An AI workspace you summon.

Messages treats any text you hand it as an address, so a contact name became an address that did not exist. The send appeared to succeed at every level — no error, a tick in the activity log, and Ghost telling you it had sent the message — while nothing arrived. Ghost now resolves the name on your Mac, refuses anything that is not a phone number or an Apple ID email, and shows you the contact’s photo and the real number before sending. Message threads also open at the newest message instead of far up the conversation, and Antigravity gained a working model picker.

Every release since Ghost started hardening its builds asked macOS for Contacts, Calendar, Reminders, the microphone and app automation — and was refused before you were ever shown a prompt, which is why Ghost never appeared in System Settings under any of them. Resetting the permission did nothing, because there was no permission to reset. All five are declared now, and updating is all it takes. The Messages view also stopped throwing away most of what a thread contains: photos, videos, link cards, tapbacks, and the text of about one message in five.

Glass shipped drawing a dark panel with a frost rim — a perfectly nice surface, and not the one its own description promised. Two separate things were laying Ghost’s own paint over the macOS material underneath, and the second only became visible once the first was gone. Both are fixed, so Glass now shows the material rather than a painting of one.

DeepSeek shipped a vision model, so if you run Ghost on DeepSeek you can hand it a screenshot, a chart or a photo and ask about it — until now that only worked on Claude, Gemini and local vision models. And the theme picker gained two entries at the restrained end: Minimal, where nothing on the surface moves unless Ghost is working, and Glass, the sheerest surface the material will give.

If you ever went looking for Open at Login and found it greyed out, that was not your Mac. Ghost was reading a perfectly normal signal from macOS, "this app has never been set to open at login", as "this build cannot do it", and then telling you to move Ghost into your Applications folder, which is where it already was. Every install had it switched off with no way to switch it on. It works now, and because replacing the app is how an update works, Ghost also puts the registration back when macOS loses it.

Paste a snippet into Ghost and two things used to go wrong. The answer came back with the code set in small grey type that ran straight into the explanation, so the hardest part of reading it was working out which half was which. And the answer landed wherever Ghost decided, which was sometimes the Terminal and sometimes the chat. Code is now set in a proper block, coloured, at reading size, and Ghost asks you where the answer should go before it starts. The Terminal typesets its replies as prose rather than raw markdown, the chat bar grows to eight lines so a long paste is visible, and the countdown plate sits in the notch on every display.

Ghost could always read text off your screen, and it could never look at a picture you handed it. Both of those changed. Press ⌘V with a screenshot on the clipboard and it goes into the message like a file, whatever model you are on, including your Claude subscription, which used to be told to go and find an API key and a vision model instead. And the screen reader that used to sit there for the better part of a minute over two words now answers in about a tenth of a second: that was macOS loading its text recognizer, and Ghost wakes it quietly at launch.

Two things made Ghost overstay. Opening it with the shortcut quietly made it permanent, so the only way to close it was the shortcut again, and on a monitor with no notch the collapsed surface had no shape to sit in, so it either showed nothing at all or a black tab stranded in the middle of the menu bar. Ghost now leaves a second after your pointer does, unless leaving would cost you something, and it draws itself a notch wherever it lands.

A timer running in Ghost was invisible unless you opened the Timer section, and so was everything else: a question you asked and walked away from, and any news Ghost had for you afterwards. The collapsed notch now says all three out loud, shaped to the cutout on your Mac. It also stops carrying yesterday's focus sessions into today.

Asking about your own documents used to mean attaching them again on every question, and forgetting to was worse than useless. You can now state the rule once, in your own words, and Ghost keeps it: a matching question finds that document, reads the part that answers it and brings it into the reply. Spreadsheets can be changed as well as read, one cell at a time, without the workbook losing anything you set up.

Ghost has always asked before it does anything risky, and an approval prompt can only ever answer one question at a time. It cannot hold a standing rule. So there was no way to say never touch that folder, or never message anybody, and no way afterwards to find out what Ghost had actually attempted: a refusal left no trace, and a read that worked left none either. Boundaries are those standing rules, checked before anything else runs, and the action log is the record. Both live on your Mac.

