Changelog

Not released yet

• First setup. Welcome aboard now asks for the Captain's PIN too (approving the AI's changes, letting devices out). Then a short first setup, each step skippable: your home (where you live, time zone, units); the AI (is Ollama there, what this PC can run, the chat size, building the personas, who answers "Hey Ship", the recommended helpers for other jobs); talk out loud (the voice files, hear the AI, teach it your voice); and other devices at home (turn it on, the address with a QR code for your phone, trusting the certificate, the Shuttlebay). Engineering → Starbase → Run it again.
• Get started on the Bridge (the Captain): add your crew, pair a device, connect your mail, two-step sign-in, backups, outside access, tool servers. Each ticks itself when it's done; ✕ puts one away, Put away the card.
• The Captain is told when Ollama isn't there (not installed or not running): before, the Bridge just showed the personas "not built".
• The wiki (docs.starfarer.org): how to install, use and run Starfarer, its devices, and building on it, with a glossary, troubleshooting and questions people ask. Its pages are in docs/ (Material for MkDocs: mkdocs build), and each change updates its page in the same commit. The README is now a short front page that points there. "Codename" is gone: the name is Starfarer.

0.9.0 (2026-11-12)

• Starships: your own PC or laptop, on Windows, a Mac or Linux. Add one in the Shuttlebay (Add a device → Starship) and pair it as yours. Hold Right Ctrl to talk (Right Option on a Mac; changeable); its wake word is off unless you turn it on, and its mic is open only while the key is held. A corner window pops up when the AI talks or shows something, with what you said and her words, and fades after; anything that works on a Shuttle's screen works there (the Viewscreen, pictures, videos). Always show the hologram (off to start with) keeps a small orb in the corner with a count of what's waiting and your timers. A tray icon (the menu bar on a Mac) has its switches. The bell's pop-ups, timers, alarms and pages show as the PC's own notifications, and using it counts as where you are (a timer rings there too, and a Shuttle in that room).
• The AI's hands on your Starship. Only while Let the AI use this PC is on (its tray menu, on that PC; off to start with), and only for its owner: Clearance has a Starship hands line, which the Captain can only turn off for someone. The same rules as the Starbase PC: look-only at once, anything that changes something needs your OK and PIN (Approve in its corner window, or say yes and your PIN), the Never list, the audit log; and a notification on the PC for every action, and Ctrl+Shift+F12 stops whatever she's doing. New, here and on the Starbase PC: run the script she just wrote (OK + PIN), a preview before you approve ("what would it do?": PowerShell's own dry run, or what a file command would touch), finding files ("find my tax return PDF"), reading a file into the conversation ("read number 2"), sending a file to Ops → Files (any kind, kept as it is, downloaded from there), the volume and media keys ("next song", "set the volume to 30") and locking it. Which PC: the one you're talking on, else the one you name ("on my laptop", "on Starbase"), else she asks. Away missions can use your Starship too (the mission's PIN covers it).
• A Starship's look: her hologram or the orb (tray menu → Look, or Starship settings; her hologram to start with). "Always show the hologram" keeps whichever is picked in the corner.
• Said into a Starship in a room that has a Shuttle too, she says she's on the Starship (she named the Shuttle), and what she shows goes to that Starship only. On its own key, its person is its person even when its mic doesn't sound like the voice taught on the Bridge (its hands were off then).
• A Starship's window program stops when its Satellite does, so an update no longer leaves two orbs in the tray (one left from before is stopped when 0.5.2 starts).
• A new-email notice says who it's from ("New email from Amazon", "3 new emails, from Kim and Amazon"; names only, never what they say), and the AI's catch-up names only those: when who it's from isn't known she says so instead of guessing (she had made up senders from names she knew).
• A Start menu item with its own icon: a shuttle for a Shuttle, a starship for a Starship (neon wireframes), and a satellite for a room device. Windows: the Start menu, and the desktop if you say yes when installing (Settings → Apps shows the same name and icon, and a Starship's notifications its icon); Linux: the apps menu (and the desktop); a Mac: an app in Applications and Launchpad. Clicking it starts it if it isn't running; when it is, a Starship opens its settings in its corner window, a Shuttle its screen, a room Satellite the Shuttlebay. Devices updated from the Shuttlebay get the Start menu item at their next start (no desktop icon unless asked: satellite --shortcuts --desktop). Uninstalling takes them off too.
• The Shuttlebay shows what each thing is at a glance: each kind has its own icon in the same style, on its card (under what it's doing), on Waiting to pair, beside each Viewscreen, and on Add a device's kinds. Viewscreens have a wide curved screen; Beacons (sensors, lights and switches, later) a buoy sending pings. The same icons, any size, as SVG or PNG: /bridge/icon/<kind>-<size>.svg (or .png), for a website too.
• A Starship's corner window: her hologram shows (the window asked for the hologram code at an address its Satellite didn't pass on, so it never came); on Windows it no longer has a taskbar button with Python's icon (the tray icon is where it lives; its windows carry the Starship icon), and it's placed by Windows' own measures, 24 pixels from the screen's edge and 20 above the taskbar, at any display scaling (it could sit against or past the edge).
• Click a Starship's corner window to open the conversation, and type (Enter sends): what you said or typed there, newest at the bottom, and her answers. Typed messages are answered in text only, not out loud (you may be somewhere you can't talk). Its small always-shown card says what's new since you looked (an icon for each kind, with how many: not an inbox's total), with your timer under it, evenly spaced around her.
• Mobile Starships. A Starship is Mobile (it goes with its person: a laptop) or in a room (a desktop PC). A laptop asks to pair as Mobile by itself (it has a battery); change it under Edit. A Mobile one is listed under Mobile in the Shuttlebay, a timer set on it rings on your own devices and where you were last heard (not in a room), using it doesn't tell Starbase which room you're in, "page the office" doesn't reach it ("page Jordan" does), and the AI knows it's your laptop rather than a device in a room.
• A Starship's small card no longer runs against the screen's edge (its window was wider than the card: pywebview's smallest window is 200 pixels wide), and its window never shows a scrollbar of its own. Hologram size in its settings (60% to 200%) makes her bigger or smaller in the small card.
• Send the AI a file. A paperclip in a Starship's chat window and in the Bridge's chat (the AI card and Comms), or drop a file on it; it waits over the text box and goes with your message (100 MB at most). Say what to do with it: "read this for my class" (a PDF, a Word document or a text file) puts it on your reading shelf and she answers, or answers your question about it; "keep this" puts it in Ops → Files as it is (any kind of file); a picture she looks at with the Vision model and answers about ("what does the sign in the picture say?" right after looks again; "the picture" or "the photo" says which). Send one on its own and she asks what you'd like, with a button for each thing she can do; she never guesses. A video or anything else she can't open yet: she says so and offers to keep it. Your files are yours only (the audit log has the kind and size, never the name), and one sent in a chat waits a day.
• Pictures is a new line in Engineering → Modules → Tools and Clearance (on for everyone to start with; it can be switched off). Looking at pictures needs a Vision model chosen and downloaded in Neural Net → Models.
• The reading shelf takes Word documents and text files too, from a chat or Logs (File…), not only PDFs.
• Dragging the Hologram size slider in Starship settings no longer moves the whole window (nor does selecting words in the conversation): only her small card and the window's top bar move it.
• Asking for another AI: "give me Lumina", "can I have Nova" and "switch back to Celestra" hand you over too, and so does a name heard a little off when you're plainly asking for someone ("get me Limina", "get me Silestro", "Celestro"), instead of searching for videos with that name, stopping a video or opening an old conversation with someone else. "Give me Lumina videos" still searches. Handed over for just that, the AI you asked for says hello and doesn't look anything up.
• Picking a video politely: "can you play number five?" plays number 5 (it searched for number 5's title). When she asks about one result ("Would you like to watch it now?"), a yes plays it.
• Asked what mode or filter she's on, she's told her real settings with you (language, roleplay, uncensored mode, whether the conversation is private) and answers from them, instead of making up an "idle mode". Her personality, creativity and roleplay are unchanged.
• The check of names and numbers after a lookup or a PC command counts what she was told with your message (a new email's sender), so a true answer no longer ends with "double-check that".
• A grid of results is put away when you move on: asking for another AI, or anything that uses a tool (a timer, a search, something on your PC), puts it away; talking about it keeps it up.
• A Starship's window fits what it shows: a video fits its card (it ran out of the bottom), and a grid of 12 or a video with the conversation open fits too: the conversation shrinks to its last lines, the card comes under it and the text box under the card, and the window grows to fit (past the screen's height, the card scrolls).
• Satellite 0.5.10 (update Satellites, Shuttles and Starships in the Shuttlebay).
• The Cargobay: big videos, pictures and sound, kept on Starbase. A new view in Ops → Cargobay, next to Files. Drop files on it or pick them (any size, up to your space); they go up a piece at a time, one after another, written to Starbase's disk as they come, with Pause and Cancel. A file that stops part way (the connection drops, the page closes) carries on from where it stopped when you pick it again. Only videos, pictures and sound, told by what's in the file, not its name. It's laid out as Files is: click one to open it beside the list (in its place on a phone), where a picture shows and a video or sound plays (the kinds a browser can play), with Download, Move (into a folder on the Starbase PC, with PC hands and your PIN; nothing there is overwritten) and Delete. It stays until you move or delete it.
• Too big for a chat: a video, picture or sound over 100 MB dropped on a chat (the Bridge, Comms or a Starship's window) offers Send it to your Cargobay instead. A Starship sends it a piece at a time through its own program.
• The AI and the Cargobay: she never reads the files. She sees the list ("what's in my cargobay?", and how much space is left), looks at a picture in it when you ask ("what's in the drone panorama?"), moves one onto the Starbase PC ("move the canyon video from my cargobay to D:\Videos": your OK and PIN, PC hands only) or deletes one (your OK and PIN). "Send drone.mp4 to my cargobay" sends a file from your Starship or the Starbase PC (with the AI's hands on there): the first piece at once, the rest in the background, and a notification on the Starship when it's all there.
• Engineering → Starbase → Cargobay (the Captain): where it keeps files (Starbase's own folder to start with, or a folder on a bigger drive in the Starbase PC, with your PIN; never a network share), each person's space (50 GB to start with) and what the drive always keeps free (20 GB to start with: a file that would go past it isn't taken). Each person's Cargobay is theirs only, the Captain included; the audit log has the kind and size of each file, never its name. The Cargobay is a line in Clearance (everyone but Guests to start with).
• Engineering's views (Network, Voice, Systems...) scroll to the one that's open on a phone, and Ops' views fit a phone's width.
• "How much room is left in my Cargobay?" (or "how much space is left") is no longer answered as a question about timers.
• Satellite 0.5.11 (update Starships in the Shuttlebay for the Cargobay from their window).
• Satellite 0.5.12: a Starship's window says Cargobay.
• Devices outside the home, through your own address. Shuttlebay → Edit on a Satellite, Shuttle or Starship has Outside the home (the Captain's or First Officer's PIN, at home; off to start with). A device let out tries Starbase at home first and, when it doesn't answer there, connects through the address in Engineering → Starbase → Domain (it learns the address from Starbase: nothing to type on the device, and it hears when the address changes). It goes back to home by itself as soon as Starbase answers there. The Shuttlebay marks it Away while it's connected from outside, and each time is in the audit log. Guests aren't answered on a shared device while it's away. A Starship's window says "Ready · away from home".
• From outside the home, the AI's hands work only on the computer you're using. Talking on your Starship away from home, its hands work on it as at home (your switch on that PC, OK and PIN for changes, a notification for each action, the Stop key). From outside (a Starship that's away, or the Bridge through your address) they never reach the Starbase PC or another of your computers: no commands, scripts, opening, finding, reading or sending files there, and no moving Cargobay files onto the Starbase PC. An away mission started from outside does what it can without a PC, and one waiting for approval to use a PC is approved at home. A Starship that's away takes its hands only from itself, even from home.
• Satellite 0.6.0 (update every device in the Shuttlebay to let it connect from outside).
• Click a result on a Shuttle's or Starship's screen. A tile clicked on the Viewscreen there (videos, your mail list, your past conversations) counts as if you'd said its number into it, so she answers as it goes up. Only on a device that's someone's own; on a shared one, say the number (your voice says whose results they are). Needs Satellite 0.6.1.
• "Player number seven" (how "play number seven" is often heard) picks number 7. When the AI can tell you're picking but not which one, it takes the one number you said; when it still can't tell, or the results have gone, nothing plays and she says so (she'd said a video was playing when none was).

