## [0.96.5] - 2026-08-24 ### Added - Added root-only version-aware durable learning state that recognizes installed runtime and memory-policy transitions, attaches one exact claim to the existing provider reflection turn, and automatically revalidates durable intent, corrections, reusable procedures, preferences, and project knowledge through the existing evidence-gated memory and skill tools. - Added bounded, lock-serialized transition history with strict retry/continuation settlement, child and worker zero-footprint behavior, byte-preserving unsupported-state fallback, and canonical OKF routing while workflow context keeps references instead of duplicate truth. ### Fixed - Stopped repeated tool-call cycles after three identical observable-result periods without preempting changing results before the existing configurable coarse fuse, and gave active goals state-changing recovery guidance instead of re-polling unchanged status. - Kept goal satisfaction and increment aligned with final acceptance by requiring trusted evidence before either transition, repairing legacy satisfied-but-unproven requirements before completion, surfacing unproven requirement IDs, and returning generated evidence IDs with their trust status. ## [0.96.4] - 2026-08-23 ### Fixed - Restored OpenRouter Ox Alpha tool use by defaulting it to Pi's text tool protocol and omitting the unsupported `reasoning.effort: none` default. ## [0.96.3] - 2026-08-23 ## [0.96.2] - 2026-08-23 ### Fixed - Made foreground and delegated-worker retries honor provider wait boundaries and fail closed when a requested wait exceeds the configured maximum. - Kept signed commentary and orchestration payloads out of the visible assistant transcript while retaining normal assistant text. - Let accepted xAI streams use the HTTP-bounded quiet-stream allowance before first generated progress instead of the generic short first-token timeout. ## [0.96.1] - 2026-08-22 ### Changed - Kept durable goals active across bounded runaway guards, stalled turns, repeated requirement blockers, and timed-out workers; each condition now injects recovery guidance and requires a different autonomous approach instead of silently waiting for manual continuation. - Automatically reopened goals blocked by bounded runaway/provider-turn guards when restoring a session while preserving explicit owner pauses, cancellations, terminal failures, budgets, and approval boundaries. ### Fixed - Prevented internal goal-continuation and recovery notices from impersonating new owner turns and repeatedly re-admitting an unchanged failed tool operation; real successful operations and new user turns still advance recovery. - Honored the resource selector's exact negative extension filter when deciding whether to load default-on TPS. - Made background completion summaries report succeeded, verification-needed, failed, and canceled counts as disjoint outcomes instead of describing failed work as both finished and failed. - Kept every provider default resolvable after catalog refreshes and moved the retired Cerebras default to `gpt-oss-120b`. ## [0.96.0] - 2026-08-22 ### Added - Added one canonical five-phase work lifecycle—Survey, Contract, Plan/Route, Execute, Prove/Deliver—wired through the existing goal, task, delegation, evidence, and approval owners, with project-relative POC/MVP versus complete-feature delivery contracts. - Added a scrollable Ctrl+Q work inspector for full goal, requirement, evidence, task-plan, worker, and background-tool details. - Bundled the passive TPS footer meter as a default-on extension for fresh installations. ### Changed - Made solo/team routing, independent review, and verification depth adaptive to delivery risk and evidence instead of treating long work as an automatic team trigger. - Classified one plain local `git commit` as a reversible scoped checkpoint after green verification while keeping composed commands, history rewrites, push/tag/release/publish, and destructive operations approval-gated. ### Fixed - Preserved active-branch ancestry when excluding lifecycle-ledger records from compaction input, preventing context accounting from collapsing to only the newest tool result. - Reconciled already-notified terminal tmux jobs into freshly hydrated host lane state so absent workers cannot remain displayed as active. - Kept the five-phase lifecycle contract within chat and minimal model prompt budgets across host checkout-path formats while retaining the full contract for larger profiles. ## [0.95.0] - 2026-08-22 ### Breaking Changes - Removed tmux standing dispatch grants and the public `workerDelegation.writePaths` setting. Workers now receive one immutable launch profile; an omitted path inherits machine-wide project access and an explicit path narrows the worker. - Native delegated workers are leaf agents. Fresh nested delegation is rejected, and worker profiles no longer expose recursive-agent limits. - Replaced delegated `readPaths`/`writePaths` and task-profile resource/budget overrides with focused model, thinking-level, path, and tool controls that can only inherit or narrow the foreground authority. - Renamed delegated query-only memory retrieval from `memory` to `memory_read`; the raw root `memory` tool is no longer valid in worker profiles. ### Added - Added lightweight worker profile controls for model, thinking level, path, and tools, with exact model-pin conflict handling and inherited foreground defaults. - Added fresh, worker-safe adapters for bounded artifact retrieval, toolkit scripts, skill search/read, and skill audits without sharing foreground extension/session instances. - Added a root-only, default-on reflection cue consumed inside the orchestrator's next ordinary provider turn, with audited automatic application for safe additive memory and skill writes. ### Changed - Collapsed the remaining worker, background-tool, worktree, and process-supervision messages into one-line TUI activity summaries, with one in-place thinking/working lane and compact verification identifiers. - Made native and tmux workers autonomous by default: routine dispatch needs no grant, Pi workers inherit compatible parent tools and resources, and managed tmux panes receive their initial task only after capture is armed. - Made the foreground cost guard an explicit opt-in; legacy positive thresholds remain dormant until enabled. - Goal completion now refuses every open task step, active goal-owned worker or tool task, cited unfinished tool task, and active pipeline. - Moved automatic reflection into the current root session with no isolated/background model request; automatic background Auto Learn launches are disabled while explicit `/auto-learn run` remains available. ### Fixed - Prevented duplicate or stale background terminal wakes by rechecking durable observation and goal ownership at the provider boundary. - Prevented OKF organization from matching or deleting a substring of a hot-memory fact; exact removal now occurs under the managed memory lock. - Isolated default AgentSession test storage from the real user agent directory. - Made tmux deadline handling terminate the owned pane, while dismiss only detaches supervision. - Rejected every fresh-only model, thinking, path, tool, profile, or fork override when reusing a persistent worker instead of silently ignoring it. - Blocked direct `run_process` argv access to worker-private auth, session, settings, and memory paths while preserving ordinary machine-wide project access. - Bounded and made cancellable worker skill audits, and rejected explicit profiles whose requested worker adapter is not active instead of silently narrowing them. - Moved provider tool-guideline budget diagnostics out of the chat renderer and into `/context` diagnostics. - Dismissed pending current-session reflection cues and refreshed the root prompt synchronously when reflection is disabled, preventing stale learning work from resurfacing after re-enable. - Bounded reflection response scanning, accepted writes, memory and skill fields, automatic overlap audits, and `skillify` draft bodies; truncated automatic promotion audits now fail closed. - Omitted raw root memory tools and prompt snapshots from child sessions; managed workers receive memory only through the bounded, source-labeled query broker. - Corrected platform-aware machine-root resolution and case-insensitive drive deduplication so Windows multi-drive workers retain machine-wide authority without global reservation serialization. - Routed bundled tmux extension dependencies through the embedded package runtime so compiled Bun releases load the manager without missing `dist/core` modules. ## [0.94.1] - 2026-08-21 ### Added - Added orchestrator-owned project OKF organization with proactive local recall, bounded read-only worker queries, and loss-safe audited rollback. ### Changed - Unified foreground tools, background tasks, and delegated workers under compact `Performed N actions` activity counters with details available through Ctrl+T. ### Fixed - Suppressed already-observed background completions and late duplicate parent wakes while retaining durable terminal handoffs for explicit verification. - Kept reflection and durable memory lifecycle writes exclusive to the main orchestrator, including managed-worker and Auto Learn subprocesses. - Isolated project OKF records and rejected unsafe paths, symlink traversal, oversized fields, conflicting overwrites, and stale rollback deletion. ## [0.94.0] - 2026-08-21 ### Breaking Changes - Removed extension `toolGroup` and `toolGroupSummary` rendering hooks; every model tool invocation now follows the native action-transcript contract. ### Changed - Replaced Bash, file, skill, goal, task, worker, and extension-specific collapsed cards with one append-only `Performing N actions` / `Performed N actions` row. Main-chat actions stay collapsed; their only detailed projection opens through Ctrl+T. ### Fixed - Kept repeated calls as distinct transcript actions instead of relocating presentation instances, and moved operational session warnings from permanent chat lines to the transient activity lane. ## [0.93.19] - 2026-08-21 ### Changed - Collapsed every agent Bash invocation into bounded command-counter rows, moved expanded transcript scrollback to Ctrl+T, and replaced hidden reasoning lines with one in-place Thinking/Working status; direct user shell output remains visible. ### Added - Added fingerprint-only provider request snapshots, atomic foreground tool reservations, canonical result terminals, compaction lifecycle brackets, and deterministic interrupted-session repair. ### Fixed - Fixed auto-compaction preflight to anchor ongoing same-model sessions to provider-reported usage and account only request-envelope changes, preventing fixed character heuristics from compacting code/tool-heavy histories prematurely. - Fixed provider-usage admission reintroducing context-GC-removed history, and made post-compaction usage staleness follow durable branch order instead of message timestamps. - Fixed memory-provider lifecycle hooks so hung providers time out, are abandoned across reload generations until their late operation settles, and emit bounded source-labelled diagnostics. - Fixed budget-limited goals remaining projected as active, malformed requirement dependencies crossing storage boundaries, worker model pins being hidden from persistent-agent listings, and public subscriber failures escaping the session event boundary. ## [0.93.18] - 2026-08-21 ### Fixed - Matched Grok subscription compaction to the installed CLI lane: reuse the live structured session prefix, tool catalog, cache affinity, priority-processing wrapper, 80% trigger, original-request-plus-checkpoint replacement, and a durable full-transcript pointer while leaving API-key xAI behavior unchanged. ## [0.93.17] - 2026-08-21 ### Fixed - Learned a bounded next-attempt first-progress timeout from censored stream stalls, scoped it to comparable prompt sizes, and cleared it after a successful stream instead of repeating identical Grok timeout windows. - Allowed credential-safe source brace globs and explicit source filenames even when one path is stale, while retaining directory and dotenv protections. - Bounded retained failed jscpd evidence by age, count, and total bytes while protecting concurrent scans and explicit report directories. ## [0.93.16] - 2026-08-20 ### Fixed - Recovered repeated xAI retained-history token-generation failures after one unchanged retry by performing one bounded provider-recovery compaction and continuing the same foreground run. - Prevented print/RPC JSON streams from repeating the complete accumulated assistant prefix on every delta, which could turn one long response into gigabytes of output; streaming records now stay below 50 KiB and the terminal event remains authoritative. ## [0.93.15] - 2026-08-20 ## [0.93.14] - 2026-08-20 ### Fixed - Adapted the first model-progress watchdog to measured prefill throughput so zero-output Grok subscription turns fail promptly without constraining genuine long reasoning. ## [0.93.13] - 2026-08-20 ### Added - Added autonomous machine credential discovery and encrypted Bitwarden Secrets Manager profile storage. ### Fixed - Preserved failed background child results as operation outcomes and made waits event-driven without losing terminal parent wakeups. - Kept worker terminal reports inline through 50 KiB, then persisted the complete output and returned its verified file pointer. - Allowed agents to start durable goals autonomously while stripping unapproved token budgets and generating stable record IDs. - Blocked credential-file access before tool execution and serialized concurrent Secrets Manager profile mutations. ## [0.93.12] - 2026-08-20 ### Changed - GitHub release publication now requires isolated npm/Node and Bun binary smoke tests covering model discovery, streamed prompts, and interactive TTY conversations. ## [0.93.11] - 2026-08-20 ### Added - Added bounded model-blind credential discovery for the current working tree and process environment, so agents can locate and organize supported local secrets without asking owners for source paths or variable names. - Added provider-native `/fast` controls with an enabled-state footer badge: OpenAI Codex and Grok use priority/default processing independently from reasoning effort. ### Changed - Durable goal creation is now available at agent discretion during ordinary owner turns while exact token budgets remain owner-controlled; explicit chat goal phrasing still starts goals directly. ## [0.93.10] - 2026-08-19 ### Fixed - Preserved classified tool-execution metadata through credential-output redaction, so completed non-zero shell exits remain `operation_outcome` results in the real session runtime instead of reverting to harness failures. - Stopped goal continuation after an aborted/error provider turn and suppressed idle autosteer after an interrupted foreground response, preventing one abort from consuming the entire stall allowance with immediate hidden replays. ## [0.93.9] - 2026-08-19 ### Fixed - A shell command that runs to completion and exits non-zero is now reported as an operation outcome rather than a tool failure, so a red test baseline, a search that matched nothing, or a false predicate reaches the model as its own verbatim output and no longer consumes recovery budget. Timeouts and blocked broad searches remain tool failures. - Removed the task-step "recovery exhausted" guidance branch. Task context is only ever injected alongside a user prompt, and a user turn already re-admits the operation, so that branch could only ever describe a refusal that had just been cleared. - Aligned lean and minimal system prompts with the agent package's shared retry rule: an unchanged operation is not replayed immediately and is readmitted after another successful tool call or a new user turn. ## [0.93.8] - 2026-08-19 ### Fixed - Bash failures now carry the exit code and a stable SHA-256 digest of the complete raw output, independent of bounded previews and managed output paths. ## [0.93.7] - 2026-08-18 ### Fixed - Fixed native Windows RPC shutdown after a persistent PowerShell command by re-arming child terminal observation before teardown. ## [0.93.6] - 2026-08-18 ### Changed - Context GC keeps investigations intact: the recency window default rose from 8 to 24 messages, tool results referenced in recent assistant turns are protected from packing (superseded reads still pack), and packed stubs now cite retrieval as an imperative `read ` call. - Skill vault loads accept an optional pin (up to two): pinned skills are protected from eviction while loaded, still expire idle and count against the slot and byte budgets, and eviction now honestly selects the oldest-loaded unpinned skill (per-skill use is unobservable, so the previous least-recently-used ordering was effectively load order). - The standing system prompt slimmed down: the N+2 architecture and evidence-gate statutes moved out of the full core into on-demand skills (new bundled `n-plus-2-architecture`; existing `evidence-gated-tdd`) behind one pointer line, and the contract gained explicit precedence (current-turn user instructions override standing style, never security) and answer-shape rules (analysis asks get complete answers; harness protocol text is never restated as an answer). - Release preparation now delegates mandatory full-suite validation exclusively to successful GitHub Actions CI on the exact preflight HEAD; local release commands never run the full suite. ### Fixed - Same-batch edits to one file no longer collide: an identity change observed at execution triggers a bounded re-read and anchor revalidation (twice at most), with the write serialized against this process's mutation queue and checked against the revalidated version immediately beforehand, and a stale anchor caused by this run's own earlier mutation says so. A write by another process landing between that check and the write itself is still neither detected nor preserved — an unchanged pre-existing limitation, now stated literally in the code instead of described as atomic. - File-identity checks no longer discard the nanosecond timestamps `stat` already returns, so a same-size in-place rewrite completing inside one millisecond is now visible to the edit tool's staleness checks instead of comparing equal. The two identity fields are optional additions, so existing implementers of the published inspection contract are unaffected. - Policy rejections that teach no longer lose their lesson to diagnostic truncation: broad-search blocks resolve through a catalogue entry whose guidance carries the narrow-form advice and the `broadSearch="route-to-file"` escape route un-truncated. - Tests spawning the CLI as a child process now pass the suite's `pi-source` resolution condition, so a stale gitignored `dist` build can no longer crash the child at startup and fail six startup tests with unrelated assertions. - Blocked-replay and circuit-exhaustion failure records now lead with the retained root-cause diagnostic and carry the replay or circuit notice in a separate note field, and the all-caps recovery corrections were replaced with one calm actionable sentence each — anti-replay semantics, thresholds, and termination unchanged. - Compacted lean system-prompt guidance: streamlined Windows bash tool guidelines and tightened the lean operating contract so 16k context-window models stay within the 8192-character capability budget under representative Windows runner working directory paths. - Hardened Windows process lifecycle and worktree cleanup synchronization: synchronous best-effort termination now feeds one keyed, watchdog-bounded shell barrier that tracks every admitted child generation through `close` and reports strict release failures; worktree harnesses compare platform-correct canonical paths, clean all owned roots after partial initialization, and retain teardown errors; worker model pin tests use authoritative event-driven completion without polling; and background tool handoff has a deterministic tool-start barrier. ## [0.93.5] - 2026-08-17 ### Changed - Made the skill vault multi-slot: up to three concurrent skills share one byte budget with least-recently-used eviction, load results state the pending activation, base directory, and any evicted skills instead of claiming immediate activation, and unload/status operate per slot. - Bash failure results now report the effective working directory the command ran in on a final `cwd:` line — shell-reported `$PWD` from a collision-safe length-framed POSIX exit sentinel, or the state-tracked effective cwd on the Windows contract — and the tool description states the persistent-cwd contract. ### Fixed - Stopped tool-failure records from destroying evidence: missing-path failures retain the diagnostic naming the exact path, and executed process-exit failures carry a bounded sanitized tail of the command output as evidence while blocked replays gain nothing new. - Made catalogued per-error guidance lead the failure correction ahead of the recovery gate's loaded-action text, so specific advice (such as listing a missing path's parent) is no longer displaced by generic repair-action instructions. ## [0.93.4] - 2026-08-17 ### Changed - Made active extension/project/account tools explicitly on-demand: availability, wildcard profiles, repository context, prior sessions, or tool guidance alone no longer establish relevance, and optional credential gaps do not trigger speculative `secret_store` use. ### Fixed - Made stale `edit` anchors return a bounded digest-qualified snapshot from the exact current source checked by the atomic matcher, while keeping exhausted edit operations local so corrective reads and changed edits remain available without redundant post-success rereads. - Fixed workflow lifecycle and capability envelope defects: enforced mutating tool capabilities on `pipeline`, `worktree_sync`, and `improvement_loop`, unified cwd-aware path envelope evaluation across relative roots and denied subtrees, prevented stranded waiters and admission races across manual and automatic compaction, re-armed multi-batch goal auto-continuation loops without phantom budget charges on pre-provider exhaustions, stage-scoped open pipeline checklist gates, bounded recursive stage output discovery against external symlink escapes, and captured trailing out-of-process mailbox replies on timeout without error suppression. - Re-authorized action-sensitive memory and pipeline calls at the compiled gateway while preserving explicit extension manifests, kept delegated memory query-only, enforced credential-migration source scopes, and gated every context-scout child read through one immutable caller envelope without inventing outer paths for composite or fixed-store reads. - Persisted exact pipeline run/stage checklist links with explicit unlinking and one authoritative normalization/bounds path, serialized project-wide pipeline lifecycle mutations across processes, and made run/definition/context restoration project-owned, symlink-safe, bounded, disk-authoritative, fail-closed on corrupt or conflicting manifests, and resilient to stale or unavailable session snapshots. - Preserved primary manual-compaction failures through reconnect cleanup, kept path-scope authorization realpath-authoritative while denying resolved escapes, isolated malformed pipeline definitions, and made bounded durable reads symlink-resistant and version-stable while context-scout line counting stays constant-memory. - Restored background tool tasks only from the active session's bounded fork lineage, excluding unrelated records from task lists and monotonic task-id allocation. - Kept constrained system prompts within their cross-platform capability budgets by canonicalizing resources to LF, using compact connector/edit/checklist guidance, and charging pipeline-link instructions only when the pipeline tool is active. ## [0.93.3] - 2026-08-17 ### Changed - Made root and nested-worker delegation guidance provider- and reasoning-independent with task-scoped parallelism criteria, removed per-dispatch budgets from model-facing worker starts and task profiles, disabled foreground cost warnings by default, and left worker-tree cost/time ceilings unbounded unless explicitly configured. ### Fixed - Kept local worker terminal messages out of provider usage and reservation accounting, classified worker protocol faults without transport retries, and allowed incremental edits after prior successes without cross-operation failure-family shutdowns or contradictory completion guidance. ## [0.93.2] - 2026-08-17 ### Fixed - Prevent image-heavy sessions from entering ineffective auto-compaction and report fixed versus compactable context separately when bounded compaction cannot recover. ## [0.93.1] - 2026-08-17 ## [0.93.0] - 2026-08-16 ### Breaking Changes - Removed `ACTIVE_SKILL_CONTEXT_CUSTOM_TYPE`; active skill guidance is now projected through `AgentContextPlan.transientSystemPrompt` instead of a custom message. ### Added - Added compact provider-neutral `create_goal`, `get_goal`, and `update_goal` lifecycle tools on every model-capability class, backed by the existing authoritative goal executor and persistence path. - Added `--service-tier` and a session-level `serviceTier` SDK option so harness requests can opt into xAI Priority Processing while retaining request-level overrides. ### Changed - Split the coding-agent CI suite into four independent shards per OS and removed test-only system setup from release fast paths, targeting a sub-five-minute critical path without reducing coverage or Windows worker parallelism. - Replaced eager agent-core runtime barrel imports with lean owner entry points to reduce `AgentSession` startup and focused-test import time. - Updated the Anthropic SDK and sandbox-runtime extension examples to the current releases. ### Fixed - Kept Linux-relative Windows benchmark ratios visible without letting independent runner variance block binaries that satisfy the absolute release budgets. - Projected transient active-skill guidance through the provider system channel so models cannot mistake repeated skill projection for new user instructions. - Kept every collapsed tool panel header-only, including partial, failed, extension, unknown-tool, lazy-history, and direct-shell results, until the user expands it, without orphan expansion hints for renderers that intentionally stay blank. - Made goal auto-continuation independent of research/delegation lane capability and host-counted unchanged passes toward the durable stall limit, preventing models from bypassing the stop by omitting `no_progress`. - Let compact lifecycle models report concrete active progress and reject agent-requested goal blocking until three consecutive stalled turns have been recorded while keeping active-goal provider context within its 400-character overhead budget. - Recorded and reported provider-turn cost-fuse stops distinctly from repeated identical-tool loops, including the correct durable goal stop reason. ## [0.92.0] - 2026-08-15 ### Breaking Changes - Native Windows now requires PowerShell 7 (`pwsh.exe`) as its sole agent-shell host; legacy Windows PowerShell 5.1 and custom non-`pwsh` shell paths are rejected. ### Changed - The persistent Windows PowerShell host now uses process-scoped headless performance settings and a warmed command path without changing the native code page; managed Unicode stays UTF-8 and mixed Windows-1252 output is decoded compatibly. ### Fixed - Bun-compiled binaries now await CLI startup, preventing RPC mode from exiting before it attaches stdin and returns the first response on Windows. - Windows runtimes now prewarm and validate one persistent PowerShell process without a disposable startup probe, and release publishing is gated on native x64/ARM64 latency against Linux. - PowerShell command completion now joins stdout with a nonce-framed stderr barrier, preventing late stderr from leaking into the next command or racing session teardown. - Worker-lane teardown now disposes the complete Windows shell execution