# Changelog ## [0.5.80] - 2026-09-19 ### Added - **One-click installers, and a build for every platform.** Releases carried a single archive (`hoocode-windows-x64.zip`); everyone on macOS or Linux had npm as their only route. `scripts/build-binaries.sh` now takes `--targets` and `--list` and produces seven archives — `linux-x64`, `linux-arm64`, `linux-x64-musl`, `linux-arm64-musl`, `darwin-x64`, `darwin-arm64`, `windows-x64` — plus a `checksums.txt` covering all of them, cross-compiled from one runner. The musl builds mean Alpine and `static` distroless have a working binary for the first time. ```bash curl -fsSL https://kolisachint.github.io/hoocode/install.sh | sh # macOS, Linux irm https://kolisachint.github.io/hoocode/install.ps1 | iex # Windows ``` Both installers detect the platform (including musl vs glibc), verify the archive's sha256 against the release checksums, install under `~/.hoocode` with no root, link `hoocode` and `hoo`, and pre-seed the optional Rust helpers (`fd`, `rg`, `embsearch`, `webtools`, `voicetools`) into `~/.hoocode/bin` — the directory hoocode already resolves them from — so a first run is fast and works offline. `HOOCODE_RELEASE_BASE_URL` points them at a mirror for air-gapped installs. See `docs/install.md`. - **Tips on the notification band.** An occasional one-line tip above the prompt while the session is idle or a turn has been running a while, teaching the modes, dials, commands and extension surfaces that using the product does not reveal. Tips live in one file (`src/modes/interactive/tips.ts`); keybindings in them are resolved at display time, so a rebound key is taught as the user's own. A tip is posted only when the band is empty and is dropped rather than retried, so it can never delay or replace a notification the user caused. Off via `/settings` → Advanced → Tips, or `tips.enabled: false`. New settings: `tips.enabled`, `tips.seen`, `tips.starNudges`. ### Changed - The extension API parameter is `hoo`, not `pi`, across the core extensions, every example and the docs. It is positional, so existing extensions are unaffected whatever they call it. A `pi` key in a package manifest is still read as a deprecated alias for `hoocode`; `hoocode` wins when a package declares both. - The OAuth callback page shows the HooCode mark instead of the upstream project's. - `/share` prints the gist URL alone unless `HOOCODE_SHARE_VIEWER_URL` names a viewer. The previous default pointed at a host that does not exist. - `enableInstallTelemetry` documented as inert — hoocode sends no install or update telemetry. Update checks read the npm registry and are separate. ### Fixed - **The macOS builds are signed, so macOS will run them.** `bun build --compile` appends its payload to a copy of the bun executable, which leaves the Mach-O carrying a signature that no longer matches what it covers — and Apple Silicon does not warn about that, it kills the process on launch: `Killed: 9`, no dialog, no reason given. Every `darwin-*` binary is now ad-hoc signed before it is packed (`rcodesign` on the Linux runner the release cross-compiles from, `codesign` for a local build on a Mac), and `build-binaries.sh` refuses to pack an unsigned one rather than shipping an archive that dies on first run. `install.sh` repairs an invalid signature on the way in as well, so an older archive, or a mirror that rewrote the file, still installs something that starts. - **`scripts/build-binaries.sh` runs on a Mac.** Building every target died before the first compile on `mapfile`, which is bash 4 and macOS ships 3.2; and the checksums step used `sha256sum`, which is coreutils. That step also failed a `--targets` subset build outright — one of its two globs matches nothing, and under `set -o pipefail` that took down the script after every binary had already been compiled. ### Removed - The `hoocode update pi` alias. `self`, `hoocode` and `hoo` all still work. ## [0.5.79] - 2026-09-18 ### Added - `/login` lists two Google subscriptions: **Google Antigravity** and **Google Cloud Code Assist (Gemini CLI)**. Antigravity is the one a personal Google account wants — Gemini 3.8 / 3.7 / 3.6 Flash and 3.1 Pro on every plan, plus Claude 4.6 and GPT-OSS-120b — and it defaults to `gemini-3.8-flash-tiered` after login (Antigravity's ids are its own, see `docs/providers.md` for the table). Both logins need an OAuth client supplied through the environment — hoocode ships no Google credentials — and `--help` lists the four variables. The Gemini CLI client is now refused the free tier by Google (`UNSUPPORTED_CLIENT`), so it is for paid Code Assist tiers with a `GOOGLE_CLOUD_PROJECT` set; it defaults to `gemini-3.1-pro-preview`. See `docs/providers.md` -> "Subscriptions". ## [0.5.78] - 2026-09-18 ## [0.5.77] - 2026-09-18 ### Changed - The default model for a ChatGPT/Codex subscription login is `gpt-5.6-terra`, not `gpt-5.5` (which retires from Codex on 2026-10-14). ## [0.5.76] - 2026-09-17 ### Changed - **The startup banner is flush against the left edge.** The owl glyph carried a three-space indent plus the header's one-column padding, and the resource listing lined up under it with a four-space rail — the whole first page now starts at column 0. - **The owl glyph is terminal-default ink.** It wore the theme's accent; now it renders dark on light themes and light on dark ones, with no theme logic of its own. The `hoo` accent is untouched. - **A fresh session opens with the logo on the first row and the prompt on the floor.** The screen fill sat above the banner, so a short session packed the logo just above the prompt at the bottom; it sits directly below the banner now, with the leftover rows between it and the conversation. Past a screenful the fill is 0 and the layout is exactly the old pack-against-the-floor. ## [0.5.75] - 2026-09-17 ### Fixed - **The magenta session chip is magenta with a white name on it.** Slot 4 went through the same lift as every other chip, which made dark ink legible by bleaching the fill into pink — on light themes a deep rose the theme wrote came out as a pastel with dark text. Magenta is deepened, never lifted, until white clears the chip bar, and a token that already carries white is used exactly as the theme wrote it; the other five slots are untouched. ## [0.5.74] - 2026-09-17 ### Fixed - **Scrolling back to an image shows the image.** A screenshot or a diagram a tool returned was drawn while it streamed and then read `[image]` the moment you scrolled up to look at it again. The pinned transcript window draws it now (see the tui changelog for why it could not before). A picture whose top edge is off the window is still named until the whole of it is on screen. - **The cut-out themes' shadow no longer trails a tick under the bottom-right corner.** Under `vox-cutout-light` / `vox-cutout-dark`, every message block's shadow ended with a hairline hanging a full row below the sheet's bottom edge — the corner glyph was the right-hand column's `▏`, which fills the whole height of its cell, sitting in a row whose run is `▔`, an eighth. The two legs meet on their own and neither draws the corner now. Docs: `themes.md` → `paperShadow`. ## [0.5.73] - 2026-09-17 ### Fixed - **No more blank page between the conversation and the prompt.** On the `radar` tool-output view — or any session short enough to fit the screen — the screen fill sat between the transcript and the chrome and showed as a band of empty rows above the prompt; folding a long session into `radar` could leave nearly a screenful of it. The fill is now the first thing in the tree, so the leftover rows are above the banner and the banner, conversation, ledger, prompt and footer are one run against the bottom of the screen. Scrolling up and back down, and the end of a turn, land on the floor the same way (see the tui changelog for the renderer half). - **Stepping a dial twice shows the stop you are on.** The first press of `alt+z` (or any dial) put its glimpse on the notification band; the second went to the back of a queue behind it and the band went on showing the stop you had already left for its full three seconds. A glimpse now names the dial it came from, and a second reading of the same dial replaces the first on screen and restarts its clock. - **Clicking a link in the transcript works again.** Capturing the mouse for the wheel took the click away from the terminal; the app resolves the OSC 8 link under the pointer itself and opens it — plain left click, no modifier. The opener uses no shell and only http/https/mailto. ### Changed - **`full` chrome shows the whole task list, mid-turn included.** The ledger used to fall back to its one-row summary while the agent was streaming. That is exactly when the rows are worth the most — they are the only thing on screen that says which item the model is on — and the dial already has a stop for wanting the transcript rows back instead: `compact`. - **The message-block shadow is thinner.** A hairline along the bottom and down the right edge rather than half a cell of solid colour, so a filled block reads as paper on a page instead of as a second band of colour around every message. ## [0.5.72] - 2026-09-17 ### Changed - **Two arrows on screen instead of three.** A picker showed an unstyled ASCII `>` on its query line, two rows under an accent `›` on the selected row, for the same role the main prompt spells `❯` — three glyphs for two signals, and nobody had chosen the `>`: it was hardcoded inside the `Input` widget, which never got the prefix knob the editor has had all along. Every place you can type now wears the prompt's `❯`, muted so it does not out-shout the cursor beside it: the `/model`, `/resume`, `/settings`, `/config`, `/login` and session-tree query lines, the session rename, extension prompts, and the `ask_options` custom-answer row. `›` is left to mean one thing — this is the row you are on. (`→` in the `ask_options` breadcrumb stays; it means "maps to", which is a different thing.) Rule and reasons: `docs/ui-map.md` → "Two arrows, and what each one means". ## [0.5.71] - 2026-09-17 ## [0.5.70] - 2026-09-17 ### Fixed - **The prompt goes back to the bottom of the screen when a pane or a notification closes.