0.8.0 (2026-11-11)

• Engineering → Clearance: who may have the AI use each tool. One grid: every tool, a tick per rank (First Officer, Crew, Cadet, Guest; the Captain always has everything), and people given it by name. The built-in parts are one line each (Mail, Messages, Away missions, Past conversations, Video), and Clearance covers their part of Ops too: someone not cleared for Mail doesn't get the Mail buttons, for Messages isn't written to, for Away missions can't start one. Timers and reminders, lists and hand-offs have a line too now (they were for everyone). All users ticks every rank with a sign-in at once; Guest can be ticked for web search, links, weather, leaving a message, Video, and anything a Module or tool server adds (the Captain decides): a Guest at a home device can then use it, a change waits for their yes on that same device, and anything that needs a PIN isn't for Guests. "–" where it can't be given, and pointing at it says why (PC hands are for adults; mail, away missions, timers and PC hands aren't for Guests). Only the Captain ticks ranks; the Captain or First Officer gives tools to people by name. A new Module's or tool server's tool starts with the Captain and the First Officer; the ones already here keep who had them. Engineering → Tools keeps each tool's on/off and how much asking it needs, and shows who has it.
• Guests, for a while, without an account. Ticking Guest asks for how long: until tonight, until tomorrow night, for a week, or until you untick it; then it's off by itself ("till tonight" shows under the tick). More can be given to Guests: Lists (the guests' own lists, shared by every Guest; the house sees them in Ops → Lists and can tick off or clear them), hand-offs (code only: the experts and the reading shelf are someone's own) and past conversations (only today's guest conversations on the device they're at, and only finding them, not going back into one). Timers and reminders stay off for Guests until Shuttles and Satellites can ring them (today only Bridge pages ring). "Also given to" says "no one else aboard" when there's nobody but the Captain to give a tool to.
• Each deck opens with an intro card (as the Holodeck's tabs do): its icon, name and what it's for, then how to use it with the controls in bold. Hide folds every deck's card to its name line (remembered on that screen); "What is this?" opens them again. Every deck has one now, Comms included.
• Shuttlebay, tidied. Its intro card replaces the paragraph that still said Shuttles were to come. The devices are listed once, by room (rooms side by side on a wide screen), and Screens signed in now beside them lists only the Viewscreens. A device's card says what it's doing and, only when something's wrong, what (its sound, its wake words, an update ready, with its own Update); Details has its system, version, mic, speaker, wake words, who it shows at rest and its address. Its buttons are Test (speaker, mic, both, or a Shuttle's screen), Sound, Edit and More (log, restart, unpair, uninstall); one that's away shows only Edit and Unpair. Unpair asks on the page, as Uninstall does. Add a device is a button in the Devices header (open by itself while nothing is paired), and Update all shows there when more than one device can be updated. Its log or a form takes the whole row while it's open.
• Ignore a problem. When the AI would cut in about a device (a weak mic that doesn't hear its own speaker, say), its card in the Shuttlebay has Ignore: the AI stops bringing it up until Undo there. Going back to your question, or moving on to something else, when the AI cuts in does the same; looking into it doesn't. Only the Captain and First Officer are told about problems: others' hellos and systems reports leave them out. Starbase remembers who it told, and what's Ignored, across restarts, so a restart no longer makes the same problem news again (something else wrong with the same device still is).
• Spacedock, as a grid of apps. Every Module is a tile with its icon, name, publisher, category, a short description and Install; search, and Installed, Updates and each kind along the top. Click one for a card over the page with the rest: about it, what's new, screenshots, what it adds (tools for the AI, a Holodeck deck, settings), what it needs, who signed it, links, and Install, Update or Remove. A publisher gives a Module its look with icon.png, screenshots/ and a few MODULE lines (docs/MODULES.md); pack puts them in the catalog, and spacedock art changes only the look, without the key. A Module with no icon gets one drawn. Pictures are fetched and checked by Starbase (PNG, JPEG, WebP or GIF; never SVG). The catalogs and trusted publishers moved to Engineering → Modules.
• The Holodeck is your apps. It opens on a grid of tiles, one for each installed Module with a page of its own (its icon, from its folder, or one drawn; its name, publisher, kind and what it is), with its intro card. Clicking one opens its page (#holodeck/<id>), with All apps to go back; the AI box says which app is open. Section headings on app pages and Engineering → Modules no longer pick up the top bar's padding and line.
• An app shows anything it does. A Module shares a picture, video or sound it made (hub.media.share) and gets Starbase's own link for it: only for the person it's for (or the crew, if the Module says), and a Shuttle it's sent to. An app's Holodeck page can now have a gallery (a picture opens big), video and audio players, a progress bar that updates while something runs, a big text box, numbers, switches, sliders, a picture to send, and tables, on top of text, rows, lists, buttons and forms. The Viewscreen has two more layouts: media (one picture or video fills it; several are numbered) and blocks (any part of an app's page). Both work on Shuttles too, with Satellite 0.3.23 (update Shuttles in the Shuttlebay). examples/addons/showcase uses every piece; docs/MODULES.md, "Showing what your app does".
• Fixed: moving a calendar event to a time only ("move the dentist to 4pm") keeps it on its own day. It went to the next 4 PM from now, so tomorrow's appointment could land today.
• Paging. "Page Jordan in his bedroom: dinner is ready!" is heard right away (no waiting on the AI): the page tone, then the AI reading your words ("Page from Sam: dinner is ready!"); a Shuttle shows it for half a minute (unless a video's playing there). "His bedroom" is the room his own device is in, or a room with his name in it; "page Jordan" without a room goes where Starbase last heard him, his own devices and his open Bridge pages; "page the kitchen", and "page everyone" / "announce ..." (every shared device but the one you said it on). For 2 minutes after, "reply: coming!" goes back to where the page came from. Only the Captain and First Officer page someone in their quiet hours; anyone else is offered a house message instead ("yes" leaves it), as when there's no device on where they are. Nothing is kept (the audit log has who paged where, never the words). Clearance has a Paging line: everyone aboard to start with; Guests can be ticked. Works on every Satellite and Shuttle, older ones too.
• Timers, alarms and reminders ring on the room devices (Satellite 0.4.0: update them in the Shuttlebay): in the room it was set in, on your own devices, and in the room Starbase last heard you in by your voice (the last half hour; Ready Room → Your AIs → Voice teaches it your voice). Never the rest of the house. In the room it was set in and on your own devices she says all of it ("Kim, time's up: pasta"); anywhere else only who and what kind ("Kim, your timer's done"). An alarm rings every few seconds for up to 10 minutes, a timer for up to 3, a reminder twice. Anyone can stop it ("stop", "OK", "snooze") on any device it's ringing on, and stopping it anywhere stops it everywhere; if it wasn't yours, its person is told who did, in the bell.
• Shuttles: under the clock, what's waiting as icons with a count (a shared Shuttle: one small row per person, their initial first; never what it is; email and house messages are how many are unread right now, unless that line is Off in Ready Room → You → Notifications), then timers counting down with a bar, the next alarm, and anything ringing there, blinking. When a card pops up the icons step aside and the timers stay, one small line each.
• Notifications. Everything that should reach you goes through one place: timers, alarms and reminders, away missions finished or waiting on you, new house messages, new email (off to start with; Starbase then looks every few minutes), calendar events coming up (15 minutes before, or what you pick), a task given to you, answers to your requests (the Captain and First Officer: new requests) and, for the Captain and First Officer only, ship problems (a device offline, a sound problem, low disk, a backup that didn't work; Ignore still holds). A bell by your name has the last week's, each opening its page, with Mark all read. Ready Room → You → Notifications: for each kind Off, Bell only or Bell and a pop-up (timers and alarms always ring), quiet hours (10 PM to 7 AM to start with: nothing pops up, only your timers and alarms ring), and Allow notifications on this screen so pop-ups show while Starfarer is in the background. The next time you talk, the AI mentions what came in (who it's from and what kind, never what it says: you may be at a shared device). Opening a house message, stopping a reminder or Ignoring a problem clears its notification.
• The Bridge, tidied. An intro card on top, and Today for everyone: the next calendar events, upcoming reminders and timers, My Day, away missions waiting on you, new house messages and unread mail (each opens Ops; a part with nothing in it doesn't show). The Captain and First Officer get Ship status in place of the Starbase, Models, Nodes online and Logs panels (and Classic view): Starbase and Ollama, graphics memory, devices online, each problem with its own Ignore, requests to answer, the last backup and outside access, each opening its page. Sensors is theirs too; it fits the space it's given, and on a phone it's an Open Sensors button. Activity is only what matters: an away mission finished, an answer to your request, and for the Captain and First Officer a device going or coming back, a restart, a backup, a new request. It starts with the last day's, so it isn't empty after a reload; how long each answer took is in Sensors. The ear button says the name of the AI you usually talk with (Bridge and Comms). On a phone: the AI, Today, Ship status, then a short Activity.
• The Ready Room, in four tabs like Engineering, each with views along the top and a card for the one on screen: You (Profile, Security), Your AIs (Rapport, Voice, Specialists), Requests (Ask the Captain; To answer for the Captain and First Officer) and Oversight (the Captain). The Captain no longer sees a form to ask themselves. Old links (#readyroom/her, /review, ...) still land on the same view.
• Rapport, a tab per AI in its color: how each one is with you and its mood with you now, without switching to it first; usual marks who you talk with, and Make it my usual switches. One you can't talk with yet is grayed, with Ask the Captain. Ship roleplay and mature content are under For every AI; the room that counts as private for mature content is picked from your devices' rooms instead of typed.
• Ask for a tool. A permission request can be for an AI or a tool you don't have (the lines of Clearance you aren't cleared for). Approve and give it gives a tool to that person by name in Clearance (an AI as before); it's in the audit log.
• Security in folding cards that say how each stands (password, Your PIN, two-step sign-in, signed-in devices, recovery codes, trusting Starbase), with Sign out at the top. "Voice PIN" is Your PIN now (it approves far more than voice), and the old "Voiceprint: coming" card is gone (it's in Your AIs → Voice).
• Smaller fixes: Voice lists the names of the AIs you talk with instead of fixed ones; Specialists says "none picked" for a model that isn't chosen, and points only the Captain and First Officer to Engineering; the time zone is picked from a list.
• Engineering, in four tabs. Neural Net (Personas, Models, Rules, Decisions), Crew (Crew, Clearance, Audit log), Starbase (Network, Voice, Systems, Backups, Domain; Restart Starbase at the top) and Modules (Installed, Tools, Tool servers, Catalogs), each with its views along the top and a card saying what the one on screen is for. Settings went where they belong: conversation memory to Rules; the decision model, the line for the AI and hand-offs to Decisions; PC hands to Clearance; mature content to Crew; alerts, readings and the Viewscreen's wait to Systems. Voice no longer repeats the Shuttlebay's paired devices. Old links (#engineering/hub, #engineering/clearance, ...) still land on the same view.
• Personas, a tab each in its color (like the journals in Logs), with + New persona. A persona's page is cards that fold and stay as you left them: Who it is (name, color, its model and whether it's built, with Build it or Rebuild right there, its post, the names it wakes to), Voice, Temperament, Lines (quick lines, what a device says when Starbase can't be reached, how it sees the others) and Advanced (fallback personality, extra instructions). Save stays at the bottom of the screen. In Models, a persona's name opens its card.
• Tools: a search, and each Module's tools fold under its name (built in, each Module, each tool server). Tool servers have a view of their own.
