An AI workspace you summon.

Ghost has always asked before it does anything risky, and an approval prompt can only ever answer one question at a time. It cannot hold a standing rule. So there was no way to say never touch that folder, or never message anybody, and no way afterwards to find out what Ghost had actually attempted: a refusal left no trace, and a read that worked left none either. Boundaries are those standing rules, checked before anything else runs, and the action log is the record. Both live on your Mac.

Ghost has had a knowledge base since 2.0, and on most Macs it was empty. Saving a fact needed a tool, and a plain sentence like remember that I am in the Tuesday section is answered on the fast route that carries no tools, so the one moment you told Ghost something worth keeping was the one moment it had no way to write it down. Asking what do you know about me then got the only honest answer available: nothing. Both halves are fixed, and the fact is saved on your Mac by Ghost itself rather than by a model deciding to.

Sums, conversions, the clock, dates and text tools are computation. There is nothing for a model to add to any of them, and waiting a few seconds and paying for the privilege was the wrong answer to 2+558. All of it now happens on your Mac, before any provider is contacted, with no API key and no permission needed. Contact lookups got the opposite fix: they used to reach a model that has no way to read Contacts, so it would invent a phone number and present it as fact.

Open Safari has always happened the moment you asked, on your Mac, with no model involved. Close Safari went the other way entirely: it became a model turn, then a high-risk tool that stopped to ask for approval, and on a bad day an answer claiming it had closed something it never touched. Both halves are the same mechanical thing now, and neither needs a model or an API key.

Settings has a row promising what Ghost can do, with examples to try. Opening it gave you four lines about installing an optional external runtime that almost nobody turns on. It now answers the question someone opening that row is actually asking, and the help text around it stopped naming three features that no longer exist: a command palette on ⌘K that was never built, and screens inside a window Ghost stopped opening.

Ghost draws its privacy line by origin: anything out of Messages, Notes, Mail or Contacts is private and never goes to a cloud model. That rule is exact about where text came from and blind to what is in it. A card number pasted into a plain text file is, as far as the rule is concerned, ordinary text from an ordinary app. Ghost now reads the selection itself first and says what it found before you press anything. The same release adds a Diagnostics page for the opposite problem: the actions that quietly did not work, and had nowhere to say so.

Two things you could not see. The model picker gained a second column for the model, and the window it lives in was still the width of the old single column, so the picker looked like it had been cut in half. Separately, asking Ghost to write code put the answer in the chat window, where a long diff is the wrong shape. Coding requests now open the Terminal and stay there, with the full diff, the file cards, and a line telling you what is happening while it happens.

Two things a user reported, both broken since before anyone said so. A Ghost app launched from the Finder does not inherit the PATH your Terminal has, and Codex installed through npm is a small script that goes looking for Node on exactly that PATH. Separately, every image Ghost looked up on the web was being checked with a request the check itself could not read, so real pictures were judged unreachable and removed from the answer before you saw it.

A Ghost user pointed out that the "Try: …" line above the composer was suggesting phrases that did nothing, and the reason it stayed hidden is that a Ghost action which failed produced no card at all. So an action blocked on a missing permission looked identical to one that quietly did nothing. Every suggested phrase is now checked against the code that has to answer it, failures say so on screen, and there is a page in Settings listing everything you can say.

Choosing Low, Medium, High or Max on the Codex route only ever added a sentence of advice to the prompt. The real model and reasoning effort came from whatever your own ~/.codex/config.toml said, so a setting made inside Ghost changed nothing about how Codex actually ran. Ghost now chooses the model and the effort for each run, keeps that choice to itself, and tells you what Codex reported using.

A Ghost user wrote in to say the Codex route was simply dead: choosing "your ChatGPT plan" produced nothing, with no error to explain it. They were right, and it had been broken for everyone who had not first pointed Ghost at a code repository. So is the larger problem behind it, which was that Ghost never checked whether your subscription was signed in before asking it to answer.

This release came out of using Ghost for a day and writing down everything that went wrong. It was taking ⌘/ away from every app on your Mac, telling you about keyboard shortcuts it had never implemented, hiding its own update window behind itself, and freezing for a quarter of a second every time you pressed Return. It has a menu bar icon again, so you can tell it is running.

Ghost had no first run at all: a new install opened an empty text field and left you to guess. It now walks you through where answers come from, offers you a first question, and stops taking your keyboard at every launch. Typing a slash lists everything it can do. Conversations can be searched and named. This release also closes a security hole in web fetching, and finishes the undo journal.