session before temporary directories are removed, preventing locked-cwd `EPERM` failures. ## [0.91.4] - 2026-08-15 ### Fixed - Empty `profile_inspect` bases no longer read as a start gate. Native `delegate start` still omits `profileId` and uses `authority`; `profile_create` is the only action that needs an owner-authored explorer or implementer base. - An explicit owner phrase such as `this is a goal` or `the task is a goal` now starts the durable goal from the rest of that message or the previous user task, instead of only authorizing a later `goal start` tool call. - Handover language after `this is a goal` (`by the way`, `i'm handing over`, sub-agent/role assignment) is classification, not the objective. The previous user task becomes the goal. - `delegate start` with only the shared-schema `task` field now starts the worker using that brief. Sending both `task` and `instructions` is still rejected so neither value is dropped. - Failed ad-hoc Python `-c`, Node `-e`/`--eval`/print, and interpreter heredoc probes no longer advertise workspace edit/write repair. That guidance was steering the model to rewrite the probe instead of stopping. - `read` on a Pi session `.jsonl`, including sessions under a configured custom agent directory, now returns a labeled user/assistant/summary/tool transcript. Authoritative compaction and branch summaries remain visible, while thinking, signatures, summary details, and successful tool payloads are omitted. - Owner course-changes such as `instead of …, I want to …` and `I want to refactor …` now start the durable goal and authorize `goal start`. - Explicit goals queued behind an active turn are admitted only when their user message starts, so clearing the queue cancels them and their first request plus retries retain the declared token-budget lease. ## [0.91.3] - 2026-08-15 ### Fixed - Release promote now dispatches the destructive suite on `release-vX.Y.Z` instead of a raw commit SHA, which GitHub rejects and left promote polling until timeout. - Release prepare now refuses unless HEAD already has a successful `ci.yml` run, so a red or unfinished tree cannot buy another full Ubuntu+Windows matrix or burn a version number. - CI skips `npm test` and the Windows runner on `Release v*` commits and on the tag publish quality gate. The suite already ran locally (`./test.sh`) and on HEAD. Workspace tests now stop at the first failing package or file. ## [0.91.2] - 2026-08-15 ## [0.91.1] - 2026-08-15 ### Added - Host-owned `pipeline` tool walks numbered folder stages (ICM): status is `output/` files, increment completes the current stage then starts the next. `task_steps advance` and `goal increment` share that complete-current-then-start-next verb. Goal complete refuses an active pipeline; pipeline increment refuses linked open task_steps and running `tool_task`s. Current-stage context is injected as a GC-managed `` page. Workers and lean models cannot activate `pipeline`. The bundled `icm-architect` skill is the authoring method for building a workspace; the runtime does not name it from the tool. ## [0.91.0] - 2026-08-14 ### Breaking Changes - Omitted worker `forkTurns` now defaults to self-contained birth context (`none`) even for same-provider/model root workers. Set `forkTurns` to `all` or a positive turn count to inherit sanitized parent turns. - Repository `AGENTS.md`/`CLAUDE.md`/`GEMINI.md` stay off until a settings layer sets `projectContextFiles` to `"on-demand"`, which lists paths only. They are not injected. Global `~/.pi/agent` context files remain mandatory. `--no-context-files` no longer disables the global file. ### Changed - Packed tool output and truncated bash/python model previews now keep a head+tail window so first hits and terminal errors both survive. Live TUI preview stays tail-only. Full output is still saved to the artifact or managed file. - Repository `AGENTS.md` loading is opt-in per directory. Default is global `~/.pi/agent` files only. `/settings` → Project AGENTS.md enables listing this project's files or keeps global-only; save per directory, project, or all projects. - Collapsed file edits no longer dump the full diff. Consecutive edit/write calls group into a count, a 2–3 file snippet, and the last successful action; `Ctrl+O` expands the full list. Thinking blocks are hidden by default (`hideThinkingBlock`, `Ctrl+T` to show). - Collapsed tool groups use human nouns: Task Step(s), Skill(s), Worker(s). Skill, Skillify, and Skill Audit share one skills group. - Worker terminals that need parent review no longer interrupt the owner with Review now / Keep blocked. The parent agent wakes on the existing terminal handoff and decides via `delegate` status/review. The human stays on the edge: no blocking owner question is queued. - `Ctrl+O` only expands or collapses tool output. Deferred session history loads on `Ctrl+Shift+H` (`app.history.load`) so an expand never remounts the transcript. - Exported `loadProjectContextFiles()` now matches the live loader: default is global files only; `includeProject: true` lists project paths without injecting their bodies. - Long-term memory retrieval now consults a local durable graph when one is present on disk, so graph recall happens automatically on the next turn. - Wired built-in `memory`, `skillify`, `skill_audit`, and `improvement_loop` onto the default capable-session tool surface so they activate when the model/session can use them. Session create now initializes the bundled memory providers, so SDK sessions that never bind extensions still get the `memory` tool when the grant allows it. A `memory` write of a repeatable procedure now triggers reflection, and a clean `promote_skill` lands as a loadable skill under stock policy. An owner who enabled auto-apply and omitted `skill` still keeps that ceiling. Workers still cannot take the write/self-adaptation tools. - Goal, `task_steps`, and `tool_task` now share a live join: a still-running background tool cannot verify goal evidence, agent complete refuses while linked checklist steps or cited tool tasks remain open, and continuation waits on those running tasks. - A just-written or archived skill refreshes the live catalog, so `skill` search/load can use it in the same session without `/reload`. ### Fixed - Goal start authority now accepts owner speech such as `this is a goal, use it` while still rejecting `goal-oriented` compounds and ordinary task text. - Failed goal actions, including unauthorized start, now return `isError` so tool-failure recovery can block unchanged retries in the same turn. - Failed `delegate` validation, API-correction, and start-skip results now return `isError` so unchanged retries are blocked instead of burning another worker turn. - Worker `delegate list` now marks which session peers the caller can control. Nested-limit guidance tells the model to reuse only `controllable=true` descendants, not siblings. - Nested worker start is rejected at admission when the tree already holds its `maxAttempts` ceiling, instead of returning started and dying before the first provider token. - Corrected the `delegate` `forkTurns` parameter description so omitted starts document `none`, matching the runtime default. - A worker tool denial for an exhausted token/cost/wall/tool budget now terminals the lane instead of blocking one call and letting the model retry other paths. ## [0.90.12] - 2026-08-14 ### Fixed - Stopped `task_steps_context` from telling the model to continue an in_progress step after tool-recovery exhaustion of the last unchanged operation. - Healed extension tool calls that omit identity already produced by a successful result from the same extension (for example `boardId` after `resolve_project_scope`), so the next call executes with that evidence instead of repeating the empty operation. ## [0.90.11] - 2026-08-14 ### Fixed - Anchored Windows tool/recovery/package-command fixtures to `realpathSync.native(tmpdir())` and gave the leftover module-level bash tool a disposable session, so release-gate load no longer hangs `exit 1` or `rmSync` on 8.3 short paths. ## [0.90.10] - 2026-08-14 ## [0.90.9] - 2026-08-14 ### Fixed - Disposed the session resource-loader extension generation on shutdown so Windows can remove the session tree instead of hanging `rmSync` after an all-active profile load. ## [0.90.8] - 2026-08-14 ### Fixed - Rejected provider requests from goal-owned foreground executions after their authoritative goal becomes paused, blocked, usage-limited, completed, cancelled, budget-limited, replaced, or cleared, without mislabeling generic stopped goals as token exhaustion. - Parsed natural-language goal token budgets with spelled-out units and separator grouping ("5 million", "500 k", "1.000.000"), failed closed on unparseable explicit ceilings, and scoped budget parsing to text outside the goal objective so subject-matter numbers are never adopted as ceilings. - Stopped goal executions cleanly before the next provider call when the token budget crosses mid-turn, instead of truncating output at a tiny cap or surfacing a synthetic error message; wrap-up turns after a mid-turn goal stop drain gracefully while dead goals still cannot restart. - Recorded buffered goal usage loudly (warning plus continuation failure) when execution state vanishes instead of silently discarding spend. - Projected budget-exhausted worker attempts that finish with partial claims as budget-exhausted, and tallied blocked/partial/canceled workers in a new attention count so terminal statuses always partition. - Bounded a hung worker wait when a blocked write-reservation restore left it with no deadline, evaluated the deadlock guard before the yield erases its evidence, and cleared yield bookkeeping on denied restores so concurrency is not over-admitted. - Woke a blocked worker-wait restore from the write-reservation availability event instead of a 1s poll, so swarm waits resume on the release that unblocked them; the 300s bound remains a watchdog, not a retry loop. - Stopped worker lease heartbeats at run completion and fenced renewals with the lease captured at start, so stale runs cannot extend foreign leases and successful workers are not converted to failures during finalization. - Restored bounded default worker-tree ceilings ($0.50 / 120s); unbounded trees are an explicit opt-in only. - Excluded retired agents from nested-session delegation limits. - Kept a stuck worker terminal handoff observable and recoverable: an observe-only watchdog warns, the undelivered batch is preserved for restore, and durable identity is ensured at flush time so restarts replay it without redispatching in-flight work. - Ordered mandatory delegate directives ahead of optional profile listings in the provider guideline budget, dropped overflowing guidelines whole with a visible diagnostic instead of truncating mid-word, and surfaced worker model pin gaps (roles-only configs list unpinned roles; delegations bypassing pins via an unpinned role are flagged). - Released write-reservation leases on coordinator dispose and stopped leaking the goal execution lease on a synchronous prompt failure. - Centralized goal-active checks behind isGoalExecutionActive with a boundary rule banning inline goal-status comparisons outside core/goals. - Stopped labeling OpenRouter's OAuth (a permanent API-key exchange, not a subscription) as "(sub)" in the footer/usage cost summary and stopped routing its billing failures through subscription-hop failover; both now key off the provider's `isSubscription` flag instead of bare OAuth-auth-type. ### Added - Showed each OAuth provider's login label (e.g. "Sign in with SuperGrok or X Premium") as secondary text in the `/login` provider selector. - Documented xAI (Grok/X subscription), Kimi Code, and OpenRouter under docs/providers.md's Subscriptions list; added `grok`/`supergrok` CLI provider aliases for `xai`. ### Changed - Split releases into prepare and promote: the tag is created only after CI is green on the exact release commit, staging uses an explicit allowlist, the gate guard is an execution proof, and changelog or release-note gaps abort loudly. - Made model catalog generation hermetic by default (live fetch only with PI_FETCH_MODELS=1) with a scheduled drift check that fails on removal of repo-referenced models. - Extracted extension runtime binding from AgentSession into ExtensionBindingController and ratcheted the session line ceiling down (4000 to 3900). - Defaulted the xAI provider to grok-4.6; the native catalog is grok-4.5 and grok-4.6 on the subscription Responses path. - Added the full H1 crash sweep and executable invariant catalogue (`test:destructive`), plus a nightly/dispatch `destructive.yml` gate that `release:promote` requires before tagging. - Added H3 seeded interleave and H4 virtual-time soak to `test:destructive` (INV-W1/W2/W3/W5/B1 under shuffled worker ops; stall/worker-wait/budget and stuck-notify/heartbeat watchdogs). - Documented the propertyAliasNormalize repair mode in the bundled tool-call-repair skill and reference grammar. ## [0.90.7] - 2026-08-13 ### Fixed - Acknowledged worker terminal notifications at durable message acceptance without redispatching an in-flight handoff, and prevented late goal-bound terminals from restarting a stopped parent. - Required current owner authorization for model-created goals and exact owner authorization for token ceilings. - Charged every goal-owned provider response with the shared cache-discounted token rule and bounded each subsequent provider output by the remaining explicit budget. ## [0.90.6] - 2026-08-12 ### Fixed - Fixed oversized extension tool prompt snippets and guidelines crashing session startup instead of being bounded for provider-visible context. ## [0.90.5] - 2026-08-12 ### Added - Added optional provider-neutral worker model pins with global-first role/default precedence, immutable fresh-worker and verifier admission, fail-closed validation and availability checks, effective-binding reporting, and zero provider prompt/routing overhead when unconfigured. ## [0.90.4] - 2026-08-12 ## [0.90.3] - 2026-08-12 ### Fixed - Removed the implicit `$0.50` and two-minute worker-tree ceilings while preserving explicitly configured global, profile, and inherited budgets. - Renewed durable worker leases during long provider and tool waits so active workers can checkpoint and publish terminal handoffs after the original lease expiry, with host-safe intervals for explicitly unbounded leases. - Rejected `laneId` on `delegate start` instead of silently discarding it and creating an unexpectedly anonymous worker. - Preserved provider-authored `delegate` arguments while sanitizing action-specific dispatch copies so durable worker transcripts cannot diverge after tool execution. - Retried provider-neutral isolated worker error completions and retained bounded failure detail for durable recovery instead of flattening them to `model_error`. - Suppressed ineffective auto-compaction retries when the next context estimate drifts downward without material growth. - Classified recursive ancestor-directory shell searches as broad and exposed the existing bash timeout ceiling in the tool schema so model-generated calls cannot silently request millisecond-style hour-long commands. - Kept ordinary fresh delegation lean when budget authority is omitted, exposed explicit per-worker authority ceilings alongside inherited and profile budgets, removed the runtime-only verifier role from the model-facing start contract, restored bounded recursion to the profile-free baseline, and kept that recursion when ordinary worker tools are narrowed unless an explicit capability restriction makes the worker a leaf. - Limited profile-free workers to one direct child at depth one through immutable admission state, while preserving broader owner-authored profile limits and preventing descendants from widening an ancestor's limit. - Limited the lean profile-free session to one retained nested identity across all root workers so parallel roots cannot each create a duplicate child tree; authored profiles can explicitly raise the session-wide nested limit. - Aligned PowerShell discovery with its cold-start availability probe and bounded the native incident-collector test around both PowerShell subprocesses under loaded Windows/WSL hosts. - Marked broad-search guard rejections as pre-execution operation feedback so compaction cannot promote a corrected search call into a harness failure. - Defaulted nested workers to self-contained birth context so foreground orchestration instructions cannot make a scoped read-only leaf report missing parent authority as a harness failure; explicit same-model inheritance remains available. - Marked inherited foreground history as context-only in the mandatory worker system contract so parent-owned orchestration cannot override the latest task envelope or consume nested capacity. - Classified queued workers as admitted event-driven work across start, status, and task projections, forbade interrupting healthy workers to force a queue, taught read-only authority narrowing for genuine parallel review, and required cancellation of a superseded queued task after its replacement starts so safety serialization cannot become duplicate execution. - Preserved review-pending results as `partial`, project-level blockers as `blocked`, and evidence-classified retries as nonterminal so foreground orchestration does not mistake them for harness failures. - Rejected worker self-waits and made child waits yield then reacquire the caller's exact fenced write reservation so queued recursive orchestration can run without concurrent mutation or a parent-created deadlock. - Identified depth, direct-child, nested-session, and session identity capacity denials as expected policy outcomes and directed workers to reuse an eligible idle worker instead of misreporting the denial as harness instability. - Required parents to drain every paginated child transcript before judging a terminal handoff and added mandatory literal guidance that delivered `worker_blocked` claims are task blockers, not lost worker state or harness failures. - Allowed one exact failed shell probe to run again after a successful `edit` or `write` mutation in the same canonical workspace, while keeping policy failures, unrelated workspaces, and untrusted custom adapters isolated. - Distinguished explicit-reply inbox waits from worker-completion waits, preserved pre-deadline completion through delayed caller-resource restoration, reported late idle results as completed-after-timeout, required non-timeout idle waits to retrieve durable claims through status or every transcript page, classified suspended workers as durable nonterminal state with host-owned retry guidance, and added mandatory literal timeout and follow-up guidance so waits cannot become false worker stalls or missed-completion diagnoses. - Rejected profile-only `task` and top-level `budget` fields on `delegate start` instead of silently dropping a child objective or turning explicitly bounded work into an unbudgeted dispatch; mandatory guidance classifies both as expected API corrections and requires one immediate retry with the value unchanged in `instructions` or `authority.budget`. - Preserved attempt-local and worker-tree budget exhaustion as authoritative `budget_exhausted` terminal outcomes instead of flattening bounded denials to generic `completion_error` failures, with mandatory handoff guidance that earlier transient transcript errors cannot replace the terminal cause. - Classified an unknown optional worker profile as correctable routing policy, with mandatory guidance to omit `profileId` for adaptive authority or use an exact listed preset instead of reporting harness failure. - Classified unavailable optional worker models and presets as correctable routing policy, with mandatory guidance to omit the model/profile selection and inherit adaptive authority instead of reporting harness failure. - Classified `agentId` as reuse-only in mandatory guidance and treated an unknown reuse identifier as a side-effect-free API correction rather than lost worker state or harness failure, preserving the instructions and intended authority for one fresh retry. - Kept the fully wired root delegate schema and guideline surfaces below the provider startup ceilings while retaining explicit budgets and mandatory caveman task, budget, timeout, reuse, and profile rules. - Kept terminal worker execution errors separate from harness health and added mandatory caveman handoff/status guidance that tool timeouts and provider, API, network, WebSocket, fetch, overload, or exhausted-retry failures must not stop healthy siblings unless orchestration state, delivery, or control evidence actually fails. ## [0.90.2] - 2026-08-11 ## [0.90.1] - 2026-08-11 ### Fixed - Projected failed and canceled background-task waits as tool errors, and blocked active goals after recovery-exhausted or runaway stops so automatic continuation cannot restart the loop. ## [0.90.0] - 2026-08-11 ## [0.89.0] - 2026-08-11 ### Fixed - Kept the Windows Bash tool schema within the provider-context budget without removing its routing contract. - Made process-matrix watcher ticks expose their asynchronous completion to deterministic timer drivers. ## [0.88.0] - 2026-08-11 ## [0.87.0] - 2026-08-11 ### Breaking Changes - Removed `formatSkillsForPrompt`; skill catalogs are no longer rendered into system prompts. Use the host-owned `skill` vault/tool lifecycle. - Provider prompt additions from extensions must use replay-safe `context.transientMessages`; `before_provider_request` now rejects payload growth after request admission. ### Added - Added autonomous model-blind credential migration from environment variables, dotenv files, and credential/key files into current-project Bitwarden profiles without exposing values; an unavailable TUI vault requests only one masked `BW_SESSION` key before continuing. - Added import-free provider-prompt and tool-contract budgets that reject oversized harness prose before it reaches a model. - Added provider-only extension context messages that remain outside durable session history and compaction summaries while participating in complete request admission. ### Changed - Compressed system, tool, worker, recovery, and dynamic provider context while retaining mandatory rules, exact capabilities, security boundaries, and user or skill content. - Unified worker status, review, event waits, and profile management under `delegate`; removed `context_audit` and obsolete split delegation tools from the default model surface while retaining `/context` and explicit diagnostics. - Changed skill discovery to retain bounded frontmatter only; one compact tool now searches metadata and loads one exact body request-locally, while the host owns monotonic usage, idle expiry, file/profile invalidation, and context-cost reporting. ### Fixed - Made tool-failure recovery records explicitly mandatory and guaranteed one tool-free user delivery after the recovery circuit opens. - Made provider request planning transactional across extensions, memory, goals, active skills, tool projection, and text-only tool protocol; only durable history is compacted, replanned history is adopted by the live loop, and irreducible mandatory envelopes fail explicitly. ## [0.86.17] - 2026-08-10 ## [0.86.16] - 2026-08-10 ### Fixed - Fixed Windows tool-failure recovery contract fixtures to use canonical temporary paths. ## [0.86.15] - 2026-08-10 ### Added - Added explicit recovery contracts for `read`, `write`, `edit`, and `ls`; only raw successful `write` evidence from the same backend authority and canonical path can prove that a missing file was created, while inspection and retarget actions require changed calls. Custom operation adapters must share an explicit authority before cross-tool recovery is taught or admitted. ## [0.86.14] - 2026-08-09 ## [0.86.13] - 2026-08-09 ## [0.86.12] - 2026-08-09 ## [0.86.11] - 2026-08-09 ### Fixed - Preserved `reply_target_forbidden` for explicit destination overrides on `reply` while allowing extraneous fields on `inbox` and `reply` to be automatically sanitized. ## [0.86.10] - 2026-08-09 ### Fixed - Fixed delegate tool rejections by auto-sanitizing extraneous optional fields on flat action schemas so LLM dispatches proceed cleanly without dropping execution. - Increased terminal handoff timeout to 30 minutes (1,800,000ms) and ensured active subagent progress runs unconstrained while idle watchdogs handle transport stalls. - Reinforced Team Lead orchestration policy and event-driven wakeup so orchestrators immediately address subagent help requests and steer active parallel execution. ## [0.86.9] - 2026-08-09 ### Fixed - Fixed host-denied capability tool calls (like writing outside workspace bounds or accessing private memory) permanently marking the overall agent worker attempt as blocked; agents can now self-recover from a policy denial and complete the task successfully. ## [0.86.8] - 2026-08-09 ## [0.86.7] - 2026-08-09 ### Fixed - Fixed delegate worker authority hallucinations crashing the worker by normalizing platform tool aliases (`python_tool` -> `python`, `powershell` -> `bash`) and automatically reconciling the `workflow.delegate` capability when the orchestrator explicitly includes the `delegate` tool in authority constraints. - Removed Windows-specific `powershell` prompt guidelines and tool manifests to enforce the strict bash shell contract and prevent model confusion. ## [0.86.6] - 2026-08-08 ### Added - Enforced goal-graph dependency validation during worker admission, blocking worker dispatches whose target requirements depend on unsatisfied or open requirements. - Automatically injected memory query capability and memory tools into worker execution plans when memory retrieval is enabled. ### Fixed - Allowed auto-injected memory query capability and memory tool through worker execution contract boundaries without violating static capability ceilings. - Exempted worker verification requests from goal-graph dependency checks so completed worker tasks can always be verified. ## [0.86.5] - 2026-08-08 ## [0.86.4] - 2026-08-08 ### Added - Made persistent workers the default delegation workflow: `delegate start` with an `agentId` now dispatches the new task onto that existing worker's durable conversation (idle agents only; the worker keeps its admitted authority — passing `authority`/`profileId` is rejected with `reuse_keeps_admitted_authority`; busy/unknown agents fail with explicit reasons), `list` reports each agent's live `activity` so idle specialists are discoverable, and the tool contract teaches the orchestrator to prefer reuse over minting unnecessary fresh worker identities. Starting without `agentId` creates a fresh specialist identity and conversation whose bounded birth context follows `forkTurns`. - Added a host-owned, restart-durable worker attempt ladder: a delegated worker that fails on an evidence-classified transient error (network, 5xx, rate limit) is suspended durably and re-enqueued after jittered backoff, resuming from its persisted transcript under a fresh fence — instead of terminalizing and forcing the orchestrator to re-delegate blind. Bounded by the grant's durable `maxAttempts` ceiling (default 2 total attempts; `maxAttempts: 1` never ladders), evidence-gated (failures without a classified transient cause never retry), and restart-safe through persisted suspended state and the existing recovery path. - Added a live agents panel (`ctrl+q` toggles, `escape` closes; configurable via `app.agents.open`/`app.agents.close`) as the detail view behind the statusline's aggregated concurrency counts: each worker lane with status, runtime, profile, elapsed time, and cost, plus running background tools — rendered in the same orchestration-panel row language as the delegate tool output. - Added a shared bounded `delegate tasks` view of durable DAG tasks and attempts, same-objective `dependsOn` dispatch gates, peer `broadcast`, event-driven `wait_many`, subtree-scoped wake/control actions, durable root reply inboxes, and replay-safe idle-leaf