• Backups (Engineering → Starbase → Backups). One zip with the conversations, memories, crew, tasks, missions, audit log, settings, personas, mail accounts, saved keys and certificates; files and installed Modules if ticked; never the voice and AI models or the logs. Databases are copied whole even while Starbase is busy. Back up now, or every day or every week at a time, keeping the last N: only Starbase's own backup files (from this install) are ever removed. The folder can be another drive or a network share (changing it takes the Captain's PIN, and it's checked writable first). A scheduled backup that was missed while Starbase was off runs when it's back; one that fails tries again each hour and warns the Captain. Restore (the Captain, at home, with the PIN) saves what's here first, then restarts and puts the backup back before anything opens. All of it is in the audit log.
• Domain: Starbase from outside the home (Engineering → Starbase → Domain), through the household's own address and a tunnel (Cloudflare Tunnel, Tailscale Funnel) or a reverse proxy, with the steps for each and Check it (Starbase opens the address the way a phone away from home would and says what it finds). Off until the Captain turns it on, at home, with the PIN, once they have two-step sign-in themselves. While it's off, anything arriving from outside (a tunnel, a proxy, Tailscale, an internet address) is turned away; before, it reached the sign-in page. From outside: a password alone never signs anyone in (two-step sign-in), "keep me signed in" lasts a week, a session started at home doesn't work, and Guests, pairing devices, making the Captain, recovery codes, turning two-step off, changing outside access and restoring a backup stay home-only. The real visitor's address is taken from the tunnel only when it's one the Captain trusts, so sign-in limits and the audit log see each visitor.
• Two-step sign-in (Ready Room → Security): a code from any authenticator app (a QR code to scan, or the key to type), set up and turned off at home with your password. Each code works once; a recovery code works in its place. Signed-in devices show which ones signed in from outside.
• Away missions go away. When a mission runs on the mission model (Engineering → Neural Net → Hard thinking) and it can't share the graphics card with the AI's own model, the AI tells you, in its own words, that it's heading out and switching over. While it's away a bar shows it on every page (your own mission: what it's on and how far along, with Recall), and the ship's computer answers anyone who talks to it, in plain words and without a model: it's away on a mission and will answer when it's back. Timers, lists and a waiting OK still work. What you said is kept, and it answers when it's back. "Recall Celestra" (or Recall) brings it back early: the mission pauses after the step it's on, and Resume in Ops (or "carry on with the mission") sends it back out. When the mission finishes, or needs your OK, it comes back: in its own voice, in the conversation the mission came from, with what it found; a notice on your other screens, and said out loud on a page that's listening. With room for both models (a bigger card) it never has to go away.
• Away missions save files: Ops → Files. Ask for a script, a report, notes or a CSV on an away mission ("write me a PowerShell script that backs up my Documents") and it's saved to your Files in Ops, with the mission that made it: read it there, download it, or delete Starfarer's copy. With PC hands you can also pick a folder on the Starbase PC (your PIN, once), and each new file is copied there too. Nothing is ever overwritten (a name that's taken gets a number), saving never runs anything, and only text files are made. The folder must be on the PC itself (not the network), and never a whole drive, Windows, Program Files, a Startup folder or Starfarer's own. Your files are yours only, the Captain included.
• Scripts and lookups are away missions too. Ask for a script in a conversation ("write me a PowerShell script that…") and it's its own away mission: the coding model (Neural Net → Code) writes it and it's saved to your Files (and your folder); the AI says it's on it (or heading out, when the coding model takes its place on the graphics card) and comes back to tell you what it does. A function, a regex or a one-liner is still answered right there. Quick lookups (the weather, a web search, reading a link) are still answered at once, and each is kept in Ops as a Looked up mission with its sources; they're yours only (not in the Captain's Everyone view), and never from a private conversation. Any mission started in a conversation now ends there too: the AI tells you when it's done, failed or needs your OK, even when it didn't go away.
• A script's job comes from the conversation. The AI writes out the job from what was said before handing it to the coding model, so "do the script" after a detour still gets the script you asked for (it had been getting only those last words, and wrote a different one).
• Scripts use the AI on your PC, and play safe. The coding model is told the AI Starbase has (Ollama's address and the models chosen in Neural Net that are installed, with how to call them, pictures included), so a script that needs AI uses those instead of an outside service with a key to paste in, unless you name one. It uses only commands and addresses it's sure exist; a script that renames, moves, deletes or overwrites anything only shows what it would do until it's run with -Apply (or --apply), unless you asked for the changes straight away; one item that fails is skipped and said, never treated as done; names it makes are safe for the file system; a second run doesn't redo the first.
• The AI box, on every deck. A button bottom right on every deck but the Bridge's home and Comms: click it to talk or type to the AI there (hold its mic to talk). It's the same conversation as Comms, and the AI is told what's on your screen ("Engineering · Clearance"). When the AI says something while it's closed, a note pops up above it and a count shows on it.
• Co-work chats. Each project and each task list has its own chat with the AI (each person their own, even on a shared one): in the AI box when that project or list is open, and in Comms → History → Co-work. The AI knows how it stands right now (the rows or tasks, what's late, who's on what).
• AI Assist. A button on each task and each project row: the AI starts a conversation about it in that chat, asks what it needs, then offers to do it as an away mission; your yes sends it off, written up from the whole chat (a script goes to the coding model). The task or row shows AI working, then Ready for review with the result and its files (or AI couldn't finish); tick the task off (a row: Done) once you've checked it. "Help me with the gate task" works by voice too, wherever you are.
• The AI in all of Ops. From a conversation it can now change a task (due date, important, My Day, a note, a repeat, a reminder, who it's for, its list, its name), add steps, delete one (asks first) and make task lists; start a project, add rows and change a row's status, % done, dates or who; see your calendar and add, move and cancel events (cancelling asks first); and put My Day, a task list or a project on the Viewscreen where you are.
• Code answered in the conversation and the files a mission saves keep the same script rules and use the AI on your PC.
• Ops' intro card is about the view on screen (Overview, Tasks, Projects or Files), and intro text spans the card.
• Ops → Tasks, in the way of a to-do app. Your task lists on the left: My Day (what you pick for today), Important, Planned (by when: overdue, today, tomorrow, later), Assigned to me, then Tasks and your own lists. A task has steps, a due date, Remind me (it rings like any reminder), a repeat (tick it off and the next one comes up), notes and a star; drag tasks into order; finished ones fold into Completed. Share a list with people you pick: they see it, add and tick its tasks, and a task on it can be given to one of them. Nobody else sees it, the Captain included. The AI adds, reads and ticks off tasks ("add a task to call the plumber tomorrow", "put pay rent on my day", "what's on my day?", "mark pay rent as done"). Lists (shopping, to-do) stay as they were.
• Ops → Projects, in the way of a project sheet: Grid, Gantt and Board. A project is rows (the steps) with Assigned to, Status, Start, Finish, Duration, % Complete and Predecessors, and any columns you add (text, number, date, dropdown, person, checkbox, percent). Rows can sit under other rows (Indent / Outdent): the one above gets its dates and % complete from them. A row waits for its predecessors to finish, and moves later with them. Grid: click a cell to change it (Enter goes down, Tab across). Gantt: bars on a timeline with the waits as arrows and today as a line; drag a bar to move it, its end to change its length. Board: cards in columns by Status (or another dropdown, a person or a checkbox); drag a card across. Shared only with people you pick, like task lists. Ask the AI "how's the kitchen project going?" for what's late, under way and coming up.
• Ops: Overview | Tasks | Projects. The Overview's right column is My Day (with what's due today or overdue) over the Away missions, folded to one line ("1 running · 2 scheduled", and what's waiting on you) until you click it open (remembered on that screen).
• Times in your own time zone. The calendar's today, away mission schedules and the dates the AI tells you now use your time zone (Ready Room → Profile); they used the Starbase computer's.
• Draft it for me writes like you. It reads the emails you've sent from that mailbox (the ones to that same person first) and writes the reply the way you write: your greeting or none, your length, tone, punctuation and sign-off. It's read from your Sent folder when you ask for a draft and kept in memory for a few hours, never saved; it never takes facts from them. A POP3 mailbox has no Sent folder, so its drafts stay as before.
• Lists: Delete list. Each list in Ops → Lists has Delete list (asked first), and Clear done shows only when something on it is ticked (it removes the ticked items). Saying "delete my batman list" works too.
• Your own To, Cc and Bcc, and a New email. Reply, Reply all and Forward in Ops each have To, Cc and Bcc lines: a reply's are filled in from the email (its Reply-To, or who wrote it; Reply all adds everyone else), yours to change; Bcc goes to them but is never shown to the others (your own Sent copy keeps it). New email in a mailbox writes one from it (To, Cc, Bcc, Subject). Each address is checked before anything goes, 20 people at most. When the AI answers an email for you it still sends only to who the email or your own words name.
• Attachments open. An email's pictures (PNG, JPEG, GIF, WebP) show after it, in Ops and on the Viewscreen; a PDF opens in the browser; anything else downloads (an SVG or a web page only ever downloads, never shows). Only you can open your own. The AI reads an attached PDF or text file when you ask ("what does the attachment say?", "read me the attached invoice", "the attachment in the email from Kim"): the email you just opened (in Ops too), or the one you name. It says so when it's a picture (it can't see those yet) or a PDF with no words in it.
• Scroll bars match the ship: thin, in the theme's own colors, on every card and panel that scrolls.
• Ops: an email or a house conversation opens where the calendar is, until you Close it (the inbox or the list of conversations stays on the left, the open one marked); on a phone it opens in place of the Messages list. The month shows only its own weeks (usually 5), with shorter days, so it fits. On a phone the whole Ops page scrolls (the tabs stay at the top) and the intro cards start folded. The Away missions "?" is gone: what it said is in the intro card.
• Logs is what the AI remembers; lists and reminders moved to Ops. Logs now has three columns: what the AI knows about you and your reading shelf; a persona's journal with you; and who it is with everyone. A Journals tab for each persona you may talk to (any new one too) picks whose journals you see; it opens on the one you're talking to, and the Captain sees how many drafts wait for an OK on each. Each column's panels fill to the same bottom line, with Forget (Clear my history) across the bottom; two columns on a smaller screen, one on a phone (on a phone the panels used to overlap). The list of conversations is gone from Logs (Comms → History has it, with search). Ops → Lists sits under Messages (its own tab on a phone: Messages, Calendar, Lists, Missions) and steps aside while a mailbox or a conversation is open. Timers, alarms and reminders are in Ops → Calendar: "Coming up" above the month, and on their days.
• Delete works on mail connected with a password (Gmail, iCloud, Hover and the like): it said the server "can't move one email to Trash safely". Python's IMAP library kept the list of what the server can do from its greeting, before sign-in, which leaves out moving mail. Starbase now asks after signing in.
• The Never list, at the bottom of Clearance: what the AI won't do for anyone (wipe a disk, delete everything on a drive, your user folder or Desktop / Documents…, or a system folder). The Captain can take one off with their PIN; it then needs an OK and the PIN every time.

