Always ask reads commands before they run, apps get grants you control, approval cards reach your phone and calls, memory and rooms stay quick and private, and Murage comes with Fuigo 1.0.31.
Always ask in 1.0.3
Always ask reads each command before it runs. If the text names your home folder, a system folder, a whole disk or a mounted volume, Murage asks first, at every access level, including Full access and No limits.
It covers more than the shell. The same check reads PowerShell, Command Prompt, Windows Subsystem for Linux, and code run through Python, Node and similar tools.
Raw writes to a disk always ask. Any write to a storage device asks first, whatever the device is called.
Apps and engine settings in 1.0.3
Each app gets only the grants you give it. A connected app asks before it reaches a new tool, and what you allow stays with that app and that bot.
A routine's remembered approvals stay with the bot that runs it. Another bot cannot borrow them.
The settings that decide what an engine may do are protected. A bot cannot change them from inside a turn; you change them in Settings.
Murage's own approval hooks stay Murage's. Bots cannot change them, at any access level, including Full access and No limits.
Approvals on your phone and in calls in 1.0.3
Approval cards reach your phone. Allow or deny from the phone and the waiting bot carries on.
Calls announce what is waiting. A call tells you how many approvals are waiting and lets you answer by voice, with the plain words spoken back to you.
The composer keeps your draft while an approval card is open, and returns with it when you are done.
Spending ceiling and setup backup in 1.0.3
The monthly learning ceiling holds. Replies that report no usage are counted as unmetered, and learning stops at the ceiling you set.
First-run backup ends verified. Setup finishes only when your first backup has run and checked out, or when you have turned backups off yourself. Setup checks both records before it finishes.
Rooms and memory in 1.0.3
Rooms run with memory off. A room member whose memory is off keeps its place in the conversation, and Keep all lets every turn run.
Rooms keep their order. Each message in a room has one place in the conversation, on every window and on your phone.
Search and browse show your newest memories first.
Thread recall in 1.0.3
A bot can recall an earlier thread. Ask it to find what was said in another conversation and it reads that thread, within what it is allowed to see.
It works with memory off or paused, because it reads the conversation itself.
Bots read only what they may in 1.0.3
Each memory remembers where it came from. Murage tracks the conversation a memory was learned in, so a bot reads only the memories from conversations it was part of.
Switching a bot's engine keeps that line. The new engine picks up the same boundaries.
Faster memory cleanup in 1.0.3
Removing a memory or a person's access is one quick pass. Murage handles the whole backlog together instead of one receipt at a time.
Cleanup counts the real work it does, so it stays inside its budget.
No long freezes while memory builds. The memory index builds and updates in small steps that always finish, so Murage stays smooth on a very long history.
Idle checks only visit threads with work waiting.
Attachments in 1.0.3
Attachments are checked as they are read. Murage confirms the file is the one you attached, a regular file of a sensible size, and unchanged since it was saved, before a bot reads it.
Engines in 1.0.3
Fuigo 1.0.31. Murage 1.0.3 comes with Fuigo 1.0.31 bundled.
Antigravity at Auto asks first in projects with their own hooks. When a project carries its own Antigravity hooks file, the turn runs as at Ask, so every change waits for you.
OpenClaw 2026.8.1 or newer. Murage works with OpenClaw from version 2026.8.1. At Ask, OpenClaw asks before it runs anything. At Auto and Full access it follows your own OpenClaw command settings, as in 1.0.2.
Murage Cloud in 1.0.3
Your Cloud home runs the engines Murage offers on your computer, with the same approvals, the same settings pages and the same memory.
Settings in a Cloud window show what applies there. Pages about your computer say so and point you to the desktop app.
The Cloud browser stops by itself when idle, so a browser you left open does not keep running.
Delegated team replies in 1.0.3
Replies are held and checked before they reach a channel, then released automatically. While Murage checks a delegated reply against what its bots may read, you see the words with the note "Bots will see this reply once earlier memory is checked", and your bots read that the reply is left out for now. When the check finishes, the reply is released to them on its own, with no step from you.
A reply is marked as using something you deleted or changed only when that is true. A check that is still running reads as checking, never as a removed source.
Hand-offs return your teammate's words after memory-settings or team changes. Change a bot's memory settings, add or remove a teammate, or switch permissions, and the next hand-off still brings the teammate's answer straight back to the asking bot.
Hand-offs never hold. Delegating to a teammate always answers the asker at once, with the teammate's words or a plain line saying what happened.
The asker is woken when a shared teammate answers. A hand-off from a direct chat to a shared teammate starts the asker's next turn when the answer arrives, so the bot carries on without a nudge.
A clean reply goes through as written. A reply from a turn that began after a change goes straight to the channel when it is sent.
Replies held in 1.0.2 are restored. Replies that 1.0.2 saved as withheld in your own conversations are restored after the upgrade. When Murage starts, it checks them again and restores each one whose words are still stored.
Your roster, permissions and settings stay yours to change. A change holds only the replies of turns that began before it; new turns go straight through.
Delegating bots follow through. When a bot hands work to a teammate, the follow-through starts when the reply arrives, at the level the asker asked under, and Murage asks again if your authority has changed since. Each owed follow-through is one durable record, so a restart does not lose it.
Windows in 1.0.3
On Windows, Codex sessions start cleanly. Murage hands Codex its session hook in a form the Windows command line reads exactly, so every Codex session starts with its approval check connected.