** Open `/settings` on a session with some history, press Esc, and the prompt stayed where the pane had pushed it with a band of blank rows underneath — same after a notification faded. The fix is in the renderer (see the tui changelog): the screen fill takes back exactly what the chrome gave up, so the prompt is on the floor at every session length, whatever opened and closed above it. ### Changed - **What a command has to say now appears above the prompt, not in the conversation.** `Mode set to "build"`, `Cloned to new session`, `Copied last agent message`, the plugin catalogue, what `/learn` read — every one of them used to write a dimmed row into the transcript, true for a moment and litter for the rest of the session. They ride the notification band now, which sits directly above the prompt, where your eye already is after typing a command, and clears itself. Listings get the rows and the reading time they need (a third of the screen, and longer the more there is to read). The exceptions are the ones you cannot reconstruct once they fade — a share URL, an export or import path, where credentials were saved — which still write a row you can scroll back to. - **The band is filled, so it reads at a glance.** It takes the same background a message block does — the warning fill for a warning, the block fill for everything else — rather than being one more line of text against a transcript already full of them. - **`/copy` copies the structure, not the picture of it.** What is on screen is markdown already rendered: a table is box drawing, a code block is a bordered panel, every line is wrapped to whatever width the window happened to be — so selecting it with the mouse and pasting it into Word or Confluence pasted the drawing, dotted rules and all. `/copy` now goes back to the markdown the model wrote and puts it on the clipboard twice: as text, and as HTML for anything that takes a rich paste. Word and Confluence paste real headings, lists and tables; a terminal or a commit message still gets the markdown. On macOS and Windows both flavours travel together; Linux clipboards can only advertise one type, so it gets the markdown, and the status line says which you got. - **`/copy` takes the session, not just the last reply.** `/copy` is still the last agent message, `/copy all` is the whole conversation and `/copy 3` the last three exchanges — each as markdown and rich text, tool calls left out (`/export` is still there for the whole record). ## [0.5.69] - 2026-09-17 ### Changed - **The app fills the terminal, and the prompt sits on the floor of it.** The renderer appends — a frame is the component tree flattened into a line buffer and written from wherever the cursor is — so a frame was exactly as tall as its content. On a fresh session that meant the banner a few rows down with the prompt under it and your shell history above, and the prompt then walking down the screen over the next few turns until the session was finally long enough to scroll. It is one layout now at every session length: banner on the first row, conversation in the middle, prompt and footer on the last. A picker gets the same floor for free — they all take the prompt's place in the same container, so they grow downward instead of pushing the prompt up and stranding it mid-screen when they close. Scrolling back is unchanged, and reaching the bottom puts the prompt back where it was. This is still the normal screen: terminal scrollback, selection and search all keep working, and the session is still there after you quit. - **What just changed says so above the prompt, then gets out of the way.** Moving a dial used to write a line into the transcript — `Model: opus-5`, `Chrome: compact`, `Tool output: peek` — each true for about a second and litter for the rest of the session. Those now appear on a transient band directly above the prompt and fade after three seconds, as do the settings glimpses (`/model`, `/name`) and every warning, which used to leave a filled block in the transcript for something like "No previous directory to return to". Errors, the notices you pay for if you miss them, and anything carrying a value the screen cannot reconstruct — a share URL, an export path, a login confirmation — still go to the transcript. All six dials announce themselves now: the three that stayed quiet did so because a permanent transcript row was too much to pay for repeating what the footer already showed, and the band is not permanent. - **`compact` keeps the task ledger's counts instead of hiding it.** The middle stop of the chrome dial (`alt+z`) now makes the same trade for the ledger it already made for the footer — keep the strip you glance at, give up the rows you read — rather than being a cliff between `full` and `bare`. `bare` is unchanged: no footer, no ledger. ### Fixed - **A short session no longer leaves the tail of the last one under it.** Clearing a long session used to leave whatever had been on screen below the new, shorter frame, because clearing on shrink is off by default. A frame that is never shorter than the screen has no rows below it to leave behind. ## [0.5.68] - 2026-09-16 ## [0.5.67] - 2026-09-16 ### Changed - **Every surface that asks you for something now wears the prompt's box.** The pickers (`/model`, `/models`, `/settings`, `/theme`, `/thinking`, `/sessions`, `/tree`, `/color`, `/login`, fork-from-message), the options pane the agent asks with, the extension selector / input / editor and the login dialog all take the prompt editor's place on screen — and they drew three different things there. Most drew two bare rules; `/model` drew no chrome at all; the options pane and the extension input drew two rules plus a title row and a blank line. Their content started at column 0 where the prompt insets it, half of them did not name themselves, and switching `editorBorder` moved the prompt without moving anything that stands in for it. They now all draw one frame, which is the prompt's own: the same border renderer, the same `box`/`rule` setting, the name in the top border where the session chip rides, the key hints on the last row inside, and content inset one column. The extension editor and the `--team` approval gate lost the second border they were drawing inside the first, which is three rows and two columns back on each. ### Fixed - **A message sheet reaches the right edge of the terminal again.** Under the cut-out themes a pasted sheet held three columns back from the right margin and only ever used one of them: the shadow's column is `▌`, a left half-block, which paints the sheet's edge in the left half of a single cell and leaves the right half as page. The other two were empty, on every row of every message, and the text wrapped early to pay for them. The gutter is one column now. - **The pickers and the settings pane stopped throwing two columns away.** Both list widgets held two columns back from the right edge — one of them commented `-2 for safety` — although every row is truncated to the width it is handed and a selected row is painted out to it. Model names, descriptions and setting values now run to the last cell, and the settings pane's help text wraps against its own indent rather than against twice it. - **The voice panel's level meter runs to the right edge.** Its track stopped two columns short: one for the panel's own left gutter, and one for nothing, which left a notch of dead page at the end of every capture. ## [0.5.66] - 2026-09-15 ## [0.5.65] - 2026-09-15 ## [0.5.64] - 2026-09-13 ### Fixed - **A session's own name is legible on its chip in every theme.** The chip is filled with the session's palette colour and the name is written on top, and the fill was taken from the palette untouched wherever the theme was dark. Some palette entries sit in the luminance band where *neither* near-black nor white reads on them: Solarized Dark's violet and magenta slots came out at 4.5:1 and 4.3:1 — under the floor for body text in either ink — so the one piece of text that says which of four open terminals you are typing into was the hardest thing on the input box to read. The fill is now measured rather than guessed at, on every theme: it is moved only when the better of the two inks cannot clear 5.5:1 on it, so a palette entry that already carries its ink is used exactly as the theme wrote it. The ink itself is picked by measuring both candidates against the fill instead of by a fixed luminance cutoff, and it is measured against what the terminal will actually paint — on a 256-colour terminal the rounded fill, not the exact one it was asked for. - **A light theme's chip is its own colour again, not a highlighter.** Lifting a deep ink at its own saturation turned `#00382d` into `#00ffcd` and `#035500` into `#09ff00`. A lifted fill is now pulled back off full saturation, so the hue survives and the fluorescence does not; a fill the theme is already happy with is never touched. - **The default `dark` theme is held to the contrast floor `light` already was.** It shipped without a sweep of its own, and 28 of its tokens were under AA on at least one surface it paints — `borderMuted` at 1.38:1, `dim` at 1.94:1, `muted` at 2.82:1, `error` at 3.00:1. The selected row, the warning notice and the export info band were also bright enough to eat the whole contrast budget on their own. The three surfaces are pulled back, the gray ramp and the blue, red, violet and comment inks are lifted, and every token that is read now clears 4.5:1 on every surface with rules and inactive chrome at 2.8:1. `syntaxNumber` and the thinking-level ramp were also collapsing into their neighbours (ΔE under 11) and are re-cut to separate. ### Changed - **Eight built-in themes instead of fourteen: four light, four dark.