0.7.0 (2026-11-10)

• The Viewscreen: where a Module puts results to pick from, on the screen where you asked. On the Bridge it takes the right side (Sensors shrinks to its line; Nodes, Logs and Activity step aside) and the conversation stays where it is; on a narrower screen it sits under the conversation, and on a phone above it. On a Shuttle it fills the screen. A grid of 12 (3 rows of 4) with thumbnails (fetched by Starbase: the screens never contact those sites), each numbered and marked with its site; pick by clicking, or say or type "3", "the second one", words from a title; "next" / "none of these" for 12 more; "search on Vimeo", "search for whales instead", "all sites". Picks go straight to it, not through the AI's choice of tool. The grid becomes the player; leave the Bridge deck and the video shrinks to the bottom right and keeps playing (click it to go back). Nothing picked in 2 minutes (Engineering → Starbase → The Viewscreen) and it's put away; so is a video that ends or is stopped. A Module chooses how its results look (the layout and its options).
• One video search across every video Module (built-in Video tools: find, control, what's playing): "play a video about octopuses" mixes YouTube's, Vimeo's, the Internet Archive's and your sites' on one grid. Video Modules are providers (hub.videos.provide). An adult site is searched only when someone allowed it names it on their own Bridge, and plays only on their own screens; its titles aren't told to the AI.
• Asking for a video works with a small brain too: when it fills in nothing ("I need one more thing for that: what to find…"), puts the site where the screen goes, or calls it a web search with the video tool as the name, Video reads what to find and the site from your own words ("you tube" counts as YouTube). With nothing to find it asks "What should I look for?". When nothing can play, the reply says why (no pages found, the site refused, or its pages name no video). Modules' tools can do the same (fill, ask).
• When a tool says it couldn't do something, the AI says so and gives its reason (not "it didn't say").
• Color commentary: the AI reacts to what a Viewscreen grid shows in character (amused, into it, grossed out, embarrassed: whatever fits who it is, in its own language with them) at ship roleplay Light or Full, and just says they're up at Off; it never reads the numbers out or makes anything up about them. Adult-site titles reach the AI only when its language with that person is Unfiltered (otherwise it knows nothing about them and stays coy). A conversation with adult-site content in it is never drafted into the AI's general journal lines (who it is with everyone); it can still shape the AI with that person. Tools see how the AI talks with the person (caller["style"]).
• A video Module hears which of its videos went up on a Viewscreen (Web Video saves them), a saved one is marked Saved, and one kept on Starbase plays from Starbase on the Bridge, and on a Shuttle (Satellite 0.3.19: its Satellite fetches it with its key, in pieces so it can skip; only what was sent to that Shuttle). Shuttle targets say their Satellite's version. Modules can tell who's asking in a route of their own (hub.person, hub.device), and hear when someone clears their history (me.history_cleared).
• Modules can need other Modules (MODULE.requires): Spacedock installs what's needed first and turns it on with it, and won't remove or turn off one that's needed; a Module uses another's api with hub.need(id). A Module with a program in it comes in one version for each kind of computer (platforms/-/, packed with --platform), and Starbase installs the one made for it. Packages up to 160 MB. A Module's setting can be a slider (range).
• Adult sites by voice, as a setting: per personal Shuttle (Shuttlebay → its Whose, the Captain or First Officer), for its person if they're allowed adult sites, and only when Starbase recognizes their taught voice (a personal device otherwise takes anyone talking to it for its person). Typed on their own Bridge, as before, and said into their own signed-in Bridge's mic when their voice is recognized there. When a voice isn't recognized, the reply says so (it had said adult sites by voice weren't on for the Shuttle).
• Away missions, after the first real test (a recipe found and its ingredients added to a list):
• Your PIN is safe across a restart. What waits for your PIN (a mission's plan, a schedule) is in Ops, so a PIN said within 30 minutes of the ask still approves it after Starbase restarts (it used to be lost, and the PIN went into the conversation as a message, where the AI said it was good).
• Your PIN with nothing waiting goes nowhere: never kept in the conversation, never sent to the AI. You hear "Nothing here is waiting for your PIN right now" (or, with several waiting, to approve the one you mean in Ops). Said with a command waiting for your OK, your PIN is the OK too.
• The plan is read out word for word before your PIN, right after the AI's own words (in its own words, it didn't always match the plan you were approving).
• The same job isn't made twice: asking again (or saying yes again) while it's open points to the one in Ops; one waiting for your PIN reads its plan again.
• Plans without padding: only the steps the job needs, no "review" or "summarize" steps, no step twice.
• No made-up web addresses: it reads only addresses a search gave it or the job named; others get "search first".
• "I will try another way." (and the like) is a promise, not the report: it's told to carry on. "finish(report)" without a colon is read as the report. The mission calls you by your first name ("Sam", not "Sam,").
• The decision model is how the AI decides, for everyone. It was a test option beside the keyword rules; now it's simply on (Engineering → Starbase → How the AI decides only picks its model), and "Decided by" is gone. The rules still decide a message when the decision model can't (no answer in time, or not sure), and for Guests. What someone says now shows on their screens before that call, and a spoken message while the AI is busy with someone else gets "One sec" right away again (the call used to wait its turn first, quietly).
• The decision model (Engineering → Starbase → How the AI decides): one quick call reads the moment (the last few lines, what's on their screen and playing, their tools) and decides what someone wants: talk, a tool and its inputs, a pick on their grid, a web search. It replaces matching words to tools, the tool picker, picks by title words, and the mood keyword lists; the code still checks everything it decides, and if it's late or unsure the rules decide that message. It never changes how the AI talks. data/decide-replay.request compares it with the rules on the Captain's own messages (data/logs/ decision-replay.html, kept on that computer). Decisions show in Sensors and data/logs/decisions.jsonl (no words).
• With the decision model on, "how are things", "tell me about our systems", "what's going on with the Sensors" get the real readings (a "status" decision), never made-up ones; the rules also know more ways of asking. Her mood from her own replies goes in only when a conversation starts ("When you last talked with Sam, you were..."): fed back every message, a worried line about a device grew into worrying about them, then arguing. "Reset mood" resets it. Spoken "censors" is heard as Sensors and "shadow bay" as Shuttlebay (she took Sensors for uncensored).
• Her personality stays hers: the opening of her own note goes right before each message (it sat under every rule, farthest from her reply). With the decision model on, her mood follows how she came across in her own replies and goes in as a memory ("Lately you've been feeling warm toward Sam"), never as orders or a quote of theirs. Her journal lines are memories, not rules ("who you are stays exactly as described"); she no longer writes lines about who she is with everyone, nor about tools, and conversations that were mostly tools at work aren't journaled.
• No sample swears in the language line sent with each message (she opened half her replies with them, word for word). The "nothing was checked" note goes only with a question (a word like "watch" in a story set it off), and "what", "they" and "name" no longer match tools ("what's your name?" matched the video tools). The flirty mood's "you can go there" only when uncensored mode is open (it sat beside "fade to black"); the content line says to hold back in character.
• Her mood changes slowly (decision model on): each reply moves it only part of the way, so one worried line about an offline device no longer flips her to concerned; it takes two in a row (warm or annoyed: three), and every reply counts, a systems report too, easing it back. When no decision came back, her mood stays as it was (it went by keywords in what they said).
• The video search is for live streams too ("watch xqc on Twitch" went to a web search): its tool says so, and the decision model's list of what tools are for does too, and so do the rules (a web search isn't for videos or streams when a tool does that).
• Video players (the Bridge, and a Shuttle's screen in Satellite 0.3.21): a site's player that must be told the page's address (Twitch's "parent") gets it from an {host} in its address. Twitch's player only plays on a page whose address has no port, so on one that has a port (Starbase's own, :3011; a Shuttle's 127.0.0.1:8780) the screen says so instead of a blank player, with a link to watch it on the site (on a Bridge).
• A tool's answer is told to the AI in its own voice: the note around it no longer starts "You used the tool video.find_video…" or asks for "plain words" (she answered "I used the tool and got 12 videos", flat, though the video search asked her to react in character). A tool can say how to talk about its answer (Answer(text, voice=…), Modules too): it goes last, nearest her reply. The video search's react-in-character line now does, on the next page of a grid too (it was cut off there).
• The speech detector (Silero VAD, optional; Engineering → Voice → Listen for): on the Bridge and Satellites, people talking start and end listening, not a fan, dishes, knocks or music (it went by loudness: those started follow-ups and conversation-mode captures with no words in them, and kept a capture open). Talking over her stops her only when it's speech. It comes with the wake words; an install that has them gets it in Voice files ("Speech detector", 5 MB). Sensitivity low / normal / high; "Any loud sound" is the old way, and devices go by loudness until it's downloaded. Satellite 0.3.20 fetches it from Starbase, checks it, and tries it in a program of its own first (one that fails never stops its wake words); on the Bridge it runs beside the wake words, in the same worker. Conversation mode on the Bridge uses it too.
• The Bridge took Starbase's listening times (wait, pause, follow) as a call to turn wake-word listening on, on that page, the first time it connected for voice (hold to talk included): two functions had the same name. It uses the times now, and listening stays as you set it.
• Instant commands come from whatever is up (core/instant.py): a grid's number, next, back, close; a video's pause, louder, stop (at once now, not through the tool picker). Modules add their own with hub.instant.
• A video asked for by voice into your own Bridge's mic goes up on that Bridge (it said there was no screen where you were).
• The Viewscreen's "Next" (was "Next 12"): when there's no more, the Bridge says so (before, nothing seemed to happen), and the AI is told that's all that happened (it had said it was "browsing through some results"). It asks the Modules for more whenever the next page wouldn't be full. The AI is told nothing is playing until something is.
• A site's own player on the Bridge shows only Stop (its own controls are in the video). When a site's page or player names its video file, it plays in Starfarer's player instead (pause, volume, skip), falling back to the site's player when the file won't play. Satellite 0.3.18: the same on a Shuttle.
• A Module's video search (hub.search(..., kind="videos")) also gives each video's own player link (embed), when the search engine knows it, and its picture (thumb).
• Phones: the Bridge, Logs and Engineering no longer run wider than the screen.
• Spacedock is open (Captain and First Officer; changes are the Captain's): add a catalog of Modules (a web address, or a folder on Starbase's machine), trust its publisher after checking their key's fingerprint, and install, update or remove its Modules. Every Module is signed (Ed25519); one that isn't exactly what its publisher signed doesn't install, and neither does anything from a publisher you haven't trusted. An install keeps the copy it replaces; a removed Module is put aside, not deleted. It loads once it's on and Starbase restarts. Publishers sign with python -m starfarer spacedock keygen | pack | verify (docs/MODULES.md). Starfarer ships with no catalogs and no Modules.
• The Holodeck is open: each Module with a deck of its own gets one there (what it's doing, its buttons and forms), for the crew (not guests).
• A Module's own settings, in Engineering → Modules → Settings (the Captain): its own values, secrets that never come back to the Bridge, and settings set per person.
• Screens for Modules: a Module can play a video or show a card on the screen where someone asked (a Shuttle in that room, one they name, or their own Bridge when they typed there), control it from any room (pause, play, stop, louder, quieter, volume, skip), and know what's playing, as the screen itself reports it. A video is turned down while a Satellite listens and while the AI talks, and back up after. The Bridge has its own player for videos put on "your screen": it plays as whoever is signed in to YouTube in that browser.
• A Module's tools know who asked and from where, and get Starbase's web and video search, strict for Cadets, guests and anyone family-safe.
• A Module's tool can say what's going on right now ("a video is playing on the Den screen"): then a one-word "pause" reaches it, and the AI picking tools is told. Before, one word was always taken as chat.
• A video sent to a Shuttle counts as playing right away, so "pause" works before its screen has reported.
• Adult video sites, per person: the Captain or First Officer allows them in Engineering → Crew, only for an adult with a birthday on file (never a Cadet; a birthday that says under 18 turns it off). A Module plays them only when that person asks on their own Bridge (never by voice: a voice can be mistaken), and only on their own screens (their Bridge, or a Shuttle that's theirs; never a shared one). Their searches get safe search off; nobody else's ever does.
• More players for Modules, on Shuttles and the Bridge: Vimeo (controlled like YouTube), video files, and another site's own player (shown in a sandbox: it can't open windows or take the page anywhere; it can be stopped, not paused). A Module can change the sites the Bridge may show while it runs (sites added in its settings), and each video on a screen says which Module put it there.
• Conversations to pick from (Comms → History): each Bridge page (a browser tab: your phone, your laptop, your PC) shows its own conversation and opens on a new one; your others are listed by day (which AI, where, how long), searchable and filtered by AI, to rename, delete, or open and carry on (another AI's conversation brings that AI back). Quiet 30 minutes, a page's next message starts a new one, unless you just opened it from the list (she's told you picked it back up). Your room devices carry on the conversation you were last in. New conversation ends the one shown on every page showing it, on your devices too, and the hand-off follow-up with it.
• Private conversations (Comms → History → Private): when a conversation turns adult (uncensored mode unlocked, or an adult site searched or played), it splits off there into a private one; the AI keeps the last lines from before, so it carries on without a seam. Private ones are listed only behind your PIN, and the tab locks again as soon as you leave it (another tab, a click elsewhere, the page going to the background). Opening one from it turns uncensored mode on for it. Wrong PINs count with uncensored mode's (three, then 10 minutes). They're never in the Logs, the normal list or her journal, and never carry on on a device where private things can't be said (a shared room). Older conversations split the same way once (the database is copied to data/backups first).
• A video or a grid asked for on the Bridge shows only on that page, not on every browser you have open.
• Comms: her hologram is shown big, as tall as the conversation (fit inside its column); History opens on the right.
• Past conversations by voice (Engineering → Tools → Conversations): "what did we talk about Saturday?", "when did we talk about the sprinklers?", "go back to that one", "open number 2". Found by when ("yesterday morning", "last week", "November 3") and what it was about: by meaning (a vector of each one's name and summary, from the Embed job's model, when there is one) and by words. The AI is told each one's day and name, and the summary of its own conversations; another AI's are someone else's (only who and when). The list goes up on the screen where they asked (a new "list" layout on the Viewscreen) to pick by number, name or click. Going back to one: on a Bridge page that page shows it; said into a room, their next message carries it on; another AI's brings that AI back. Private ones are only searched and opened once their PIN was given in that conversation (uncensored mode, where it can be), and never mentioned otherwise. Satellite 0.3.22 shows the list on a Shuttle.
• Conversation summaries: when a conversation is over (4 lines or more), the AI sums it up in a sentence or three: what it was about, what was found or decided, anything left to do. Shown under its name in History (the whole of it on hover), found by search, and summed up again if it's reopened and goes on a while. When a long one is reopened, she's given its summary for the start she'd otherwise not see. Only ever that conversation's own, never in her journal; private ones' only behind the PIN or in that conversation. Older ones are summed up a couple at a time.
• Comms: the header shows the conversation's name (its first line until it has one); click it to rename it. A new one shows "New conversation", and a name typed there before you say anything is kept for it.
• The Viewscreen in Comms: results, a list of conversations and the video playing show in Comms too, on the deck you're on in that browser tab. It takes the hologram's place beside the conversation, wider than she is, and she moves above the conversation, smaller, until it's put away; History stays on the right. On a phone it goes above the conversation and she steps aside (not drawn while hidden). The video follows you between the Bridge and Comms and shrinks to the corner elsewhere. A narrow Viewscreen fits fewer thumbnails across and puts its buttons under its title. The docked video now sits under the menu, Sensors enlarged and History on a phone.
• Ops in three columns: Mail, Calendar, Away missions (side by side on a wide screen; tabs on a narrower one, the Missions tab showing how many wait on you). Calendar: Starfarer's own, each person's and nobody else's (the Captain's neither): a month at a glance, pick a day to see what's on it, add, change or remove events (all day or with times, through several days, repeating every day / weekday / week / month / year; one day of a repeating one can be removed on its own); kept ready to sync with Google, Outlook and iCloud later (each event has a uid and its repeat as an RRULE). Away missions: Waiting on you (missions' and schedules' plans to approve with the PIN), then Running, Scheduled and Done (folded); click a mission to see its plan as a checklist: what it did, what it's on, what it's waiting on, what's still to come. Mail: the place for it, not connected yet.
• An open page catches up after an update: a Bridge page left open while Starbase updated kept its old scripts (the email showed on the Viewscreen as "Nothing to show" and the tool box wasn't folded). Starbase now tells pages which Bridge files it has, and a page whose files are older reloads itself when nothing's going on (or asks). Tapping an email in the list now asks for it in the conversation ("Read email 3"), so she answers as it goes up; what she's told never shows as a pop-up any more.
• An email's links stay links: only a real button (a short label on a colored background, like "See all jobs") takes the ship's button look. Before, every padded link did, so an email that wraps whole cards, logos and icons in links (a LinkedIn job alert) came up as rings inside rings.
• Saved passwords and keys are scrambled, locked to this computer. Sign-in tokens, the household's Google keys, tool servers' tokens (Home Assistant's) and Modules' secret settings (Twitch's, Kick's) used to sit in the data folder as plain text. Now they're kept with AES-256-GCM, and the key is locked by Windows to the Starbase computer: it opens by itself when Starbase starts (nobody types anything, with or without anyone signed in to Windows), but a copy of the data folder, a backup or the database on another computer can't open them. Ones from before are sealed at the first start. Moving Starfarer to another computer means reconnecting accounts and pasting keys again; if Windows ever can't lock the key, nothing changes and the Captain is warned (Linux and macOS: a key file outside the data folder).
• Ops → Messages: messages in the house, and a button for each mailbox. The Mail column is now Messages: a button for house messages and one for each connected mailbox, each with its own icon (one look for the ship's own messages, Gmail, Outlook, iCloud, Yahoo, AOL, Fastmail, Proton Mail and any other email), the name on the right and a small number for how many are new; click one to open it. House messages: people in the house leave each other messages, in Ops (New message, then a conversation per person, with replies and read marks) or by asking the AI ("tell Kim dinner's at 6", "leave a message for my wife: running late", "any messages?"; a reply to one she just read out goes back as a message). Private to the two of them, like email: the Captain never sees anyone else's, and the log keeps only who wrote to whom, never the words. A Guest at a home Shuttle can leave one for someone, but has to give their name first ("it's Mike"); they can't read any. Deleting one takes it from your own view only. She reads them out when you ask; bringing them up by herself comes later (the number on a Shuttle waiting screen needs a Satellite update). Counts for mail come from the provider (POP3 can't say).
• Opening an email marks it read, as a mail app does: clicking it in Ops, tapping it on the Viewscreen, or the AI reading it to you ("read me the email from Kim"). Looking at the inbox, or asking what's new, still changes nothing. Mark unread puts it back. The counts on Ops → Messages and an open inbox catch up at once, whichever screen it was done from. (POP3 can't mark: there it stays as it was.)
• An email in Ops looks the way it does on the Viewscreen: its own HTML in the ship's look (headings, pictures fetched by Starbase, real buttons as the ship's pills, links opening in a new tab), made safe the same way (no scripts run in it, trackers dropped), as tall as it is so the column scrolls it. An email with no HTML shows its text as before.
• An email's plain-text version without the HTML codes some senders leave in it. Opening an email in Ops shows its plain-text version (the Viewscreen shows its HTML one), and some senders' still holds the HTML's codes: a bank's had " ͏" a hundred times (invisible padding for the inbox preview), "–", "

