Changelog — Mockingbyrd

1.0.4292026-10-13

The scan now notices the other hooks. It only ever asked one question about them — is Mockingbyrd's guard installed — so a second hook sitting beside it read as perfectly healthy. A hook in that position sees every tool call it matches, and can refuse one or answer in the tool's place. One you have not accepted now fails the check by name, accepting it is a script you run, and one that appears later fails again. It looks in all four places these can be installed from, where the old check read a single file.
Settings can join this machine to a workspace, if you have an enrollment code. It is a fifth thing that leaves the machine and, like the other four, it is named on that screen with the address it talks to: the code you typed, a public key made here, and the version. The private key stays in the Keychain and is in nothing sent. Nothing else goes to a workspace in this build — no scan result, no ledger, no file.
Upgrading from 1.0.366 or earlier also brings 1.0.374's notice for when the background service is still running the version you replaced.

1.0.3742026-10-12

The app tells you when the background service is still running the version you had before an update. Replacing the app does not replace a process already running from it, so until something restarts the service it goes on enforcing the build you replaced — while About shows you the new one. Agent Access now says so, with a badge beside the button and the button itself reading Restart to update; --gateway-status prints the same thing and the one command that fixes it. 1.0.369 made Homebrew do the restart on upgrade. This is the app noticing on its own, which is what an install from the disk image had no way to do.

1.0.3692026-10-12

The app is unchanged from 1.0.366. What changed is the Homebrew cask: upgrading now restarts the background service as well, so it stops running the version you had before until the next time you restart your device.

1.0.3662026-10-12

A rule pack older than the app can no longer hide an out-of-date guard. The check that compares the installed guard against the one this build ships had that version written into it when the pack was last updated — so a pack from an older build compared against the older guard, found a match, and reported everything fine. If you upgraded and the guard stayed behind, nothing told you. The scan now says so, and the fix beside it installs the guard this build actually carries.
Two checks that failed for reasons of their own rather than anything on your device: one that misread turns as yesterday’s when it ran in the first minutes of the day, and one that called the sitemap stale after every edit to a page.

1.0.3602026-10-12

Agent Access calls are no longer blocked by the guard. The layer that keeps an agent off raw mail and message connectors was matching on the tool’s name, and the gateway’s own mail tools are named after the service they reach — so it refused the governed path while telling you to use it. If your agent could not read a linked mailbox through Agent Access, this was why. Raw connectors are refused exactly as before.
A model proxy, experimental. Point an agent’s base URL at Mockingbyrd and every model call it makes passes one place: checked against a policy, counted into the ledger, and written to the audit log. Your API key is relayed untouched and never stored, prompts and completions are never written down, and the response streams — the first token arrives when the model produces it. It is a measurement tool for now, and it is off unless you start it.
On the site: a nav that works on a phone, and pages for booking a pilot.
Versions 1.0.241 to 1.0.359 were not released.

1.0.2402026-10-06

Agent Access. Link Google, Microsoft 365, Notion and Slack to Mockingbyrd once. Every agent on the device then points at one local endpoint, and you decide per agent which accounts it can see and what it may do in each — rather than handing each new tool its own grant to each account, and unlinking one to connect another.
Each agent gets its own profile, its own key and its own URL. Revoking one affects nothing else. A profile that may not reach an account is never shown that account’s tools at all, so it cannot ask.
Permissions run none → read → draft → write → destructive, and can be narrowed to named folders, calendars, pages or channels. Any action can be set to ask you first, and the prompt is the one the guard already uses — no answer, no call.
Google Calendar, Drive and Gmail; Outlook mail and calendar, and OneDrive; Notion; Slack. Every call is written to the same audit log as everything else.
Starter templates fill the first permissions in, so adding an agent is a choice from three shapes rather than a blank form. They never grant a level a service has no action for.
Accounts can be renamed and everything moves with them — the policy, every permission, every tool name and the stored sign-ins.
The Agent Roster draws profiles, the gateway and your accounts as one map, and now says why an account has no line drawn to it.
Versions 1.0.198 to 1.0.239 were not released.

1.0.1972026-10-01

Housekeeping, and the release that proved the update itself works: a copy of 1.0.194 installed from the disk image fetched this build, checked it, replaced itself with it and came back as 1.0.197.
A diagnostic command left the disk image it had opened still mounted. It never affected an actual update — that path always closed the image — but a machine that ran the command repeatedly collected mounted volumes.
Versions 1.0.195 and 1.0.196 were not released.