** `dark`, `light`, `colorsafe-*`, `vox-cutout-*` and `solarized-*` stay. A picker is read at a glance or not at all, and half the list was a second opinion on a theme already in it. A settings file naming a retired theme keeps working — `high-contrast-*` and `warm-*` load as `colorsafe-*`, `vox-*` as `vox-cutout-*` — rather than dropping to the fallback theme and flipping a light terminal to a dark one. A theme of your own under the retired name still wins over the redirect. ## [0.5.63] - 2026-09-10 ### Fixed - **The cut-out themes' message blocks no longer have holes in their fill, and the shadow no longer reaches inside the sheet to hide them.** The right edge of a sheet was nicked one column in on roughly every fifth row, to read as cut by hand rather than ruled. A terminal cell is far too coarse a step for that, so it never read as scissors — it read as damage, in two shapes. On the top row, the one row with no shadow behind it because the offset is down as well as right, the nick showed as a bite taken out of the sheet's top-right corner: bare page inside the block's own outline. On every other row the nick was backfilled with a block of shadow ink, which put a tooth of shadow *inside* the fill — a dark step that reads as a rendering fault, not an edge. Both are the same mistake seen from two sides: the fill was leaving gaps and the shadow was covering for them. The edge is now ruled, every row of a sheet ends in the same column, and the shadow is one half-cell column beside the sheet and nothing more. The gutter, the shadow's column, the offset bottom run and its closed corner are unchanged, and so is every theme that sets no `paperShadow` — the twelve shipped themes without it render byte for byte as they did. ## [0.5.62] - 2026-09-09 ### Fixed - **`[skill]`, `[compaction]` and `[branch]` blocks are sheets like every other message block.** All three were written to use "the same background colour as custom messages for visual consistency" and all three stopped at the colour: they got the fill and none of the edge, so under a cut-out theme they rendered as flat full-width bands sitting beside the sheets they were copying — no gutter, no cut edge, no shadow — in the same transcript. The fill and the paper treatment were two independent decisions made at each call site, which is why they drifted; they are now one call, `applyBlockFill`, and a test walks every block component plus the source of every component file so a new block cannot take the fill without the edge again. - **A filled block no longer wraps past the right margin in a narrow terminal.** Below a width where the gutter and two columns of padding still leave room for content, the padding kept its columns and pushed the row wider than the band it was meant to fill: the shadow's column went with it and the line wrapped. Padding is now derived from the band, and where the band is too narrow to carry its own bottom run the box gives the paper treatment up and draws the plain full-width band a theme without paper draws, rather than degenerating into a one-column band with a shadow beside it. - **`/learn` no longer ends as an extension error when the session it was started in is replaced mid-run.** Mining reads transcripts with a model and can run for minutes, and nothing stops a `/new`, a `/resume`, a `/fork` or a `/mode` landing in the middle of it. What replaces the session disposes the old one, which invalidates the command ctx the run captured, so the first line the finished run tried to print threw instead: the user got `Extension "command:learn" error: This extension ctx is stale after session replacement or reload` under the banner of the session that had just replaced theirs, and the digest they had waited for was discarded. The run now learns about the replacement from `session_shutdown` — emitted just before the disposal, which is what makes it the last moment a run can still be told — aborts its mining pass there, and reports nothing, because there is no longer anywhere to report to. Only time is lost: every transcript already read is in the on-disk cache, so `/learn` in the replacing session resumes from it. - **A cut-out theme's shadow no longer pokes out past its own corner.** The bottom run of a paper sheet's shadow is drawn with `▀`, which fills a cell edge to edge, while the column down its right edge is `▌`, which fills half of one. Ending the run on `▀` under that column overshot it by half a cell, and what the eye got at the bottom-right of every filled block — user messages, extension blocks, error and warning frames — was a stray tip coming out of the shadow. The run now ends on `▘`, the same top half cut back to the column's width, so the two edges close flush. - **And no longer floats a column of page between a sheet and its shadow.** A hand-cut right edge nicks one column out of roughly one row in five, and that column used to be left as bare page in front of the shadow, which detached the shadow from the sheet casting it at exactly the rows the cut was meant to make look hand-made. A nick is a notch taken out of the sheet, not a hole punched in the shadow behind it, so the column it gives back is now inked as shadow. The shadow's own column stays in the one cell it always occupied — stepping it in with the cut leaves no overlap between one row's half-cell mark and the next, and reads as a dashed staircase. ## [0.5.61] - 2026-09-06 ## [0.5.60] - 2026-09-05 ### Fixed - **A semantic index built by an older embedding model now rebuilds instead of switching semantic search off for good.** The embsearch daemon refuses to open a store whose recorded model disagrees with its own — rightly, since vectors from two models are not comparable — but refusing was where it stopped: the store stayed on disk, the daemon never came up, and the service parked itself in `unavailable` with a rebuild one directory-removal away. The check meant to catch this ran *after* the spawn and reset only the sidecar, never the store, so on a model change it was unreachable anyway. Recovery now catches the refusal and confirms, via embsearch's `store-info` — which reads a store's manifest without loading a model, and so is the only thing that can still identify a store nothing will open — that a readable store is what the daemon choked on, then rebuilds. A store it cannot read is left alone and the original error stands, because deleting an index is the wrong answer to an unknown fault. This was about to bite: embsearch 0.3.2 changed its model id, and only the fact that an already-installed binary is never upgraded in place kept anyone from hitting it. `store-info` ships in **embsearch 0.3.3**; against an older binary the probe simply fails and the previous behaviour stands, so no version floor is needed and nothing regresses on an older daemon. - **A chunker change no longer leaves dead text in the index.** Bumping `CHUNKER_VERSION` resets the sidecar, and the sidecar is the only record of how many chunks each file produced — so it reported zero for every file, and the loop that drops superseded chunks counts down from that number. Any file that re-chunked into fewer pieces left its tail vectors behind holding text that no longer existed anywhere, retrievable forever. Upserts hid it: chunk counts looked right, the sidecar looked right, only the search results were wrong. ## [0.5.59] - 2026-09-05 ### Fixed - **`hoo`, `/new` and `/reload` now leave you looking at the same thing.** All three rebuild the session's resources and repaint the chrome, and they did it from two hand-kept lists, so an edit to `settings.json` reached one and not the other: after `/reload` the footer went on promising auto-compaction that was switched off, and the model count, the subagent indicator and the session chip kept the state of the session before it; after `/new` a changed `theme` never loaded at all. A theme that did load left the banner in the retired theme's colours, on either path — a `Text` holds its string with the escapes already in it, so invalidating it is not repainting it. One list now, applied by every path, and the resource listing is drawn once per session change instead of drawn and immediately wiped. `/reload` also drops the stale view-layer references into the transcript it just replayed, the way a session swap always has. ## [0.5.58] - 2026-09-04 ### Changed - **The keyboard map is grouped by intention, not by mechanism.** Sorting the bindings by what the widget is — everything that cycles together — made a list that was tidy on the page and useless at the keyboard, because "it cycles" is not what anyone is thinking when they reach for a key. Sixty bindings is not a thing anyone holds; five groups of at most five is. The groups are the five things you are ever doing here, in the order the loop runs: | group | what it is | keys | | --- | --- | --- | | **Compose** | the message in your hands | `alt+e` `alt+r` `ctrl+v` `alt+enter` `alt+↑` | | **Steer** | what the agent is before it runs | `alt+a` `alt+m` `alt+t` | | **Read** | what you see of what it did | `alt+o` `alt+l` `ctrl+o` `ctrl+t` | | **Go** | sessions and places | `alt+h` `alt+w` `alt+c` `alt+s` `alt+k` | | **Flow** | getting out, getting back | `esc` `ctrl+c` `ctrl+d` `ctrl+z` | Two of them cost nothing: **Flow** is what every terminal program already taught you, and the overlays — pickers, the tree, the options pane — print their own keys on their own hint lines, so they are read rather than recalled. That leaves three groups to genuinely know. No key moved. The grouping is now the source's own declaration order, which matters beyond the file: `orderKeybindingsConfig` writes `keybindings.json` in that order, so the file you open to rebind something is grouped the same way. The startup banner, `/hotkeys` and `docs/keybindings.md` all lead with the same five groups in the same order, instead of three different organisations. - **A dial names the key that steps it back, once.