retirement that preserves agent bindings and transcripts. - Added immutable sanitized worker birth context with `forkTurns: "none" | "all" | "N"`: same-provider/model children inherit all bounded complete turns by default, cross-provider/model children default to none, and explicit cross-boundary inheritance is rejected. ### Changed - Redesigned the activity statusline above the editor into a fixed-slot layout (turn state · plan position · concurrency counts · last event): slots keep stable positions instead of shifting as chips arrive, concurrent background tools aggregate into per-runtime counts (`2 bash · 1 python`) instead of enumerating task ids, background tool chips show the task description instead of internal `tool-task-N` ids, color now carries status only, and only the plan slot truncates when width runs out. - Bounded recursive orchestration before durable side effects (depth 8, 64 direct children, 256 each for session agents, tasks, and attempts, and 256 queued dispatches), persisted retry eligibility as exact `notBefore` deadlines, and exposed bounded retry/dependency state through the shared task projection. - Raised the default global worker concurrency from 1 to 20 while retaining explicit positive safe-integer overrides and the existing fixed fleet, queue, budget, and write-reservation safety bounds. ### Fixed - Fixed TUI startup benchmarks stopping the renderer without disposing session-owned resources, which left packaged smoke and profiling processes running indefinitely. - Fixed the native Windows incident collector honoring an ambient session-directory environment variable over an explicitly supplied agent directory. - Fixed persistent-worker control recovery so task-bearing wakeups, terminal handoffs, and inferred replies remain crash-safe and replay-safe after mailbox history pruning; bounded mailboxes now reserve mandatory byte, entry, and replay-evidence capacity, terminal notification failures retry autonomously, session-root replies use an explicit acknowledged inbox, and poisoned terminal-correlated tasks no longer block later work. - Fixed delegated workers dying with bare `completion_error`: token budgets now charge prompt-cache reads at 10% instead of face value (a fixed ~3k-token cached system prompt no longer turns `maxTokens` into a request counter), non-viable grants (`maxTokens` under 5000) are rejected at `delegate start` with `token_budget_below_floor` instead of starving mid-flight, worker failure summaries and research lane results carry the underlying executor error, and transient provider failures (socket drops, 5xx, rate limits) retry with jittered backoff inside the worker attempt instead of failing instantly at $0. - Fixed corrupted TUI rendering (stale duplicated status lines, wrapped line fragments) on terminals that render East Asian ambiguous characters (`·`, `…`, `●`) as two columns, such as Windows consoles with a CJK codepage/font: the renderer now probes the terminal's actual character width at startup and recalculates layout accordingly. - Replaced timer-loop parent terminal-handoff retries with one bounded attempt-keyed retained queue that drains only on explicit terminal, mailbox-capacity, state-change, and recovery events; exact replays are inert, conflicts fail closed, callback failures remain retained, and reentrant signals redrain without polling. - Fixed worker orchestration edge cases around bounded transcript paging, reopened transcript equality, tied attempt timestamps, long mailbox-control payload sanitization, paused suspended resumes, and concurrent mandatory verifiers: raw-entry cursors now disclose empty continuations and oversized-message omissions, canonical JSON and shared tool-detail retention prevent false divergence after a locked reopen, durable insertion order selects activity, paused work stays nonterminal, and admitted verifier demand retains queue/projection headroom plus capacity-event replay. - Fixed orchestration authority drift by routing command admission, event replay, and snapshot recovery through exact shared reducers and strict codecs; canonical persistence and replay now reject unsupported fields, conflicting identities, invalid graph relationships, and divergent retained state, while file-locked exact-content reconciliation prevents stale worker-session owners from duplicating durable control delivery. - Fixed persistent-worker transcript and completion ownership: one revision-fenced conversation core now verifies exact append bytes and bounded callback-evidenced suffixes across retries and cancellation, rejects stale supported writers, ownership-boundary content changes, unreserved results, and late output, preserves immutable birth metadata, accounts cumulative retry cost, and retains shared provider reservations until returned usage is charged. - Fixed worker crash recovery discarding a durably persisted empty terminal response and calling the provider again; recovery now replays the empty completion so the original deterministic output validation runs without duplicate work or cost. - Fixed malformed ancestor `.git` markers capturing project credential scope; repository discovery now requires a bounded, valid symbolic or detached Git `HEAD` before reading remote configuration. ## [0.86.3] - 2026-08-06 ### Fixed - Enforced a maximum 1-level delegation nesting model (orchestrator + leaf workers): removed `delegate` and `workflow.delegate` from default worker authority, and rejected nested subagent `delegate` `action: "start"` calls with `subagent_delegation_disabled`. ## [0.86.2] - 2026-08-06 ### Fixed - Aligned memory state sidecar paths with the `managedMemoryStateFile` SSOT, preventing root-level `.pi-managed.json` file generation beside `MEMORY.md` / `USER.md`. - Enhanced `migrateAgentDirLayout` to automatically discover and migrate unexpected root files and folders under `~/.pi/agent/` to their canonical `state/` directories. - Relaxed `wrapToolWithCredentialExposureGuard` to execute tool calls without upfront blocking errors on search or Python scope heuristics, relying on redacting loaded secrets from tool results instead. ## [0.86.1] - 2026-08-05 ### Fixed - Matched active project credentials across canonical, symlinked, and Windows short-path working directories, and aligned orchestration regression gates with explicit non-delegating leaf profiles and effective profile-free capability telemetry. ## [0.86.0] - 2026-08-05 ### Breaking Changes - Replaced the local `SecretVault`/dotenv-materialization API and model-driven credential mutation actions with a provider-neutral credential manager backed by Bitwarden; the model-facing `secret_store` now exposes only status, metadata listing, and project-authorized activation. ### Added - Added automatic pinned `bw` provisioning, the private `/secrets` owner workflow, portable Git-project bindings, cross-machine Bitwarden sync, and in-memory credential injection for Bash, Python, and allowlisted direct processes without exposing `BW_SESSION` to model-controlled execution. ## [0.85.9] - 2026-08-05 ### Added - Added durable recursive worker-agent trees with inherited delegation, exact paginated peer transcripts, threaded messages, event-driven agent controls, platform-shell execution, and model-authored model/reasoning/tool/capability/path/budget selection. ### Changed - Changed orchestration profiles into optional presets: profile-free agents receive the maximum host-permitted core surface, direct project writes are enabled by default, roles are labels unless the host supplies a ceiling, root budgets are cumulative, and the global scheduler replaces framework depth, fan-out, and per-profile concurrency caps. ### Fixed - Made recursive worker orchestration parent-aware: queued children now have stable identities, waiting parents yield scheduler capacity, terminal children deliver one durable idempotent parent handoff, peer controls stay tree-scoped, reply replay is atomic, explicit leaf grants remain non-delegating, and concurrent descendants share cumulative provider budgets. - Counted durable agent attempts that ended before their first usage checkpoint when reconstructing a root tree's cumulative attempt budget after restart. - Resolved omitted adaptive-agent reasoning from the selected model's supported default instead of assuming `medium` and rejecting non-reasoning models. - Chunked wall-clock timers above the host timer limit and saturated durable lease timestamps at the maximum representable date so unrestricted safe-integer budgets cannot overflow into immediate timeouts or failed starts. - Removed per-event idempotency marker files from the bounded orchestration event store and made its corruption cursor a non-atomic derived overwrite, reducing Windows filesystem and security-scanner churn while retaining exact cross-process deduplication and cursor recovery. ## [0.85.8] - 2026-08-05 ### Changed - Upgraded the pinned test toolchain to Vite 8.2 and Vitest 4.1, enabled the native Node module runner, and made Linux and Windows workflows verify and use the same source-resolution contract. - Split extension loading, factory execution, virtual-module catalogs, threat scanning, extensionification, and tool-definition construction into explicit lifecycle owners, and replaced broad cross-package barrels with narrow owner imports. ### Fixed - Serialized supervision start/stop transitions, cleaned partially started peers, awaited runtime-owned memory, GC, shell, and supervision shutdown before process-matrix and early CLI exits, and made Windows memory cleanup wait for worker termination before removing its state tree. - Made suite and manual-session cleanup await idempotent session disposal before unregistering providers and deleting state, preventing background workers, extension runtimes, and Windows file handles from leaking across tests. - Serialized same-target async atomic writes and advisory-lock admission with self-removing per-path queues, preventing Windows rename retry storms without bottlenecking unrelated files or tenants. - Isolated draft extension validation from the live generation, bounded extension factory and disposal lifecycles, and fenced process-matrix storage and llama process ownership behind injected adapters. - Removed the Vite transform graph from targeted source tests and narrowed heavyweight test fixtures, reducing cold focused-test startup from roughly 7–12 seconds to roughly 2–3 seconds. ## [0.85.7] - 2026-08-04 ### Fixed - Isolated external-resource discovery and reload-rollback regressions from unrelated bundled-extension imports so native Windows release validation retains deterministic time bounds. ## [0.85.6] - 2026-08-04 ## [0.85.5] - 2026-08-04 ### Fixed - Treated final ripgrep and grep exit code 1 as successful zero-match results across Linux and Windows, preserved PowerShell grep IO/regex failures as exit code 2, kept routed external commands in the persistent Windows shell, and kept goal-continuation budgets independent from the core identical-tool-call runaway guard. - Prevented later turns from re-entering an auto-compaction frontier that failed to restore headroom until materially new compactable history exists, while preserving overflow recovery. - Serialized context-GC payload and artifact ownership updates across processes, replaced quadratic shared reference-array rewrites with bounded holder markers, and kept read-only GC projections from replacing the latest committed report. ## [0.85.4] - 2026-08-04 ### Breaking Changes - Removed model-visible `action` and `intentId` phases from `write` and `edit`; callers now send one semantic mutation containing the path and payload while the harness owns preflight. ### Added - Added a Pi-managed local execution path for the complete Bonsai and Ternary-Bonsai GGUF families through a pinned Prism llama.cpp runtime, with exact model identity checks, bounded host-derived resource profiles, warm residency, validated paired-drafter policy, and complete Windows x64 CUDA archive installation. - Added LFM2.5-8B-A1B Q4_K_M to the curated local-model roster as a native-tool-first sparse-MoE worker candidate, with task-scale `/fitness` gating before role assignment and phone-protocol calibration only after native-call failure. ### Changed - Shape and hard-gate the stable system prompt from the same model-capability profile that filters tools and lanes: lean, minimal, and chat models receive bounded role-specific contracts, oversized project instructions are deferred by path, constrained static memory obeys its prompt budget, and aggregate expansion is rejected after extension overrides without changing native-versus-phone tool protocol selection. - Made `write` and `edit` single-call model operations while keeping path/capability preflight, serialized stale-target rechecks, and exclusive create semantics harness-owned. ### Fixed - Hardened phone-protocol tool execution for non-native local models with reasoning-channel envelope recovery, parallel-call identity, single-call write/edit examples, bounded corrective teaching after failures, and protection against repeating an already-successful mutation. - Prevented write/edit safety preparation from duplicating model tool calls; edit now also rechecks target identity immediately before writing and discards preview plans when source bytes differ, preserving and reporting external changes. - Retained an exact, digest-verified write or edit payload after a target-only collision or path failure so repair needs only a corrected path; references are session-isolated, bounded, expiring, kind-checked, and consumed after a successful mutation, while invalid references and non-target failures are never presented as retargetable. - Prevented active goals from becoming permanently blocked by an `Agent is already processing` race: foreground ownership now spans retry/follow-up idle gaps, background handoffs queue into that owner, and goal continuation waits event-first without counting rejected admission as a turn or failure. - Kept sanitized tool-failure projections authoritative through session context extensions and invoked each extension context handler once per provider request. - Fixed simultaneous background-tool completions racing separate notification prompts: terminal handoffs are now bounded, coalesced, and serialized while every task result remains individually retrievable through `tool_task`. - Required Amazon Bedrock to use a durable verified profile-and-region scope, with STS/control-plane discovery, bounded runtime probes, exact model visibility, and request-level region/profile binding; `us-east-2` now resolves only US inference profiles. - Kept source and bundled extension loading compatible with the lean Bedrock provider entry so startup and transactional reload resolve the same module boundary. - Updated Undici to 8.9.0 to fix cache-directive parsing, retry framing, blob media-type, cache-control whitespace, and cookie-attribute advisories. - Serialized asynchronous foreground preparation and terminal background delivery under one identity-bound owner; isolated retained mutation payloads per session and lane without cross-tenant eviction; incrementally indexed worker-input handoffs for long sessions; and transactionally reconciled concurrent `MEMORY.md`/`USER.md` writers with interrupted-write recovery. ## [0.85.3] - 2026-08-03 ### Fixed - Fixed the bundled Windows incident collector on PowerShell 5.1 hosts where the module-provided `Get-FileHash` command is unavailable. - Fixed native Windows path canonicalization so 8.3 short paths and their long-path spellings resolve to one resource identity. - Fixed cooperative worker cleanup under Windows file-lock contention so terminal state is durably persisted, including cleanup requested during the adoption grace window. - Fixed system Python detection incorrectly accepting the Windows Store execution alias or another non-Python executable as an installed interpreter. ## [0.85.2] - 2026-08-03 ### Fixed - Fixed fresh Windows search-tool provisioning by pinning checksum-verified `fd` release assets instead of relying on GitHub's rate-limited latest-release API, and hardened Windows release-gate portability without enabling unsupported native tmux. ## [0.85.1] - 2026-08-03 ### Fixed - Prevented concurrent and ineffective repeated auto-compaction runs in image-heavy sessions and contexts with protected recent messages. - Fixed Windows runtime probes and case-insensitive context-file identity, plus Bash-like path parsing, portable `printf`, word-list and arithmetic `for` loops, and nested `break`/`continue` in the managed shell. - Preserved managed-tool provisioning causes and bounded execution-failure guidance in recovery logs, failure corpora, and `/toolhealth`. - Kept proven native tool-call models off the phone/text protocol and routed phone validation, repair teaching, and failure guidance through the shared tool pipeline. - Required the exact release ref to pass Linux and Windows CI before publishing binaries. ## [0.85.0] - 2026-08-02 ### Breaking Changes - Changed `write` and `edit` to path-first `prepare`/`commit` protocols; `write` is now create-only, and custom file adapters must provide a shared mutation-intent controller plus `createFile` no-clobber semantics. ### Added - Added session-bounded exact-content references so successful writes and edits can copy unchanged bytes without retransmitting content. - Added live and terminal elapsed time to every interactive tool panel, including read, Python, extension, error, and replay paths. - Added `profile_writer` for immutable, session-branch-scoped worker profiles that can narrow owner-approved tools, resources, budgets, models, and thinking levels without writing profile files. - Bundled the pinned Rust `jscpd` 5.0.14 scanner for every desktop release target and provisioned it only into Pi-managed storage. ### Changed - Edit commits can bind anchors to inclusive read-line ranges, prove uniqueness globally without occurrence arrays, and reuse a compact preview match plan and diff during execution. - The core agent contract now treats the user's desired outcome as authoritative over suggested methods and requires evidence-backed disagreement when a method may undermine that outcome. - Compacted the always-loaded core, goal, checklist, profile-writer, and trust-boundary instructions while preserving their behavioral and security invariants. ### Fixed - Rejected write collisions, missing edit targets, and stale prepared edits before mutation; non-UTF-8 edits now fail through the centralized change-approach workflow. - Removed full edit-argument serialization from asynchronous TUI preview rendering. - Bounded collapsed streamed write previews so growing content is neither rescanned nor fully split and highlighted on each update. - Kept native delegation available when tmux is missing or unsupported, validated tmux before worktree/process side effects, and prevented regular agents from overriding the owner's worker profile at dispatch time. - Kept base-profile delegation working with branch-unaware session adapters while explicitly blocking session task-profile persistence on that unsupported boundary. - Kept local binary release packaging able to stamp the bundled jscpd version when dependency installation is intentionally skipped. ## [0.84.1] - 2026-08-02 ## [0.84.0] - 2026-08-02 ### Breaking Changes - Require Node.js 24.18.0 or newer. ### Added - Provision checksum-pinned ripgrep 15.2.0 and jq 1.8.2 binaries for supported Linux, macOS, and Windows targets, and report both through `/doctor`. ### Changed - Guide agents to use ripgrep for candidate filtering and jq for bounded JSON projection before native semantic parsing. ### Fixed - Block jq filters that project the process environment while preserving ordinary `.env` JSON field queries. ## [0.81.43] - 2026-08-02 ### Added - Added provider-neutral `deduplicate-by-evidence` and `evidence-gated-tdd` bundled skills, including evidence scoring and authorized security-scanner references. - Added bundled `authorized-web-security-audit`, `secure-agent-tool-surfaces`, and `skill-creator` skills for evidence-scored exploit awareness, least-privilege tool design, and portable specialization authoring across providers. - Added a pinned strict production clone gate that covers all owned TypeScript, JavaScript, Python, shell, PowerShell, CSS, and markup sources, rejects scanner omissions, and requires zero verified 50-token clones. - Added per-session background tool tasks: calls still running after 15 seconds, or manually transferred with Ctrl+B, return a task ID immediately, persist bounded output, emit event-driven completion, and support one-shot wait or cancellation without polling or cross-session sharing. - Added a live transcript pager on Shift+PageUp that preserves the viewed position while output continues and resumes tail following only after an explicit jump back to the bottom. - Added a native PowerShell incident collector, shipped beside `pi.exe`, that places its ZIP beside the script by default and packages the affected human session, recovery/orchestration/TUI evidence, runtime fingerprints, and bounded Windows event records while excluding credential and configuration stores. - Added bounded command-aware test-output projection for persistent shell sessions: passing chatter is collapsed, failure identity and summaries remain in context, exact raw bytes are handed off through a managed file, and unknown/error paths fall back to raw output without changing exit status. - Added session-core proactive memory reflection and provider lifecycle delivery across print, RPC, and interactive modes, using bounded semantic turn digests that exclude raw tool-result payloads. - Added high-confidence natural-language goal admission so explicit chat goals use the same durable continuation state as the goal command without treating ordinary tasks as persistent goals. ### Changed - Bounded tool-selection observation history by both count and encoded bytes, and compacted machine-owned host-state serialization to reduce rewrite and parse cost in long-lived installations. - Updated the core agent prompt with a compact, language-agnostic adaptive systems posture: explicit lifetime grouping, zero-valid states where safe, benign stubs at suitable internal boundaries, linear execution, and mandatory correctness/security/API-boundary exceptions. - Moved the repository to the stable TypeScript 7 compiler through one no-fallback execution path and upgraded the fixed test/build toolchain while retaining exact dependency pins. - Reduced source and packaged startup transformation by importing lean AI entry points and preferring compiled JavaScript for Pi-owned bundled extensions while preserving TypeScript-first user extension loading. - Consolidated provider, resource, session, selection, export, process, and TUI lifecycle ownership behind focused systems, with strict clone evidence proving no verified production clones remain. - Reduced avoidable turn latency by batching independent read-only calls in one model turn, coalescing checklist transitions, reading tool-performance evidence once per decision, moving transcript recall indexing into one bounded worker owned by each session, and exposing bounded passive phase timings through `/toolhealth`. - Lowered the default fractional compaction trigger from 70% to 60% of the model window while preserving explicit overrides, reserve headroom, recent-context retention, anti-thrash savings, and summary verification. ### Fixed - Fixed background task control bypassing explicit tool allowlists, resource and orchestration profiles, custom tool surfaces, and model-capability filtering while preserving it on the default session surface. - Fixed the direct zAI default selecting the retired `glm-5.1` model by resolving to current `glm-5.2` and verifying the default against the generated catalog. - Fixed large piped stdin ingestion repeatedly copying the accumulated prefix by retaining UTF-8 chunks and joining once after end-of-stream. - Fixed oversized-file line scanning repeatedly copying newline-free prefixes by assembling decoded fragments through the shared linear line owner. - Fixed Windows Python-engine latency by keeping one serialized coordinator process per agent session instead of spawning Python for every complex command, with request-correlated output/control barriers and whole-process recovery after aborts, timeouts, crashes, or protocol faults. - Fixed incident collection to include the current session-owned orchestration namespace after its consolidation under `state/orchestration/sessions`. - Fixed native Windows incident correlation to derive its bounded Event Viewer window from the selected session and filter shared recovery/failure logs by session identity or timestamp. - Fixed Windows shell execution so quoted or piped ripgrep patterns retain their proven file/stdin scope, common `ls -la` works across both routing tiers, redirected `.ps1` commands use the selected PowerShell host, native combined commands skip unused PowerShell discovery, and host output no longer leaks duplicate CLIXML records. - Fixed oversized `USER.md` writes by migrating the full profile into deterministic bounded OKF shards with a compact index, including retry-safe multi-shard migration, archived fact updates, and pre-write rejection of redirected archive directories. - Fixed compaction to collect provider memory handoff once per run, reuse its bounded result across retries, and preserve the existing compact active-goal projection for automatic continuation. ## [0.81.42] - 2026-07-27 ### Changed - Rebuilt delegated workers around immutable owner-authored execution contracts, durable logical-agent identities, resumable conversations and mailboxes, fenced write reservations, bounded resource materialization, verified model-pinned compaction, and event-driven terminal handoffs. - Consolidated session-owned orchestration events, actions, mailboxes, conversations, and deletion under one bounded artifact bundle while keeping cross-session write reservations globally coordinated. ### Fixed - Made the Windows shell engine preserve `$?