--- title: "Cerevisor 3.4 and 3.5: send a workflow as one file, then steer its agents mid-run" slug: cerevisor-v34-v35-share-and-steer date: 2026-09-23 excerpt: Cerevisor 3.4 lets a workflow leave the computer it was built on, as a moved folder or as one shareable file. Cerevisor 3.5 lets a person talk to agents while they work. Here is what the two releases make possible together, and where they still stop. featured_image: "https://bbtxujdxvidaghmhxkqs.supabase.co/storage/v1/object/public/generated-images/blog-1790144478240-cerevisor-v34-v35-share-and-steer.webp" featured_image_alt: "Illustration of two laptops on a wooden desk: a glowing sheet of paper floats out of one, and beside the other a teal chat bubble sits next to a chain of small connected cards." author: Kinan Hamwi author_url: https://www.linkedin.com/in/kinanhamwi/ canonical_url: https://cerevisor.com/blog/cerevisor-v34-v35-share-and-steer updated_at: 2026-09-23T06:21:22.626809+00:00 --- # Cerevisor 3.4 and 3.5: send a workflow as one file, then steer its agents mid-run TLDR Cerevisor 3.4 (21 September) lets a workflow leave the computer it was built on: move its folder, or send it to someone as one file carrying nothing private. Cerevisor 3.5 (today) lets a running Claude Code agent take new instructions mid-run, and a Codex agent ask a question instead of giving up. Together, a workflow can be handed over and then talked to. Until this week, an honest description of a Cerevisor workflow was “it works on the computer it was built on, and runs the way it was told”. A workflow here means a set of AI agents laid out on a canvas, each with its own job, handing files to each other in order. Once started, it could be watched, paused or stopped, but not told anything new. The 3.4 release changed the first half of that sentence. The 3.5 release, two days later, changed the second. Read together, the two notes describe one idea. --- ## Why a workflow used to be stuck on one computer Every Cerevisor workflow works inside a folder: the place its agents read input files from and write results to. Before 3.4, a saved workflow remembered those files by their full address on the disk, user name included. Copy the project to a new laptop or an external drive, and every agent went looking at addresses that no longer existed. In 3.4, files inside the folder are saved as positions inside that folder. Move the whole folder with the workflow file in it and the agents find everything again. Files that really live outside the folder keep their full address; Cerevisor does not guess a new home for them. When the workflow file travels without its folder, it still opens, with a card saying it was saved on another computer and two buttons: choose a folder here, or create a new empty one. Pick a folder holding none of the expected files and the card simply stays, so a wrong first guess is never final. An agent card also marks an input file as not there when it is missing and no earlier agent will write it, which catches a broken move before a run. Underneath, world and workflow files (a world is one file holding several workflows) are now written to a side file and swapped in only once complete, so a crash mid-save does not leave a half-written file. A footnote from the code: if the system refuses the side file, Cerevisor falls back to an ordinary save. --- ## Sharing an AI agent workflow as one file Moving is for your own machines; sharing is for someone else’s. In 3.4, Share on any workflow or whole world writes one file another Cerevisor user can open. Nothing is uploaded; the sender chooses how it travels. The interesting part is what the file refuses to carry. It holds the agents, their instructions and any text files the sender ticks. It never holds where anything lives on the sender’s computer (so no user name), which AI model and provider (the company whose service an agent calls) each agent uses, the keys that pay for them, secrets (only their names travel), the sender’s approvals, schedules, run history, recordings, chats, or anything the agents wrote. It does carry the workflow’s own rules about which tools each agent may use. What it drops is the sender’s agreement to those rules. The file is plain readable text, so the sender can check all of it before sending. 10 MB the most a shared workflow file can carry in all, with no single file over 1 MB. Only text files travel. Key Insight A shared workflow arrives with its rules but without the sender's approval of them. The receiver's machine has never agreed to anything on its behalf, so the first run shows the normal pre-run summary, a plain list of what will run and on which model, and asks. Opening one is deliberately cautious. Before anything is written, a dialog shows the agents, the files that will be created, what the sender left out and what this computer is missing, beside a plain warning that it came from someone else. Cerevisor makes a new folder, overwrites nothing, runs nothing, and re-checks the file with its own rules rather than trusting how it was made. Sharing is free on every plan. For anyone evaluating an [AI agent platform](/blog/ai-agent-orchestration-platform) for a team, a colleague can now review a workflow without a screen share or a folder full of private paths. --- ## Decision steps a reviewer can actually inspect A decision step is an agent that reads evidence prepared by earlier agents and makes a call, such as approve or reject, with a quoted reason. In 3.4, each decision card has an Inputs button showing exactly what the model was given. Agents feeding a decision are told how much room they have and sent back once if a file runs over. A refusal now names its real cause, such as too large, an unreadable file type or a missing file, where one sentence used to cover several problems. And evidence from a