** The instant after you move a dial is the one moment you are primed to learn its other half — you have used one direction and can feel the missing one — so the reverse rides along with the first step of each dial in a session and never again. A hint that repeats forever stops being read, and its cost falls on the people who already know it. - **The task panel advertises the roster key.** It already printed `alt+l cycle` in its header; on the teams lens it now prints the focus key too. That is what lets `alt+n` stay: it is the one letter in the set that names nothing, and it survives on the fallback every unmemorable key needs — being read off the screen instead of remembered. - The layout test now holds the grouping as well as the keys: every binding belongs to exactly one family, families are declared contiguously and in order, and no learned family exceeds five subjects that carry a key. That last one caught **Go** at eight before the count was corrected to ignore actions that ship unbound — an action with no key costs no memory. - **Every dial is now `alt+`, and `shift+alt+` steps it back.** The thinking level came off `shift+tab` and the task ledger off `ctrl+n`, so the six most-pressed keys in the app share one modifier, one shape, and six letters that each name their dial: | dial | forward | back | | --- | --- | --- | | **a**gent mode | `alt+a` | `shift+alt+a` | | **m**odel | `alt+m` | `shift+alt+m` | | **t**hinking level | `alt+t` | `shift+alt+t` | | tool **o**utput | `alt+o` | `shift+alt+o` | | task **l**edger | `alt+l` | `shift+alt+l` | | session **c**olor | `alt+c` | `shift+alt+c` | `alt+t` also buys the pairing that `alt+o` already had: same letter on both rings, `alt` walking the dial and saving where it lands, `ctrl` acting on what is drawn right now. `alt+o` sets how much tool output there ever is and `ctrl+o` jumps to all of it and back; `alt+t` sets how much thinking there ever is and `ctrl+t` shows or hides what you have. Those two are all that is left on the `ctrl` ring besides the flow keys. The task ledger gains the reverse it could never have had on `ctrl`, where `shift+ctrl+n` is Windows Terminal's "new window". `alt+l` names the pane's own word for itself — the task ledger — where `ctrl+n` named nothing. `shift+tab` still steps the thinking level as a second key. It is the only dial with no slash command and the only one whose setting changes what the agent does, so it keeps a way in on a terminal that does not send `alt`. `app.session.tree` gave `alt+t` to the thinking dial and ships unbound; `/tree` opens it, the same trade `app.model.select` makes for `/model`. `ctrl+n`, `ctrl+p` and `shift+ctrl+p` are all free now, so the emacs config in `docs/keybindings.md` collides with nothing. `app.tasks.cycleView` became `app.tasks.cycleForward`; existing `keybindings.json` files are migrated on startup. - **The six dials now work the same way.** Everything on screen with an ordered set of stops — agent mode, model, thinking level, tool output, session colour, the task panel's lens — is stepped with a key, and until now those six keys had four different shapes between them (`alt+`, `ctrl+`, `shift+ctrl+`, `shift+tab`) and only three could step backward at all. Nothing told you which was which, so each one had to be memorised on its own. They share one rule now: **a dial steps forward on its key and back with one more modifier held, the letter names the dial, and the slash command picks a stop outright.** What moved: the model dial from `ctrl+p`/`shift+ctrl+p` to `alt+m`, because the model is a cockpit dial — what the agent *is*, not what is on screen — and `p` named nothing. Agent mode and thinking level gained the reverse halves they never had. `app.thinking.cycle` and `app.mode.cycle` became `…cycleForward` so every two-direction dial reads the same; existing `keybindings.json` files are migrated on startup. - **`app.model.select` ships unbound; `/model` opens the picker.** Its key went to the dial that steps the model, on the principle the colour dial already followed: the key steps, the slash command chooses. `/mode`, `/model` and `/color` are the three pickers behind the dials. - **The startup banner, `/hotkeys` and `docs/keybindings.md` lead with the dials.** `/hotkeys` gained a Dials table naming what each one steps through and where to see its state, and spells out the ctrl/alt pairing: `ctrl+o` opens the tool bodies you have and `alt+o` sets how much they ever show; `ctrl+t` shows the thinking you have and `shift+tab` sets how much there ever is. ### Fixed - **Searching the session tree no longer fires its verbs.** The tree's two label keys were the last verbs left on `shift+`, and outside the Kitty keyboard protocol that is not a chord at all — the terminal sends the plain uppercase letter. The tree takes every printable key into its search query, so typing `TODO` or `Logger` toggled label timestamps and opened the label editor instead of searching. They move to `alt+l` ("label") and `alt+t` ("time"), which is where every other picker verb already lives, and a layout test now refuses a bare `shift+` outright. - **The options pane gave its arrow keys to the step, never to the text.** On the free-text row `←` stepped back to the previous question — which clears the field — so a cursor key could throw away a half-typed answer, and `→` submitted rather than moving right. The text now gets first refusal and the step takes what is left at the ends: `→` commits from the end of the answer (an empty field is already at its end, so the plain custom row still advances), `←` stays out while there is an answer to lose, and `enter` commits from anywhere. ### Changed - **`alt+a` cycles the agent mode**, replacing `alt+g`, which stood for nothing. Mode and model are one letter apart and `alt+m` is the model selector, so the letter has to carry the meaning: `a` for agent mode. - **The session tree's hint line is readable.** It printed every alias of every key — `ctrl+left/alt+left/ctrl+right/alt+right` for one fold verb, five spelled-out filter keys — in a style no other hint line used. It is now the house style (dim key, muted description, `·` separated), one key per verb, with the five lenses shown as the range `alt+1…alt+5`. The header chip that said `[+label time]` says `[timestamps]`. - **`docs/keybindings.md` documents the keys that exist.** It still listed the layout from before the cockpit rings: `ctrl+l` for the model selector, `ctrl+g` for the external editor, the picker verbs on the `ctrl` letters they were moved off, the session tree and `/resume` as unbound, and no mention at all of the view dial, the mode cycle, voice, settings, `/cd`, the team roster or the options pane. Rewritten from the definitions, grouped by ring, and it now leads with the rule that decides which ring a key is in. - `app.options.next` and `app.options.back` are registered keybinding ids like every other action, instead of being defined but missing from the type map and reached through a cast. The layout test now checks that every id belongs to a scope, so the next one cannot slip through unchecked. ## [0.5.57] - 2026-09-04 ### Changed - **The tool output dial is three stops and two keys, and `full` finally means full.** It had grown into three separate ideas: a dial (`alt+o`) with a `radar` / `glance` / `full` scale, an all-or-nothing expand (`ctrl+o`), and a one-at-a-time unfold (`alt+u` / `shift+alt+u`) that peeled backwards from the newest block and meant something different in each view. Three states to hold, and a `full` stop that was not full — `ctrl+o` was what made it full. Now there is one value. The dial reads **radar → peek → full**: one line per run of calls, the call line with the first few lines of its result, the same with nothing trimmed. `glance` is gone as a stop — a handful of result lines answers "did this find anything" better than a folded body did, so `peek` replaces it as the default, and `PEEK_LINES` is the single knob every renderer trims to (including tools with no renderer of their own, which used to print their whole result whatever the dial said). `ctrl+o` still exists and is still the reflex key: from any stop it jumps straight to `full`, and pressing it again returns to the stop it came from. The header, compaction and branch summaries and skill blocks follow it, since `full` means nothing is held back. The two keys differ in what they remember: `alt+o` saves where it lands, `ctrl+o` does not. `alt+u` and `shift+alt+u` are gone, and with them the per-chain opened state, the per-block revealed flag and the "a revealed block leaves radar while it is open" special case. A run of calls is a summary line in radar and its own calls at every other stop; nothing opens one chain or one block on its own any more. Old `toolOutputView` settings still load: `glance` becomes `peek`, `collapsed` becomes `radar`, `standard` becomes `full`, and a config that still says `peek` needs no migration at all — it names a live stop again. ## [0.5.56] - 2026-09-04 ### Added - **The session chip's color cycles from the keyboard.** `Alt+C` steps it to the next slot and `Shift+Alt+C` back, wrapping at both ends, with no picker in the way — telling two terminals apart is a matter of pressing until the two chips stop looking alike, not of choosing a color. `/color` still opens the swatches and still takes a name, and both bindings are rebindable as `app.session.color.cycleForward` / `app.session.color.cycleBackward`. ## [0.5.55] - 2026-09-04 ### Fixed - **A light theme's session chip is no longer filled with ink.