  " and "
  ". Those are now turned back into what they stand for, and invisible padding is dropped everywhere (inbox previews too). The AI reads the cleaned text, and so does the quote under a reply. A real plain-text email keeps its own spacing, its links ("?a=1&para=2" stays) and its "https://…".

• Do things with your mail: mark read / unread, delete, reply, reply all, forward. In Ops → Mail an open email has Reply, Reply all, Forward, Mark read / unread and Delete. Delete moves it to your provider's Trash (never gone for good). A reply quotes the email under it and stays in the same thread; a forward takes its attachments along; both go out from that account (with an app password: its own sending server, and a copy lands in Sent). "Draft it for me" has the AI write the reply from what you type (or from the email alone), for you to change and send. Asking the AI: "mark it as read", "mark them all read" are done at once. "Reply to Kim saying I'll be there at 7" (or "reply to Kim word for word: …"), "forward that email to joe@example.com", "delete the email from the bank": she reads the whole reply back word for word (and who it goes to), or says which email goes to Trash, and nothing happens until you say your PIN ("make it shorter" changes the reply first; "no" drops it). Who gets your mail only ever comes from your own words or the email itself: she asks for an address rather than guess one. Your PIN is never kept or shown. At most 30 emails sent an hour. POP3 mailboxes can reply and forward, but marking and Trash need IMAP.
• Connecting mail is just your email address and its password. Ops → Mail → Connect: type your address and Starfarer finds the provider from it (no list to pick from, no server settings unless you want them). Gmail, iCloud, Yahoo and AOL want an app password made on their own site: the line under the box says so, with a link straight to the page that makes one. Outlook.com addresses get a "Sign in with Microsoft" button instead (with Starfarer's Microsoft app). Setting up a Google project is no longer offered (a Gmail already connected that way keeps working).
• Mail with an app password: Gmail, iCloud, Yahoo, AOL, Fastmail, Proton (its Bridge) or any other. Paste an app password made on the provider's site, and that's it: no Google project, no domain, no signing in again every week. IMAP (or POP3) with the provider's own server settings filled in (change them under Server settings; Other: your own). Starfarer tries the password before keeping it, keeps it scrambled, and only looks: the inbox is opened read-only, so nothing gets marked read, moved or deleted (POP3: nothing is ever deleted). If the password is changed or cancelled at the provider, Ops asks for a new one. The inbox, an email, asking the AI ("any emails from Kim?") and the Viewscreen work the same as with Google sign-in, which stays as the advanced way for Gmail (the household's own Google project). Outlook.com takes no passwords from other apps any more: see the next line.
• Outlook with Microsoft's sign-in (the advanced way, like the Google project): the Captain registers an app for the household once in the Microsoft Entra admin center (the steps are in Ops → Mail → Outlook; it needs a Microsoft directory: a free Azure account or the Microsoft 365 Developer Program) and pastes its Application (client) ID. There's no secret. Then each person signs in on Microsoft's own page, and Outlook's mail is read over IMAP with that sign-in (look only, as with the others). Microsoft renews the sign-in by itself; when it ends, Ops asks them to sign in again. iCloud has no sign-in like this (Apple only offers app-specific passwords).
• The AI's personality, at every role-play level, tool answers included. Off is now low-key rather than "a plain assistant": still themselves, just quieter, with no starship talk beyond the app's own names for things (the Ready Room says Light or Full lets more come through); Light is their full personality with a little ship flavor; Full is everything, in character. A tool's answer no longer flattens her ("briefly, in your own voice" became "as yourself, a remark of your own welcome"), and the facts check no longer strips her remarks: it rewrites only the facts, and the app's own words (Bridge, Comms, Captain…) are never taken for made-up names.
• Your mail on the Viewscreen. "Check my email" puts your inbox up beside the conversation as a list to tap or pick by number (who, when, subject, a snippet; unread stands out). Opening one ("read email 1", a tap) puts the email itself up in full: its own layout and pictures, dressed in the ship's look, scrolling by itself at a reading pace while she sums it up; scroll yourself to go faster or back, ❚❚ / ▶ to stop and start, "← Inbox" to go back. It's made safe first: nothing in it can run, its colors and fonts give way to the ship's, links open a new tab (the real address shows on hover), invisible trackers are dropped, and its pictures are fetched by Starbase (the screen never contacts the sender's sites). Shuttles get the list for now; the email itself there comes with a Satellite update. "Read me the band email" finds the one from BAND (it used to search every email's words).
• Tool boxes in Comms: open for code the AI writes (and an away mission's plan, to read before the PIN); folded for every other tool, still in the history to look back at.
• Mail from a conversation, after the first real test: codes in sign-in and verification emails are hidden from the AI unless you ask for the code ("what's the code in my latest email?"), and links never reach it (they're in the email in Ops → Mail), so neither ends up in the conversation; "a summary of my last 10 emails" gives 10 and goes through them (it used to add "unread only" on its own, stop at 8 and refuse); "unread", how many and "a summary" come from your own words; right after it lists your mail, "sure" opens the first and "the second one" that one. (Tools can now say which inputs come from their words over the AI's guess: words_win.)
• Away missions don't get Mail's or Ops' own tools: a mission works alone, and an email's words could try to steer it (mail in missions is to be talked through first); Ops' tools padded a mission's plan in testing.
• Ask the AI about your mail ("any emails from Kim today?", "do I have new mail?", "what's my latest email about?", "read me the second email", "read me the email from the bank"): two look-only tools, check_mail and read_email (Engineering → Tools → Mail), on the Gmail you connected. Your own mail only, never anyone else's (the Captain's neither); never for Guests. Nothing is sent, changed or marked read; what you searched for stays out of the audit log. The AI answers only from what's there, and an email's words are never taken as instructions.
• Mail: connect your own Gmail and read it in Ops. The Captain pastes the household's Google keys once (from the household's own Google Cloud project, a "Desktop app" client; kept on Starbase, never shown again). Then each person clicks Connect Gmail and signs in on Google's own page (Starfarer never sees the password; PKCE). On the Starbase computer it finishes by itself; on another device the last page doesn't load and you paste its address into Ops. Then your inbox (who, subject, a snippet, unread marked) and each email as plain text (never the sender's HTML), read live from Google and not kept; opening one here doesn't mark it read in Gmail. Yours only, the Captain's neither; tokens are never shown or logged; Disconnect tells Google to stop and forgets the account.
• Updates show up without a forced reload: the Bridge's page, scripts and style sheet are sent as "check for a newer one" (no-cache), so a browser never mixes a new page with its saved old scripts (Ops showed up unstyled).
• Ops: away missions: give the AI a job with several steps ("find three robot vacuums under $300, compare them and add the best one to my shopping list") and it works through it on its own in the background, one tool at a time, reading each answer before the next step, then writes a report (only what the tools gave it; what it couldn't find, it says). Every step shows in Ops as it goes, with the sources. It runs as the person who sent it: only the tools they could use themselves (web search with their own safe search, reading links, weather, their lists and reminders, their Modules and home tools, and the PC's look-only commands for the Captain), never adult sites. One mission runs at a time, behind anyone who's talking. The mission brain is the Deep job's model when one is chosen in Neural Net, else the AI's own chat model, told only to work the job (never as the persona). Cancel one, run it again, delete it. Each person's missions are their own. The report is checked by plain Python against everything the tools said: names and numbers that aren't there get one rewrite, and anything still not there is listed with the report ("double-check those"). A tool call a small model writes as text is taken as a call (a near name, like "list_add", is the tool it meant; one to a tool that doesn't exist gets the real names, never an answer the model made up), and a turn is cut where the model ran on into its next one.
• Waiting on you (Ops): a step that would change something (adding to a list, turning something on, a command that isn't look-only) waits for your OK; a serious one also needs your PIN (3 wrong: that step is refused). Say no and it carries on without it. No answer in 24 hours: the mission is dropped, with what it found by then.
• The AI offers an away mission in a conversation when a job fits (the decision model sees it), and starts it when you say yes (it comes before the one-word shortcuts like weather); a message that starts with "away mission", however it's punctuated ("away mission. Check…"), or "run that as an away mission", starts one at once. A lookup and then something added to a list ("find a lasagna recipe and add what I need to my shopping list") is offered as one too, even without the decision model (it used to put "what I need" on the list). Never from a private conversation (Ops isn't behind your PIN). Telling you when one is done comes later, with notifications: for now the result is in Ops.
• Schedules (Ops): a job sent again and again, in your own time zone: pick how often (every day, every weekday, every weekend day, or a day of the week) and when, or type or say it with the time first ("every weekday at 7: check the weather and my shopping list", "away mission: every morning at 6:30, …"). Each run is a mission in the list. A run is skipped while the one before is still going or waiting for your OK; one missed while Starbase was off runs if it's less than 2 hours late. Run now, pause, delete.
• Ops is set up from the conversation: no text box in Ops any more; it's the board (Waiting on you, Schedules, Missions). Ask the AI for a job and it offers to run it; say when it repeats however you like ("check the weather and my shopping list every weekday at 7") and it offers a schedule, saying when, before anything is saved. Built-in Ops tools let you ask what's running or waiting, cancel or run a mission again, pause, resume, run or delete a schedule, and say yes or no to a waiting step, all from the conversation.
• A mission's plan, approved once: before an away mission does anything, the AI plans it (each step, the tool, and whether it changes something). One that only looks starts at once. One that changes something shows you the whole plan (in the conversation, said out loud too, and in Ops) and waits for your OK and PIN, which then covers its planned changes for the whole mission. A change it didn't plan, or a serious one, stops and asks again (a yes to an unplanned one covers that tool for the rest of the mission). A schedule is planned and approved once, when it's set up: it stays paused until then, and every run carries that approval. The PIN is said or typed (a room's shared device too, when it knows your voice) and never kept. A PC command that changes anything needs the PIN as well as the OK (look-only ones still run at once).
• Tools given by name: the Captain or First Officer can give any tool to someone by name (Engineering → Tools, "Also for"), PC hands included (adults only). A tool someone wasn't given doesn't work for them, by voice, in a conversation or in their missions. PC hands also work from a room's device that knows their voice.
• The Captain sees everyone's Ops (Mine / Everyone): each with whose it is, to look at, not change. Everyone else sees only their own.
• Reminders: "every morning at 6:30" is 6:30 AM (it was read as 6:30 PM, like a bare "at 6").
• Diagnostics: a line "mission: " in data/diag.request is a dry run (data/logs/mission-diag.txt): look steps run, it stops at the first change, nothing is saved.
• Conversations get names: the AI names each one by its topic in a few words, after the first exchange, and again once it's over if it went on (its topic may have moved). It's the conversation's own model, told only to name it, in the background (anyone talking goes first), from that conversation's own lines. Private ones get names too, shown only behind your PIN. Rename any of them (⋯ → Rename): your name is never replaced; clear it and the AI names it again. Older conversations are named a few at a time.
• Adult conversations move to Private on their own: the same look says whether a conversation is adult (sexual or explicit, or looking for porn or adult videos; not swearing, violence, flirting, or health questions) and from which line. It moves to Private from their line where it turned, with its name; what came before stays, named again from its own lines. Only a verified adult's (a Cadet's stay where the Captain can see them). Older ones are looked at the same way, a few at a time.
• Clear my history (Logs): erases, for good, your conversations with every AI and what the AIs remember about you (facts, their journal lines from your conversations, their mood with you), and takes the words out of your tool calls in the audit log (the calls stay). Your account, voice, documents, reminders, lists and specialists stay; nobody else's history is touched.
• A Module's tool can keep what it was asked out of the audit log (private), and a Module's settings can take several lines of text.
• Satellite 0.3.15: the Viewscreen's grid on a Shuttle's screen (picked by voice). A Shuttle plays videos a Module sends it and reports what they're doing; videos duck under listening and her voice. While a video plays, it doesn't check its speaker by ear (the video's sound hid hers and set off a false "didn't hear the AI" alarm). Its log says when a video starts, changes and is controlled.
• Satellite 0.3.16: checking its speaker by ear judges a whole reply, all its sentences together, and skips replies too short to tell (each sentence counted as a reply, so one long answer set off a false "didn't hear the AI's last 3 replies" alarm, which then cut in ahead of what was asked).
• Satellite 0.3.17: a Shuttle fits the Viewscreen's 3 rows on its screen.
• Satellite 0.3.19: a Shuttle plays videos saved on Starbase (Web Video), passed along to its screen as they come.
• Satellite 0.3.20: the speech detector (above): people talking start and end what it sends, not noise.
• Satellite 0.3.21: its screen says when a site's player (Twitch's) can't play on it, instead of showing nothing.