`, support controlled `exit`, and accept `head`/`tail -N`, so diagnostic-capture command chains complete with a terminal result instead of losing status or treating `exit` as an external command. - Added a provider- and tool-neutral WSL incident collector that packages the latest human session, recovery and orchestration records, explicitly requested command logs, TUI evidence, boot identity, installed-runtime hashes, bounded kernel diagnostics, and relevant Windows host events without collecting credential stores or emitting false missing-log warnings. - Made pre-start worker failures publish exactly one durable terminal handoff, rejected malformed typed result envelopes, and handled null or Buffer filesystem watcher filenames on Windows. - Made orchestration session paths portable across Windows and POSIX and bounded profile, process, event, result, and cumulative usage payloads at their owning contracts. - Kept explicit empty worker tool surfaces inside the repair loop and persisted immediate or argument-repaired tool requests in durable execution order, preventing unavailable-tool calls from collapsing into completion errors or divergent transcripts. - Preserved bounded host-observed changed-file progress when an agent-bound worker is suspended, so owner-session disposal remains resumable without fabricating terminal parent-session records. ## [0.81.41] - 2026-07-27 ### Added - Added a model-blind native secret store with a private plaintext dotenv editor, encrypted bounded profiles and workspace bindings under Pi state, metadata-only tool results, user-only UAC routing, normal Bash/Python environment activation, and credential-path/output exposure guards. - Added a provider-neutral shell search guard that rejects broad `rg`/recursive `grep`/`find`/`fd` scans before execution and supports an explicit managed-file override with bounded disk use. - Added an OpenAI subscription `/usage` flow for inspecting earned reset passes, reviewing reset details, confirming redemption, retrying idempotently, and refreshing remaining availability. - Added one event-driven activity lane above the editor for routing, tools, task steps, goals, workers, queues, compaction, and retries, plus an explicit `--session-mode user|worker` audience contract for unattended terminals. - Added managed Amazon Bedrock SSO login for the exact configured AWS profile, with bounded single-flight CLI execution, automatic pre-response recovery, and a strict no-browser boundary for worker and background requests. ### Changed - Made durable goals use compact Codex-style provider context and continue without implicit turn, active-time, or spend limits; only owner-supplied token and per-invocation limits stop execution, while time/spend remain observable accounting. - Split AgentSession contracts, durable goal lifecycle/accounting, owner-input replay, interactive event dispatch, and startup-resource rendering into focused owners, with a repository check preventing either coordinator from reclaiming those responsibilities or exceeding its size boundary. ### Fixed - Kept retry-guided compaction provider failures inside the exact-request retry layer instead of restarting the compaction plan as an unknown failure. - Removed successful orchestration bookkeeping from collapsed chat history, retained full detail on explicit expansion, and prevented resumed terminal state from replaying as new completion feedback. - Deferred retained tool-result reads, renderer construction, and image conversion during collapsed history reload until explicit expansion, with the materialized payload released again on collapse. - Prevented denied extension code and embedded profile content from crossing the read/import boundary, preserved exact CLI/live grants through reloads without invalidating their shared runtime, and made core acceptance fail on skipped or todo evidence. - Preserved durable usage from tool hooks, compaction, branch summaries, and resumed sessions across session, daily, and cumulative accounting. - Rejected resource directories as context files, resolved scoped model IDs literally, exposed unavailable selections, and clarified unsaved-session fork failures. - Consolidated external-editor execution, restored the Windows terminal title after package checks, reported aborted retries as failures, and corrected manual update checks, npm uninstall compatibility, read-error rendering, and sibling extension paths. ## [0.81.40] - 2026-07-24 ### Added - Added one targeted `accept:core-workflows` gate covering active-worker crash/restart fencing, simultaneous durable writers, repeated compaction/reopen cleanup, provider-neutral routing/reasoning/result/retry contracts, and adversarial UAC omission without running the full test suite. - Added owner-authored orchestration profiles with pinned model/thinking/tool/resource/budget policy, architect-owned worker allowlists, durable DAG attempts and fenced typed results, exact-session process-worker resume, and a constrained direct-argv `run_process` launcher for execution profiles. - Added one event-driven native interaction layer for human questions, task steps, and worker lanes: batched single/multi-select questions with unrestricted custom text, clipboard image attachments, skip/review flows, grouped width-bounded work status, durable human worker labels/profile ids, quiet idle behavior, progressive evidence detail, and host-owned lifecycle across extension reload and session resume. Worker UAC excludes the question tool before construction, and the legacy question examples now adapt this native contract instead of carrying two UI implementations. - Added a bounded session image store for clipboard attachments, configurable through `images.clipboardDirectory`, with stable numbered references that survive `/resume` and deterministic latest-image resolution for prompts such as “look at the image.” ### Fixed - Fixed Windows startup migration of the NTFS `auth.json:Zone.Identifier` alternate data stream so its bytes move into bounded legacy state and the named stream is removed without rewriting the auth file. - Persisted one immutable admission-time worker execution contract across queueing, retry, restart recovery, and mandatory verifier recovery, so profile edits cannot silently switch a pending worker's model, thinking level, tools, execution policy, or resource identity; current host policy may still narrow the recorded authority. - Rebased durable-runtime startup tails onto a projection snapshot installed during the initial read, preventing a concurrent compaction from replaying post-snapshot events without their prefix. - Made durable orchestration replay and append fail closed on missing event ordinals, truncated tails, inaccessible storage, invalid snapshot idempotency data, and missing or changed published snapshots without reparsing an unchanged projection on every append. - Fenced process-matrix reconciliation, adoption, cleanup, self-owned heartbeat/exit, resumed-worker PID publication, terminal persistence, and delivery acknowledgement with one shared per-entry conditional-write contract so stale process generations cannot overwrite newer registrations. - Made session teardown, activation, and quit failures drain every cleanup step; replacement failures reconstruct and rebind the previous durable session, clean rejected candidate resources/artifacts, remain distinct from post-commit callbacks, and serialize process disposal behind any admitted replacement. - Made session replacement transactional through candidate preparation and awaited old-session resource shutdown, moved process/worktree supervision under the active session lifecycle, restored exact session+task workers only after goal activation, persisted late terminal notices for replay to the owning session, denied automatic recovery for mismatched or terminal goals, and bounded process-matrix retention. - Fenced overlapping session replacements and RPC prompt/replacement races, and made durable worker terminal notifications acknowledge delivery only after the bounded parent handoff is persisted; owner-question handoffs no longer spend a redundant model turn. - Made `/resume`, `--resume`, `--continue`, and exact `--session` restore a blocked goal through the same core persisted transition as `/goal resume`, before worker supervision starts. - Bounded durable orchestration persistence with immutable digest-verified projection snapshots, a count/byte-limited append-only event tail, bounded retained idempotency evidence, crash-safe pointer publication, and monotonic ordinals across compaction and concurrent-runtime catch-up. - Made owner-input requests crash-safe and transport-neutral: `ask_question` now checkpoints before display, uses the full multi-line editor without an answer-length clamp, RPC exposes the same fail-closed typed question protocol as the TUI, `/resume` replays the original tool-call id, large custom answers remain exact in bounded artifacts, RPC images are retained before checkpoint, client-forged artifact references are rejected, non-vision image submission fails visibly, and worker `ask-user` verdicts create deterministic parent requests instead of relying on prompt compliance. - Made the clipboard paste action match platform conventions (`Ctrl+V` on Unix/macOS, `Alt+V` on Windows, both on WSL), preserve ordinary text paste when no image is present, resize image payloads through the shared safety path, and keep default storage out of working directories. - Added a zero-write, single-namespace extension storage contract for durable state, rebuildable cache, and automatically released bounded work; extension loading now honors injected agent directories for transform cache and storage, while `pi doctor` reports unexpected root writers through a bounded read-only audit. - Contained directory profile overlays and configuration backups under canonical `profiles/` and `state/` namespaces, archived obsolete root scratch/Auto Learn layouts, and added bounded conflict-preserving migration with zero-write legacy reads. - Consolidated generated context payloads under one leased, bounded per-session work namespace; context/report inspection and unflushed session creation are now zero-write, recognized legacy stores migrate safely, and empty session namespaces are pruned without applying retention to transcripts. - Consolidated fitness, adaptation, and tool-selection host state behind one validated lock-safe atomic store; concurrent sessions no longer overwrite profile or tool evidence, and worker read-only mode remains zero-write. - Extracted managed tmux-worker lifecycle and claim review from the background coordinator, made managed and in-process workers share one durable task runtime and terminal outbox without materializing a withheld execution controller, required every managed dispatch to carry its fixed profile, authorization, instruction, provider, turn, lease, tool, path, and budget contract, persisted the full compiled execution grant before process/prompt side effects, rejected scope-changing follow-ups, removed the extension's duplicate parent wake path, removed the research controller's circular dependency on its parent, and renamed raw worker-claim modules so untrusted claims are no longer presented as durable results. - Consolidated failure-corpus, tool-recovery, and worktree-audit persistence behind one lock-safe bounded JSONL sink; worktree audit is no longer unbounded, concurrent failure-corpus rotation cannot lose appends, and worker terminal telemetry no longer masquerades as an accepted result. - Unified process supervision and durable orchestration on one logical-agent identity, pinned initial tmux workers and exact-session resumes to the same managed lane, and made resume prefer the persisted session file while rejecting divergent lane context. - Separated untrusted worker claims from host-fenced durable worker results, removed parallel result adapters, and made session, goal, status, telemetry, and review projections use the claim contract without implying worker self-report is accepted task truth. - Unified capability envelopes, profile grants, lane construction, runtime gates, research policy, and worker execution on one canonical capability vocabulary; equivalent grants such as `worktree.read` and `tests.execute` now survive through execution instead of failing a second translated gate. - Consolidated foreground envelopes, runtime gates, orchestration profile validation, and lane manifests behind one tool-capability policy catalog; active network, skill, source, verifier, and status tools no longer disappear from capability visibility while separate authorization tables drift. - Unified goal and durable-objective acceptance/lifecycle transitions: every satisfied requirement now needs its own trusted proof, goal pause/resume/cancel/complete reconciles already-loaded worker execution without defeating lazy UAC, terminal objectives cancel residual attempts with explicit reasons, and worker terminal publication has one idempotent path. - Consolidated goal requirements, foreground task steps, and delegated DAG work behind one identity-based read model; task steps now persist explicit requirement links, legacy text inference has one conservative fallback, and worker dispatch synchronizes durable objective acceptance criteria without treating worker self-report as proof. - Consolidated versioned session snapshot persistence, validation, defensive cloning, list reads, latest reads, and branch-ancestry fallback behind one typed codec shared by goal, task, evidence, learning/audit, lane, and worker state; live accessors and review acknowledgements now read one active branch while diagnostics retain explicit whole-session history, and domain validators share explicit plain-record and general record-object guards. - Consolidated worker admission, profile/verifier resolution, capability checks, durable attempt preparation, and resumed lane-id allocation so immediate, queued, recovered, and scheduler-revalidated dispatches share one policy contract, durable tasks are the sole identity source, and a lifecycle instantiated before late durable writes cannot reuse an existing lane id. - Unified managed-worker identity across dispatch, goal binding, persistence, reload recovery, and terminal reporting; running tmux lanes now restore under the same durable id instead of degrading into indeterminate bindings after `/reload`. - Persisted per-check compaction verification score ranges across retry fallback and surfaced them in session analytics and `/usage` diagnostics. - Made foreground prompt preparation transactional: routing events stay balanced, failed extension preflight retains pending `nextTurn` context, queued messages cannot reset active-turn cost accounting, and pre-start execution failures release early-painted message identities. - Consolidated terminal foreground response handling behind one recovery coordinator with deterministic transient retry, quota failover, retry closeout, compaction, and queued-continuation ordering. - Consolidated manual and automatic compaction detection, execution, retry, cancellation, persistence, and extension notification behind one controller with a shared result-application path and provider-neutral policy types. - Consolidated foreground model tool-protocol selection, probing, calibration, circuit breaking, repair teaching, and turn-local telemetry into one controller shared by session call sites. - Made execution policy a mandatory durable pre-lease gate: approvals and owner notifications now replay, approval never grants authority without a newly compiled grant, paused objectives cannot start or resume work, and workers bind their grant before entering leased/running state. - Split goal auto-continuation, autonomous research, model-fitness probing, and shared lane-model resolution into single-owner controllers, leaving the background facade responsible only for composition and the separate managed-lane bridge. - Moved durable worker scheduling, execution, recovery, verification, and terminal notification behind one controller; capacity-bound workers now queue consistently across providers, owner-pinned verifier profiles run automatically before acceptance and retry event-driven recovery after temporary admission failures, and dead Pi workers resume the exact persisted session and logical-agent identity with checkpoint/resource handoff. - Consolidated worker profile resolution, risk classification, capability grants, execution budgets, lifecycle state, structured-action enforcement, and terminal notifications behind single-owner contracts; removed delegate/settings authority overrides, made undelivered in-process terminal handoffs resume-safe, and enforced trusted acceptance evidence before task/objective completion. - Made out-of-process managed workers emit the same bounded event-driven terminal handoff as in-process delegates, taught models to retrieve results once after that handoff instead of polling, and let unprofiled background lanes use the selected model's declared or provider-agnostic reasoning default. - Unified foreground startup, background-lane defaults, and isolated-completion clamping through the shared provider-neutral model capability resolver. - Made foreground and isolated worker tool routing share the same calibrated text-protocol variant instead of silently forcing subagents onto the default dialect. - Classified process-matrix/tmux children as workers from their parent identity, and applied worker/resource-profile UAC before built-in/override tool construction and live extension import, so withheld tools invoke no runtime factory and denied extensions load no module code. ## [0.81.39] - 2026-07-20 ### Added - New `processMatrix` system (on by default, `processMatrix.enabled: false` is the explicit opt-out): a durable, restart-surviving master/worker process matrix under `state/process-matrix/`. A worker launched with a known parent (`PI_PARENT_PID`/`--parent-pid`, threaded automatically through `tmux_agent_manager`'s `fire_task`) self-registers and watches its parent's liveness; on parent death it winds down gracefully (never silently), leaving a resumable payload, and either gets adopted by a new master or self-exits after a bounded grace window. A master's startup scan for orphaned workers ALWAYS asks the owner before touching anything (adopt, cooperative cleanup, or leave untouched) and is report-only with zero writes/kills when non-interactive — see `docs/process-matrix.md`. - Closed the tool-selection observe/promote loop: durable per-(model, intent) agreement tracking, an evidence-gated compact prompt hint (activates only past utility/margin/min-evidence thresholds, deactivates when its tracked efficacy drops, never auto-executes), a `getReport()` surface joined into `/toolhealth`, and `PI_TOOL_SELECTION_OBSERVE` / `PI_TOOL_SELECTION_HINTS` kill switches. - Goal evidence now carries a validated ref and a `verified` flag: `add_evidence` checks a "tool" ref against real session tool-call records or a "file" ref against the filesystem, and marking a goal `complete` requires at least one satisfied requirement backed by verified or user-confirmed evidence (configurable, default on). - Delegated workers whose mutation needs a human look are now observable and sticky in `delegate_status` instead of purely advisory text: an unreviewed-mutation notice persists until the parent explicitly acknowledges it via a new `delegate_status` review action. Enforcement stays visibility-only, never write-blocking. - Goals now carry a durable, per-goal cumulative continuation budget (turns, active wall-clock, and attributed USD spend) across every continuation invocation for the goal's lifetime, with a conservative default ceiling and a visible `goal_budget_exhausted` stop reason. - A turn-boundary advisory nudge fires when the task_steps workflow contract (one in_progress step, no stale open steps) is violated for 3 consecutive turns — a one-line harness note, never a blocking gate. - The goal continuation snapshot and prompt now include a read-only summary of open task_steps steps, and satisfying or completing a goal requirement nudges when an open task step appears to reference it — read-only cross-visibility between the goal and task-steps systems, with no shared state machine. - A canonical, typed path module (`agent-paths.ts`) is now the single source of truth for everything machine-managed under the agent directory (`state/`, `cache/`, `work/`, runtimes, models, sessions, npm/git installs); an idempotent startup migration relocates the confirmed root-level straggler (`trust.json`) into `state/`. - tmux workers launched via `tmux_agent_manager` are now PERSISTENT and talkable mid-run: a new `send_followup` action re-injects a fresh prompt into an already-live job's pane using a unique per-turn marker pair and re-arms the pane's completion watcher, reusing the existing event-driven per-turn handoff; session start now also reconciles tmux sessions against this session's own job records (an orphaned session is marked informational, never killed; a live session with a pending turn has its watcher re-armed); a new `dismiss` action stops tracking a job without killing its tmux session, and an idle worker (no turn currently dispatched) no longer holds a reload-quiesce registration. - tmux worker dispatch is now approval-gated by a persisted, per-session/per-goal STANDING GRANT: `grant_dispatch` (interactively confirmed, or opt-in via `--allow-tmux-dispatch` with no UI) authorizes repeated unattended `fire_task`/`send_followup` launches within a budget (`maxLaunches`, optional expiry, goal/tool/path scope); `revoke_grant` ends it early; a launch with no covering grant and no interactive approval is refused, never silent. A grant-covered `pi` child is launched with a restricted profile (`--tools`/`--resource-profile` or `--no-extensions --no-skills`, plus a scoped `--append-system-prompt` naming the grant and its hard stops) pushed into the child's own launch configuration; non-`pi` agents are bounded at the launch layer only. Self-reported worker usage is ingested as an advisory, idempotent claim (`reportSpawnedUsage`), never a hard cross-process cap. - A new host bridge (`pi.reportManagedLane`) makes out-of-process tmux workers first-class `tmux-worker` lanes: visible in `/autonomy` and `delegate_status` alongside in-process worker lanes, reload-quiesce-registered only while a turn is dispatching, and left as a bounded claim snapshot on terminal. A tmux worker's self-reported changed files are re-checked against the session's active write scope and flagged for parent review when out of scope (reusing the existing in-process worker review path verbatim); in-process worker lanes are now goalId-tagged, matching the existing research-lane tagging. - Goals gain a `worker` evidence kind (verified against the worker's lane/result and its review flag, so an unreviewed worker completion can never ungate goal completion) and a structural `dispatch_worker` action that records a requirement↔lane binding without silently satisfying the requirement; the binding and worker-evidence verification are wired live (dispatches a real in-process worker lane today — tmux-worker selection from this tool is not yet available). - The goal loop no longer stalls out or races a redundant re-dispatch when a worker is actively handling an open requirement: a new `waiting` continuation state (reason `worker_in_flight`) pauses the loop without submitting a hollow pass and stops the idle scheduler from re-dispatching, resuming automatically once the worker's lane goes terminal; per-goal worker/subagent spend is now tracked (`continuationWorkerSpendUsd`, summed from the goal's own lanes) against a new conservative default ceiling, accurate for in-process lanes today and advisory for tmux workers pending a documented follow-up. - The goal tool's `dispatch_worker` action can now target a persistent tmux worker instead of the default in-process one (`dispatchTarget: "tmux"`, opt-in per call): core structurally invokes the tmux extension's `fire_task` itself — the same tool call the model would make — single-agent and 1:1 to the requirement's bound lane, still gated by the existing standing-grant authorization; an unattended dispatch with no covering grant is honestly refused (`dispatchSkipReason: "no_standing_grant"`), never silently launched and never a fabricated lane id. Correlating the extension's own dispatch report back to the internal lane id is a new deterministic keyed lookup (`BackgroundLaneController.resolveManagedLaneId`), not a racy lane-list diff. - New `worktreeSync` system (on by default, `worktreeSync.enabled: false` is the explicit opt-out): a hard-gated, worktree-per-lane parallel-work workflow (`worktree_sync` tool: `status`/`create_lane`/`sync`/`continue`/`abort_sync`/`land`/`release_lane`/`reconcile`) where every writing agent works in its own git worktree/branch and integration is always rebase-onto-main + fast-forward, serialized under one integration lock with a configurable land-time gate command verified at the exact landing tip — see `docs/worktree-sync.md`. Wired into the goal loop and tmux dispatch: two new continuation reason codes (`lane_sync_required`/`lane_sync_conflict`) give the goal loop a deterministic directive when a bound worker's lane is stale or has a rebase stopped on conflicts; the goal runtime snapshot can surface per-requirement worktree lane state; a goal-bound tmux dispatch (`dispatchTarget: "tmux"`) creates the lane FIRST when worktree-sync is enabled, aborting cleanly before any tmux launch on a creation refusal (`dispatchSkipReason: "worktree_create_failed"`), and launches the worker with `--worktree-lane ` plus one extra lane-doctrine system-prompt clause; `LaneRecord` gains an optional `worktreeLaneKey` so `/autonomy` and the goal snapshot can render the pairing. - A new session-role identity (`core/session-role.ts`) gives a worker session (lane-bound or `PI_SESSION_ROLE=worker`) a strict UAC ceiling: `goal`/`delegate`/`delegate_status`/`improvement_loop`/`extensionify`/`skillify`/`run_toolkit_script`/`model_fitness`/`tmux_agent_manager`/`context_scout`/`python` can never activate, wins over any allow-list or resource-profile grant; `worktree_sync`'s `create_lane`/`release_lane`/`reconcile` are refused and `land` is deny-by-default (new `worktreeSync.workerLand` setting) for a worker, which may only ever target its own bound lane; `land`/`release_lane` now refuse `lane_owner_conflict` when a different, still-alive session owns the target lane; a lane-bound session's `edit`/`write` targets are checked (symlink-safely) against the lane's own worktree root, refusing `path_outside_lane`; and every scattered on-disk store plus `SettingsManager`'s write path go read-only for a worker session, so no worker ever touches `~/.pi/agent/state` or `settings.json` — see `docs/worktree-sync.md`'s "Identity, UAC, and zero footprint" section. - Lane-worker eligibility now rides the model-capability system end to end (`evaluateLaneWorkerRefusal` in `core/model-capability.ts`): a worktree-sync lane worker requires capability class `full`, a declared registry context window, an advertised native tool-call path (`Model.textToolCallProtocol` unset/false), and no graded `/toolprobe` demotion to text-protocol/none — a goal→tmux dispatch refuses early as a best-effort check (`dispatchSkipReason: "worker_capability_insufficient"`, zero lane/pane side effect) and the dispatched child session refuses authoritatively at its own startup with a deterministic, greppable log line, regardless of how it became lane-bound. The lean capability class also now blocks the full orchestration surface (`goal`, `worktree_sync`, `improvement_loop`, `extensionify`, `skillify`, `model_fitness`, `context_scout`, `tmux_agent_manager`) in addition to `delegate`/`context_audit` — see `docs/worktree-sync.md`'s "Capability adaptation" section. - The Windows `bash` contract now routes through three tiers instead of one: the existing simple-command PowerShell floor (unchanged), a new bundled Python shell engine (uv-provisioned Python 3.13) for pipelines, redirection, chaining, quoting/expansion/globs, and the coreutils vocabulary, and named fail-closed refusals for constructs outside that grammar (job control, process substitution, arithmetic expansion, heredocs, nested shells, control-flow, `eval`/`source`/similar, and more) — see `docs/windows.md`. State-mutating commands (`cd`, `export`, `unset`) always route to the engine, the sole mutator; working directory and environment persist across calls and across tiers, with subshells (`( … )`) isolated and brace groups (`{ …; }`) sharing state like bash. A new `windowsShell.pythonEngine` setting (default `true`) is the hard kill switch: explicit `false` restores the prior PowerShell-only, simple-command-only contract verbatim. When the Python runtime cannot be resolved, the PowerShell floor keeps working and engine-only commands return a named, actionable degradation error instead of a silent wrong-approximation downgrade. Proven by a new engine conformance suite (Linux + Windows CI), a Linux-only differential oracle comparing engine output against real `bash -c` across the supported grammar, and Windows cross-tier integration tests exercising state handoff between the PowerShell and engine tiers. ### Changed - Self-adaptation (native reflection + learning policy) is now on by default for a fresh session in every autonomy mode (off/safe/balanced/full) — evidence-gated (confidence threshold + `ObservationStore`). The preset lattice is monotonic: increasing autonomy no longer silently disables self-adaptation. All kill switches (`PI_NATIVE_REFLECTION=0`, `learningPolicy.enabled=false`, `AutoLearnSettings.enabled=false`) still disable it in every mode. The raw autonomy-prompt standing-grant authority block stays gated on `autonomy.mode` (`"off"` default unchanged). - The `delegate` tool's description and prompt guidelines now vary by wiring mode: an async start/poll contract when worker