** A palette entry has two jobs on a light theme and they pull opposite ways: as text on paper it has to clear 4.5:1, which forces it dark — and a dark yellow is brown, a dark cyan is navy, a dark green is bottle. As a chip fill it only has to out-contrast the ink laid on it. So the fill is now lifted off the token: same hue and saturation, raised to a lightness where the hue reads as itself, then a step further if the result sits in the luminance band where black ink and white ink are equally poor. `/color yellow` paints a yellow chip. Only the fill moves. The token itself is untouched wherever it is drawn as text — agent tags, tool rows, the task panel — and dark themes, whose palettes are already bright, are used exactly as before. With the fill lifted, hues that had been dark enough to be ambiguous showed their real family, so several light palettes needed correcting too: slot 3 was an orange rather than a yellow in `light`, `vox-light`, `vox-cutout-light`, `warm-light`, `high-contrast-light` and `colorsafe-light`; `light`'s slot 5 was a teal called green; `colorsafe-light`'s slot 5 was an olive; and `warm-light` and `high-contrast-light` had no violet at all, so a plum stood in for `purple` and a plain red for `magenta`. `solarized-light` is left as it is — its slot 2 and slot 5 are Solarized's own violet and green. - **Session colour slots now hold the hue their name promises.** `/color` and the `/color` picker address the six identity slots by name (`cyan`, `purple`, `yellow`, `magenta`, `green`, `blue`), and the code documented that each slot keeps a recognisable hue family across the built-in themes — but several palettes had them in another order, so the names were only true on the dark themes anyone happened to check. - `light`'s slot 3 shipped a brick red (`#b5340e`), which both contradicted its `yellow` name and sat one hue from slot 4's crimson, leaving two chips that read the same at a glance. It is a yellow now. - `warm-light` and `high-contrast-light` had slots 2 and 4 swapped, so `/color purple` painted a red chip. Reordered. - `colorsafe-light` was scrambled outright: `magenta` was pure blue, `green` was violet, and `blue` was a near-black khaki. Reordered. - `warm-dark` answered `/color cyan` with amber and `/color magenta` with teal. Reordered, and slot 6 gained the blue (`#7bc0ff`) its light counterpart already had, in place of a salmon that only repeated slot 3's warmth. - `colorsafe-dark` was reordered, and slot 2 gained a violet (`#dca0e4`) — the palette had no purple at all, so some slot had to lie until it did. The dropped `#ffbe5c` duplicated slot 3's yellow. The new hue clears AAA on every surface and separates further under simulated dichromacy than the palette's existing worst pair. A test now locks the ordering: for every shipped theme, no rearrangement of its own six identity colours fits the slot names better than the one it ships. Palettes stay the theme's own — what cannot drift again is the order. ## [0.5.54] - 2026-09-04 ### Changed - **Prompt surface trimmed by ~384 tokens per turn** (measured with `--print-token-surface`: 7,077 -> 6,693 on the default tool set). The savings are all deduplication, not lost guidance: - `task-main.md` restated its own parameter schemas three times — the "When to delegate" list was duplicated wholesale by a later "Delegate proactively" bullet, and "cannot see this conversation" / "returns ONLY its final answer" each appeared twice (-206). - `TodoWrite` stated the same three rules in both `description` and `promptGuidelines`, which ship together on every turn (-131). - The base prompt carried two SearchCodebase-vs-bash guidelines saying the same thing and three concision guidelines saying the same thing. Merging both funded a new guideline about reporting failed or unverified work, and still came out ahead (-61). - **`build` mode no longer says "One tool per turn."** It contradicted the base prompt's instruction to batch independent tool calls, and since `build` is the default and the mode prompt is appended last, that made the base guideline dead text in every default install. Edits stay sequential; reads and searches batch. The mode also dropped "show diffs / wait for implicit acceptance", which duplicated the permission gate, and gained "never commit or push unless asked". - **`ask`, `debug` and `plan` prompts tightened**, each now smaller than before: `ask` and `debug` state which read-only shell commands are fine rather than leaving the model to guess, `debug` no longer calls `read` and `SearchCodebase` "commands", and both now say that "I could not determine it" beats an invented answer. `plan` points at `ask_options` for blocking questions and asks for verification steps that prove the goal, not just that the code runs. ### Fixed - **Read-only modes are now actually enforced.** `ask` and `debug` ship `denied_tools: [edit, write]`, and `plan` confines writes with `allowed_write_paths`. Previously `plan` auto-allowed `write` with no path restriction, so overwriting a source file in plan mode raised no prompt at all. `bash` remains prompt-governed in `ask`/`debug`; see `docs/modes.md`. - **`allowed_write_paths` no longer blocks every write on Windows.** Patterns are written with `/` but the paths handed to the model come from `relative()`, which is backslash-separated on Windows — and this check runs before `auto_allow`, so a mismatch is a hard block rather than a prompt. Both sides are now normalized, absolute paths are also tried in their cwd-relative form, and pattern metacharacters are escaped so `.hoocode/plans/*` no longer also matches `Xhoocode/plans/`. - **The active mode's prompt no longer leaks into spawned subagents.** A read-only `explore` child was being told to "read before editing" and "run tests after every change" by the parent's `build` mode prompt, on top of its own system prompt and against a tool allowlist that has no edit tool. - The system prompt joined `Current date:` to the guidelines list with a single newline, so it rendered as a malformed final bullet. ## [0.5.53] - 2026-09-04 ### Changed - **The `search` tool is now `SearchCodebase`.** A clean break: there is no alias, no compatibility shim, and no deprecated path. The old name resolves nowhere — `--tools search` and a `tools: search` agent allowlist now drop the tool with a diagnostic rather than silently mapping it. Update any agent, skill, mode, or SDK caller that names it. - Rename `search` to `SearchCodebase` in agent frontmatter (`tools:`), skill frontmatter (`allowed-tools:`), mode `enabled_tools` allowlists in `settings.json`, `--tools`/`--disallowed-tools`, and SDK `activeToolNames`. Shipped templates are already updated. - Claude Code's `Grep`, `Glob` and `Find` still normalize to the tool, now under its new name. `SearchCodebase` pairs with `SearchHooCode`, which is unchanged: one searches your codebase, the other searches hoocode's docs. - Extensions that override the built-in tool must register `SearchCodebase`; an extension still registering `search` now adds a new tool alongside the built-in instead of replacing it. - The radar view's tool-name column widens from 9 to 14 columns to fit the longer name. - **`--enable-search-tool` is now `--enable-semantic-index`,** and the `enableEmbsearchTools` setting is now `enableSemanticIndex`. The old names said "search tool" but never gated the tool: `SearchCodebase` is always registered and cannot be turned off. The flag only controls whether the semantic index is built and fused in, which is what the new name says. - An existing `enableEmbsearchTools` in `settings.json` migrates to the new key on load, so a deliberate `false` keeps indexing off. The tool rename is a clean break; this key is a stored choice rather than a tool name, and dropping it would silently turn indexing back on. ### Removed - **The legacy `--enable-embsearchtools` flag alias.** It has been a spelling of `--enable-search-tool` since the two semantic-search tools were unified; both are now `--enable-semantic-index`. ## [0.5.52] - 2026-09-03 ### Changed - **The TUI spends fewer rows on blank space.** One blank line separates two blocks; it is no longer paid for twice. `/clear`, `/cd` and `/debug` each drew two blank rows above their confirmation and two below it, and every bordered picker padded the inside of its own rules — the rule was already the separator. Two to three rows come back on each of: the `/model` and `/models` pickers, the session, tree, fork, extension and `/login` provider selectors, the extension input and editor dialogs, the `/reload` notice, and `/clear`, `/cd`, `/debug`, `/changelog` and `/hotkeys` in the transcript. Filled blocks (user messages, warnings, errors) keep their painted band — those rows are the sheet, not empty space. ## [0.5.51] - 2026-09-03 ### Removed - **`grep`, `find` and `ls` tools.