0.6.0 (2026-11-07)

• Names for everything that connects to Starbase: a Viewscreen is the Bridge in a browser (nothing to install, signed in); a Satellite is a speaker and mic in a room; a Shuttle is a wall screen or TV; Starships (someone's own PC or laptop, with the AI's hands) and Probes (small ESP32 devices) come later, and Beacons (sensors, lights, switches) will come through Modules. Every paired device has a name of its own (no two alike), asked for when it's installed; people and the AI use it.
• The Shuttlebay is open. It shows everything connected to Starbase right now: each Viewscreen (who, which browser, whether its voice is on) and each paired device (its type, its room, and what it's doing: idle, listening, thinking, speaking, in conversation). It lists the paired devices and the ones waiting to pair. The Captain and First Officer pair a new device after checking its code, or refuse it ("Not mine"). They can rename it, move it to another room, make it shared or someone's own, choose whether guests may talk to it, set its sound, test its speaker or mic, and unpair it (which disconnects it at once). Everyone else sees the shared devices and their own screens. Pairing moved here from Engineering → Voice.
• Guests per device: on a shared device, a voice the AI doesn't know gets the Computer persona (family-safe), as before, unless guests are turned off for that device; then it isn't answered. On by default, off for a Starship.
• The AI knows the devices by name: which one someone is talking through ("the Kitchen Satellite in the Kitchen"), and, when they ask about devices or name one, the paired devices and whether each is online.
• The Satellite: the program for a speaker and mic in a room (a Raspberry Pi 4 or 5, or a spare Windows or Linux PC). It hears the wake words on the device itself and sends nothing until it hears one. Starbase answers through its speaker, with the same follow-up window and conversation mode as the Bridge. A short tone plays when it hears its name, it reconnects by itself, and it answers the Shuttlebay's speaker and mic tests. Music comes later. The Shuttlebay's "Add a device" has one command for a Pi or Linux, and a zip with install.bat for Windows (Python 3.12 or newer; the 32-bit installer on a 32-bit PC, such as a Compute Stick). The installer checks it's talking to your Starbase (its certificate's fingerprint), installs the Satellite, asks what to call it, pairs it (a code to check on the Bridge) and starts it now and at every boot (on Windows, when Windows signs in: set it to sign in by itself). The Satellite says hello on its speaker when it's paired. Running the installer again updates it and keeps the pairing. If the device's clock is wrong it says so plainly ("this device's clock says 2017-04-20..."), and connects by itself once the clock is set.
• The Shuttle: a Satellite with a screen (a TV or monitor), always on. The persona's hologram fills the screen on black, with a small clock, sideways or upright; it becomes whoever is answering, then goes back to the device's own persona. When there's something to look at, it pops up in the Bridge's colors and the hologram slides and shrinks out of the way, then comes back when it's done: the weather (now, and the next days) and lists so far, pictures and videos (YouTube) once the AI can put them there. Nothing pops up for plain talk. Its screen opens full screen in the device's default browser if that can go full screen (Firefox, Edge, Chrome, Chromium, Brave, Vivaldi), and otherwise in Firefox, which the installer recommends and offers to install (Windows and Linux). The screen keeps itself awake, opens again if it's closed, keeps showing the hologram while Starbase restarts, and never needs Starbase's certificate or a sign-in. The Shuttlebay has a Test screen button.
• The hologram is far lighter on small machines (a Compute Stick, a Pi), on the Bridge and on a Shuttle: only the clip on screen plays, and a frame is drawn only when the clip has a new one (it used to redraw at the screen's rate and keep the talk clip playing unseen). Where keying each frame is still too slow, it switches by itself to a light mode that leaves the work to the graphics chip and looks nearly the same; a Shuttle starts in it. The Shuttle's Firefox profile also keeps less in memory.
• A Satellite or Shuttle without a mic it can use keeps running: it says so (the Shuttlebay shows it under Sound), stays connected, and picks up a mic plugged in later. Before, it stopped, and a Shuttle's screen with it. Any other failure restarts it after 10 seconds instead of stopping it, and if the screen ever shows the browser's "Unable to connect" page instead of its own, it's closed and opened again. On Windows, where nothing else watches a program started at sign-in, a small supervisor starts it again if it ever crashes.
• Editing a paired device in the Shuttlebay (its name, room, whose it is, guests) no longer makes it forget it was paired: Starbase closed its connection as if it had been unpaired, so it asked to pair all over again. It now just reconnects as its new self. A Satellite also checks with Starbase before forgetting its key (0.2.9).
• Updates for Satellites and Shuttles are sent from Starbase: the Shuttlebay shows each device's version, with its own Update button on the right (lit when that device is behind, greyed out when it's up to date) and Update all. A device that's away gets it as soon as it connects. The device checks it's exactly what Starbase sent, tries the new program out, keeps the version it had, installs the new one (and any new Python packages) and starts again; if the new version can't get back to Starbase within 10 minutes (or keeps failing to start), it goes back to the old one by itself. A device only fetches an update itself when its person asks (satellite --update). Satellite 0.2.4; earlier ones are updated by hand once.
• When a Shuttle starts, it says "Welcome onboard the " (the device's own name, "the Kitchen Shuttle") in the clock's lettering, then the hologram and the clock come up. It remembers its name, so the welcome doesn't wait for Starbase.
• On Windows, install.bat checks that the parts the Satellite needs actually load. A fresh Windows can lack Microsoft's Visual C++ runtime (NumPy needs it; without it the Satellite stopped at once, every time): it offers to install it, or says where to get it. The Satellite says the same, on a Shuttle's screen too.
• A Shuttle's screen always runs Starbase's current hologram code: the browser could keep an hour-old copy, so an updated Shuttle still ran the old one. Its clips are served in parts, as browsers ask for video (Firefox seeks with them when a clip loops or starts over), and from the Shuttle itself rather than from Starbase each time. Satellite 0.2.6.
• A Shuttle's browser decodes the hologram's clips with the processor, not the graphics chip: on an older chip (a Compute Stick's) the driver turned them into a solid green block. Satellite 0.2.7.
• The light hologram (Shuttles, small machines) no longer flickers back to her resting clip between the parts of a chained extra (turning away to the screens behind her, then back): only the clip on screen is drawn, the next one covers it the moment it's really playing, and a part that stalls doesn't stop the chain. Satellite 0.2.8.
• A Shuttle's screen writes its own news into the Satellite's log: page errors, a clip that won't play, and what the hologram is doing (20 seconds after it starts, then every 5 minutes).
• A Shuttle's hologram no longer waits for the voice link: it asks Starbase which persona to show on its own. When it can't reach Starbase, the screen says why (the clock, the certificate, the network). Without a mic it doesn't set up wake words until one is plugged in.
• A paired device's sound is set in the Shuttlebay (Sound): which mic and speaker it uses, her volume there, and the tone when it hears its name. It's applied on the device at once (no restart) and kept there.
• New installs make HTTPS certificates that strict checkers accept (Python 3.13 and newer). An existing install's certificates are left as they are, so phones and PCs that already trust Starbase keep working.

