Vancetope 0.4.0 is out 🎉

Vancetope 0.4.0 is tagged and pushed — 192 commits since 0.3.0.

0.3.0 grew the surface. 0.4.0 connects it in three directions at once: outward (the browser becomes a first-class source of material), inward (your documents can be encrypted in a way the server itself cannot undo), and downward (Benjy makes agents work on models small enough to run at home). The thread that connects them is the one from last time: the model, the data, and the runtime are yours.

Capture: the browser reaches into your projects

Vance Capture is a browser extension for Chrome, Firefox, and Safari. One click jumps a link into your reading stack; a second imports the page the browser is showing — the rendered one, behind the paywall cookie, after the JavaScript ran — as a document, via POST /grab (HTML to Markdown, no outgoing request from the server). One extension can serve multiple targets, links get tags as pills instead of #hashtags, and the packages for the browser stores build with a single command.

The credential behind it is new too: integration tokens, long-lived and narrowed — an scp profile plus a project pin per token, multiple profiles per token, and revocation that checks the pin against lost updates. Sharing a scoped key is not sharing your account.

Encryption that stops at the server

Age encryption inverts the usual cloud deal: the server stores only ciphertext, and the key stays with you. The server manages age-encrypted documents without ever holding a key — it sees armor, metadata, and a locked marker. Decryption happens where the key is: in Cortex, in the foot view (passphrase or identity file), on your machine. Agents participate through doc_encrypt, which checks the write gate before encrypting — a tool that can lock a document still respects who may write it.

The crypto lives in a dedicated module (vance-age, a Java facade over jagged’s age-v1 implementation) with a TypeScript twin (@vance/age), so both ends speak the same format without sharing infrastructure.

Benjy: orchestration for small models

Benjy is an iterative orchestration engine built for models in the range the benchmark matrix covers — small, local, cheap. The task queue is the state: a Ford-doer works one item, a mechanical check plus a small LLM eval decide whether it’s done, and a reflection gate stands before DONE. Safety nets measure progress and cost, not volume — an agent that writes a lot but decides nothing does not pass. A structural item-charge cap keeps a confused loop from burning tokens, the todos projection streams into the UI, and a delegation manual teaches the orchestrator to spawn orchestrators.

And because a council shouldn’t need a frontier model either: Zaphod session mode runs a reactive council chat per user turn, with head replies as interim notes, a pinned synthesis model, and a bundled seven-philosopher recipe.

Guards, quizzes, and a paint job

  • Shooty graduates from a completion guard to a guard system with points — START, COMMAND, completion — and a START guard can replace the turn prompt entirely, so per-user-turn policies are now scriptable.
  • Workbook forms and quizzes: a vance-field block and a button action registry, quizzes with reset, resolve, and persistent score, and free-text answers graded by an internal form-judge LLM profile.
  • Report themes: per-customer CSS themes layer onto the PDF export, and the web UI’s markdown preview picks up the same theme.
  • Tenant UI theming: custom CSS and a header logo, tenant-wide.
  • Scheduled model discovery (opt-in) captures model info and endpoint pricing as they ship it, and writes prices as manual docs — discovery and pricing stay source-separated.

Everything else

  • Facelift is release-ready: Capacitor 8 toolchain, optional PIN lock, Play Store signing, real Android icons — and i18n across the federation boundary, so every addon’s client strings translate.
  • Setup agent mode: both setup wizards are headless-driveable via YAML config, fail-closed — the exact path an LLM agent or a CI job takes.
  • File tools get an If-Match guard (contentHash on file_read, expectedContentHash on file_edit/file_write) against silent last-writer-wins.
  • defaults_list/defaults_read ship the bundled vance-defaults to agents; ai_model_current answers “which model is this chat on?”; location_get is a client tool with browser-native permission state.
  • Follow-up gained an optional FIM-completion path for the edit mode; Cortex got menu mount points and selection-translate for every text document; Foot got /new and /ui-new; the recipe picker got categories, a search field, and a projectKind filter.
  • Empty-response diagnostics: phantom tool calls are detected and reported instead of surfacing as an empty chat turn.
  • Build hygiene, mostly invisible but real: ESLint now fails the client build, Java sources are Spotless-formatted with a ratchet, and PMD runs with a curated ruleset — six adoption rounds burned the baseline down.

Worth knowing before you upgrade

0.4.0 is a minor bump below 1.0, so it’s allowed to break. The client stack moved (js-yaml 5, Electron 44, Capacitor 8), the Docker images are on Docker Hub as 0.4.0 and latest, and the full list — including the fixes — is in the changelog. The CLI installs as brew install mhus/vancetope/vancetope; Java-free bundles for all four platforms hang on the release.

Try it

  • Get started — the Docker stack, a couple of commands, a few minutes.
  • Bring your own model — Vancetope ships no model; you connect your own.
  • Something broken? Discussions or an issue. Still early, still rough, still real.

Onward to 0.5. 🚀

🎉 more confetti