** `search` is now the only dedicated code-discovery tool; exact matching lines, counts, and raw directory listings are a shell job through `bash` (`rg`/`find`/`ls`). This takes ~760 tokens off the fixed per-turn surface. - `--tools read,grep,find,ls` becomes `--tools read,search`; the read-only bundle is now `read` + `search`. - Claude Code's `Grep`, `Glob` and `Find` all normalize to `search` in agent frontmatter. `LS` has no counterpart and is dropped with a diagnostic rather than silently widening an agent to `bash`. - SDK exports `createGrepTool`/`createFindTool`/`createLsTool`, their `*ToolOptions`/`*ToolInput`/`*ToolDetails` types, the `grep`/`find`/`ls` tool-call and tool-result event variants, and `isGrepToolResult`/ `isFindToolResult`/`isLsToolResult` are gone. ## [0.5.50] - 2026-09-03 ## [0.5.49] - 2026-09-03 ### Added - `/color` takes colour names, not just slot numbers: `/color green`, `/color blue`, `/color magenta`, and the first letter of each on its own — `/color g`, `/color b`, `/color y`, `/color r`. The six slots are palette positions rather than fixed hues, but across the built-in themes each position keeps a recognisable family, so the names describe it: cyan, purple, yellow, magenta, green, blue. Spellings that sit between slots resolve to the nearest one instead of being rejected — `red` and `pink` reach magenta, `orange` and `amber` reach yellow — and the confirmation names the slot it landed on, so `/color red` answering with "magenta" is how you learn the palette has no red of its own. The numbers still work, and the picker now labels each swatch with its name. ## [0.5.48] - 2026-09-03 ## [0.5.47] - 2026-08-31 ### Added - `webfetch` takes `grep`, finding where a long page mentions something. An outline maps a page by heading, which helps when the page has headings and one of them names what you are after. `grep` covers the rest: it returns each match with its offset, the text around it, and the section it falls in, so a page with no headings — or whose headings do not name the thing — stops needing a front-to-back read. Match offsets are the offsets `offset` reads, so a hit is followed by fetching at it. `outline` and `grep` are two views of one page, so asking for both is rejected here rather than spending a subprocess to be told by the binary. A blank pattern is not a search: it resolves to a plain fetch and never reaches the binary. The TUI marks a search result with its hit count, as it marks an outline with its section count. Needs `webtools` v0.6.0 or newer; an older binary rejects the flag and the error names the binary and how to update it. ## [0.5.46] - 2026-08-31 ## [0.5.45] - 2026-08-31 ## [0.5.44] - 2026-08-31 ### Added - `webfetch` takes `outline: true`, mapping a long page instead of reading it. Paging made a long document readable front to back, which is the wrong shape when the answer is in one section and the rest is overhead. An outline returns the headings with the offset that reads each section and what it costs, so a page of any length maps for a few dozen tokens and only the section worth reading is fetched. Outline offsets are the offsets paging already uses, so a row feeds straight back into `offset`. The TUI marks such a result `outline, N sections`, since an outline's token cost is its own and not the page's. Needs `webtools` v0.5.0 or newer; an older binary rejects the flag, and the error now names the binary and how to update it rather than passing an argument-parser message through — the fix for an unknown flag is never the call site. ### Added - `webfetch` takes an `offset`, so a long page can be read to the end. With a `webtools` binary that reports paging offsets, a cut page comes back with the window it covers and the offset that continues it, and passing that offset back reads the next window. Windows tile the document exactly, so nothing is skipped or repeated, and a whole document costs one budget per window instead of one copy of the page per attempt. Against an older binary the fields are absent and the note falls back to advising a larger `maxTokens`, the only honest advice when there is no offset to resume at. `--offset` is sent only when non-zero, so a read from the start never passes a flag an older binary would reject. - `webfetch` says when a page was cut off, and how to get the rest. A fetch that overran its token budget came back with the binary's bare `…[truncated]` marker: enough to tell the model something was missing, nothing it could act on, so a long document was a dead end rather than a first page. The result now carries the budget the cut was made at and the ways past it, `details.truncated` records it, and the TUI marks the token line `(truncated at N)` instead of showing a prefix and a complete page identically. The note names the *clamped* budget, not the requested one — advice to raise `maxTokens` past the 25000 cap would point somewhere that changes nothing. - `websearch` reports what its results cost, as `webfetch` already did. Search is the one web tool with no token budget of its own — snippet length is whatever the backend returns — so the estimate the binary already sends back is the only thing that makes an expensive query visible before it is already in context, and it is the number `maxResults` is tuned against. It was being parsed into the result details and then dropped at render. ### Fixed - The agent-selection gold set covers `code-review` and `security-review`. 0.5.42 added both agents without cases for them, and the eval's coverage assertion — every agent in the roster is expected by at least one case — has failed on `main` ever since, so every branch cut from it inherits a red `bun-test (coding-agent)`. The assertion earns its keep: an agent no case asks for scores as a permanent miss, so a roster can grow agents nobody selects while the eval reads as though the descriptions got worse. Three cases each, plus one more `expect: null` — review phrasing over a diff already pasted into the conversation, where a subagent that cannot see it is strictly worse. All authored from how the ask is actually phrased rather than from the agent descriptions, per the fixture's own circularity note. The two review agents ship with identical tools, isolation, background flag and cost, so like `explore`/`plan` they are separated on the ask itself: is this correct, versus can this be attacked. ## [0.5.43] - 2026-08-31 ### Added - A startup notice when `websearch` is enabled with no search API key. The tool works with no configuration at all, which is the problem: the keyless default is scraped DuckDuckGo HTML, rate-limited hard and liable to fail outright, and the failure arrives as a bad search rather than as a setup problem. The TUI now says so once per session when `websearch` is active and no keyed backend is configured, in two lines: what is wrong, and the `BRAVE_API_KEY` / `TAVILY_API_KEY` that fixes it. The remaining backends and the `webtools.search` block of `~/.hoocode/settings.json` — the same file the `webtools` binary reads its own credentials from — are in the docs. Detection mirrors the binary's own resolution order (env over settings file) across Brave, Tavily and SearXNG, and never returns the credential itself, so a key cannot reach the UI or a log. Pinning `duckduckgo` as the provider is read as a deliberate choice and stays quiet, as does the new `warnings.websearchApiKey` switch — `/settings` → Warnings → Web search API key, beside the Anthropic extra-usage toggle it is modelled on. ## [0.5.42] - 2026-08-31 ### Added - Two built-in review agents, `code-review` and `security-review`. Both ride the existing `templates/agents/` channel, so they cost nothing to wire: `embed-templates.mjs` already embeds that directory and `Task` already dispatches by name. They are agents rather than skills because review is the case isolation is for — a review reads far more code than its findings are worth carrying, and in a subagent that reading never lands in the parent context. Their tool allowlists include `bash` for read-only git inspection but exclude `edit` and `write`, so a review reports and the caller decides. A test pins that. - `/new-canvas` scaffolds a styled page instead of a placeholder. The template served `

0 note(s). TODO: build the UI.` — unstyled, and with no pattern to copy, so every canvas started by inventing one. It now ships a small correct page: palette as custom properties with a `prefers-color-scheme` block, an explicit `body` background, a list, an empty state, and a reduced-motion-respecting highlight on rows that changed. It also demonstrates the thing `canvas-design` asks for. State renders on the server, so the page is right the moment it loads and stays right with scripting off; a `/state` endpoint and a one-second poll update it in place so what the agent changed appears without a reload. Everything from state goes through an escape helper and `textContent`, never `innerHTML`. No CDN and no webfont: the page is served from `127.0.0.1` and now works with the network off, which a remote script or font would have thrown away. The markup is built with plain strings and concatenation rather than template literals, because this file is itself generated and a backtick or dollar-brace in it is an escaping hazard for no gain. - A built-in `canvas-design` skill, loaded only when a canvas is being built. `/new-canvas` handed the model a protocol contract and nothing about design, and the scaffold serves `