delegation is asynchronous, the synchronous contract otherwise. ### Fixed - Bundled Python shell-engine source now keeps `BuiltinContext.stderr` optional for direct builtin callers, and its conformance/oracle tests parse the terminal control frame from stderr, matching the runtime transport. - Tmux dispatch grants now authorize and charge every launched child process; persistent follow-ups reserve their turn before pane injection to prevent duplicate external prompts after a crash. Process-matrix workers verify a fresh parent-session heartbeat alongside PID liveness, and worktree landing advances the named main ref with compare-and-swap recovery stages rather than merging whichever branch is checked out. - `/goal start` no longer double-fires its continuation loop: a single mutex now serializes the idle-driven and manual goal-continuation paths, eliminating both the "Agent is already processing" warning and an unhandled rejection that previously fired on effectively every `/goal start` (the idle auto-continue timer's default 0ms delay meant the manual and idle paths raced on nearly every invocation); the command layer gained try/catch parity and status-line handling for the new skip outcomes. - Task/goal state resolution (and the whole goal runtime snapshot: goal state, evidence, worker results, learning decisions) now walks the active session branch's own ancestry instead of scanning every branch's flat entry list — fork/branch-switch no longer leaks another branch's goal or task-steps state. - `task_steps`'s `add` action dedupes a retried add of an already-open duplicate step instead of creating a second copy (a legitimate re-add of previously completed work still creates a new step); a completed step with no evidence attached now surfaces a reminder in both the tool response and the injected per-turn context; and a `set`/`update` call that silently demotes another in_progress step to pending now names it in the response. - Goal stall detection now keys on satisfied-requirement and verified-evidence counts instead of raw event count, so hollow goal-tool calls that append events without making real progress can no longer defeat the stall guard. - Session disposal now durably persists canceled/in-flight worker lane records and a bounded worker result (including changed files) before the dispose cutoff, instead of losing them to an in-memory-only completion; queued (not-yet-started) workers are now visible to the reload quiesce gate from the moment they're enqueued, not just once running. - All goal-state free text rendered in the continuation prompt (the user goal, requirement text, blocked reason, evidence summaries, and the open task-steps summary) is now wrapped as untrusted data, matching the existing worker-result boundary — closing a prompt-injection vector reachable via a model's own `add_requirement`/`block_goal` calls. - The injected `task_steps_context` block is now GC-managed like `memory_context`, ending unbounded per-turn context growth for sessions with an open checklist; fixed a latent default drift between two independently hand-kept copies of the context-GC defaults (one was missing the `run_toolkit_script` tool, the other was missing `python`/`powershell`) by deriving both from one canonical source. - Runaway-loop stops and repeated tool-validation-failure escalations are no longer silent: both log a session entry; runaway stops surface a user-visible warning; validation escalation feeds the model router's existing cheap-route escalation gate. Isolated/reflection child loops inherit the runaway handler when on the foreground model. - Atomic, locked writes for model-adaptation, tool-recovery event-log rotation, the learning observation store, and skill-curator usage tracking (new shared `src/core/util/atomic-file.ts`); standing model-adaptation rules now also retire early once evidence shows they stopped reducing recurrence (in addition to the 30-day bound). - Reflection's automatic skill promotion runs the same `skill_audit` overlap check the `skillify` tool enforces; a near-duplicate draft is held as a consolidation proposal (learning-audit trail) instead of written. - Background/research/worker/reflection/fitness isolated-completion lanes carry a stable namespaced synthetic cache-affinity key (never the real session id), so provider session-affinity / `prompt_cache_key` caching actually hits on repeat lane calls. - The session cost guard folds this turn's background/spawned spend (per-turn baseline delta) into the same ceiling as the foreground projection (default action stays "warn"; per-lane caps untouched). - Spawned-usage accounting is idempotent: every `addSpawnedUsage` call site supplies a stable, content-derived `reportId`; the model-fitness probe threads its tool-call id as the idempotency token (separate deliberate runs count; retries dedupe). - `IsolatedCompletionOptions.cacheRetention` is required at the type level (silent "none" default removed). - Ollama/Transformers/prism readiness caching keyed per (server, model) instead of per-server — a second model on a confirmed server is never waved past the installed/residency checks. `LocalRuntimeController.reconcile()`/`dispose()` stops pi-spawned runtimes dropped from the live configuration on reload (detected-only servers never touched), wired into the reload path. - Compaction's summarizer honors managed-local readiness/residency for auto and manual `/compact`; also fixed a latent manual-`/compact` bug that dropped the resolved fallback model/failure and could pair a model with the wrong credentials. - Compaction pre-check accounts for this turn's own context-GC savings (read-only GC projection; suppression-only — near-full hard trigger unaffected). - Reload gate honors all in-flight work via a unified in-process quiesce registry (`reload-blockers.ts`): foreground streaming/compaction, research/worker/model-fitness lanes, context-scout runs, and isolated completions (registered at their single choke point). - Context-policy prompt-enforcement defaults now derive from the live context-GC settings (explicit values still win); corrected the stale GC-defaults doc comment (12/2500 → 8/1200). - Documented and test-pinned the system-prompt cache-stability invariant (one provider-cached block, rebuilt only on tool-surface change, day-granularity date). - A text-protocol ("phone") model that fails to parse the same tool-call signature 3 times in a row is now demoted to native fallback for real: the persisted tool-probe verdict itself is now cleared (was: only the cached protocol was cleared, leaving the phone flag on), which previously caused every subsequent turn to re-run up to 8 inline calibration completions before the user's prompt and, on failure, throw the user's turn away entirely. Ensuring the text protocol for the active model no longer performs blocking inline calibration or throws out of the prompt path under any circumstance; calibration now only ever runs off the hot path, via an explicit `/toolprobe` or the new evidence-gated auto-probe below. - A model whose native tool calls keep failing argument validation is now automatically probed and, on graded evidence, escalated: a local/managed model gets an evidence-gated auto-probe (native is tried first; the model is only routed to the text protocol if native genuinely has no working path), and a cloud model escalates to a more capable router tier. This replaces a validation-failure escalation path that previously reused the mutation-blast-radius escape hatch and so treated a read-only tool's repeated validation failures as a no-op. - The model router's tier resolution and configured-model lookup now honor a persisted "no working tool-call path" probe verdict for local/managed models: a medium-tier turn falls back to the expensive tier (or the model is skipped) instead of routing to a model already proven unable to call tools. - A buffered cheap-tier routed turn that throws now rolls the live in-memory session state back to match what was actually persisted, instead of leaving never-flushed messages permanently stranded in memory. - Native tool-call probe trials and text-protocol calibration completions now count toward the turn-scoped cost guard and daily usage totals (were previously untracked — up to ~10 free completions on a model's first probe). - A text-protocol model that repeatedly emits unparseable prose instead of a tool call now receives an in-loop corrective reminder (throttled after the first firing), closing a gap where the existing runaway/stall backstop only trips on repeated *parsed* tool-call signatures. - A dead tmux session whose job never reached a terminal state now releases its bound managed lane (one report per non-terminal agent, `reasonCode: "tmux_session_orphaned"`) during session-start reconcile, so a goal bound to it stops waiting on a worker that can no longer report back; nothing is killed, only the lane record is released. - A goal waiting on a dispatched worker now escalates to the owner (`action: "ask-user"`, reason `worker_wait_timeout`) after a bounded max-wait (default 60 minutes) instead of waiting indefinitely, when the worker is alive but hung past its deadline; every pre-existing caller that omits the new optional wait-clock arguments behaves byte-identically (waits indefinitely, as before). - A managed (tmux) worker's terminal usage claim now attributes to its lane's advisory `costUsd`, closing the previously-documented undercount in a goal's `continuationWorkerSpendUsd` for tmux-worker spend. - A goal requirement bound to a worker lane that vanished after `/reload` (a genuinely-running managed lane is never snapshotted at dispatch time) is no longer at risk of a duplicate re-dispatch: `dispatch_worker` now refuses re-dispatch when the bound lane's liveness/outcome cannot be determined (`bound_lane_indeterminate`) or is still live (`requirement_already_bound`), preserving the existing binding unchanged; a bound lane with a confirmed terminal outcome still allows a legitimate retry. - Hardened worktree synchronization with token-bound lock ownership, lifecycle serialization, exact gated-tip landing, crash-recovery reconciliation, cumulative overlap checks, and typed lane Git/check actions; hard lane workers no longer expose unrestricted `bash`. - Fixed concurrent atomic writes by giving each invocation an exclusive same-directory temporary file and cleaning up only its own temporary path. ### Performance - Memoized per-message context-audit and token-estimate work within a session (object-identity keyed), byte-identical vs full recompute across compaction and branch-switch boundaries — the full-history rescan no longer reruns on every tool-call round trip. - Precompiled and cached minimatch patterns for resource-profile filtering (~8% of startup CPU; refired on every reload/profile switch before). - Extension TS transforms cached in a durable `agentDir/cache/jiti-transforms` directory (jiti's content-hash fsCache made explicit; hot-reload module isolation preserved). - Lazy highlight.js: `lib/core` + register-on-first-use (~190 eager grammar registrations removed from startup), identical output/alias resolution. - Cached resolved `fd`/`rg` system-PATH locations across runs (no `spawnSync` probe per launch; staleness re-probes). ### Tests - Pinned the transform-before-cost-guard pipeline-order invariant (regression test fails under a simulated inverted order). - Added a permanent regression guard proving goal/task state resolution survives compaction whose cut point lands past the latest snapshot, in-memory and after a session-file reload (investigated as a suspected bug; the repro passed, so no source change was needed). ## [0.81.38] - 2026-07-16 ### Changed - Updated repository development and CI to Node.js 24 and moved GitHub workflows to Node 24-based action releases while retaining Node.js 22.19 as the published runtime minimum. ### Fixed - Fixed Windows shell routing for native drive and UNC paths, extension live reloads, managed Ollama executable discovery, and canonical delegated-worker path reports. - Fixed Windows full-path find/FFF search parity, cross-platform watcher/runtime test behavior, and SQLite handle cleanup when runtime-index schema validation fails. - Fixed the Windows Bash-like router to prefer a usable PowerShell 7 executable, preserve `echo -n`, no-match `grep`, `rm -f`, `mkdir -p`, directory-copy, and hidden-listing semantics, and reject unquoted pathname, brace, and home expansion instead of passing it literally. ## [0.81.37] - 2026-07-16 ### Fixed - Updated release validation for the native Python/task-step surface, update preflight, platform-shell output, and prompt-cost growth, and made the Windows binary smoke test prove the stable Bash-like contract executes through PowerShell. ## [0.81.36] - 2026-07-16 ### Added - Added native session-persisted task steps with the built-in `task_steps` tool and `/task`/`/steps` commands, replacing the machine-local checklist extension. - Added one stable `bash` tool contract on every platform, with deterministic finite-grammar conversion to UTF-8 PowerShell execution on Windows, fail-closed handling for unsupported shell constructs, and legacy `powershell` tool-name remapping. - Added a native uv-managed `python` tool with pinned/checksummed runtime provisioning, direct cross-platform execution, bounded process-tree deadlines, streamed output artifacts, doctor/update/postinstall integration, and native UAC/profile registration. ### Changed - Agent, interactive, and RPC shell calls now have a 120-second wall-clock default, including continuously producing commands; agent-tool overrides cap at one hour. Removed the unbounded synchronous full-file/recursive optimizer path and added scoped paths-first search guidance. ### Fixed - Made the platform-limited FFF native binding optional so clean Android/Termux installs use the supported fallback instead of failing with `EBADPLATFORM`. - Listed the native `python` and `task_steps` surfaces in CLI help for clean-install discovery. - Updated `undici` to 8.5.0 to resolve current TLS, WebSocket, header, cache, and connection-reuse advisories. ## [0.81.35] - 2026-07-15 ## [0.81.34] - 2026-07-15 ## [0.81.33] - 2026-07-15 ### Added - Added a profile-selectable bundled tmux agent manager with portable team templates, event-driven terminal result signals, exactly-once parent wake handoffs, startup reconciliation, and packaged binary resources. - Added a leased multi-tenant transient workspace under `~/.pi/agent/work///` with ownership manifests and bounded age, count, byte, scan, and depth retention. - Added native Windows x64 and ARM64 build, test, smoke, and release gates. ### Fixed - Added in-settings profile model editing, including returning an existing profile to session/default-model inheritance and immediate transactional reload for active profiles. - Made profile extension choices use collision-safe path identities and description/folder labels, so separate folder-based `index.ts` extensions can be enabled independently. - Made goal ledgers user-recoverable with manual status, resume, reopen, complete, close, and override controls while retaining evidence-gated agent completion. - Removed redundant approval waits and unbounded repair loops from the bundled skill/extension authoring and harness-learning workflows. - Made delegated worker terminal events queue bounded, serialized parent wake handoffs without injecting untrusted worker output, status polling, or debounce-timer races. - Made child-process waits settle when attached after a fast child already emitted its terminal event, and routed exec cancellation through event-driven process-tree escalation. - Removed Unix-only temporary-path, shell, editor, clipboard, package, and runtime assumptions from Windows execution paths. ## [0.81.32] - 2026-07-13 ### Fixed - Fixed published installs to include dependencies nested under internal workspace packages, including the OpenAI SDK required by Fugu Responses models. ## [0.81.31] - 2026-07-13 ## [0.81.30] - 2026-07-13 ### Added - Added a bundled harness self-adaptation skill with evidence, layer-selection, measurement, retention, rollback, and authority gates for compounding Pi work without gratuitous self-modification. - Added per-delegation, lane-profile-gated read-only memory retrieval for isolated workers while keeping private memory files and every memory mutation unavailable. - Added explicit queued/running worker status and lane-specific completion notifications without injecting late worker output into the active foreground transcript. ### Fixed - Bounded long-session telemetry by bytes with cumulative per-session summaries, made recovery-log worker replacement batch-safe, added active-session-safe age/count/byte retention for context payload stores, replaced repeated full-session footer, context, analytics, and background-lane scans with incremental or indexed reads, and invalidated provider request-prefix caches immediately after compaction. - Avoided full copies of large context strings during curation, artifact hashing, context GC, RPC framing, local-runtime progress parsing, and HTML branch reconstruction. - Made managed local-model readiness verify the configured Ollama model after startup, exit cleanly when it is missing, and prevent prefix warming from silently falling back to another model. - Kept startup running when an extension fails to load, while reporting the failure, restoring prior provider and flag state, and discarding partial event registrations. - Preserved bounded read-only delegated worker output when a worker returns plain text, custom JSON, or reaches its output limit instead of failing it as unparseable. - Made worker delegation follow the selected lane model's provider and tool protocol, and prevented multiple queued local workers from deadlocking. - Restored OAuth rejection recovery for Codex subscription models by matching the provider ID instead of the Responses API ID. ## [0.81.29] - 2026-07-10 ### Fixed - Updated capability, fitness, and regression coverage for the artifact and delegation companion tools and plain-text worker results. ## [0.81.28] - 2026-07-10 ### Fixed - Added bounded recovery for locally unexpired OAuth credentials rejected with an initial Codex 401, including locked reload/refresh and rotated-token persistence. - Made delegated workers session-owned background jobs with non-blocking starts, explicit local-foreground queuing, bounded `delegate_status` retrieval, and safe read-only plain-text result handling. ## [0.81.27] - 2026-07-10 ### Added - Added first-class `max` and reinforced-orchestration `ultra` thinking-level support across CLI, settings, profiles, skills, custom model metadata, selectors, themes, and cost-guard downgrades. ### Changed - Bounded delegation context by packing stale `delegate` results while retaining retrievable originals, and made goal continuation prioritize and structurally fence the newest worker snapshots. - Enabled bounded delegation by default for capability-eligible models while preserving explicit disable, profile/tool, concurrency, cost, time, write-scope, and validation gates; Ultra now strengthens proactive delegation without owning the capability. - Enabled local safe-auto memory retrieval and budget-gated prompt inclusion by default while retaining explicit disable and compact-model caps. - Applied delegation and research capability gates to each resolved lane model, so configured lane models neither inherit nor bypass the foreground model's capacity verdict. - Upgraded profile-shipped research and worker lanes to isolated, turn-bounded child tool loops with exact glob-expanded UAC surfaces, read/write path enforcement, multi-turn usage accounting, direct-write reporting, relative profile references, and fail-closed diagnostics for opaque tool grants. - Rebuilt routed-turn prompts for effective thinking changes, including same-model tier overrides, and made the cost guard account for the actual routed model, full provider-bound prompt/tool surface, and model-declared long-context pricing while projecting output from the session reserve instead of a model's absolute output ceiling; opt-in downgrades affect the imminent request without mutating routed/profile/session thinking, and the exported default matches the runtime's warning-only `$2.50` default. The USD warning guard remains independent from the `0.7` compaction trigger and does not impose an artificial ceiling on GPT-5.6's public context window. ### Fixed - Fixed clean-checkout TypeScript resolution for the exported `@caupulican/pi-agent-core/paths` subpath before package builds exist. - Restored default stream-stall bounds after partial settings spreads so HTTP timeout clamping cannot create `NaN` watchdog delays. - Made `contextPolicy.memory.enabled: false` authoritative for both retrieval paths; fail-closed legacy/opaque memory query egress unless a provider is explicitly local or external egress is explicitly enabled; centrally source-fenced all legacy recall output; blocked common raw tokens, bearer credentials, and signed URLs; synchronized live-loaded/unloaded extension memory providers; and exposed the external-egress consent in `/settings`. - Synchronized profile UAC across SDK, startup, editing, and reload: SDK sessions retain the shared goal/delegation/toolkit defaults and accept complete one-shot situations; extension-provided profile models resolve on startup; reusable situations preserve soul and complete router settings; relative references and explicit empty selections apply consistently; and failed generations roll back settings, providers, memory, tools, model/thinking, discovery state, and diagnostics together. - Made profile edits, selection changes, deletion, and configuration restore transactional across runtime validation and persistent storage; backups now round-trip canonical multi-profile and explicit-none selections without restoring external-root trust. - Removed the duplicate CURRENT/TODAY/SUBAGENTS cost summary from the autonomy footer line; the compact footer stats remain authoritative and `/cost` retains the detailed report. - Restored the proactive over-ceiling cost-guard warning in that authoritative footer line without duplicating session totals. - Restored the `(sub)` marker for subscription-equivalent current cost and stopped applying USD cost-guard projections to ChatGPT subscription usage. - Counted cached-read and cache-write tokens in adaptive prefill profiling, rejected effectively deferred response headers as a false prefill boundary, and made the profiler terminate cleanly when an inner provider stream rejects or ends without a terminal event. - Kept the stream-stall watchdog authoritative for short HTTP idle settings by constraining every watchdog phase and its adaptive ceiling below each nonzero transport timeout; disabling the HTTP timeout still leaves adaptive watchdog protection active. - Kept research evidence provenance valid when `maxSources` is one by reserving the synthesis source cited by generated findings. - Re-clamped thinking, resynchronized the capability-filtered tool surface, and rebuilt the base prompt on every model set/cycle path so model switches cannot expose stale tools or orchestration guidance. - Preserved generated models' default thinking level and thinking-level map in faux-provider registrations so GPT-5.6 and Ultra harness runs exercise the production capability contract. ## [0.81.26] - 2026-07-09 ### Fixed - Fixed dynamically registered provider models to honor configured `modelOverrides`. ## [0.81.25] - 2026-07-09 ### Fixed - Added session-level compaction gate failure and deterministic gap-fill telemetry to make nonzero gate-failure rates visible in stats and `/session` output. ## [0.81.24] - 2026-07-09 ### Fixed - Fixed cost displays to use one CURRENT/TODAY/SUBAGENTS summary across the footer and autonomy cost line, with subagent cost included in CURRENT and local-midnight TODAY rollover. ## [0.81.23] - 2026-07-09 ### Added - Added background worker-thread tool-recovery logging with bounded queue/drop counters surfaced in `/toolhealth`. ### Changed - Made tool-argument repair a built-in path by removing the `toolRepair.repair` setting; `toolRepair.logging` now controls only recovery log writes. ## [0.81.22] - 2026-07-09 ### Fixed - Fixed model-router judge handling so static decisions bypass the judge, judge-unavailable fallback preserves the baseline reason, and nested shell execution forms escalate correctly. - Fixed auto-compaction failure and abort paths to preserve queued steering-message processing. - Fixed resumed long sessions to populate prompt input recall immediately while keeping transcript rendering lazy. ## [0.81.21] - 2026-07-08 ### Added - Added a local cold-start live acceptance gate for stock-stall Ollama tool-call turns. - Added runtime residency adapters for Ollama, pi-managed Transformers, and advisory external serves. ### Changed - Made the pi-owned Ollama model store canonical, with `/models import` adopting user-store models by hardlink/copy instead of re-download. - Routed local model activation through the residency arbiter before serving or warming local models. ### Fixed - Fixed local-class adaptive stall handling to raise cold connect bounds from measured prefill/load timing while keeping remote no-profile connect bounds unchanged. - Fixed local context sizing to derive GGUF metadata by architecture key/suffix instead of architecture name lists. - Fixed pi-managed Transformers venv setup to validate pip and interpreter coherence, repair with `ensurepip`, recreate stale venvs, and surface venv package install guidance. ## [0.81.20] - 2026-07-08 ### Fixed - Fixed pi-managed Transformers setup to resolve the environment Python before creating its venv and to repair existing incomplete venvs before Hugging Face model downloads. ## [0.81.19] - 2026-07-08 ### Fixed - Fixed post-compaction token measurement to keep passive estimates idempotent and use the same max real-usage/estimate basis as the auto-compaction trigger. ## [0.81.18] - 2026-07-08 ### Added - Added an exact Bonsai-4B GGUF Q1_0 curated local-model suggestion for one-step managed Ollama setup and curator-role probing. ### Fixed - Excluded local-only planning docs from npm package file selection even when they exist in a local checkout. ## [0.81.17] - 2026-07-08 ### Added - Added host-local model perf profiles that record streamed prefill/decode rates and adapt quiet stall bounds from measured throughput. - Added local OpenAI-compatible prefix warming and longer managed Ollama residency defaults for local-model startup. - Added local-model context sizing that derives `num_ctx` from host RAM and model metadata, then creates a sized Ollama Modelfile alias for managed installs. - Added a runtime residency arbiter core for fitting, evicting, refusing, and reserving local model loads across runtime adapters. - Added local acceptance/bench perf-profile hydration so live protocol checks and opt-in local benches feed adaptive stall bounds. ### Fixed - Documented every tool-repair registry mode in the bundled repair catalogue and covered the registry/docs link with tests. ## [0.81.16] - 2026-07-08 ### Added - Added graded `/toolprobe` native capability reporting and persistence so native verdicts require both an echo probe and a task-scale read probe, while echo-only or absent native support can calibrate the text protocol. - Added MiniCPM5-1B to the live acceptance fleet as a full-base native tool-calling target through the pi-managed Transformers sidecar. - Added a pi-managed Hugging Face Transformers runtime path for curated full-base local model suggestions, starting with `openbmb/MiniCPM5-1B`, using an isolated venv and pi-owned HF cache. ### Fixed - Fixed tool probing so a real task-scale native tool call wins without requiring a separate echo-only probe, and the MiniCPM sidecar stops generation after a complete native function call. - Documented the Ollama serving-context requirement for local OpenAI-compatible models. ## [0.81.15] - 2026-07-07 ## [0.81.14] - 2026-07-07 ### Fixed - Fixed text