On Windows, in-project files are recognized even under short folder names. Murage reads every part of a path by its full folder name, so a path written in the short form (such as RUNNER~1) is still known to be inside your project.
Engines on Windows always get the live environment. Every engine start reads Murage's current environment, so a value Murage sets or removes later reaches the next engine.
On Windows with Git installed, every Ask shows its approval card. Asks made through Git Bash reach Murage's approval check, so each one waits for your answer.
Skill links are replaced in place. When a routine moves to a new skill bundle, Murage removes the old link and creates the new one itself, so scheduled routines keep running.
Windows folders and links follow the system's own rules. Removing a skill link removes the link and never the files behind it, and recursive removal walks the tree itself and never follows a link out of it.
Moving to 1.0.2 and back in 1.0.3
Downgrade to 1.0.2 and back keeps all data. "Prepare to reinstall" leaves a folder that 1.0.2 opens and can back up, including your memory file. When you return to 1.0.3, it rebuilds what 1.0.2 does not keep and carries on the memory work where it stopped.
Also in 1.0.3
Forgetting a memory is quick and complete. Removing a memory costs only its own deletion, and the memory helper starts with the server's data directory, so it always works on the right store.
Memory changes settle in the background at a steady pace. Changes to what a bot may remember are applied in measured slices under a per-minute budget, so your rooms keep responding while the work completes.
The memory panel and review section draw on first open, and markup drawn before the sanitizer loaded is drawn again once it is ready.
First paint is quicker, with the engine sign-in work moved out of the way.
Routines due at boot run. A routine that came due while Murage was closed runs when it starts and frees its thread.
Threads recover from a failed turn. A turn whose own failure handling fails keeps the thread it was using.
A bot picks up the conversation right after a restart. The first turn after Murage restarts rebuilds the conversation in full, so the bot carries on where you left off.
The packaged app boots the same way a development build does. The packaged server ships the exec helper and the websocket bundle next to the app.
Phone store apps stay on your own content. In the store builds, no page that sells, signs you up or opens checkout is shown.
First run waits to know where it is. Setup steps are drawn once the surface is known.
Set up my browser stays available before the Chrome Web Store listing is approved.
The Backups page invites a restore test.
Also included: review pins, Cloud browser idle handling, steady memory index building, attachment reading, Cloud home and Windows PowerShell updater improvements.
Known limits in 1.0.3
Always ask reads a command as it is written. It is a strong first line, and a few command shapes still get past it. A per-command sandbox, which stops the write itself, is the planned next step.
A folder named in a setting, a variable or another command's output is not followed, because Always ask reads only what the text spells out. Deleting or mirroring into a folder held in a variable still asks.
Routines keep their 1.0.2 behavior for writes whose folder sits in a variable. On a scheduled or manual routine run, such a write runs without a card and the run history records a line for it. Owner turns, webhooks and every other rule are unchanged.
Helpers that change folder more than once, or start another helper, can be read from the wrong folder.
Options placed after the command a helper runs are not read.
A very long run of short options before an inline command is not read.
Some ordinary commands ask when they need not. Listing your home folder by its full program path, listing it into a file, or copying from it with rsync can each show one extra card.
OpenClaw at Auto and Full access follows your own OpenClaw command settings, as in 1.0.2, and Always ask does not read its commands first. At Ask, OpenClaw still asks before it runs anything.
Delegate follow-through
A follow-through is automatic at most once. If a follow-through had started when Murage stopped unexpectedly, it is not replayed. Its reply is kept as context for the bot's next turn.
A cancellation can need a second stop. If the disk refuses the write that records a cancellation and Murage then stops unexpectedly, the cancellation may not survive the restart, and the follow-through can still run once. Stopping the bot again cancels it.
Memory change settling
After upgrading a large install, earlier memory finishes its background check over a few hours. On a large real install it took about 3 hours, at about 17 MiB a minute. Rooms can answer a little slower until it finishes.
Delegated replies from turns that began before a change wait for that check. New turns are not held.
Memory added while a forget or an edit is still being cleaned up appears once that cleanup finishes. Until then a bot answers without it. Small installs finish in seconds; on a large install it can take a few hours.
Right after a large delete or forget, a bot's first reply can take about 5 seconds longer while the cleanup keeps its steady pace.
After a memory settings change, an import or a team change, a bot's recent-work list leaves out replies from other conversations that rested on memory shown before the change. Its pinned records, team memory and the room's own lines stay with it.
The per-minute budget is a steady, bounded pace, not an exact write limit. It counts the work Murage charges, not exact bytes written or all disk activity.
An in-line change by you is charged at an estimate. Its real bytes commit with that change and are not measured, so they can land after the charge has expired if it stays open longer than a minute.
The estimate follows a change in cost after a few slices, so for a short stretch the charge can run below the real cost, and very costly rows are charged at a ceiling.
Checkpoint copying of the log into the main file is not counted by the budget.
A restart within a minute of marker writes lets two processes each charge a full budget in one window.
CI review record
Built from FerroxLabs/murage@ae773e129e8d771e08ef39f41bbb4f5c513ec2a8. CI run 39794876319 (https://github.com/FerroxLabs/murage/actions/runs/39794876319) was reviewed and released under the approved waiver docs/releases/ci-waivers/1.0.3.md (sha256 8711a6fb1a50b1880dc1ee0fafab335d161a0828903d8f60fca344e0dc103392), approved by Sean Donahoe on 2026-10-22.