0 note(s). TODO: build the UI.` — so whatever a canvas looked like was improvised from nothing. `artifact-design` does not cover it and would mislead if it fired: a canvas is a live page served from a loopback server, not a file written to disk. What is different is the whole skill: the markup lives in a JS template string, `node_modules` and `package.json` are forbidden so there is nothing to install and no build, the protocol carries no theme so the page owns its palette outright, state is mutated by both the agent and the person, actions are tool schemas that cost tokens while an instance is open, and a reload issues a new URL that kills the open tab. Grounded in the catalog rather than invented: 22 of GitHub's 23 canvas extensions import nothing but the SDK and `node:` builtins, and the flagship `pr-artifact-explorer` is a read surface that sidesteps concurrent editing entirely. The skill takes both as the house style. It costs nothing per turn. `disable-model-invocation` keeps it out of ``, materialization is unconditional so the file is always on disk, and `canvasBuildBrief` names its absolute path at the one moment it is worth reading. Measured: the surface is unchanged at 8,470. - A built-in `artifact-design` skill for building self-contained HTML visuals. hoocode writes a visual as one `.html` file on disk that `/canvas` can open. The skill covers what that file needs to be good: reading the treatment the request actually calls for, writing the color/type/layout plan before the markup, designing both themes through custom properties, and avoiding the handful of looks generated design keeps landing on. Named for the output rather than the activity: a bare `design` would sit in the prompt next to `/new-canvas` and read as software design as readily as visual design. Note that "artifact" is new vocabulary in hoocode; it names the thing produced, not Claude's hosted artifacts. Libraries get an explicit no by default. A hosted page and a file on disk fail differently: a CDN dependency is free for a page that is always viewed online, and fatal for a file opened offline, where Tailwind-from-a-CDN is an unstyled document. Webfonts are the exception, because a fallback stack degrades instead of collapsing. Delivery is a `file://` markdown link, which hoocode's renderer turns into an OSC 8 hyperlink wherever the terminal supports one. It is the first ungated built-in skill, because there is no feature switch that predicts a request for a visual. Measured cost is +130 tokens per turn, of which part is the `` block header that no default session previously paid; the two agents add +180 together. ## [0.5.41] - 2026-08-31 ### Added - Sessions record the git branch they started on, and the resume list shows it. A session you never named, that opened with "look at this", was unfindable in the list — the first message said nothing and there was nothing else to go on. The branch usually says exactly what the work was, and it is the rare piece of meaning that can be written down safely: unlike a derived title it is a fact, so it is still true a month later. It has to be recorded rather than derived, because by the time anyone reads the list the working tree has moved on. One optional field on the session header, read from `.git/HEAD` at session creation — a walk up to the repo and one file read, no subprocess outside the reftable case, sharing the footer's implementation so the branch a session remembers is the string the footer was showing at the time. Shown in the picker only where it adds something: a session with a chosen name already says what it is, and `main` names no particular work. Also in `/session`. Sessions recorded before this simply have no branch and read as they did. - A session chip: the session's name, filled with its colour, laid into the top-right of the input box. The name used to live at the tail of the footer's busiest line — after the brand mark, the mode, the path and the git branch, in `dim`, the quietest colour a theme has. It answered *which session is this*, and it was the least visible thing on screen. The chip puts the same fact where the cursor already is, and gives it a colour so it can be recognised rather than read. Every session now carries a name and a colour without anyone setting one. Both are pure functions of the session id: a two-word slug from a 32x32 vocabulary (`amber-harbor`), and a slot in the six-colour identity palette the agent tags already use. Because they derive from the id, a resumed session comes back wearing the same chip and a fork gets its own, with nothing to store. `/name` and the new `/color` override either, and those choices are written to the session's `session_info` entry, which now resolves its two fields independently — setting a colour cannot clear a name, and renaming keeps the colour you have already learned. `/color` on its own opens a swatch picker that repaints the live chip as you move through it. The chip is laid into border cells the box was already drawing, so it costs no screen row, and it yields where it should: to the `↑ N more` scroll indicator on the same border, and to the box itself below 48 columns, where the footer takes the name back rather than leaving it nowhere. The editor's border colour is untouched — it still carries thinking level and bash mode, so identity and agent state never fight for the same pixels. The fill's ink is picked from its own luminance, which is what lets one code path render on a dark theme's bright hues and a light theme's deep inks alike. `theme.fill()` is the new primitive for that: the palette lives on the foreground side, where `theme.bg()` could not reach it. The session picker shows the same colour as a swatch per row, and the slug for sessions nobody has named, so a session recognised by its chip is found the same way in the list. ## [0.5.40] - 2026-08-30 ### Added - A `solarized-light` / `solarized-dark` pair: Ethan Schoonover's palette kept as it was designed rather than corrected to a contrast floor. Solarized is one palette read from both ends — eight monotones on a symmetric CIELAB lightness ramp, and eight accents that are the *same hex* on either ground. The two themes are that ramp with the roles mirrored (`base03`↔`base3` for the page, `base02`↔`base2` for the highlight, `base01`↔`base1` for comments, `base00`↔`base0` for body), and nothing is retuned per mode: `success` is `green` `#859900` and `error` is `red` `#dc322f` on cream and on slate alike. `test/theme-contrast.test.ts` checks the two files against each other for exactly that, because a theme that drifts an accent between modes has stopped being this palette. Each mode has three content tones rather than a ramp of grays, and the tokens are mapped onto them: `text`/`toolTitle` emphasized, `muted`/`toolOutput` body, `dim` and the quotes, rules and syntax comments in the comment tone at 2.0-2.8:1. That is where Solarized puts its comments, so this pair is neither AAA like the accessible themes nor AA like `vox-*` — it holds the contrast Solarized actually has, tier by tier (content 3.2:1, accents 2.3:1, comments 1.9:1), on every surface it paints and on both Solarized terminal stops. Anyone who needs a guaranteed floor still wants `warm-*`, `colorsafe-*` or `high-contrast-*`, and the theme docs say so. Two things the TUI needs that sixteen colors do not cover. The transcript wants a surface per tool state where Solarized ships two background stops, so each sheet is mixed from the accent that already means that state and then pulled back to the highlight's own lightness — a state reads through hue instead of by getting louder, which is what keeps the ink on a tool box at the contrast it has on the page. And position gets no hue at all: `selectedBg` and the radar mark are neutrals on the `base03`→`base01` axis, one step off the page. Those surfaces are the only colors in either file that are not canonical, and they are named in `vars`; the test rejects a non-canonical *ink*. ## [0.5.39] - 2026-08-28 ### Fixed - Switching away from a cut-out theme no longer crashes the UI with `Unknown theme color: paperShadow` (or `headlineText`). The cut-out tokens are optional per theme, and every renderer that reads one is supposed to check first — but two of those checks were made once, when a message block was built, and the answer outlived the theme that gave it. Every block already on screen when the user picked another theme went on asking for the shadow ink and the heading chip that only the `vox-cutout-*` pair defines, and the first repaint after the switch threw. Both are now asked per frame instead: `Box` takes its paper treatment as a function it calls each render, and the markdown theme looks for the headline pair inside its heading callbacks. The blocks above the prompt follow the switch in both directions — a cut-out theme gives them their shadows, a plain one takes them away. ## [0.5.38] - 2026-08-27 ### Fixed - A radar run no longer lands hard against the turn that introduced it. The rows of a run stack without gaps on purpose — one line each, they only read as a map when nothing separates them — but the same rule left the *first* row with nothing above it either, so the prose and the run below it ran together as one paragraph. The gap belongs to the run rather than to its rows: one blank line at the top of the chain, and the rows go on stacking underneath it. Radar only, and only where the blocks are not already drawing a spacer of their own, so an opened run and every other view are unchanged. - The cut-out themes' paper shadow reads as one edge again. Two defects made it read as debris instead. The shadow's right-hand column followed the cut edge in front of it, stepping in a column on roughly one row in five — and since `▌` paints half a cell, a one-column step leaves *no* overlap between one row's mark and the next, so what should have been an edge broke into a dashed staircase. It was the loudest thing on the block, too: the sheet's own edge is a quiet colour against the page, so the only part of the cut anyone could see was the shadow coming apart. The cut now moves the sheet and never the shadow, and a nicked row shows its cut as a column of page between the two, which is what a nick looks like. The bottom run also stopped a cell short of that column, leaving the corner open where the two shadows should have met. It now ends underneath it. A theme with `paperShadow` but no gutter is unchanged — there is no column there to meet, and a run reaching past the last cell would wrap. ## [0.5.37] - 2026-08-25 ### Fixed - The marketplace TTL tests no longer clone three real GitHub repositories on every call. `refreshMarketplaces` has always meant the well-known indices as well as the user-added ones, so a test covering a *local* git remote still reached `github.com` three times per call — six to eight seconds a test locally, and past the 30-second budget on a loaded CI