixed /localsetup on Windows: s skip works where the footer shows it, and the source list on step 1 shows its selection
• Fixed three session faults: a crewmate paused on a usage window reported as failed, the system prompt changing with the permission mode (losing the prompt cache), and the schedule list the model reads lagging behind changes
• Fixed a manual /compact on a conversation compacted before growing the context: it says "Nothing to compact" and sends no request
• Fixed five small faults: a path named ..foo is inside the working folder, the Grep tool accepts path "." on Linux and macOS, mercury run --format text shows control sequences as visible text, an unknown tool name is shortened in results and logs, and the /localsetup summary lists each step once
• Fixed a local model receiving screenshots it could not see: a local model gets images only when its server declares vision, the context meter and the window guards count a request the same way (a session that read 30% on the screen had been refused at 395k tokens), an oversized request drops its oldest images first instead of refusing, and /compact compacts such a session
• Fixed a line starting with a slash that is not a command: it is sent as your words instead of being answered with a help sentence painted as if you had typed it; a restarted session no longer re-runs a line it had already run under its old time; images sent to a daemon-hosted session keep their numbers
• Fixed an expired ChatGPT sign-in showing only after the first prompt was spent: Mercury checks it when it opens and in /health, and a prompt that still meets the wall comes back to the composer and is sent after /logins
• Fixed copying on macOS turning Arabic and emoji into mojibake when Mercury was started without a UTF-8 locale
• Fixed ten findings from the field: an inline shell block in a skill (!cmd) expands before the prompt is sent; a scheduled session on a local model starts when its server answers; --toolset selects the requested tools; the SDKs refuse a list value that begins with a dash; a project skill loads after folder trust and its permission grant ends with its invocation; the shell safety check stays fast on long commands and reads a multi-line fork bomb; an instruction import through a symlink stays inside the project; a project MCP approval follows the working directory too; rows and JSON output escape C1 control characters
• Fixed the model picker hiding a ChatGPT login's live rows when the current model is not OpenAI's
• Fixed plain commands captured to a file: mercury update, --help and every plain command print nothing about terminals
• Fixed the native OpenAI connection dropping a reasoning item's own text
• Fixed long Eval cells looking silent: a finished cell reports its tool calls and their time, and the crewmate's tool-use count advances while it runs
• Fixed an MCP client's message arriving as if it were yours: a message sent into a session through mercury mcp-server arrives as an outside report from a named sender with no authority over the task or permissions, scoped by the server's token file
• Fixed a first /compact that would make the conversation larger: it is refused before any request is sent, and a one-shot schedule refused once stays on the /saturn board and starts when the refusal clears
• Fixed GPT-6.1 Terra losing its own reasoning between turns: a long think arrives as a chain of encrypted reasoning items and only the last had been kept; the whole chain is kept, and a model present only in the bare API list keeps its requested effort, max included
• Fixed a Python str.replace whose argument carries / or * being refused as a file write: the write guard tells the string method from os.replace and names the span it refuses
• Fixed Arabic PDF rows losing their reading direction; matching in Grep's document search and in WebFetch normalises tatweel, bidi marks and presentation forms
• Fixed four faults behind the readings: a text-only token count woke the model catalogue's discovery on every count, firing extra requests on Gemini and llama.cpp; git spawn settings cached a repository's layout past a filesystem change; the Python SDK settled a prompt before its queue acceptance was recorded; a language-server reply written after its pipe closed crashed a crewmate at shutdown
• Fixed browser refusals: the Browser tool had refused a call that merely spelled force: false, a reopened page in a persistent profile had no focus until brought to front, and a failure on an unclickable target now explains the cause and names the blocking policy
• Fixed the reply mark (answering your 12:04 message) showing on a reply that carried no words
• Fixed two Windows faults: a source build on a default Git for Windows checkout no longer fails the document-licence check, and /copy no longer puts a byte-order mark before the first character
• Fixed the installation and sign-in text to describe the current release, in every one of the 21 translations