1.0.1942026-10-01

A copy installed from the disk image can update itself again on a machine that also has the Homebrew tap. 1.0.193 decided which copies were Homebrew's by the name of the bundle, so on any machine that had ever tapped the cask it told every copy to run brew — including ones brew had never installed, which could then never update at all. It now reads the symlink a cask leaves pointing at the app it actually installed.
A copy Homebrew did install is still never replaced in place: it hands you brew upgrade --cask mockingbyrd, which keeps brew's record of what is on disk true.

1.0.1932026-10-01

Mockingbyrd can install an update itself. It is off until you turn it on — until then a newer build is a button beside the version in Settings, not something that happens to you.
Three things have to hold before anything is replaced: the download matches the length and checksum published beside it, it carries a Developer ID signature from the team that signs Mockingbyrd and that signature is verified against the bytes themselves, and Apple has notarized that exact image. The build on the image must also be the version the site promised. Any one of them missing and it is refused, with the reason in the app’s Monitor tab.
A copy installed with Homebrew is never replaced this way. Brew keeps a receipt naming the version it put there, so the app hands you brew upgrade --cask mockingbyrd instead of quietly making that receipt wrong.
The install is one move, onto the same volume: interrupt it and the copy you had is still whole.

1.0.1892026-10-01

Fixes no longer assume macOS has a python3. On a machine that has never had Apple’s command line tools, /usr/bin/python3 is a placeholder that offers to install them and then stops — which is where four fixes stopped. They now find a real interpreter, and a new check says so up front, with the one command that resolves it.
A machine with no screen recorder is no longer marked down for a projection it has nothing to build from. One fix used to offer a chmod against a file that was never created. Those checks now read as not applicable, and a phase where nothing applies says that rather than scoring zero.
The Enforcement panel no longer claims the guard checks a command regardless of which interpreter would have run it. It reads the text of the command — it does not follow an interpreter, expand a variable or decode anything — which is why interpreters stay off the allow list.
“Allow always” on a safety layer asks first now, and names the rule it would stop holding. The self and connector blocks have their own titles instead of being called destructive commands, and Settings no longer says a permanent override expires on its own.
The decisions and notes the app shows are built from this machine’s own scan, so a question that does not arise here is not raised.
Usage and the optimizer count from one ledger, so the thinking total, the session count and the price of a model agree across the page.

1.0.1412026-09-30

The app follows the domain: the update check, the download link and the code request all point at mockingbyrd.io.
An install page, with a Homebrew tap behind it.
Four new pages: the problem panels, an FAQ, a glossary, and a score page you can run without installing anything.
The version pill drops the OS requirement, and the home page stopped stating the same facts three times.

1.0.1322026-09-29

Crash reporting, off unless you turn it on. Nothing is sent, and the reporter is not even started, until you switch it on in Settings.
Versions 1.0.128 to 1.0.131 carry no app changes.

1.0.1272026-09-28

A small release: one visual fix in the app. Nothing changed in what it checks or what it reports.

1.0.1232026-09-28

The Agent Roster stopped calling an AI assistant an app, and stopped reading a sandbox as the measure of reach.

1.0.1222026-09-28

Nine pieces of wording corrected in the app, including one that promised something the app could not deliver.

1.0.1202026-09-28

The Agent Roster counted seventeen apps it would not show you. Now it shows them.

1.0.1192026-09-28

No change to the app. It is rebuilt from the same source as 1.0.118, so installing it over that build changes the version string and nothing else.

1.0.1182026-09-28

The doctrine that ships with the app is the new one, set in the Mockingbyrd system — and rewritten so it is about your machine rather than somebody else's.

1.0.1152026-09-27

The usage score stops making you do arithmetic to read it.

1.0.1132026-09-27

A welcome tour, because the app opens on a number and a number invites two wrong readings.

1.0.1112026-09-27

The app is called Mockingbyrd now. New name, new icon, new wordmark — and nothing underneath it moved.

1.0.1052026-09-26

Mockingbyrd — then still called Mockingbird — becomes a paid app: a seven-day trial, licenses that need no server, and one request that leaves the machine. What it measures still never does.

What changed.