• On a phone, a long deck name in the top bar no longer pushes the page sideways.

• When Starbase can't be reached, a Shuttle shows it. After 30 seconds (so a restart of Starbase shows nothing), the hologram dims to a faint flickering ghost and "Starfarer offline · trying again" appears under the clock, in its lettering; after a few minutes, where it's trying, why it can't get there and when it last could. When Starbase is back she brightens and "Starfarer online" shows for a few seconds. A Shuttle with nothing kept to show (its first start, with Starbase not up) shows a radar searching for Starfarer instead, with its name and the clock.

• Satellites and Shuttles answer when someone calls them while Starbase can't be reached: the persona they called says so, in its own voice ("Unable to reach Starbase Starfarer. Retrying."), with one line for losing touch and one for Starbase not being up yet when the device starts. They only ever speak when called. Each persona's two lines are set in Engineering → Persona ("When Starbase can't be reached"); the built-in ones have their own, and a persona a Captain makes gets plain ones with its name. Starbase makes them in each persona's voice and the devices keep them, fetching only what changed (also when a persona is added, edited or removed). The devices keep their wake words too, so their names work while Starbase is down.
• Each device can be set to show a particular persona at rest (Shuttlebay → Edit → At rest): who its hologram is, and who answers "Hey Ship" when Starbase can't be reached. As usual, it's its person's own persona on a personal device, the ship's default on a shared one. A Shuttle now asks again who to show the moment it reconnects (an edit in the Shuttlebay reconnects it), and when a persona changes, rather than within 5 minutes.
• A mic or speaker plugged into a Satellite while it runs is found: it looks for sound devices again (the sound system only knows what was there when it started). The Shuttlebay also has a Restart button for each device. Satellite 0.3.0.
• A device's log can be read in the Shuttlebay (Log, Captain and First Officer): the end of the device's own log, newest last, with how it's doing (its version, Python, mic and speaker, whether it's listening for its wake words, its persona at rest). Nothing anyone said is in it: the device leaves words out. Each device's row also says whether it's listening for its wake words, and why not when it isn't (no mic, or the wake-word engine can't load there). Satellite 0.3.1.
• Wake words work on older Windows (Windows 10 1607, Windows Server 2016), where the Satellite never heard its name: the wake-word engine's onnxruntime DLL is built for newer Windows in two ways. It's marked "for app containers only", which those Windows enforce ("This operation is only valid in the context of an app container"), and it asks for SetThreadDescription where only newer Windows have it (on 1607 it's in KernelBase.dll: "The specified procedure could not be found"). When the engine won't load, the Satellite now clears that mark and asks KernelBase for that function (keeping a copy of the DLL as it came), and tries again; if it still won't, the Shuttlebay says which Windows functions are missing. Satellite 0.3.3.
• The wake-word engine can no longer knock a device offline. A Satellite now loads it in a separate program first (once for each version of it), so if it crashes there, the device stays connected and the Shuttlebay says how it crashed and where; and the wake words are set up beside connecting instead of before it. Starbase also turns the wake words off for a device that keeps asking for them without ever connecting (an older Satellite whose engine crashes it), so it connects and can be updated; they come back on with its next version. An update pressed for a device that's away is kept through a restart of Starbase, and the Log shows when the program stopped and was started again. Satellite 0.3.4; 0.3.5 checks the engine again when Starbase's words change (a list it can't take stops it too, and is no longer mistaken for the engine not running there).
• On Windows, Satellites use the wake-word engine's 1.13 line (sherpa-onnx below 2): 2.x ships a build of onnxruntime made for newer Windows, which crashed on Windows 10 1607 even once it loaded. An update installs it.
• A speaker chosen in the Shuttlebay could land on Windows' WDM-KS way of reaching it, which can't play the way the Satellite plays ("Blocking API not supported yet"), and the Test speaker went silent. It never picks WDM-KS now, looks in the system's usual list first, and a speaker that won't open falls back to the system's default. The Log also lists every sound device it sees (and how it reaches each), the Windows build, and the engine's version. Satellite 0.3.6.
• Satellites can be uninstalled, on the device or from Starbase. On the device: satellite --uninstall, or on Windows Settings → Apps → "Starfarer Satellite" (it's listed there now) or uninstall.bat. From Starbase: the Shuttlebay's Uninstall (Captain or First Officer, while it's online). Either way it stops, removes its start-up entry, settings and program, and Starbase forgets it; Python, the browser and the Visual C++ runtime stay. Only what the installers made is removed, never a copy run from somewhere else.
• install.bat picks a Python the Satellite's parts are known to work on (3.13, 3.14, 3.12) when there are several, and with only Python 3.15 or newer the wake-word engine comes from its 2.x line (1.13 has no build for them). Satellite 0.3.7.
• install.bat installs Python itself when there's none it's tested on: it offers Python 3.13 just for that user (no admin), with winget where Windows has it, otherwise the official installer from python.org (only if it's signed by the Python Software Foundation), matched to 32-bit, 64-bit or ARM Windows. With a newer or older Python already there it offers 3.13 beside it. If it can't download, it shows the exact link for that PC.
• A Shuttle now changes to the persona its person picks in the Ready Room at once. Two things kept it on the old one until it restarted: Starbase didn't tell the person's own devices about that choice, and the screen, given its new persona at rest, kept the old one as if it were someone answering. Satellite 0.3.8.
• When speech-to-text misspells the AI's name and the wake check still takes it as her name ("Hey, Selkstra"), she now gets her name spelled right. Before, in conversation mode, "Hey, Selkstra" on its own reached her as typed, and she picked at the spelling for the rest of the conversation. A misspelled name also no longer swallows the words after it ("Hey Clastra, how are you" reached her as "you").
• Asked "What's my name?" (or "who am I", "my real name"), the AI gets their name right next to the message. The line at the top of her prompt lost to a conversation full of "Captain": "Your name is Captain", "I don't know your real name".
• How long the AI listens is set in Engineering → Voice → Listening, for every device (the Bridge and the Satellites, at once): how long it waits after the wake word for someone to start talking (8 seconds), the pause that means they're done (0.9 seconds), and how long it keeps listening after it answers (8 seconds). Someone who says "Hey Celestra" and stops to think is no longer cut off: before, the first pause ended it, and what they said while Starbase was checking the name was lost. The quiet in between isn't sent. Satellite 0.3.9.
• What the AI says about the ship is true. Its flavor stays its own ("checked the shuttle's systems, all quiet"), but now it's given Starbase's real readings first: on a hello (a line, if it brings them up), and on a systems report, a status check or "what's going on today" (with their reminders for the rest of the day). Readings: what's connected, each device's mic, speaker, wake words and version (and whether an update is ready), speech-to-text, the AI's voice and brain, and disk space. It's told not to describe checking anything that isn't there.
• When something breaks (a Satellite or Shuttle offline for more than a few minutes, a mic or speaker problem, wake words that stopped, a failed update, speech-to-text or the AI's voice stopping, Starbase low on disk), the AI cuts in on the Captain's or First Officer's next message, once: it says sorry for interrupting, says plainly what's wrong, and asks whether to look into it or get back to what they asked, which is held. Looking into it, it gets the details and the warnings from that device's own log, and what can help; "go back" (or "never mind", "not now") answers the held question. The hold is Starbase's, so it follows them from room to room, and it expires (15 minutes). A Shuttle in that room shows the problem on its screen too. On and off, and the times, in Engineering → Starbase → Systems, which also shows what the AI would be told right now.
• Starbase has its own line in front of the AI: when several people ask at once, someone waiting for an answer goes ahead of background work (the AI's journal), in the order they asked. Someone waiting more than 2 seconds by voice hears a fixed "One sec, I'm finishing something." (each persona can have its own, Engineering → Persona; it never says who or what). Each wait shows in Sensors. How many answers at once is a setting (match Ollama's OLLAMA_NUM_PARALLEL), in Engineering → Starbase.
• A Satellite or Shuttle notices when its mic is unplugged (or sends nothing but silence: muted): within 5 seconds (silence: 30), the Shuttlebay says so, the AI's readings have it (and it cuts in), and it picks the mic up again when it's back (it looks every minute). It remembers it had one, so started again while it's unplugged it still says the mic is missing (a screen that never had a mic isn't a problem). Before, an open mic that was unplugged just went quiet: the wake word stopped working and nothing said why. Satellite 0.3.10.
• Its speaker too, three ways (a speaker gives nothing back, so it can't be watched like a mic): one it can't open (a USB speaker unplugged) is noticed when the AI next talks, and in a check every minute that plays nothing, and found again when it's back; a quiet switch to the system's default speaker is said, not hidden; and, asked to in the Shuttlebay (Sound → "Check its speaker by ear", off by default), it says so when its own mic stops hearing the AI's replies (speaker off, unplugged or turned down; leave it off for a speakerphone, which takes its own sound out of the mic). A new Test both in the Shuttlebay plays a tone and listens for it. A pulled analog plug can't be seen by the sound system: the by-ear check and Test both are what catch it. Each device's row in the Shuttlebay now shows its mic or speaker problem (before, only its Sound form and Log did). Satellite 0.3.10.
• A mic or speaker Windows renamed is still the one it was set to: plugged in again (another USB port), "Speakers (USB Audio Device)" comes back as "Speakers (2- USB Audio Device)", and Windows' older list cuts names at 31 letters. 0.3.10 matched names letter for letter, so on the first device to be replugged it said its speaker "isn't there" and couldn't pick its mic, while both worked. When the one it's set to really is gone, it now says which it plays through instead. Satellite 0.3.11.
• Never use (Shuttlebay → Sound): mics and speakers the Satellite skips: never picked, never fallen back to, not even when Windows has one as its default (a monitor's speakers, say). The device itself isn't disabled: that needs admin rights (Windows' Device Manager) or an interface Windows doesn't document, and a remote switch that turns hardware off is more than this needs. Satellite 0.3.11.
• The AIs pass you to each other, for real (the roleplay): ask for another ("I want to talk to Lumina", "put Nova on", "tell Lumina I said hi"), or say yes when the one you're with offers to send another a message. The one you're with answers in its own words (it's only told it's passing you on, so it doesn't refuse in character or answer for the other); then the other comes on: on the Bridge its line follows, in its name and color, and its hologram takes over; by voice it's its voice, and a Shuttle shows it. It says it got your message from the first and answers it. It's given your message, not the other's conversation (each keeps its own). You stay with it for the conversation: calling another by name, picking one in the Ready Room, a new conversation, or 15 quiet minutes brings back your own. Only to an AI you may talk with: asked for one you can't, the AI says so plainly, and nothing pretends to be passed on. An AI never hands anyone over on its own. On and off in Engineering → Starbase.
• The Satellite's instructions say that Windows 11's Smart App Control can block it, and where to turn it off.

0.5.0 (2026-11-05)

• Nothing personal ships: the code, docs and tests no longer mention the developer, their home, machines or other projects; tests use made-up people and places. Credits are in the README and NOTICE.md.
• A home's own names for its places are its own setting: data/tools.json "words" (for example {"downstairs": "1st", "upstairs": "2nd"}) for matching a question to a long tool answer like Home Assistant's. The built-in matching keeps only general words (first ~ 1st, lamp ~ light). Upgrading an install that relied on "downstairs"/"upstairs": add them there.
• What speech-to-text mishears a persona's name as is that persona's own list ("misheard"; Celestra: "Silastra", "Celeste"...), and it's only fixed when the name is said as an address, so a person called Celeste is left alone.
• "Calm down" calms any AI, not just two by name.

