Cerevisor 3.9.0: Agents use websites and apps, free canvas, a folder per workflow

Your agents can now use a website or a desktop app for you, one careful step at a time, under your approval mode. A new free canvas lets you place agents anywhere, gather them into groups and talk to a whole group with one message. Each new workflow keeps its files in a folder of its own. The plans are now Free, Pro and Power, with unlimited storage on every plan.

1. Agents use websites and apps

An agent opens a site in Cerevisor’s own browser, or a window of an app you allowed. It reads the buttons, links and fields there, then clicks and types one step at a time. Every step passes your approval mode first. Both are on every plan.

Browsing websites. Turn it on in Settings → Permissions: turn on Web access, then Browse websites, and choose Approved sites only, Anywhere or Off.

• Approved sites only opens a site on your list and its subdomains. When the agent asks for another site, you are asked in Oversight and in Auto, and a yes opens that exact site for the rest of the run. In Hands-free, and in a run nobody is watching, the site stays closed.
• Never opened, whatever the setting: an address on this computer or your home network, an address with a user name or password written into it, and anything that is not http or https. Requests for your camera, microphone, location or notifications are refused.
• Sign in with a Vault password. Fill in Websites where an agent may type this password on the secret and assign it to the agent. Cerevisor types the password only on those sites, only on https, and only into a real password field. The agent, its model and TypeSafe never see it.
• Downloads land in the downloads folder inside your workflow folder, with File creation on. Oversight asks before each one. Programs, scripts and disk images ask in every mode, and a file over 200 MB is not saved.
• Each workflow has its own browser. A sign-in stays with that workflow between runs, and no other workflow sees it. Up to 4 browsers are open at once.

Using apps on this computer. Turn it on in Settings → Permissions → Apps on this computer: turn on Use apps on this computer, open the app, press Add a running app and pick it.

• Your list is the only list. The picker warns you before you add a program that opens many different windows, one that runs commands typed into it (a terminal, File Explorer, Task Manager), or a web browser, which reaches any website signed in as you.
• Chromium and Electron apps are read too, such as ChatGPT, Slack, Teams and VS Code.
• One agent at a time, across all runs. A bar at the top of the screen names the agent and the app, with a Stop link and a Show button that brings the app to the front.
• Ctrl+Alt+Esc stops it at once (Ctrl+Alt+F12 when another program holds that key; Control+Option+Esc on a Mac).
• Before every step Cerevisor brings the agent’s window to the front and checks it again at the moment of the key or the click. If you click into another window, the step is not done and the task ends.
• Never in a run nobody is watching, and no password is ever typed into an app.

One click on the card. An agent card has Browser and Apps switches next to Vault secrets. A switch gives the agent the tool and tells it to use it before anything else. When a switch is greyed out, the card says why, under the switches.

Watch or take over. Watch an agent’s browser while it keeps working, from the run window or from its chat. Take it over from there: while you hold it, the agent waits and its time limit stops. Hand it back and the agent reads the page again before it does anything.

What asks you first

The step	Oversight	Auto	Hands-free
Reads or moves around: reading, scrolling, going back, following a link, typing into a search box	Done	Done	Done
Sends or saves: submit, send, post, book, save, pressing Enter, a button with no name, a download	Asks you	Done	Done
Deletes, changes a sign-in or pays: delete, close an account, change a password, pay, buy, check out, transfer money, uninstall	Asks you	Asks you	Checked against your instructions

• Paying counts with deleting, because a payment cannot easily be undone. That step asks every time, even if you chose Always allow.
• Hands-free never asks. Before a step that deletes, changes a sign-in or pays, your agent’s own model checks it against what you wrote: the agent’s instructions, your notes at the start of the run, and the run’s message. If your words do not clearly cover the step, or the check fails or takes longer than 60 seconds, the step is not done.
• Typed text is recorded as a number of characters in the step records, the run’s log and the audit trail.

TypeSafe can choose the steps: turn on Use TypeSafe to choose steps when an agent browses or uses an app in Provider Hub → Quick checks. Your agent’s own model takes over when TypeSafe is unsure, and TypeSafe never types text or a password.

Browsing works for agents on Cerevisor’s own engine: Anthropic, OpenAI-compatible providers and Gemini. Using apps is on Windows and on a Mac.

2. Free canvas: agents anywhere, groups, one message to a group

In the Workflow bar, press Free canvas, right after the Software factory button. The waves are gone: put each agent wherever you want and talk to it through its chat.