protocol model gating so persisted probe verdicts opt in only text-protocol models after env/settings/model gates, while unflagged native models do not receive the primer. - Documented the `propertyCaseNormalize` and `jsonObjectPropertySalvage` repair modes in the operator docs and bundled tool-repair skill. ## [0.81.13] - 2026-07-07 ### Fixed - Fixed custom model registration to preserve `textToolCallProtocol` and show it in `--list-models`. - Fixed text tool protocol calibration failures to persist, fail fast until explicit reset, and invalidate stale calibrated protocols after repeated live parse failures. - Added `/toolprobe` and RPC `tool_probe` to live-probe native/text-protocol tool-call support and persist host-local verdicts. ## [0.81.12] - 2026-07-07 0.81.10/0.81.11 retracted before distribution; changes are folded into this section for 0.81.12. ### Fixed - Fixed external editor resolution so both inline and path-edit flows prefer `$VISUAL` before `$EDITOR`. - Fixed registered extension models without token limits to receive default context and max-output limits. - Fixed grep/find result-limit notices so exact-limit result sets are not reported as truncated. - Fixed edit tool argument preparation to leave stringified `edits` for the shared validation repair layer. - Added session analytics aggregation for shape-only tool argument validation telemetry. - Added a host-keyed per-model adaptation store for repair rules, protocol calibration, and teach statistics. - Added learned per-model tool-shape rules to system prompt assembly after repeated repair telemetry. - Added per-model teach-efficacy aggregation for tool argument validation telemetry. - Added per-model text tool-call protocol calibration before the first real turn. - Added sanitized tool-validation bounce records to the local failure corpus for repair-mode discovery. - Added tool repair health reporting, learned-rule removal, visible repaired-call markers, and repair/teach/protocol kill switches. - Fixed delegated worker action parsing to use the shared tool-argument validation repair path. - Documented tool repair diagnostics, controls, and replay workflow. ## [0.81.9] - 2026-07-07 ## [0.81.8] - 2026-07-07 ### Fixed - Fixed manual compaction retry warnings to include verification failure details. - Fixed auto-compaction custom-stream regression coverage to seed sessions above the real trigger threshold. - Fixed overflow-triggered auto-compaction to apply one checkpoint before retrying the provider request even when measured tokens are below the configured threshold. - Fixed git log filtering to preserve user arguments while applying default compact-log limits. - Fixed fuzzy edit replacements to preserve unrelated file bytes and report diffs from the actual on-disk change. - Fixed edit duplicate detection so exact matches are counted exactly before falling back to fuzzy ambiguity checks. - Fixed RPC input validation so non-command JSON lines return errors without terminating the process. - Fixed `read` tail results to return the requested content lines for newline-terminated files. - Fixed initial CLI prompt construction to separate stdin, `@file`, and message sources with blank lines. - Fixed worker edit actions to insert replacement text literally when it contains JavaScript `$` replacement patterns. - Fixed cheap-tier shell tool escalation to fail closed on compound commands containing mutating segments. - Fixed bare CLI model-id resolution to prefer the single authenticated provider and reject unresolved ambiguity. ## [0.81.7] - 2026-07-06 ### Fixed - Fixed native reflection cost deduplication to derive report IDs from a stable turn digest instead of an absent message id. - Fixed extension `tool_call` event dispatch so a throwing handler emits diagnostics without skipping later handlers. - Fixed settings overlay merging to recurse through nested objects while still replacing arrays. - Fixed root-session migration to extract filenames correctly from both POSIX and Windows-style paths. - Fixed scout truncation accounting to count assistant output tokens against the output-token cap instead of total input plus output tokens. - Fixed reflection-engine malformed-response handling to preserve provider usage after completed calls. - Fixed research-lane spend limits to clamp configured lane budgets to the foreground capability envelope. - Fixed failure-corpus secret redaction for separator-bearing `sk-proj-` and `sk-ant-` API key formats. - Fixed shared exec output decoding to preserve multibyte UTF-8 characters split across stdout/stderr chunks. - Fixed overlapping bash execution cancellation so aborting bash cancels every running command instead of only the latest one. - Fixed concurrent first-run managed-tool downloads to share one in-flight download per tool. - Fixed interactive-mode cleanup leaks by sequence-guarding current-scope session loads and disposing replaced custom editors. - Fixed the mutation-barrier regression test to wait on explicit scheduling conditions instead of timing sleeps. ## [0.81.6] - 2026-07-06 ### Fixed - Fixed interactive-mode `renderSessionContext` to serialize overlapping rebuild calls on a queue so that the newest generation wins the commit and the visible container remains intact. - `/goal ` now deterministically seeds one open requirement from the goal text, so the continuation loop is drivable even when the model skips decomposition. - Compaction retry warnings now name the summarizer selection reason and the input-size estimate, so gate failures identify the responsible model without a post-mortem. - Fixed local-model compaction capacity checks to use measured served context-window evidence from the fitness probe instead of trusting the registered window guess, including tail-truncating local servers by requiring start and end capacity needles. - Fixed manual `/compact` to preserve authoritative extension results, keep normal summary verification enabled, reserve deterministic checkpoints for gate-retry exhaustion, and surface provider failures. - Fixed provider-failure corpus recording to write once per failed assistant message with the overflow-aware classification. - Fixed startup migrations and project-trust reads to leave malformed `models.json` / `trust.json` files untouched instead of crashing startup. - Fixed interactive mode to rebind the live extensions-changed UI refresh listener after session switches. - Fixed extension factory and lazy-load failures to dispose partial event-bus subscriptions before retry or rollback. ## [0.81.5] - 2026-07-06 ## [0.81.4] - 2026-07-06 ### Added - Added FastContext-1.0-4B and Ornith-1.0-9B to `/models` suggestions for one-step pull, probe, and role assignment; added the `scout` fitness role that writes `scout.model` and `scout.enabled`, gated on the `scout_auto` fitness exam. - Added a bounded, redacted local provider-failure corpus plus provider-failure status counts for unknown-classification evidence gathering. ### Changed - Compaction summarizer selection now consults the fitness doctrine (digest lane, subtractive) and the exhausted-provider registry; every fallback is visible. ### Fixed - Fixed executor speculative retry persistence so the discarded first attempt is removed from the routed-turn session buffer before the refined retry is saved. - Fixed the bash tool optimizer so `grep`/`rg` regex patterns fall through to the real command instead of being treated as literal substring searches. - Fixed the bash tool `find` optimizer so symlinked directories are listed but not recursively followed outside the search tree. - Fixed HTML session export asset injection so dollar sequences in template and vendor JavaScript are preserved exactly. - Added the missing `/goal` command so users can start or inspect the goal ledger instead of only invoking `/goal-continue`. - Fixed compaction summarizer selection to reject candidates whose context window cannot ingest the live span (visible `window_too_small` fallback to the session model), and to warn when an explicit `compaction.model` setting cannot ingest it. ## [0.81.3] - 2026-07-05 ### Added - Added `context_scout` and `ScoutController`, a bounded read-only repository scout with citation validity checks. - Added FastContext scout install docs, a 10 GB reference profile, a consolidated per-tier model+thinking screen in Model Router settings, and a thinking-level picker during `/fitness` role assignment. - Added opt-in `modelRouter.fitnessGate` routing: probed-unfit tier models are blocked subtractively, scout `auto` selection now requires passed fitness proof, and router status/settings surface the gate. - Added provider quota failover handling: subscription usage limits halt retries and can hop once to an authenticated provider default; metered quota failures halt for explicit user choice. ### Changed - Auto-compaction now uses the kernel closed loop and surfaces verification warnings from accepted fallback summaries. - Router status now shows each tier's thinking level, including `thinking (inherit)`. - Refactored executor and curation fitness gates onto the shared model-router fitness bar without changing their proof-required behavior. ## [0.81.2] - 2026-07-05 ## [0.81.1] - 2026-07-05 ### Added - Phase-aware stream watchdog wiring in `AgentSession`, utilizing the new `StreamStallSettings` (`connectMs`, `activeIdleMs`, `quietIdleMs`) exposed and validated by `SettingsManager`. - Compaction stream stalls are now fully retryable. Both manual and auto-compaction are wrapped in `_compactWithRetry`, ensuring transient stream stalls during summarization trigger retries rather than hard failures. ### Changed - Increased `DEFAULT_HTTP_IDLE_TIMEOUT_MS` to 660s (from 120s) to support up to 10-minute quiet idles during long think phases without premature HTTP-layer kills. ## [0.81.0] - 2026-07-04 ### Added - Foreground bash commands with no explicit `timeout` are now killed after 600s of continuous silence (no stdout/stderr output), not by total runtime — a command that keeps producing output is never killed by this. Passing an explicit `timeout` disables the silence watchdog in favor of the wall-clock limit; backgrounded (`cmd &`) work is exempt by construction. Wires the `createSilenceWatchdog` primitive from `@caupulican/pi-agent-core`'s reliability kernel into the bash tool. - A silently dead provider stream can no longer wedge a turn forever. Every provider stream a session starts is now wrapped once (at construction) with the reliability kernel's `withStreamIdleWatchdog`: it bounds the wait for the first event (120s connect allowance) and the gap between subsequent events (30s idle). On a stall it aborts the inner request and surfaces a retryable `stream stalled` error, which the existing auto-retry path picks up — so a hung connection now fails over instead of hanging. The bound is on silence, never on total runtime, so a stream that keeps emitting is never cut off. - Process memory (rss, heap used, external — rounded to MB) is now surfaced as self-telemetry: the `/usage` command prints a "Process" section, and `getAutonomyDiagnosticSnapshot` gains a `processMemory` family rendered by `formatAutonomyDiagnostics`. Unlike the snapshot's other families, `processMemory` reflects live process state rather than recorded session activity, so it is always present, even when nothing else has happened yet. ### Changed - truncate and sanitizeBinaryOutput now live in @caupulican/pi-agent-core (single canonical copy). - convertToLlm and the custom message types (BashExecutionMessage, CustomMessage, BranchSummaryMessage, CompactionSummaryMessage) now come from @caupulican/pi-agent-core (moved out of `core/messages.ts`); coding-agent re-exports convertToLlm unchanged, so its public API is preserved. - The tool-result-details retention helpers (`compactToolResultDetailsForRetention`, `compactRetainedDetails`, and their byte budgets) and the `normalizePath`/`resolvePath` path helpers now come from @caupulican/pi-agent-core (`message-retention` moved to the main entry, path helpers to the `/node` entry). `utils/paths.ts` re-exports `normalizePath`/`resolvePath` unchanged, so its consumers are unaffected. - `SessionManager` no longer reads app config. Its constructor and statics (`create`, `open`, `continueRecent`, `forkFrom`, `list`) now take the agent config dir explicitly, and `listAll` takes the sessions-root dir explicitly — the kernel-promotion seam, so `SessionManager` no longer imports `config.ts`. A new host-layer `core/session-manager-factory.ts` (`createSession`, `openSession`, `continueRecentSession`, `forkSession`, `listSessions`, `listAllSessions`) is the single visible place that closes over `getAgentDir()`/`getSessionsDir()` and delegates; call sites that already hold their own agent dir (SDK, session runtime) pass it directly. Behavior is unchanged (`usesDefaultSessionDir()` now compares against the injected agent dir, identical to the previous config-derived value in the CLI). - `SessionManager` and the session storage types (`SessionEntry`, `SessionHeader`, `SessionContext`, `SessionInfo`, `SessionTreeNode`, `CompactionEntry`, `BranchSummaryEntry`, `CustomEntry`, `CustomMessageEntry`, `LabelEntry`, `SessionInfoEntry`, `FileEntry`, `ReadonlySessionManager`, `NewSessionOptions`, `SessionListProgress`) and functions (`buildSessionContext`, `migrateSessionEntries`, `parseSessionEntries`, `getLatestCompactionEntry`, `getDefaultSessionDir`, `loadEntriesFromFile`, `findMostRecentSession`, `assertValidSessionId`, `isAutoLearnSessionId`, `CURRENT_SESSION_VERSION`) now come from `@caupulican/pi-agent-core/node` (moved out of `core/session-manager.ts`); `core/session-manager-factory.ts` still wraps it with the same host-layer API, so coding-agent's public surface and behavior are unchanged. - The compaction + branch-summarization module (`shouldCompact`, `prepareCompaction`, `compact`, `generateSummary`, `findCutPoint`, `findTurnStartIndex`, `estimateTokens`, `estimateContextTokens`, `calculateContextTokens`, `getLastAssistantUsage`, `serializeConversation`, `DEFAULT_COMPACTION_SETTINGS`, `collectEntriesForBranchSummary`, `prepareBranchEntries`, `generateBranchSummary`, and the `CompactionResult`/`CompactionSettings`/`CompactionPreparation`/`FileOperations` types) now comes from `@caupulican/pi-agent-core/node` (moved out of `core/compaction/`); the `#30` cost-guard triggers (`triggerPercent`, `MIN_COMPACTION_SAVINGS`) ride along unchanged. `AgentSession` still owns the auto-compaction orchestration and calls into the promoted functions; coding-agent re-exports the surface unchanged, so its public API and behavior are preserved. - Auto-retry, stalled-stream abort, bash silence watchdog, exec kill escalation, and bash/edit write serialization now ride the shared reliability kernel (@caupulican/pi-agent-core). - Provider errors containing auth wording (401/unauthorized/invalid api key) are now terminal instead of retried, even when combined with transient wording (e.g. "fetch failed: 401 unauthorized") — retrying on bad credentials is pointless. Previously such mixed messages were retried. - Custom retry settings are now capped at 120s per backoff step (maxDelayMs). Default behavior (2s/4s/8s) is unchanged; only aggressive custom baseDelayMs/maxRetries combinations are affected. - The Auto Learn / native-reflection controller moved out of `interactive-mode.ts` into `modes/interactive/auto-learn-controller.ts` (new `AutoLearnController`): the disk-backed run-state machine (state.json + lockfile), the background-learner spawn/prune lifecycle, and the in-process reflection pass now live in one module. `InteractiveMode` constructs it with narrow deps (a live session accessor, the host's self-modification-source resolver, and a small UI callback surface) and delegates at every call-in point; behavior is unchanged. - The local-runtime (Ollama) lifecycle moved out of `agent-session.ts` into `core/local-runtime-controller.ts` (new `LocalRuntimeController`): the cached per-server `OllamaRuntime` instances, the "confirmed up this session" flag, the #31 install-on-consent flow, and the #27 router tier-escalation fallback now live in one module. `AgentSession` constructs it with narrow deps (agent dir, a last-assistant-message accessor, the session's UI context/event emitter, and the router's own tier resolver) and delegates at every call-in point (`getLocalRuntime` keeps its public signature); behavior is unchanged. - System-prompt construction moved out of `agent-session.ts` into `core/system-prompt-builder.ts` (new `SystemPromptBuilder`): the situational-soul (R6), self-modification, and autonomy guardrail blocks, the per-tool snippet/guideline options assembly, and the `_baseSystemPromptOptions` state now live in one module (distinct from the existing pure `core/system-prompt.ts` string renderer it feeds). `AgentSession` constructs it with narrow accessor deps (cwd, the settings/resource/memory managers, the tool registries, and the active extensions — each read fresh so mid-session reassignment is tracked) and delegates at every call-in point; behavior is unchanged. - Autonomy telemetry and the status/diagnostic snapshots moved out of `agent-session.ts` into `core/autonomy-telemetry.ts` (new `AutonomyTelemetry`): the G3 telemetry sink, the G8 gate-outcome recorder plus the bounded gate-outcome history (owning the `_lastAutonomyGateOutcome` / `_gateOutcomeHistory` state), and the `getAutonomyStatusSnapshot` / `getAutonomyDiagnosticSnapshot` builders now live in one module. `AgentSession` constructs it with narrow accessor deps (the session manager, the last router decision, cost/goal/lane getters, and the research/delegation/learning snapshot getters — each read fresh) and delegates at every call-in point (`_emitAutonomyTelemetry`, `_recordGateOutcome`, `getGateOutcomeHistory`, and both public snapshot methods keep their signatures); behavior is unchanged. - The background lanes moved out of `agent-session.ts` into `core/background-lane-controller.ts` (new `BackgroundLaneController`): idle goal auto-continue, the autonomous research lane, scout-worker delegation, and the model-fitness probe — plus the shared lane-model/profile/envelope resolution helpers — now live in one module, owning the lane timers, the single-flight guards, the last research-lane skip reason, the live `LaneTracker`, and the in-flight research/worker abort controllers. `AgentSession` constructs it with narrow accessor deps (the session manager, settings, model registry, live model, capability envelope, the model-capability profile, the goal continuation LOOP, the isolated-completion primitive, spawned-usage accounting, and the telemetry sink — each read fresh) and delegates at every call-in point: the idle triggers off the prompt tail, the dispose-time timer clears + lane aborts, the router judge's lane-model resolution, and the public `runResearchLaneOnce` / `runWorkerDelegationOnce` / `runModelFitness` / `getStoredFitnessReports` / `getLaneRecords` methods keep their signatures. The drive-loop boundary is preserved — the controller only ever asks the session to `continueGoalLoop`, never touching `prompt()` or streaming/retry state; behavior is unchanged. - The memory subsystem moved out of `agent-session.ts` into `core/memory-controller.ts` (new `MemoryController`): the observe-only local OKF retrieval, the bounded prompt-evidence surfacing pilot, cross-session recall gating/effectiveness, and the plug-and-play `MemoryManager` (bundled file-store + transcript-recall providers plus extension contributions) now live in one module, owning the lazily-built OKF provider, the latest retrieval/prompt-inclusion reports, the reload-safe `MemoryManager`, the recall `EffectivenessTracker`, and the extension-contributed pending providers. `AgentSession` constructs it with narrow accessor deps (settings, the current turn index, agent/workspace dirs, the session id, the child-session flag, and the tool-registry refresh — each read fresh) and delegates at every call-in point: the context-transform hot path (`_runMemoryRetrieval` / `_maybeAppendMemoryEvidenceBlock` stay as one-line delegations so the transform keeps owning the pass ordering), the drive-loop cross-session recall (`shouldAttemptRecall` / prefetch / `recordRecallOutcome`), the context_audit memory diagnostics, dispose-time shutdown, reload's provider reset + re-init, the memory-tool surfacing, and the reflection engine's fresh-memory reads. The public `getMemoryRetrievalReport` / `getMemoryPromptInclusionReport` / `registerMemoryProvider` methods keep their signatures. The controller imports no compaction/context-pipeline internals; behavior is unchanged. - The per-turn context pipeline moved out of `agent-session.ts` into `core/context-pipeline.ts` (new `ContextPipeline`): the observe-only context audit, the shadow prompt-policy plan and its correlation with legacy context-gc, the enforcement pilot, the relevance-curation queue plus the fitness-gated curation-model resolver / brain-curation drain / compaction pre-digest, the legacy context-gc pass and its packed-artifact reference release, the tool-output artifact store, and the current-context token estimate now live in one module, owning the latest audit/policy/correlation/enforcement/gc reports, the `BrainCurator` sidecar and its curation/pre-digest skip reasons, and the lazily-built artifact store. `AgentSession` constructs it with narrow accessor deps (the current turn index, the session/settings managers, the model registry, agent/workspace dirs, the active tool names, the disposed flag, the isolated-completion primitive, spawned-usage accounting, and the live `MemoryManager` — each read fresh) and delegates at every call-in point: `_installAgentContextTransform` stays host-side and keeps the pass ordering, with each stage (`_estimateCurrentContextTokens`, `_runContextAudit`, `_runPromptPolicyPlanning`, `_applyContextGc`, `_correlatePromptPolicyWithContextGc`, `_runPromptEnforcement`, `_enqueueRelevanceCuration`, `_maybeDrainBrainCuration`) a one-line delegation; the compaction pre-digest, executor reflex-brain model resolution, runtime tool-artifact-store build, per-turn cost guard, composition dashboard, and dispose-time artifact sweep likewise delegate. The public `getContextAuditReport` / `getPromptPolicyReport` / `getPromptPolicyGcCorrelation` / `getPromptEnforcementReport` / `getContextGcReport` / `getContextCurationStatus` methods keep their signatures. The pipeline reaches `MemoryController` only through the `getMemoryManager` dep (never imports it), and `MemoryController` never imports the pipeline, so the transform stays the single place the two subsystems meet; behavior is unchanged. - Two pure computation clusters moved out of `interactive-mode.ts` into new sibling modules. `modes/interactive/history-reload-math.ts` holds the TUI reload-window math (`messagesForTuiHistoryReload`, `estimateTuiHistoryLines`, the text/message tail-trimmers, and the message-text extractors, plus the `TUI_HISTORY_RELOAD_MAX_LINES`/`_WRAP_WIDTH` budgets). `modes/interactive/resource-display.ts` holds the startup "loaded resources" formatters (path/label/scope-group/diagnostics rendering). `InteractiveMode` retains thin `this.`-delegating wrappers only where its stateful display code (`showLoadedResources`, `renderSessionContext`, `addMessageToChat`) or the existing prototype-based tests resolve a formatter through `this`; the rest are called directly from the modules. Behavior is unchanged. - The editor-overlay swap that `interactive-mode.ts` repeats ~23× (both showing an overlay in place of the editor — selectors, dialogs, loaders, the reload notice — and restoring the editor afterwards) is now unified behind `modes/interactive/editor-overlay-host.ts` (new `EditorOverlayHost`). Its single `swap(component, options)` method performs the `clear → addChild → focus → requestRender` sequence, parameterizing the real per-site deltas: the focus target (defaults to the mounted component; the selector helper focuses a distinct child), `setFocus` vs `restoreFocus` (the latter for the two selector-return paths that prefer the topmost visible overlay), and the render request (`requestRender()`, `requestRender(true)` for the reload notice, or none where the caller renders later). Per-site cleanup that isn't a swap concern (component `dispose()`, temp-file unlink, clearing the stored selector reference, restoring saved editor text) stays inline at each call site. The editor-*replacement* path (`setCustomEditorComponent`, which clears early, rebuilds the editor, then mounts it) is a different shape and is left as-is. Behavior is unchanged. - The resource-profile and external-source menu flows moved out of `interactive-mode.ts` into `modes/interactive/profile-menu-controller.ts` (new `ProfileMenuController`): the `/profiles` command, the resources-hub menu tree (active-profile selection, manage/create/delete/persist profiles, the per-profile library resource-grant editor, and external-root add/remove), and the profile-apply/reload/mutation-refresh logic now live in one module (23 methods). It holds no state of its own — every fact still lives in `settingsManager`, the profile registry, and the session resource loader — so `InteractiveMode` constructs it with narrow deps (a live session accessor and a UI callback surface, including the shared `showSelector`/`EditorOverlayHost`) and keeps thin one-line delegators at the three call-in points (`handleResourcesHubAction`, `handleProfilesCommand`, `refreshAfterProfileMutation`); behavior is unchanged. - The auth / login / OAuth dialog flows moved out of `interactive-mode.ts` into `modes/interactive/auth-dialogs-controller.ts` (new `AuthDialogsController`): the `/login` and `/logout` command handling (provider resolution and selection, the auth-type/provider selectors), the subscription (OAuth) login dialog, the API-key login dialog, the Amazon Bedrock setup notice, the in-dialog OAuth select prompt, and post-login model adoption now live in one module (12 methods), together with the auth-provider classification helpers (`isApiKeyLoginProvider`, `isUnknownModel`, `hasDefaultModelProvider`, `BEDROCK_PROVIDER_ID`) that only those flows used. It holds no state of its own — every credential/provider fact still lives in `session.modelRegistry.authStorage` — so `InteractiveMode` constructs it with narrow deps (a live session accessor and a UI callback surface, including the shared `showSelector`/`EditorOverlayHost`) and reaches it at the single external call-in point (`showOAuthSelector`, for `/login` and `/logout`); behavior is unchanged. - The config backup/restore commands and the read-only report/easter-egg commands moved out of `interactive-mode.ts` into two new sibling modules. `modes/interactive/config-backup.ts` holds `/config-backup` and `/config-restore` (the profile + resource-settings snapshot and its round-trip, including the pre-restore confirmation and the security rule that restored external roots come back untrusted). `modes/interactive/report-commands.ts` holds the read-only reports (`/usage`, `/changelog`, `/hotkeys`, `/debug`) and the easter-egg renders (`/arminsayshi`, `/dementedelves`, and the kimi-k2.5 daxnuts trigger). Both are plain function modules that operate through a narrow structural `host` seam (the settings manager plus status/error/selector callbacks; or the chat container, TUI, and a few read accessors), so `InteractiveMode` keeps thin wrappers that build the host from `this` at call time — required both because those fields are private and because the existing prototype-based tests invoke the wrappers through `this`. Behavior is unchanged. - The model-router turn routing moved out of `agent-session.ts` into `core/model-router-controller.ts` (new `ModelRouterController`): the regex/executor route resolver, the optional bounded routing judge, the executor lane (Level-0 toolkit direct hit plus the speculative brain-refined retry), the per-tier thinking/tool-surface swap around a routed turn, the cheap-research-turn session buffer with mutating-tool escalation to an expensive retry, and the