0.4.0 (2026-11-05)

• Kids by age (2026-11-05): Cadets under 13 are family-friendly; from 13 they're PG-13 (mild language at most, and a PG-13 version of the family-safe rules). It changes on their 13th birthday by itself. Guests stay family-friendly.
• Web search, reading links and weather can be switched off or limited in Engineering → Tools, like other tools. Defaults: weather for everyone including guests; web search and links for the crew and Cadets (kids and guests always get strict safe search). Guests no longer search the web unless the Captain allows it. When a lookup isn't on for someone, the AI says it can't look that up instead of guessing.
• The AI's journal: the example of what's worth writing down is neutral now ("likes it when I joke around with them"), and for a Cadet it keeps every line family-friendly (PG-13 from 13). Each persona still never writes itself rules to be more careful or polite.
• Removed the one-time journal cleanup (a file read and run at every start). Journal lines can be deleted one by one in Logs.

0.3.0 (2026-11-05)

• Lumina's line about Computer no longer says she sends people to it (no AI sends anyone to another).
• Who guests and kids get (2026-11-05): guests always get Computer, and Cadets get Lumina. When a Cadet calls another AI by name ("Hey Celestra"), Lumina answers and lets them know she's the one who talks with them ("Hi Maya! It's Lumina. I'm the one who talks with you."), then answers; not again while they're talking with her. The Captain can still allow a particular Cadet other personas (Engineering → Crew); Computer is no longer always allowed for Cadets. A Cadet's devices listen for every AI's name. Settings guest_persona / cadet_persona (computer / lumina) say who, instead of the code.
• Wake words (2026-11-05): "Hey " and "OK " for every persona, "Hey Ship" for your own, and the name alone for personas that allow it (Engineering → Persona → Wakes to its name alone; automatic for long, unusual names). Nova now wakes to "Nova" alone; Computer still needs its "Hey" or "OK". With the built-ins: Hey Ship, Hey/OK Computer, Hey/OK Celestra, Hey/OK Lumina, Hey/OK Nova, Celestra, Lumina, Nova.
• Calling an AI that isn't your usual one (2026-11-05): when someone the ship knows (signed in, or recognized by voice) wakes a persona other than their own, it checks first, in its own voice ("Nova here, Sam. Are you looking for me or Celestra?"). Their answer picks who they talk with ("you", "No, Celestra", "Celestra, what time is it?"), and anything they asked with the wake word goes to that one. It doesn't ask again while they're talking with it (5 minutes). The lines are each persona's own (Engineering → Persona → Quick lines: "check" and "here").
• Voice files (2026-11-05): Starfarer downloads what voice needs itself, into its own data folder, from each project's own release, every file checked against a pinned hash: hearing (Parakeet, or the lighter Moonshine), the AI's voice (Kokoro), voice ID and wake words, about 900 MB. Engineering → Voice → Voice files shows what's there, with "Download what's missing" and a progress bar; python -m starfarer.voice.fetch does the same for installers. It no longer looks in another app's folder for them; a folder that already has the files can still be chosen in settings (stt_models_dir, tts_models_dir; voice ID is looked for in a "speaker" folder beside the speech models folder). Without the files the AI says so plainly and points to Engineering → Voice. Licenses: NOTICE.md.

0.2.0 (2026-11-05)

• Three installs: Test, Production and Personal (docs/RELEASING.md); a label setting shows "Test" / "Production" on the Bridge and the window.
• Neural Net Configuration (Engineering → Neural Net, and step 2 of first setup): scan this PC, see a recommended model for each job (deep, vision, code, reading, embed), then download it, pick another, or choose None. Can be skipped.
• Chat is always the persona's own model. If it isn't installed the AI says so plainly; no other model is swapped in.
• Other jobs use only the model chosen in Neural Net; with none chosen the job is off and the chat AI does it itself.
• The graphics-memory budget comes from the hardware scan instead of a fixed card.
• The built-in personas' models ship as Modelfiles (starfarer/modelfiles/). They all run on one shared brain, starfarer-base: Llama 3.3 8B abliterated plus a chat template with tool calling. Neural Net builds a missing one ("build") or rebuilds one, keeping the old copy; the installer will run python -m starfarer persona-models.
• Computer is strictly factual: plain statements, no stories or small talk (its own Modelfile, and Starfarer no longer tells it that stories are welcome).
• Lumina replaces Teacher: the ship's teacher, she/her, pale moon blue. Crew members, permissions, dials, the journal and moods that pointed at Teacher move to Lumina once on start (Teacher's old file is kept as teacher.json.retired).
• Nova gets his own Modelfile: he/him, sun amber, and moods on.
• Each persona has its own color (its name, replies and hologram glow on the Bridge); success marks stay green.
• Fixed: a voice follow-up could go to the last persona called by name ("Hey Nova") even after switching to another persona, because the device remembered that name. Follow-ups now go to whoever answered last on that device.
• "Let's talk about Mercury" is a question now, not a request for conversation mode (only "let's talk" on its own, "conversation mode" and the like start it).
• Turning on conversation mode without a taught voice says so: the AI answers anything the mic hears until it knows your voice (Ready Room → Voice).
• A persona without hologram clips shows an orb in its color on the Bridge, pulsing while it talks. Computer's color is that orb's blue.
• Hologram clips can carry a holo.json with the shape of their see-through oval, for wider figures.
• Personas are separate people. Each has its own conversation with each person and only ever gets its own lines back; each looks back on its own conversations for its journal (what it learns about them), alongside its own mood and Rapport. "New conversation" starts over with the persona you're talking to; the others keep theirs. What you told the ship about yourself (Logs → facts, your profile) stays shared.
• The chat shows every line in the name and color of the persona that said it (Bridge, Comms, Logs, oversight). Lines from before this have no persona: shown as "AI" in grey, and given to none.
• allow-network.bat: one click (admin) to let phones and other devices at home reach this install through Windows Firewall (its own port, home networks only). The Starbase window says when it's needed, and that the address is https, not http.
• On the home network, the Captain's account can only be made on the Starbase PC itself (otherwise the first device to reach a fresh install would become the Captain).
• Developer setting "unlock_builtins": true (settings.json only, off by default): the built-in personas can be edited in Engineering → Persona, including their personality note, to work out new defaults. Edits are kept in data/personas/_edits (ignored again once locked); "Back to as shipped" undoes one persona's edits.
• A note written in Engineering → Persona is used instead of the model's own.
• The color picker in Engineering → Persona shows the color (it was squashed to a line).
• The ship's manual: every AI knows what the ship really is (this home's AI assistant, styled as a starship) and the other AIs aboard that this person can talk to. When someone asks how to do something here, it also gets the decks and tabs in plain words (only the ones they can open; unbuilt decks as "coming"), so it can say "Ready Room → Voice". The Bridge's menu, Engineering tabs and Ready Room tabs come from the same list (core/ship.py).
• Each persona has a post on the ship (Engineering → Persona), one line like "the ship's teacher": how the other AIs know it.
• Engineering → Persona: a persona whose model isn't made yet says it can't answer until it is (it used to say it would fall back to another brain, which it no longer does).
• Faster voice replies, part 1 (2026-11-05):
• Sensors shows where the wait went on each voice turn ("Wait"): waiting for you to finish, hearing, deciding on tools, reading the prompt (with how many prompt tokens Ollama had to read), first words written, her voice. Typed messages show the prompt tokens read in "Thinking".
• Her first words go to the voice at the first comma once there are five words, so a long opening sentence doesn't hold them up; the rest is still spoken a whole sentence at a time.
• Each message starts exactly like the last one, so Ollama reuses its work instead of reading the whole conversation again: what changes every message (the time, screen or voice, facts, mood, notes, the ship's manual) now goes with the message, after the history, and the history window moves half at a time instead of a line at a time. Engineering → Rules shows both parts.
• Heads-up lines (2026-11-05): the moment a slow job starts (a web search, the weather, reading a link, a long read, a specialist, the smart home), the AI says one of its own lines, picked at random and never the same one twice in a row: Celestra, Nova, Lumina and Computer each have theirs; a persona you make uses plain ones until you write its own (Engineering → Persona → Heads-up lines). Their voice is made ahead of time, so they play at once.
• Fixed (2026-11-05): replies had got much shorter (stories about a quarter as long). Next to the message, "in a spoken back-and-forth, keep each turn short" outweighed everything, so it's back at the top of the prompt; only "no lists, headings or symbols" goes with a spoken message. The ship's line no longer says what she runs on (Celestra had started talking like machinery: "functioning smoothly", "background tasks").
• The AIs know each other (2026-11-05): each has a line about each of the others in its own words (Engineering → Persona → How it sees the others; Celestra, Nova and Lumina ship with theirs, the Computer just knows who's aboard), and knows who this person has been talking with lately and when, never what was said ("they've talked with Nova today, the most this week"). Actually talking to each other may come later, as a module.
• Fixed (2026-11-05): replies could carry the model's own control tokens and run on into a next turn ("<|reserved_special_token_19|>", "<|fim_end|>assistant"). A reply now ends at the first one: nothing after it is shown, said or kept, Ollama is told to stop, replies saved before are cut there too, and such tokens are taken out of what people type.
• The Bridge no longer shows "Listening · say Celestra, Hey Computer, Hey Ship" while it waits for a wake word: the ear icon at the top shows listening is on (and turns it off).
• Ship roleplay (2026-11-05): each person picks how much the AIs play the starship with them, in Ready Room → Rapport: Off (a plain assistant), Light (ship flavor; new people start here) or Full (they talk like they really live aboard), each with a "Hear it" sample in the AI's voice. At every level they never make anything up about the real world, the person, their home or what Starfarer did, and never send anyone to another AI. The Computer stays factual. "roleplay_default" in settings.json sets the level for people who haven't picked.
• Posts: Celestra is the ship's main AI, Nova the ship's navigation specialist, Lumina the ship's teacher; each AI now knows its own post.
• Fixed (2026-11-05): with Language set to Mature, the AI never swore (one line far up in the prompt got ignored). Mature and Unfiltered now say plainly how often, and each message carries a short reminder of the person's language setting.
• A persona can have a "Language at most" (Engineering → Persona): Lumina stops at PG-13. Stronger levels stay in the list, grayed out, in Rapport and in Engineering.
• Still no swearing, even made angry: the reminder with each message now shows what it sounds like ("Well, shit."), and at Mature or Unfiltered, being irritated or angry comes out in her language. Never with kids, guests or a "caring" persona.
• Chat sizes (2026-11-05): every built-in persona in three sizes for smaller graphics cards. Standard (Llama 3.3 8B Q6_K, 32k: 12 GB cards), Lite (the same 8B, Q4_K_M, 8k: 8 GB cards) and Ultralite (Llama 3.2 3B abliterated, 8k: 4-6 GB cards, laptops, no graphics card). Engineering → Neural Net → Chat size picks it (automatic from the scan), with "Build all"; each size has its own shared brain (starfarer-base:lite, nova-core:lite...). The installer command takes --size. A missing model in the chosen size is said plainly, never swapped.
• Celestra ships as a Modelfile too (celestra-core.Modelfile, the note tuned in Test), so she comes in every size.
• Built-in personas locked with their tuned defaults (2026-11-05): the notes, posts, temperaments (energy, sarcasm, teasing, name use, language, creativity) and voices worked out in Test are now what Celestra, Nova and Lumina ship with. Each note is in its Modelfile, with temperature = the persona's creativity (Celestra 1.3, Nova 0.9, Lumina 0.6). Installed persona models keep their old note until rebuilt: Engineering → Neural Net → "Rebuild all" makes every installed persona model in the chosen size again from Starfarer's Modelfiles (the old ones kept as -old-).

0.1.0 (2026-11-04): production baseline

Everything built up to the test/production split: the Bridge, crew and security, personas, memory and the AI's journal, voice (wake words, hearing, speaking, voice ID), Sensors and modules, web lookups with grounded answers, reading shelf, weather, reminders and lists, hand-offs to other models, PC hands, and tools from modules and MCP servers (Engineering → Tools).