• Groups. Select two or more agents and press Group, or Ctrl+G. A group has a name, a light border and its own Message box. A message sent there goes into the chat of every agent in the group.
• The agents work together on the board. Each agent in a group message is told who the others are, and asked to say what it is taking on and to read what the others post. Every agent chat now has the workflow’s team board, and agents on outside tools can read it while they work.
• Stop at every level. While an agent replies in its chat, the Run agent button above its card becomes a red Stop. A group has its own Stop, and on a free canvas the Workflow bar’s Run becomes Stop all agents while anyone replies.
• The AI Builder knows the free canvas. It places agents without waves and can make groups from your chat. Build and run step by step (Progressive Mode) is off on a free canvas, and the regular builder takes the message.
• Run works through waves, so it is off on a free canvas. Switch back to waves at any time.

3. Each workflow keeps its files in its own folder

A new workflow keeps its files in a folder named after it, inside the folder it works on:

Your folder/
└─ Social Pipeline/
   ├─ results/     what the last run made for you
   ├─ handovers/   files one agent passes to the next
   ├─ kept/        logs and ledgers that carry over from run to run
   └─ runs/        the earlier runs, newest first

• Each output file on an agent card is a Result, a Handover or Kept. Cerevisor picks one, and you can change it on the card. The file moves with it, and the file links of every workflow that reads it follow.
• A new run files the run before it. The last run’s handovers move into runs/<date and time>/, with a copy of its results and its report, so your agents never read last week’s file by mistake. Cerevisor keeps the newest 5 runs; change it in Settings → Workflow → Earlier runs to keep.
• Put back the last good results. If a run fails or you stop it, this button puts results/ back as it was when that run started.
• Older workflows can tidy up once. Cerevisor offers to move an existing workflow’s files into its own folder. It shows you a preview first, and nothing moves until you press Tidy. Undo the tidy, in the footer, puts the files back.

4. Three plans: Free, Pro and Power

• Free is for personal use, learning and teaching, and nonprofits. It keeps 2 active workflows from 1 world.
• Pro includes every feature except four, and keeps 15 active workflows across 3 worlds.
• Power includes everything with no limit: Operator and the team conversation (both experimental), running workflows from scripts and other programs, and Factory mode.

If you bought a license before, you are on Power. The plan that covered everything has a new name. The Subscription tab reads Cerevisor Power, and there is nothing to do.

Nothing is limited when you build. Creating, importing, duplicating, branching, editing, saving and exporting workflows and worlds work the same on every plan. A plan sets how many workflows are active at once. A workflow becomes active when you run it, as long as your plan has room. When your active workflows are full, Make room to run lists them, and Set aside and run swaps one out at once. A workflow you set aside stays saved, editable and exportable. Settings → Subscription → Active workflows shows what is active.

A run that is already going always finishes. The later rounds of a loop and the later steps of a pipeline take no extra room. The Powers a workflow calls need to be active along with it, and Cerevisor says so in plain words before anything runs. A scheduled run that cannot become active does not start, and the schedule shows the reason.

The 7-day trial still includes everything, with no card. Prices are on cerevisor.com/pricing.

5. Memory that serves you

• Memory is chosen by meaning. Each agent gets what is relevant to its task, ranked by Cerevisor’s on-device model, in whole sentences.
• Rate what an agent was given. In the Pre-Run Preview, mark a memory Useful or Not useful. Not useful takes it out of every prompt straight away.
• One switch for everything: Memory view → Reflection → Memory in prompts. Turn it off and no stored memory goes into any prompt, including the Operator’s.
• Open questions expire. An unknown you dismissed stays dismissed, and the rest expire after 14 days.

6. Agent chats

• Copy the whole conversation from the chat window’s title bar, or with Copy conversation in the ⋯ menu. A box of code in a reply has its own copy button.
• Your answers show where they happened. An answer to an agent’s question, and a message you send while it replies, now show in the reply.
• A file link in a reply opens the file the agent wrote.
• Thoughts and words stream again on every provider.
• Ready for new work. One button on each agent card resets its chat and turns the card a calm blue, so you can see who is free.
• Sub-agents show as dots at the sides of the agent’s head, and a card shows a chat reply as work.
• A long chat starts fresh with a handoff, and Cerevisor warns you when an agent’s instruction file is large.
• Chat replies count as runs in Analytics, the Models tab and learned routing. The Models tab shows every model you used, with a fair success rate and readable names.

7. The help chat shows you

Turn on Point on screen, the small switch under the help chat’s question box, then ask “where is…” or “how do I…”. The rest of the app dims, a cursor glides to the part, and a short note shows beside it. It only points: it never clicks, types or runs anything. It points inside Settings and the model providers too.

The help chat also reads your agent chats when you ask about them. You can paste or drop pictures into it, and when your model can see images it can take a picture of the Cerevisor window to answer. Its own instructions are 60 % lighter, and it is better at reading the right help page.