router status/diagnostics report now live in one module, owning the transient per-turn route state (active intent/route, the cheap-turn session buffer, the escalation-requested and retry-in-flight flags) and the sticky last-decision/skip-reason/intent. The parallel routed drive path (`runRoutedTurn`) keeps the actual agent.prompt()/continue() loop host-side — `AgentSession._runAgentPrompt`/`_promptUnserialized` are untouched and reached through a `runAgentPrompt` dep, so the drive loop is never duplicated. `AgentSession` constructs it with narrow accessor deps (the live agent, current model, the session/settings managers, the model registry, agent dir, the reflection abort signal, the base system prompt, the isolated-completion primitive, spawned-usage accounting, the event/telemetry emitters, and the recently-extracted `BackgroundLaneController.resolveLaneModel` / `ContextPipeline.resolveCurationModelIfFit`) and keeps a one-line delegation at every call-in: the routing prep + routed-turn entry in `_promptUnserialized`, the `beforeToolCall` mutating-tool escalation branch (`maybeEscalateToolCall`), the `message_end` cheap-turn buffering (`captureSessionMessage`), the retry-event suppression (`isRetryInFlight`), and the public `getModelRouterStatus` plus the autonomy-telemetry last-decision read. Behavior and event ordering are unchanged. - The runtime build and the self-modification-safe extension reload moved out of `agent-session.ts` into `core/runtime-builder.ts` (new `RuntimeBuilder`): the tool-registry assembly (`refreshToolRegistry`), the base-tool-definition + `ExtensionRunner` build (`buildRuntime`), the crown-jewel `reload()` with its snapshot / doctor / commit-or-rollback sequence, and the single-extension live load/unload/reconcile operations now live in one module, owning the five tool-registry maps (base tool definitions, the wrapped tool registry, the definition registry, and the per-tool prompt snippet/guideline maps). The reload snapshot spans state owned by other collaborators — the extension runner and its ref, `agent.state.tools`/`agent.state.systemPrompt`, and `_baseSystemPrompt` — which stay host/agent-owned and are captured and restored through narrow get/set deps so save/restore mutate exactly the same fields as before (the `_extensionRunnerRef.current` update folds into `setExtensionRunner`, matching the host's field-then-ref pattern); only the tool-registry maps are owned by the builder. `_bindExtensionCore` stays host-side (it exposes the session's own public surface to the runner — host identity, not build logic) and is invoked from `buildRuntime` via a `bindExtensionCore` dep. `AgentSession` constructs it with narrow accessor deps (the live agent, cwd, the session/settings managers, the model registry, the resource loader, the extension-runner get/set, the base-system-prompt get/set, the custom-tools/base-override, the requested-active-tool-names request, the profile tool filter + its warning sink, memory subsystem accessors, the goal/context-gc/worker/model-fitness tool callbacks, the isolated-completion primitive and spawned-usage accounting, the doctor context-snapshot/context-usage probes, and the streaming/compacting refusal guards) and keeps byte-identical one-line delegations for the public `reload` / `loadExtensionLive` / `unloadExtensionLive` / `reconcileLoadedExtensions` API and for `getAllTools` / `getToolDefinition`, plus a private `_refreshToolRegistry` delegation for its internal callers. The preflight → doctor → commit/rollback sequence and refusal behavior are unchanged. - The extension UI surface moved out of `interactive-mode.ts` into `modes/interactive/extension-ui-host.ts` (new `ExtensionUiHost`): the extension-provided dialogs (`select`/`confirm`/`input`, the multi-line editor, and the overlay-capable `custom` component), the above/below-editor widget mounting, extension status text, the custom footer/header swaps, the custom editor-component swap (`setCustomEditorComponent`, its early `editorContainer.clear()` preserved verbatim), keyboard-shortcut wiring, terminal-input listeners, the extension-error render, and the `ExtensionUIContext` handed to extensions now live in one module (22 methods). It owns exactly the state this cluster mutates (the live selector/input/editor dialog components, the above/below widget maps, the terminal-input unsubscribers, the custom footer/header, and the current custom-editor factory). `InteractiveMode` constructs it with narrow deps (a live session accessor plus a UI callback surface: the stable containers/TUI/overlay-host/footer passed directly, the mutable active editor and built-in header reached through get/set accessors, and the render-core / status operations that stay host-side — working indicator, hidden-thinking label, autocomplete rebuild, tools-expansion, terminal title, and shutdown/abort/reload — exposed as callbacks) and keeps one-line delegations at every call-in point: the session-invalidate reset and `handleReloadCommand`'s `resetExtensionUI`, `bindCurrentSessionExtensions`' context/error/shortcut wiring, the reload and live-refresh shortcut re-wiring, the branch-summary and `/import` confirm/selector/editor prompts, the initial widget render, `stop()`'s listener teardown, and the three `getCustomHeader()` header reads. The extension test suites are the lock — extensions see an identical `ExtensionUIContext`; behavior is unchanged. - The residual command/flow/plumbing clusters moved out of `interactive-mode.ts` into thirteen new sibling modules, bringing the file under the 4,000-line cap (5,870 → 3,971): `session-flow-commands.ts` (tree/session/fork navigation and the model selectors), `settings-selector-flow.ts` (`/settings`), `local-model-commands.ts` (`/models` lifecycle and `/fitness`), `autonomy-commands.ts` (`/autonomy`, `/auto-learn`), `session-io-commands.ts` (import/export/share/copy/name), `resource-shell-commands.ts` (`/install-resources`, `/curate`, bash, `/compact`), `external-editor.ts` (`$EDITOR`/`$VISUAL` launch), `autocomplete-provider.ts` (base completion set), `startup-checks.ts` (changelog notice, update/tmux checks, notifications, install telemetry, trust warning), `signal-lifecycle.ts` (SIGTERM/SIGHUP/uncaught handlers, graceful+emergency shutdown, Ctrl+Z suspend), `key-handlers.ts` (editor/global key wiring), `clipboard-input.ts` (image paste + user-input assembly), and `compaction-queue.ts` (post-compaction queue flush). Each is a plain function module operating through a narrow structural `host` seam; `InteractiveMode` keeps thin wrappers that build the host from `this` at call time (with get/set accessors for the fields a flow mutates — e.g. `loadingAnimation`, `isShuttingDown`/`signalCleanupHandlers`, `isBashMode`, the clipboard queue/counter, `compactionQueuedMessages`) both because those members are private and because the existing prototype-based tests invoke the wrappers through `this`. The slash-command router, `handleEvent`, the streaming/status-loader lifecycle, `renderSessionContext`, and the render core stay host-side. Bodies are verbatim; behavior is unchanged. - The residual autonomy/session/runtime clusters moved out of `agent-session.ts` into eight new `core/` collaborator classes, bringing the file under the 4,000-line cap (5,387 → 3,963): `reflection-controller.ts` (`ReflectionController` — the native end-of-loop reflection pass, the isolated-completion primitive, and the gated learning-apply/rollback path), `goal-loop-controller.ts` (`GoalLoopController` — the bounded goal auto-continuation loop), `session-analytics.ts` (`SessionAnalytics` — usage/cost/stats accounting, the /context window estimate, and HTML/JSONL export, owning the spawned-usage and daily-usage memo caches), `session-tree-navigator.ts` (`SessionTreeNavigator` — in-file branch switching + fork-selector reads), `model-selection-controller.ts` (`ModelSelectionController` — the manual model switch/cycle and thinking-level set/cycle/clamp, distinct from the per-turn `ModelRouterController`), `bash-execution-controller.ts` (`BashExecutionController` — the `/bash` path and its streaming-deferred pending-message queue), `profile-filter-controller.ts` (`ProfileFilterController` — resource-profile tool/extension gating and reload-time profile model re-apply), and `tool-gate-controller.ts` (`ToolGateController` — the agent `beforeToolCall`/`afterToolCall` hooks: router escalation, autonomy gating, extension tool hooks, and the untrusted-content output boundary). `AgentSession` constructs each with narrow lazy accessor deps and keeps same-signature public delegations at every call-in point, so callers, the constructor dep closures, and the drive loop are untouched (the `model`/`thinkingLevel` getters, the branch-summary abort controller read by `isCompacting`, and the bash-flush call sites all stay host-side). The drive loop (`_promptUnserialized`/`_handleAgentEvent`/`_handlePostAgentRun`), compaction, the retry bridge, and the extension-core wiring stay host-side. Bodies are verbatim; behavior is unchanged. ### Fixed - Default compaction model selection now respects the Model Router cheap model when enabled, otherwise falls back to the active session model with low reasoning instead of picking the globally cheapest authed model (which could route summarization through `openrouter/auto`). - `pi --version` resolved through the full application import graph (~1s to print a version string). A fast path in the CLI entry now answers `--version`/`-v` from already-loaded config (~150ms, −85%); any combined invocation still routes through the full parser unchanged. - Auto-compaction could fail or skip invisibly: three bail paths (no model, summarizer auth failure, nothing to compact) ended with no result and no reason, and the TUI rendered nothing for that combination — indistinguishable from broken compaction. Every auto-compaction outcome now carries a `result`, an `errorMessage`, or a new `skipReason` on `compaction_end`, and the TUI renders all of them. The cheap summarizer model (#30) also falls back to the session model when its key resolution fails at request time instead of silently giving up. - `pi --help` had regressed from ~160ms to ~400ms: `config.ts`'s `normalizePath` import (needed just to resolve `PI_PACKAGE_DIR`) went through `utils/paths.ts`, which re-exported from `@caupulican/pi-agent-core/node` — a barrel that also loads `SessionManager`, compaction, messages, and process-tree, none of which the help path needs. `utils/paths.ts` now imports from the kernel's new granular `@caupulican/pi-agent-core/paths` subpath instead, restoring `--help` to its ~160ms baseline; behavior and the re-exported surface are unchanged. - Bash commands could previously race file-tool (`edit`/`write`) mutations: because a shell command cannot statically declare which files it touches, it wasn't serialized against them at all. The bash tool's foreground command execution now goes through a readers-writer barrier shared with `withFileMutationQueue`: file mutations are readers (still parallel with each other across different files), and bash is the sole writer — it waits for all in-flight/queued file mutations to drain, then runs exclusively while blocking new ones, and queues FIFO against other bash invocations. New `withExclusiveMutationBarrier` in `file-mutation-queue.ts`. - `execCommand`'s kill path (used by aborted/timed-out commands, including extensions' `ctx.exec`) now actually escalates to SIGKILL: it previously gated escalation on `ChildProcess.killed`, which Node sets the moment a signal is *sent* rather than when the process dies, so a child trapping SIGTERM survived forever. The kill path now delegates to the reliability kernel's `killTree` (liveness-probed SIGTERM → SIGKILL escalation). Commands also spawn in their own process group on POSIX so aborting kills grandchildren, not just the direct child. Spawn failures (e.g. ENOENT) are now surfaced via a new `ExecResult.errorMessage` field instead of being silently swallowed as a bare `code: 1`. - Model adoption ignored the fitness probe's own verdict. Two gates, both fixed: - `/models suggest` (and the manual `/fitness` picker) could probe a model, get zero successes on every one of the six surfaces, and still land it as judge model / Model Router settings because the post-probe role selector opened regardless of the result. `runFitnessAndAssign` — the single site both flows funnel through — now checks the new pure `isProbeAllFailed(report)` predicate (research/core/research/model-fitness.ts) and, on an all-lanes-failed probe, refuses adoption outright: no role assigned, no settings written, just a clear "failed the fitness probe on all surfaces — not configured" message pointing at manual `/model` as the opt-in override. A partial or full pass keeps the existing selector flow unchanged. The predicate itself had a latent vacuous-truth gap: when every lane surface was ungraded (`total: 0`) but the judge ran and failed, `gradedLanes.every(...)` was trivially true over the empty array, so a report with zero lane evidence could still be read as all-lanes-failed — it now requires at least one actually graded lane before returning that verdict. - Manual `/model ` had no gate at all, so a model already known (from a stored fitness report) to fail on every surface, or a local Ollama model whose weights don't fit in RAM, could be set silently and 500 every subsequent turn (llama-server OOM). `AgentSession.setModel` is advisory-only here by design — a human's explicit choice is never blocked — but now emits a `warning` event (the same plain-text channel print/RPC modes already render, never a prompt) when the target has a recorded all-lanes-failed probe on this host, or is an Ollama model whose installed size exceeds ~90% of `os.totalmem()`. This advisory now also covers `cycleModel` (reachable via the `app.model.cycleForward`/`cycleBackward` keybindings and the RPC `cycleModel` call), which previously bypassed it entirely on both the scoped (`--models`) and all-available cycle paths, silently landing on a known-bad or OOM-prone model. The Ollama size/RAM lookup (and `/models remove`) also missed installed models referenced by a bare tag — Ollama's `/api/tags` always reports an explicit tag, defaulting to `:latest`, so an exact-string match silently skipped the check whenever a user typed a bare ref (e.g. `llama3` vs. the installed `llama3:latest`); both call sites now share one `matchesInstalledLocalModel` helper (`core/models/model-ref.ts`) that accounts for the bare/`:latest` pairing. - `output-accumulator-io-errors.test.ts`'s `vi.mock("node:fs", ...)` factory returned only the three members the test overrides (`closeSync`, `openSync`, `writeSync`), so any other `node:fs` export accessed during the run — `existsSync`, read at import time by `@caupulican/pi-ai`'s `env-api-keys.ts` — threw inside vitest's mock proxy and surfaced as an unhandled rejection, even though the test's own assertions passed. The mock now spreads the real module (`importOriginal()`) and overrides only the three functions it needs, so unmocked exports stay real. - `keyHandlersHost()` snapshotted `editor`, `session`, and `settingsManager` onto the key-handler host object at `setupKeyHandlers()`'s one-time init instead of reading them live off `this`. All three are swappable after init — `editor` via extension custom editors (`setEditor`, whose `onEscape` delegates back through the closures installed on `defaultEditor`), and `session`/`settingsManager` via `/reload`'s runtime-host swap — so Escape handling kept reading the stale pre-swap objects: Escape could fail to abort bash on a reloaded session, and the double-escape `/tree`/`/fork` trigger could read the wrong editor's text. `keyHandlersHost()` now exposes `editor`, `session`, and `settingsManager` as live getters over the instance (matching the existing `isBashMode`/`lastEscapeTime` accessor pattern); `defaultEditor` and `ui` stay plain properties since they're set once and never swapped. ## [0.80.103] - 2026-07-03 ### Fixed - Config-directory override environment variables are now POSIX-valid and actually usable. Because `piConfig.name` is `pi-adaptative`, the derived names were `PI-ADAPTATIVE_CODING_AGENT_DIR` and `PI-ADAPTATIVE_CODING_AGENT_SESSION_DIR` — but a hyphen is invalid in a shell variable name, so `export PI-ADAPTATIVE_CODING_AGENT_DIR=…` is a parse error and the documented override (shown in `pi --help`) silently could not be set. The names are now sanitized to `PI_ADAPTATIVE_CODING_AGENT_DIR` and `PI_ADAPTATIVE_CODING_AGENT_SESSION_DIR`. ## [0.80.102] - 2026-07-03 ### Fixed - Made the FFF lazy-install test suite environment-independent. Three tests asserted that `@ff-labs/fff-node` was not resolvable — which held locally (the package resolves only via the managed install) but failed in CI, where the declared dependency is installed by `npm ci`, blocking v0.80.101 from publishing. `loadAvailableFffNodePackage`/`ensureFffNodePackage` now take an optional injectable resolver-candidate list, and those tests pass an empty list to force the "not available" precondition deterministically regardless of environment. Test-only; no runtime behavior change. 0.80.102 republishes the 0.80.101 changes with this fix. ## [0.80.101] - 2026-07-03 ### Added - Skills may declare a `thinking` level in their frontmatter (parsed and validated on load, invalid values ignored), so a task-specific skill can carry its intended reasoning depth. The parsed value is available wherever `Skill` objects flow; turn-scoped application of an active skill's thinking is a follow-up (an extension can already apply it via the existing `ctx.setThinkingLevel()` hook). Complements profile-level thinking, which is applied to the session across CLI startup, SDK creation, `/profile` switch, and `/reload` (explicit `--thinking` still wins) — now covered by tests, including its composition with per-tier router thinking (the router override wins for the routed turn and restores the profile level after). - Per-tier thinking level for the model router: `modelRouter` now accepts `cheapThinking`, `mediumThinking`, `expensiveThinking`, `executorThinking`, and `judgeThinking`. A routed turn applies the configured thinking level for its tier (clamped to the routed model), so a cheap/local tier can run at `low`/`off` while the expensive tier runs at `high` — thinking level is now a cost/speed lever independent of the model choice. Unset per-tier thinking reproduces today's inherit-and-clamp behavior exactly; the routing judge's own bounded completion uses `judgeThinking` (default `off`). Executor-direct routes are matched before the cheap tier so they read `executorThinking`, not `cheapThinking`. Each tier's thinking level is settable in the Model Router settings submenu (an "(inherit)" option clears it to the default behavior). - `/models suggest` now opens an interactive picker over the validated local-model roster instead of printing a list to retype: choosing a model installs it, probes its six fitness surfaces on the actual hardware, and lands the role it was shaped for already pre-selected in the assignment step — so a suggested model goes from pick to installed-and-set in one flow. The suggestion's shaped `assignRole` (previously unused metadata) drives the pre-selection; non-tool-calling models carry curator/judge/lane roles and never pre-select the executor role. - The model router now auto-manages the local ollama server: when a turn routes to a local (ollama) model, pi ensures the server is up first — reusing an already-running server and the user's own `~/.ollama` models (never pi's owned storage; a reuse-mode start omits the `OLLAMA_MODELS` override that `/models add` still uses) or booting one if needed — so a local-routed turn never fails just because the server wasn't started yet. A per-session "confirmed up" cache skips the health check on later turns (re-checked only after a connection error from the same model). If the local model can't be made ready (binary missing, or the server won't boot) the turn does not dead-end: a visible warning states why (install steps inline when the binary is missing) and which tier is now handling the turn, then it escalates to the next configured tier. The runtime is owned by `AgentSession`, so headless/SDK turns get the same behavior and `/models` shares the one instance. - When a routed local model is missing only because the ollama binary itself isn't installed (not because its server is down), an interactive session now asks first: "Install Ollama?", noting it's a large one-time download, before doing anything. A "yes" downloads the pinned ollama release for the current platform straight into pi's own `runtimes/ollama` directory (never `curl | sh`, never outside pi's own directory) and extracts it — `.tar.zst` archives decompress via Node's own built-in zstd support when available, falling back to a system `zstd` binary, with an honest error if neither exists — then the turn proceeds on the original local model with no fallback needed. A "no", a timeout, an install that itself fails, or a headless/SDK session with no interactive prompt to ask through all fall straight through to the existing graceful tier-escalation warning above, worded to say so honestly (an install attempt that failed is reported as a failed install attempt, never re-labeled as if nothing was tried). The confirm dialog pauses the routing working-indicator while it's on screen and hands it back right after, so the spinner and the dialog never compete for the terminal at the same time. - New `pi-adaptative doctor` command plus an update/startup preflight that verify required tooling and provision what pi owns. It checks FFF native search (managed — actually installs it if missing, via the same path as lazy first-use), ripgrep, ollama (binary + server status), and python, reporting each as present/missing with version/detail and, for tools pi doesn't own, guide-mode install steps (printed, never executed — no `curl | sh`, no `sudo`). The preflight runs automatically after a successful `pi-adaptative update` (best-effort, never fails the update), so an update actually provisions the managed tooling instead of leaving it to lazy first-use — closing the "ran update on another machine and FFF never got installed" gap. The interactive `doctor` shows install progress; the background preflight stays quiet. ### Fixed - FFF native search now provisions itself even for ordinary searches. `find`/`grep` decide FFF-vs-fallback using their default result limit (1000/100), which exceeds the router's top-N threshold, so the decision is "fallback" and the tool returned *before* ever calling `getFinder()` — the call that triggers the lazy managed install of `@ff-labs/fff-node`. A machine that only ran default-limit searches therefore never installed FFF at all (rg/fd silently handled everything, so its speed was never available). Provisioning is now decoupled from the per-call routing outcome: `find`/`grep` kick off the finder unconditionally via a new `safeGetFinder` that can never reject (even if a custom backend's `getFinder` throws synchronously), reusing the same in-flight promise when the call does route to FFF. A genuine install failure is now retryable instead of permanently gating FFF out — the finder is always evicted so the next search re-enters — while a 30s cooldown throttles the npm spawn itself, so repeated searches during an outage don't respawn npm each time. An explicit `--offline`/`PI_OFFLINE` directive and unsupported platforms remain a stable no-retry fallback. The last install outcome is recorded (`getLastFffInstallOutcome`) for a future environment `doctor` check. - The user's prompt now appears on screen immediately when submitted, instead of appearing to hang until the model router's routing judge finishes. The judge is a bounded LLM completion (seconds), and the turn previously built and emitted the user message only *after* awaiting it, so the prompt looked frozen right after Enter. `_promptUnserialized` now builds the user message and paints it (a synthetic `message_start`) before the judge await, then reuses that same object for the turn; the authoritative `message_start` emitted later is suppressed exactly once (reference-keyed via a Set), so the message is still shown and persisted a single time, and extensions still observe it at the real turn start (their visible behavior is unchanged). - While the model router's routing/prep phase runs — the gap after the prompt paints and before the turn starts streaming, during which the routing judge makes a bounded LLM call — the interactive UI now shows the existing "working" indicator as general processing feedback, so that gap no longer looks frozen. It shows independently of the thinking level (this is routing feedback, not model-thinking) and respects the user's working-indicator toggle. New UI-only `routing_start` / `routing_end` session events bracket the phase and are emitted exactly once each — `routing_end` fires on both the success and failure paths, so the indicator never spins on after a turn that fails before it starts — and it hands off seamlessly into the normal streaming indicator. - Hardened the hardening sweep after a max-effort review of the working diff found nine regressions and latent holes the first pass introduced or left open: - `endWriteStream` (newly awaited by the bash executor) hung forever when the stream had already errored or closed before the call — an errored stream never emits `finish`, so the `once` listeners attached after the events fired and never resolved, hanging the bash tool on any spill write error. It now resolves immediately for an already-finished/destroyed/closed/errored stream. - The git-filter spill branch created its temp-file stream with no error handler, so a failed spill write still advertised a "Full output:" path pointing at a partial or missing file. It now drops the path on write error, matching the main capture path. - The execution-time envelope path check resolved a target through `existsSync`, which reports false for a DANGLING symlink — so a dangling symlink placed inside an allowed root resolved lexically and escaped the envelope (the subsequent write follows the link). `safeRealpathSync` now dereferences a dangling leaf via `lstat`/`readlink` with a hop cap, closing the escape. - `applyWorkerActions` routed writes through an injectable fs seam while the scope check used the real filesystem, so the two could disagree. The test-only seam (its sole injector) is removed; scope check and write now share one filesystem of record. - The context-GC auto-digest was fenced at RENDER time, regenerating a random boundary nonce on every provider request (the GC transform re-runs per request) — a byte-unstable prompt prefix that broke prefix caching, and double-wrapped/mangled an already-fenced digest. Fencing now happens once at digest store time; GC renders it verbatim. - A reflection write the gate marked "apply" recorded an `action:"apply"` audit with a rollback plan even when the memory tool silently refused it (budget/drift/threat return `success:false` without throwing) — a phantom rollback target that then failed not-found. A refused apply now records an `apply_failed` audit with no rollback plan and is not rollback-eligible. - The `/context` "withheld by the active resource profile" line fired even with NO active profile, blaming a nonexistent profile for a plain user disable (and double-reporting alongside the disable-wins warning). The count is now profile-only and empty when no profile is active. - A durable `memory_replace`/`memory_remove` could never auto-apply even under a fully permissive policy, because the contradiction branch short-circuited before every eligibility check — an append-only incentive that degraded memory hygiene. A new `learningPolicy.autoApplySupersessions` (default false, TUI-toggleable) lets a supersession fall through to the normal eligibility bars. - Router-swapped turns restored the pre-turn tools/system-prompt unconditionally in `finally`, silently clobbering a mid-turn extension change (e.g. `setActiveToolsByName`) that legitimately replaced them. Restore now happens only when the live values are still exactly what the swap assigned. - The editor grant-widening guard was applied only to allow-framing: the block-framing all-enabled branch still widened a closed grant to `{allow:["*"]}` for a kind the profile omitted, and the editor let the literal `"*"` wildcard marker enter the working set as a fake resource id (so unchecking one item under a `{allow:["*"]}` grant persisted `{allow:[…,"*"]}`, and the disabled item kept loading). Both paths now gate on the same original-wildcard/grant-all check, and the marker never enters the item set. - Fixed `executeBash` returning a full-output temp-file path before the file's write was flushed: the artifact write went through an async stream that was `.end()`-ed but never awaited, so a caller reading the path immediately could see partial or empty content (a load-dependent flake). The stream flush is now awaited across the normal, git-filter, cancel, and error paths, so the returned path always points at a complete file. - Fixed the context-GC auto-digest (a machine paraphrase of possibly attacker-influenced tool output) being inlined into the prompt as bare prose: it is now wrapped in the standard untrusted-content fence, the same boundary memory recall pages use, so an injection payload in the digest is framed as data, not instructions. - Fixed profile-denied context files (AGENTS.md/CLAUDE.md/GEMINI.md) being read and processed as content before the agents-kind profile filter: the loader now reads each candidate file's raw bytes once purely to discover any embedded `` blocks (unavoidable — a profile can be defined in a file it then denies), and only sanitizes, threat-scans, and exposes files the profile allows. A denied file's instructional content is never loaded into the session, and the redundant double read of every context file is gone. - Fixed the profile resource editor silently widening a closed grant to a wildcard: when every id in a kind's (possibly collapsed) universe was enabled, a no-change save re-encoded an enumerated grant like `{allow:[alpha,beta]}` as `{allow:["*"]}`, auto-granting every future resource of that kind. The save now preserves the enumerated list and only keeps `["*"]` when the grant was already a wildcard (or grant-all was chosen explicitly). - Fixed skills, prompts, and extensions denied by the active resource profile being silently absent from `/context`: it now reports "N skill(s)/prompt(s)/extension(s) withheld by the active resource profile — grant the kind to restore them", the same visibility the withheld-AGENTS.md warning already gave context files. - Fixed a silently-swallowed executor miss: when an executor-routed turn ran no toolkit command and the reflex brain could not refine the request into an explicit instruction, the turn ended with no retry and no explanation. It now surfaces a warning that the command did not run and no automatic escalation happened (the no-frontier-fallback policy is unchanged). - Fixed router-swapped turns (G4) leaving the system prompt at the full tool surface: when a turn is routed to a smaller model its tool set is filtered, but the system prompt still carried guidelines and schemas for tools the routed model couldn't call — billed every request and confusing to a cheap/local model. The prompt is now rebuilt for the routed model's filtered surface and restored afterwards, including when the routed run throws. - Fixed the learning gate's contradiction branch being unreachable dead code: the reflection call site hardcoded `contradictions: 0`, so a durable `memory_replace`/`memory_remove` — which overwrites or deletes an existing memory fact (the reflection engine's confront-before-write conflict signal) — could auto-apply and silently destroy prior knowledge. Such supersessions now route through the contradiction branch (approval-gated proposal, audited); purely additive writes are unaffected. - Fixed a learning-policy cliff where enabling the policy with stock settings silently disabled learning entirely: a below-confidence-threshold cue with no evidence returned a silent no-op (reflectionSourceConfidence 50 < confidenceThreshold 90, reflection writes carry no evidence), so every durable write was dropped with no apply and no audit trail. Below-threshold cues now degrade to an approval-gated proposal that is audited and visible in `/autonomy diagnostics`, while staying fail-closed — nothing auto-applies below the threshold. ## [0.80.100] - 2026-07-02 ### Added - Added `/models suggest`: a curated roster of local models validated during pi's own small-model research, each with the role it was shaped for — qwen3:1.7b as the toolkit executor/reflex muscle, qwen3:0.6b as a minimal fast executor, and the Ternary-Bonsai family (1.7B search scout, 4B context-curator/reflex-brain, 8B routing-judge for larger machines) marked as non-tool-calling lane/brain models. Each suggestion is a ready `/models add` ref; the roster is surfaced when no local models are installed. No per-model score is baked in — fitness is host-dependent, so `/models add` still auto-probes on the actual machine and the roster only encodes each model's validated role. ## [0.80.99] - 2026-07-02 ### Added - Added code-writing workers (G2 full): with `workerDelegation.writeEnabled` plus a `writePaths` scope, a delegated worker may emit structured file actions (write/edit) that the RUNNER applies through the capability envelope's path scope — an out-of-scope or denied path is refused with a reason and downgrades the result to blocked (a partial change can never look like clean success), and a write without the grant is ignored and flagged. `workerDelegation.maxConcurrent` (1-3) replaces the single-flight limit. The read-only scout contract is unchanged when writes are off. - Added speculative muscle-retry on executor turns: when an executor-routed turn ends without a successful run_toolkit_script execution, pi retries once on the same executor with the brain's refined instruction injected (the brain warms while the muscle tries, so the retry costs only when the muscle actually missed); visible in the router decision as executor_speculative_retry. - Added gate-outcome history (G8): a bounded 50-entry history of tool-gate outcomes replaces the latest-only record (getGateOutcomeHistory()), and the three remaining autonomy telemetry types (gateOutcome, workerRequest, approvalRequest) now emit at their honest sites. - Added per-turn foreground capability envelopes (G7): each turn derives an observe-only envelope (capabilities mapped from active tools, path scope = cwd, usd bound from the cost guard), surfaced as a one-line /context observation and via getForegroundEnvelope(). - Added capability-scaled goal-continuation budgets (G9): lean-class models (16-32k) now cap autonomous continuation at 2 turns / 5 minutes; below 16k stays gated off, full class unchanged. ## [0.80.98] - 2026-07-02 ### Added - Added the executor lane (G16): configure `modelRouter.executorModel` (or assign it in one step from /fitness -> "Toolkit executor") and command-shaped prompts that score a deterministic Level-0 EXACT hit on the toolkit registry route the whole turn to the local executor — with the judge skipped (nothing to judge), the tool surface capability-filtered to the executor's own class, and `run_toolkit_script` exempted from the cheap-tier mutation escalation ONLY on these routes (its own danger gate still applies; any other mutating tool still escalates). Ambiguous requests never route here — they stay with the main model and the reflex brain. - Added workspace research sources (G1): the autonomous research lane now grounds itself in the repo — a bounded ripgrep collector derives terms from the goal text and feeds pointer-first sources (repo-relative path, line, <=200-char excerpt; never file bodies) into the research prompt and the evidence bundle, with the synthesis anchors always preserved. Best-effort: no ripgrep or no matches reproduces the previous behavior exactly. - Added real evidence strength to the learning gate (G6): a bounded persistent observation store counts how often the same lesson (layer + normalized summary) is re-observed across passes and sessions, so `minObservations` now gates on truth — the first observation proposals, repeated ones can auto-apply. - Added autonomy telemetry emission (G3): route decisions, research/worker lane outcomes, and learning decisions now emit redacted, bounded events (ids/codes/numbers only — never prompt or memory text) as `autonomy-telemetry` session entries. - Added execution-time capability-envelope path enforcement and worker request persistence (G2 prerequisites): a tool wrapped in an envelope scope structurally refuses out-of-scope paths at the moment it runs (deny-wins, escape-proof), and every worker result persists its originating request (instructions, route, envelope) for audit. - Added digest-served telemetry: the /context curation line now reports how many brain digests were actually rendered into GC stubs on real turns — the pays-for-itself number. ## [0.80.97] - 2026-07-02 ## [0.80.96] - 2026-07-02 ### Added - Added Settings submenus for Learning Policy (enabled, auto-apply, confidence threshold, min observations; layer allow-list stays JSON-only) and Model Capability (auto/off/forced class), closing the last two settings surfaces that were configurable only by hand-editing JSON (G5). - Added routed-turn capability tool filtering (G4): when the model router swaps a turn to a cheaper model, the tool surface now follows the ROUTED model's capability class for that turn (an 8k local model no longer inherits — and pays schema tokens for — background-autonomy tools it cannot drive), restored with the session model afterwards. - Added the reflex brain to `run_toolkit_script`: when the deterministic Level-0 matcher is ambiguous ("prepare db" vs "update db"), a fitness-gated local interpreter model (validated 10/10 on the hard registry) resolves the request into a registry pick with extracted args — confidence-gated, registry-validated, and advisory only: danger confirmation and the structural execution contract apply identically to brain-selected scripts, and an absent/unfit/unconfident brain keeps today's shortlist behavior byte-for-byte. Brain spend is usage-accounted ("toolkit-brain"). ## [0.80.95] - 2026-07-02 ### Added - Added `/models`, the local model lifecycle (install -> spawn -> probe -> consume -> uninstall): `/models add ` accepts an ollama tag, an `hf.co/org/repo[:quant]` GGUF ref, a full HuggingFace URL, or a pasted `ollama pull ...` install command (parsed for its reference, never executed as shell) — pi starts its own health-checked server with OWNED model storage under `/models/ollama` (hardened env; an already-running system server is used instead, with the storage tradeoff surfaced), pulls with streamed progress, registers the model in models.json so `ollama/` resolves everywhere (session, lanes, judge, curator) across sessions, and auto-runs the fitness probe with one-step role assignment. `/models list` shows installed models with real sizes and cached fitness summaries; `/models stop` stops the pi-managed server (resource hygiene, deletes nothing). Removal is an EXPLICIT user action only — `/models remove ` first discloses exactly what gets deleted (weights + size, registration, fitness report) and requires the confirm token; pi never removes a model on its own. Hand-authored models.json files with comments are never rewritten (a manual snippet is offered instead). ## [0.80.94] - 2026-07-02 ### Fixed - Fixed pi crashing with an uncaught ReferenceError when opening Manage Library: the profile editor's universe builder referenced a helper before its initialization (TDZ). The editor path is now covered by a regression test that executes it end to end. - Fixed the selected profile not surviving pi restarts: /profiles selection was applied runtime-only, so every new session started with no profile. Selecting a profile now persists it to global settings (like model/theme selections), and selecting "(none)" persists the clear so the old selection cannot resurrect on restart. ## [0.80.93] - 2026-07-02 ## [0.80.92] - 2026-07-02 ### Added - Added the brain-curation compaction pre-digest (design surface 3, runtime-gated): when curation is enabled AND the curator model has proven itself in-session (>=5 jobs, <=5% parse failures on top of the digest fitness gate), old conversation chunks are digested locally before the frontier summarization call — digests plus the verbatim recent tail replace the full transcript. Any chunk whose digest fails passes through verbatim (partial assist, never partial loss), and each pre-digest persists an auditable session record with chars-before/after. - Surfaced three silent profile situations in the /context dashboard: an extension loaded but fully inert (profile denies all its tools and commands), an explicit tool grant that binds to no registered tool (typo or ungranted owning extension), and profile grants overridden by the user's own disable list — with the precedence now documented: a user disable ALWAYS beats a profile grant. ## [0.80.91] - 2026-07-02 ## [0.80.90] - 2026-07-02 ### Fixed - Fixed the profile editor's universe collapsing under strict UAC: the Skills/Prompts/Agents lists were built from the profile-NARROWED loaded getters, so while any restrictive profile was active you could not see — let alone grant — currently-blocked resources, including expanding the very profile you were running under. Discovery is now profile-independent (full pre-filter path sets, mirroring the existing extensions fix), and the editor's Tools list now includes registered extension tools. - Fixed profile-editor saves silently corrupting profiles: grants referenced outside the currently visible universe were dropped on save, and a fully-granted kind re-encoded to an omitted kind — which under strict UAC means DENY-ALL. Selection encode/decode is now strict-UAC-coherent (unmentioned decodes as denied; grant-all encodes as an explicit allow:["*"]; profile-referenced ids outside the visible universe survive decode/encode round-trips). - Surfaced the silent strict-UAC denial of AGENTS.md/CLAUDE.md context files: when the active profile does not mention the "agents" kind, the withheld files now produce a loader warning and a /context dashboard observation instead of instructions vanishing without a trace. - Fixed profile tool grants never ACTIVATING: activation was only ever the requested defaults intersected with the profile allow-list, so a profile granting non-default tools (e.g. a search-only profile allowing grep/find) produced an empty or truncated "Available tools" set on load and across /reload. Explicitly named tools in an active profile's allow list now activate from the registry (a blanket "*" stays grant-only, deriving activation from the defaults). ## [0.80.89] - 2026-07-02 ### Added - Added the brain-assisted context curator (opt-in `contextPolicy.curation` settings + Settings -> Context Curation submenu): a local-model sidecar that (a) writes 1-2 line semantic digests into Context GC's packed stubs so the main model stops re-running tools to rediscover packed content, and (b) scores stale artifact-backed tool outputs against the current goal so the prompt-policy enforcement pilot can evict irrelevant content earlier. Advisories are asymmetric by design: a verdict can only ever shrink the prompt, never keep or stub protected content, and every consumer behaves identically when a result is absent. Curation jobs are queued/bounded/idempotent, drain off-turn through the isolated-completion path with spawned-usage accounting, and persist auditable session records. The curator refuses models that have not PASSED the new `digest` fitness surface on this host (visible skip reasons, never silent degradation). - Added a `digest` surface to the `model_fitness` probe: chunks carry nonce identifiers, and a digest only scores as faithful when strict JSON parses AND the nonce survives verbatim — measuring extraction fidelity, not narration. - Added `/context`, a user-facing context composition dashboard decomposing what rides on EVERY request: system prompt tokens, per-tool schema costs (heaviest first), per-extension contributions, message classes (raw vs GC-packed vs policy-stubbed vs memory recall pages), GC/enforcement/curation activity, spawned background spend, and provider-reported vs estimated deltas — plus actionable observations (e.g. an oversized tool schema riding on every request) for users building their own pi integrations. - Added `/fitness [model] [trials]` as a first-class, discoverable command: with no arguments it opens the model picker, runs the probe on the selection, shows the six-surface report, and then offers ONE-STEP role assignment — context curator, router cheap/medium/expensive tier, routing judge, or learning model — writing the matching settings for you (with a hint when the model router itself is still disabled). With an explicit model it behaves like `/autonomy fitness`. ## [0.80.88] - 2026-07-02 ## [0.80.87] - 2026-07-02 ### Added - Added an opt-in Context / Prompt Policy setting that stubs stale, artifact-backed grep/find tool output in the model-visible prompt only (never the transcript) once configured retention-window and character thresholds are exceeded. Configurable via the Context / Prompt Policy settings submenu; default disabled. - Added an opt-in Context / Memory Retrieval setting that searches local Pi OKF memory documents each turn and can optionally surface a bounded, source-labeled evidence block in the model prompt (never the transcript). Configurable via the Context / Memory Retrieval settings submenu, including a separate "Include in prompt" toggle; both default disabled, and retrieval only ever queries the local provider. - Extended `context_audit` with a compact Memory retrieval / Prompt inclusion diagnostic section reporting status and counts for the two settings above, without exposing any memory content, query text, or file paths. - Added a `goal` tool that records the durable goal ledger (goal, requirements, evidence, and progress/stall events) as session-persisted snapshots. This is the producer that drives the bounded goal continuation loop and `/goal-continue`; without it the continuation runtime always read empty state and could not continue. The tool is active by default and maps to the `memory_write` capability. - Added `/autonomy diagnostics`, an effectiveness dashboard summarizing recent model-router decisions, current/spawned/daily cost totals, and, when present, the latest research, worker-delegation, learning, and goal activity. It is additive to `/autonomy [status|off|safe|balanced|full]`. - Added the autonomous research lane runtime: an opt-in, read-only background research pass that runs when the session goes idle with an active goal that has open requirements, executes one bounded isolated completion through the (unwired-until-now) research capability/budget gate, and persists a provenance-tagged evidence bundle plus a terminal lane record. Budgets cover cost per pass, wall-clock time, findings/sources caps, and idle runs per session; failures/skips are recorded with reason codes and never block or prompt the foreground. Research spend reports through spawned-usage accounting with an idempotent per-lane report id. Configurable via the new Research Lane settings submenu (default disabled; also requires autonomy mode on); `/autonomy research` triggers an explicit pass. Live lanes now feed the previously-unset `activeLaneCount` in `/autonomy status` snapshots, and `/autonomy diagnostics` shows research lane records, all evidence bundles, and the last skip reason. - Added the bounded worker-delegation runtime piloting read-only scout workers: a new `delegate` tool (active by default, mapped to the `delegate` capability, refusing with a reason until the Worker Delegation setting is enabled) lets the foreground model hand one self-contained analysis task to a worker running as a bounded isolated completion on a cheap model lane under a stripped read-only envelope. Every result is validated through the existing `validateWorkerResult` parent gate before acceptance, persisted as a worker-result snapshot plus a terminal lane record, marked untrusted in the tool output, and cost-reported through spawned-usage accounting with an idempotent per-lane report id. Budgets cover cost per worker and wall-clock time; delegation lanes appear in `/autonomy diagnostics` and count toward the live `activeLaneCount`. - Added the learning apply/audit/rollback policy runtime: reflection-sourced durable writes now route through the (previously unwired) learning gate, persist a `LearningDecision` snapshot per write, and leave an audit record with a concrete rollback plan for every applied or proposed change. With the new Learning Policy settings disabled (default) the legacy direct-apply behavior is preserved — now fully audited; when enabled, single-session reflection cues become proposals unless the configured confidence/observation thresholds and allowed layers (memory-only by default) permit auto-apply. `/autonomy rollback ` (and `AgentSession.rollbackLearningWrite`) executes the inverse memory operation or archives a promoted skill, exactly once per change, and records a linked rollback audit. Audit records appear in the `/autonomy diagnostics` learning family. - Added model-capability auto-detection so small open models (including sub-1B local models) stay usable for chat: the harness derives a capability class from the model's own `contextWindow` metadata — full (≥32k, unchanged), lean (≥16k, background-autonomy tools like `delegate` and `context_audit` blocked), minimal (≥8k, tools reduced to read/bash/edit/write, background lanes disabled), and chat (<8k, no tools at all). Filtering happens in `setActiveToolsByName`, so the system prompt sheds the blocked tools' schemas and guidelines too; the unfiltered request is remembered and restored when switching back to a larger model, with a visible notice on downgrade. Idle goal auto-continuation and the research lane are gated off below 16k (`model_context_too_small` in diagnostics), and lane output-token budgets scale to the lane model's window. Metadata-first with defaults only when info is missing (unknown window keeps full behavior); configurable via `modelCapability.mode` (`auto` default, `off`, or a forced class). - Changed background-lane model resolution to inherit the session model the lane was shipped from unless a lane-specific model is explicitly configured (the router's `cheapModel` no longer implicitly redirects lanes) — single-model setups, e.g. one local open model, now run research and scout workers on that same model. - Changed active resource profiles to strict least-privilege grants: when one or more profiles are active, any authority-bearing resource kind (extensions, skills, prompts, tools, agents) that no active profile explicitly mentions is denied outright — a defaults profile no longer loads the full extension/tool surface. Grant-all must be explicit via `allow: ["*"]`; explicitly written block-framed filters keep meaning "all except the listed"; themes are exempt; behavior without an active profile is unchanged. - Changed profile denial to gate the disk reads themselves: skill files and prompt templates a profile denies are never read from disk (extensions were already path-filtered before loading). While a restrictive profile is active, denied skills/prompts consequently no longer appear in resource listings; edit profiles with no restrictive profile active to see everything. - Added profile-shipped subagents: research and worker lanes accept a `profile` setting whose model MUST be obeyed when set (unresolvable is a visible `no_lane_profile_model` skip, never a fallback), whose soul and thinking level ship with the lane, and whose tool grants are recorded on the lane's capability envelope. Generic lanes keep inheriting the session model. - Added a level-0 subagent system-prompt core (<300 tokens of non-negotiable rules) that survives ANY prompt customization: lane settings (`systemPrompt`) and the delegate tool's new `systemPrompt` input can erase and replace everything above it — so a big session model can hand a small open model a minimal purpose-built prompt without shedding the safety floor. - Added `run_toolkit_script` (active by default, mapped to the `run_shell` capability): the user's blessed daily-ops script registry (`settings.toolkit.scripts` — name, description, aliases, uv/powershell/bash runner, danger flag) executed with a structural reliability contract. Finding is a conservative registry lookup that NEVER guesses between near-neighbors ("prepare db" vs "update-db" returns a shortlist instead of executing); the harness owns invocation (fixed argv, no shell strings) and always returns exit code, stdout, and stderr — a failed script is an error result by construction and can never look like success; scripts flagged `danger` never run without an explicit `confirm: true`. - Added the `model_fitness` probe (tool + `/autonomy fitness [trials]`): runs the real research-lane, scout-worker, and routing-judge runners plus two heavy-lifter surfaces (search-plan formulation, tool-call emission) against any registered model — local Ollama models included — reporting parse/success rates, judge discrimination, mean latency, tokens-per-second, and probe cost. Probe spend is cost-accounted; the tool is registered but not default-active. An opt-in size-class bench (`PI_LOCAL_MODEL_BENCH=1`) asserts per-class minimum bars for locally installed models. - Added a host-keyed fitness store (`/state/model-fitness.json`): every probe persists its report under a hardware fingerprint (CPU/cores/RAM), because fitness is a property of a model ON a host — role assignments stay per-machine and synced settings cannot carry one machine's speed numbers onto another. `AgentSession.getStoredFitnessReports()` exposes the current host's measured evidence for profile/role decisions. - Added the routing judge: with the model router enabled, a bounded routing-only completion on the judge lane (`modelRouter.judgeModel`, else `mediumModel`; ≤128 output tokens, 10s wall clock, static cached prompt) decides the final cheap/medium/expensive tier over the regex baseline — never the learning tier. Core rule: planning/design prompts are never cheap unless the judge explicitly deems them trivial; the regex classifier now also floors prospective planning prompts at medium (`planning_min_medium`) while plain lookups like "show me the architecture" stay cheap. Judge failures fall back to the baseline with visible reasons, judge spend reports through spawned-usage accounting, and `modelRouter.judgeEnabled: false` restores byte-identical router behavior. ### Changed - Changed bounded goal continuation to default to 20 turns and auto-inject continuation prompts after a prompt settles idle while an active goal remains open, with internal recursion suppression for continuation prompts. It now also respects new settings for wall-clock budget, idle delay, and turn limits, which can be configured via the Autonomy submenu in the settings TUI. - Added a third positional argument `[maxMinutes]` to the `/goal-continue` command to support bounded wall-clock loop termination. ## [0.80.86] - 2026-06-29 ### Added - Added dynamic token estimation checks for model context windows, warning the user if the base configuration (system prompt and tools) uses more than 70% of the context window. ### Fixed - Fixed adaptive scaling of compaction parameters (`reserveTokens` and `keepRecentTokens`) for models with small context windows to avoid immediate auto-compaction loops. - Fixed a scope redeclaration issue with `activeProfileNames` in the resource loader. - Fixed the semantic-memory context GC never packing the recall pages the bundled default memory provider emits: active providers' page markers are now merged into the GC marker list at runtime (and the generic `