spreadsheet file, refused every time before, can now be quoted as label and value pairs from one row. --- ## Steering a running AI agent in 3.5 Before 3.5, noticing a running agent heading the wrong way left blunt options: pause it, let it finish and redo the work, or stop it and start again. In 3.5, a message sent to a running [Claude Code](/blog/harness-supervisory-engineer-org-chart-box) agent (Anthropic’s coding agent) is delivered at its next tool step, meaning the moment it is about to take its next action, such as reading a file or running a command, or just before it would finish. The action it was about to take is set aside, and it reconsiders with the new instruction in hand. Sending a message never grants a permission and never cuts off a tool that is already running. Codex agents (OpenAI’s coding agent) got a different conversation. When one needs a decision, it shows the question, with options when it has them, in Cerevisor’s question panel and continues with the answer. Before, it stopped with a report saying it was blocked. The answer never loosens its sandbox, the set of limits on what files and commands it may touch. The third change sounds small and is not. Agents that run inside their own separate tool used to be told only about the files the workflow declares, a narrower limit than the one really in place. Codex, Cursor and Grok Build agents are now told their real scope: their working folder plus those files. (The notes list Antigravity too; in the code it gets its own rule sheet naming its working folder and output files.) --- ## New models and a split view that keeps its place 3.5 also adds three models. Claude Opus 5.5 costs $4 per million input tokens and $20 per million output tokens (a token is roughly a short word or part of one). It always thinks before it answers; the thinking setting still chooses how hard it thinks but cannot turn thinking off. A setting that simply says Opus now means Opus 5.5, while a workflow saved with a specific model keeps it. GPT-6 Sol ($2 / $10) and GPT-6 Luna ($0.10 / $0.50) are available for Codex and for connections that use OpenAI’s format; Codex’s default model is unchanged. Split view, which shows two worlds side by side, now keeps a separate world in each pane: switching worlds moves only the pane showing the chosen one. Dragging a world to the canvas edge now opens a split for any world, and mouse drops are no longer lost. --- ## Three workflows this pair of releases makes practical **Hand a research workflow to a colleague and let them run it on their own keys.** They review it before anything is written, connect their own providers, and the first run asks for their consent. **Move a project between a desktop and a laptop without re-pointing every file.** Carry the folder, open the workflow file, and the agents find their inputs. **Run a long coding job and correct it without throwing away the first half.** Send the Claude Code agent a sentence when it drifts, and let a Codex agent in the same workflow ask instead of stalling. > 3.4 let the work leave the computer it was made on. 3.5 let a person talk to the work while it runs. Handing over and speaking up turn out to be the same idea. --- ## Known limits across 3.4 and 3.5 Both notes carry an honest limits section. They belong in any evaluation. - **Moving:** Cerevisor looks for the folder one level up from the workflow file and no further. Schedules, watch triggers, secrets, run history and chats do not travel. An older Cerevisor cannot find files saved the new way, so the other person should update first. - **Sharing:** only text files travel, up to 1 MB each and 10 MB in all; images and PDFs are named as left out. A shared file is a snapshot, so later edits do not reach a copy already sent. - **Decisions:** an existing workflow that mixes decision steps and regular agents in one column has to be separated before it runs. - **Mid-run messages** reach Claude Code agents and Cerevisor’s own agents only. Codex, Cursor, Antigravity and Grok Build agents refuse them with a sentence; stop the agent and restart it with the new instructions. - **Codex questions** happen only when the agent decides to ask. A Codex request for desktop control still cannot be approved from inside Cerevisor. The notes are also plain about testing. As the 3.5.0 notes put it: > "In the full run, 973 of 979 test files and 11,914 tests passed." Cerevisor 3.5.0 release notes, September 2026 The same notes say nothing in 3.5 has been exercised by hand in an installed app yet, and 3.4 says the same about moving and sharing. Every claim here comes from the two release notes and the code behind them; where they disagree, I went with the code. --- ## What I would try first after updating If I were evaluating Cerevisor for [AI agent management](/blog/harness-human-in-the-loop-ai-interrupt-budget) this week, I would skip the new models at first. I would share one small workflow with a colleague, open the file in a text editor before sending it, and check that no path, key or approval is inside. Then I would run a Claude Code agent on a task it tends to get slightly wrong, and correct it with one sentence halfway through. The full detail is in the [3.4.0 notes](https://cerevisor.com/releases/v3-4-0) and the [3.5.0 notes](https://cerevisor.com/releases/v3-5-0), and the [run and monitor guide](https://cerevisor.com/docs/guides/building-workflows/run-and-monitor) covers the run window and the panel where agents ask questions. Existing installs get 3.5 through the built-in updater, and fresh installers are on the [download page](https://cerevisor.com/download). #### Sources - [Cerevisor 3.4.0 release notes](https://cerevisor.com/releases/v3-4-0) - Cerevisor, 2026-09-21 - [Cerevisor 3.5.0 release notes](https://cerevisor.com/releases/v3-5-0) - Cerevisor, 2026-09-23