8. Smaller things

• One click selects an agent card, and a double-click opens its settings.
• Back and forward buttons next to New window take you to the agent or workflow you were at before.
• A large editor for an agent’s instructions.
• Pick your look on the first screen, with a theme wheel. The window buttons follow the theme.
• The input strip sits on a workflow’s left border, taller and easier to hit, and can be turned off from its panel.
• Agents at work show as dots beside Select / Pan.
• Run status and Log are in the footer; the run pill is gone.
• A workflow’s frame follows its agents and their chat strips.
• Panning stays smooth on large workflows and large worlds.
• A narrow window keeps the whole app inside it: the skills pane, the run controls and the footer no longer slide off.
• The run log window resizes from its top-right corner too.
• The AI Builder applies a large change in parts, keeps its raw output out of the chat, and continues its chat on a subscription app instead of reading everything again.
• Connecting an AI is not blocked by out-of-date model data in the Provider Hub.
• Renaming an open world from Home keeps the new name, and the workflow rail holds only the workflows of the world on screen.
• The Learning settings tab has two controls: Enable learning experience and Replay onboarding.

Changes to how every run behaves

• Connected tools are given to agents one by one. A new workflow gives its agents none. Turn on MCP servers on an agent’s card, next to Vault secrets, to choose which of your servers that agent may use. The AI Builder and the Operator can give them too. Workflows you already have still give every server to every agent; to change one, set its MCP mode to None in its workflow settings and switch servers on, card by card. A shared workflow you open arrives with connected tools off.
• Connected tools also reach agents on Grok Build and Antigravity, through Cerevisor, which decides every call.
• A reader is skipped instead of reading last run’s copy. In a workflow with its own folder, when the agent that writes a handover does not write it again, the agent that reads it is skipped, as when any input is missing. Before, it ran on the old content.
• An agent’s command stops with everything it started, and a finished run stops the agent’s background commands unless the agent keeps one. Agent commands run below normal priority, and only one test run or build at a time, so your computer stays responsive.
• A run nobody is watching refuses instead of asking. In a scheduled, Operator or unattended factory run, a step that would have been put to you is refused at once, and the agent is told how to allow it next time.
• A factory check that could not check is not retried. When the checker found nothing wrong but could not run its checks, the item says so instead of starting a second try.
• The browser presses letters and digits on a page that listens for keys when no text field has the focus.
• folder.md stays Cerevisor’s. When an agent replaces it, Cerevisor writes it back, and agents are told to leave it alone.

Security

• Electron 44.4.5 (Chromium 152.0.7977.130), unchanged from 3.8.1.
• Nothing new leaves your computer unless you turn on TypeSafe for steps. With it on, TypeSafe is sent the task, the page or window’s title and address, its visible text, the steps so far and the names of its buttons and fields. A field’s contents are left out, no picture is sent, and Vault passwords are removed first.
• The agent’s browser is separate from every browser you use, keeps one profile per workflow, and never opens an address on this computer or your home network.
• The list of active workflows is kept on this computer and holds names, ids and times only. No run, model or token is counted for billing, and the plan check happens in the one step every run passes through.
• No new dependency. The browser is Cerevisor’s own Chromium. On Windows the app helper is PowerShell; on a Mac it is macOS’s own osascript.
• Fixed: none since 3.8.1.
• Open: a few reported weaknesses remain in a library that the Cursor integration brings in. Cerevisor does not use the affected parts. They go when Cursor’s SDK moves to the fixed version.
• Windows installers are not yet code-signed, and macOS builds are not yet notarized.

Known limits

• Browsing has not been tried on real websites yet. It was tested on pages served from the same computer. A site that blocks automated browsers blocks this one, and a page drawn on a canvas has no buttons to read.
• Cerevisor reads a step’s risk from the words on and around the button, in English. A payment button with an unusual label may not ask in Oversight and Auto.
• A browser or app task is bounded: 40 steps, 5 minutes, and it stops after 3 steps in a row that change nothing.
• Apps: Store apps on Windows (Calculator, Settings) cannot be used yet. Text with a line break is not typed. A window that runs as administrator ignores the input. A program is matched by its name only.
• Using apps on a Mac has not been tested on a Mac yet. It was built and checked on Windows.
• The folder layout and the tidy were tested on Windows, not on a Mac and not on a synced folder (OneDrive, iCloud). A file a sync client holds locked stays where it is, and the run goes on.
• Everything listed under 3.1.0’s through 3.8.1’s known limits still applies.

Platforms

Available for Windows, macOS (Intel and Apple silicon) and Linux (AppImage and Debian package). Using apps is on Windows and on a Mac only; on Linux the setting does not appear.

Updating

On Windows and Linux, existing installations receive the update through Cerevisor’s built-in updater. On a Mac, download the new version from cerevisor.com/download and replace the app in Applications. Your workflows, run history and settings carry forward untouched.