Ghost has had a knowledge base since 2.0, and on most Macs it was empty. Saving a fact needed a tool, and a plain sentence like remember that I am in the Tuesday section is answered on the fast route that carries no tools, so the one moment you told Ghost something worth keeping was the one moment it had no way to write it down. Asking what do you know about me then got the only honest answer available: nothing. Both halves are fixed, and the fact is saved on your Mac by Ghost itself rather than by a model deciding to.

Sums, conversions, the clock, dates and text tools are computation. There is nothing for a model to add to any of them, and waiting a few seconds and paying for the privilege was the wrong answer to 2+558. All of it now happens on your Mac, before any provider is contacted, with no API key and no permission needed. Contact lookups got the opposite fix: they used to reach a model that has no way to read Contacts, so it would invent a phone number and present it as fact.

Open Safari has always happened the moment you asked, on your Mac, with no model involved. Close Safari went the other way entirely: it became a model turn, then a high-risk tool that stopped to ask for approval, and on a bad day an answer claiming it had closed something it never touched. Both halves are the same mechanical thing now, and neither needs a model or an API key.

Settings has a row promising what Ghost can do, with examples to try. Opening it gave you four lines about installing an optional external runtime that almost nobody turns on. It now answers the question someone opening that row is actually asking, and the help text around it stopped naming three features that no longer exist: a command palette on ⌘K that was never built, and screens inside a window Ghost stopped opening.

Ghost draws its privacy line by origin: anything out of Messages, Notes, Mail or Contacts is private and never goes to a cloud model. That rule is exact about where text came from and blind to what is in it. A card number pasted into a plain text file is, as far as the rule is concerned, ordinary text from an ordinary app. Ghost now reads the selection itself first and says what it found before you press anything. The same release adds a Diagnostics page for the opposite problem: the actions that quietly did not work, and had nowhere to say so.

Two things you could not see. The model picker gained a second column for the model, and the window it lives in was still the width of the old single column, so the picker looked like it had been cut in half. Separately, asking Ghost to write code put the answer in the chat window, where a long diff is the wrong shape. Coding requests now open the Terminal and stay there, with the full diff, the file cards, and a line telling you what is happening while it happens.

Two things a user reported, both broken since before anyone said so. A Ghost app launched from the Finder does not inherit the PATH your Terminal has, and Codex installed through npm is a small script that goes looking for Node on exactly that PATH. Separately, every image Ghost looked up on the web was being checked with a request the check itself could not read, so real pictures were judged unreachable and removed from the answer before you saw it.

A Ghost user pointed out that the "Try: …" line above the composer was suggesting phrases that did nothing, and the reason it stayed hidden is that a Ghost action which failed produced no card at all. So an action blocked on a missing permission looked identical to one that quietly did nothing. Every suggested phrase is now checked against the code that has to answer it, failures say so on screen, and there is a page in Settings listing everything you can say.

Choosing Low, Medium, High or Max on the Codex route only ever added a sentence of advice to the prompt. The real model and reasoning effort came from whatever your own ~/.codex/config.toml said, so a setting made inside Ghost changed nothing about how Codex actually ran. Ghost now chooses the model and the effort for each run, keeps that choice to itself, and tells you what Codex reported using.

A Ghost user wrote in to say the Codex route was simply dead: choosing "your ChatGPT plan" produced nothing, with no error to explain it. They were right, and it had been broken for everyone who had not first pointed Ghost at a code repository. So is the larger problem behind it, which was that Ghost never checked whether your subscription was signed in before asking it to answer.

This release came out of using Ghost for a day and writing down everything that went wrong. It was taking ⌘/ away from every app on your Mac, telling you about keyboard shortcuts it had never implemented, hiding its own update window behind itself, and freezing for a quarter of a second every time you pressed Return. It has a menu bar icon again, so you can tell it is running.

Ghost had no first run at all: a new install opened an empty text field and left you to guess. It now walks you through where answers come from, offers you a first question, and stops taking your keyboard at every launch. Typing a slash lists everything it can do. Conversations can be searched and named. This release also closes a security hole in web fetching, and finishes the undo journal.