runner. That is what made this file the most reliable way to turn `main` red: a different test in it timed out on each run, which is the signature of a clock rather than a defect. `ensureWellKnownMarketplaces` already documented a seam for exactly this — "a check that needs the network is a check that rots" — but `refreshMarketplaces` did not carry it up to its own callers. It does now, and the tests pass an empty list, which is what their own docstring always claimed they did. The three tests drop from 20.3s to 0.6s combined. Production behaviour is unchanged: with no options the default is still the well-known list. ## [0.5.36] - 2026-08-25 ### Added - Radar marks the newest run with a marker stroke. The view answers a different question than the other two — not what a tool said but the shape of the run — and what it could not say was which run you are on. `activeToolBg` covers the verb and the subject and stops before the flush-right signal, so the status colour stays on the page: a highlighter runs over the words, not the whole line. It marks two shapes because radar shows two, the folded chain line and the per-call row; marking only the row would have left it invisible in the common case, since a run of more than one call folds to a single line. Optional like the rest, and unset it draws nothing. - Filled message blocks are cut into sheets rather than run as full-width bands. A block that reaches both margins has no right edge to show, which is why the shadow could only ever be a bottom edge: there was no column past the last one to put anything in. Blocks that take `paperShadow` now hold three columns back from the right margin, cast a shadow along that edge as well as under it, and have the edge cut rather than ruled — roughly one row in five gives up a single column, always out of padding and never out of content. The cut comes from a hash of the block's own content, so it is stable between frames and different between blocks. A coin flip per row was the first attempt and it was wrong: alternating columns read as a sawtooth, which is the opposite of hand-cut. Scissors leave a mostly straight line with the occasional nick. ### Fixed - A filled `Box` keeps its background behind anything that paints its own fill. A child that draws a background — a chip, a label strip, a highlighted span — has to close it, and that reset ended the band's background as well, so the row finished on the terminal's own canvas instead of on the block. The band now re-opens its background after any inner reset, recovering the opener from the `bgFn` it was handed rather than assuming a colour, which makes it right for any nested fill and a no-op for a `bgFn` that adds no codes. - A heading chip no longer wraps the `###` marker along with the text. Below level two the renderer prints that marker, and a marker inside a filled chip says the same thing twice — the chip *is* the marker. The hook takes the level now (`heading(text, level)`, `headingBlock(line, level)`) and only the top two levels take a bar, which is the better typography regardless: a filled bar on every `###` in a long answer is exhausting. ## [0.5.35] - 2026-08-25 ### Added - A `vox-cutout-dark` to go with the light one, and four optional token groups that let a theme draw the cut-out language instead of only colouring it. The pair is cut for Solarized: light for `base3`, dark for `base03`. On the dark side every rule runs in reverse — AAA on a dark ground is a floor, not a ceiling, and Solarized's `base02` is the lighter of its two stops, so that is what every ink has to clear. Its stocks are dark coloured papers, all of them steering clear of the cyan the ground itself is made of, because a stock in the ground's own hue has nothing to separate against. The four groups are `paperShadow`, `halftone`, `headlineBg`/`headlineText`, and `tapeBg`/`tapeText`. All optional, all with a defined fallback, so every other theme renders exactly as it did — `test/theme-cutout-tokens.test.ts` checks each one from both sides, since a fallback nothing exercises is the one that rots. - `paperShadow` draws an offset band under a filled message block, so the block reads as a sheet laid on the page rather than a colour printed into it. A terminal has no sub-pixel offsets, so this is one row of `▀` — an upper half-block, solid in the half it covers — indented a column. There is no matching right-hand column: these boxes render at the full terminal width, and a column past the last cell has nowhere to go. - `halftone` colours the unfilled remainder of a gauge or progress track, which until now borrowed `dim`. `dim` is body-weight text, and a track drawn in it reads as writing rather than as the space the fill has yet to reach. - The headline pair renders markdown headings as a filled chip. This is how a light theme keeps a vivid brand hue: inside a chip a colour can be far brighter than it could ever be as text on the page, which is exactly what `vox-cutout-light` needed — its AAA ceiling had pushed the accent from vox amber down to a deep gold, and the chip gets the yellow back at 15:1. - The tape pair renders the `[branch]`/`[skill]`/`[extension]` tag as a strip laid across the block instead of brackets set inside it. Five call sites had each built that bracket string by hand; they now share one helper, because a tape strip only reads as one device if every tag agrees. Dropped from the same design pass: a `cutEdge` token. It was meant to separate a heavy block rule from hairline chrome, but the weight change comes entirely from the glyph — a dedicated colour lands ΔE 2.6 from `border`, under the threshold at which two colours look different at all. - A `vox-cutout-light` theme: the vox voice cut for paper instead of newsprint. `vox-light` tints its backgrounds a degree or two off white, which works on the near-white page it assumes and disappears on a cream one — on Solarized Light its user message sits ΔE 1.0 from the terminal's own paper, so the block that is supposed to read as a pasted sheet reads as nothing at all. Every surface here is a flat colored stock held clear of both Solarized grounds, and the sheets carry the state: white for what you typed, blue for work in flight, mint for done, blush for failed, masking-tape tan for a warning. Unlike the `vox-*` pair the theme is AAA rather than AA, and `test/theme-contrast.test.ts` now sweeps it — against its own surfaces and against the Solarized grounds it is cut for, since a theme aimed at a specific terminal palette paints onto that palette wherever it draws no surface of its own. Flat vox yellow under a selected row is the brightest thing any text has to survive, and clearing 7:1 on it caps every ink in the palette; each one sits within a hair of that cap. ## [0.5.34] - 2026-08-23 ### Fixed - Radar hides thinking traces outright rather than folding them to their one-line label. Folding is right when the label sits between things you can see, but a message that only thought and called tools has nothing left on screen once its calls join the chain — so the label stood alone under the summary and a six-call chain rendered as one row plus six `Thinking...` lines, which is the noise radar exists to remove. One row per chain now means one row. - A settled radar chain never reads a shared command prefix as a location. A command is not a path however much it looks like one: several calls beginning `cd /Users/me/repo && …` share a long slash-separated prefix, and naming it produced `Ran cd /Users/me/repo` — a headline for the one part of the command that did nothing. Only families whose subject is a path reduce to a shared location now; a command's leading `cd … &&` is stripped so the phrase names the act, and a run that did the same thing every time reports that thing (`Ran bun run check`) rather than a count. ## [0.5.33] - 2026-08-23 ### Fixed - Radar keeps a running chain on screen. Thinking traces now fold to their one-line label in radar, the way tool bodies already do. A chain stays open across a thinking block, so an unfolded trace streaming in below it pushed the chain's own summary line above the viewport — where every subsequent call rewrote a line the terminal had already scrolled away, forcing the full redraw that clears scrollback. - A settled radar chain no longer takes its name from an act incidental to it. From 10 calls up, a tool family covering less than a tenth of the run cannot be the headline: 28 searches and 37 reads ending in a single edit now reads as `Read packages/coding-agent/src` rather than `Edited subagent.ts`, which described 1 call out of 66. Chains below 10 calls are unchanged. - A settled chain's location keeps the leading `/` on absolute paths. ### Changed - A long radar chain whose headline family is a minority of its calls now names the largest thing it left out — `Edited packages/coding-agent · 76 commands`. Capped at one extra clause: a chain reporting every family it touched has said only that it was busy. - Across enough files a shared path prefix collapses to something as broad as `packages`, which is worse than the count it displaced; from 10 calls up such a location is dropped in favour of the file count. Short chains keep theirs, so `Edited docs` still reads as before. - A radar chain of a single call keeps its signal row instead of collapsing to a phrase. `Ran npm run check` dropped both the tool and how much came back; `bash npm run check 12 lines` does not. ### Documentation - `terminal-setup.md` documents what `alt` costs. 37 actions are reachable only through it, and outside the Kitty keyboard protocol macOS treats `Option` as a compose key — `Option+M` types `µ`, and `Option+E`/`U`/`N` are dead keys that send nothing — while some Linux terminals claim `Alt+` for menu mnemonics. Added the per-terminal setting for Terminal.app, iTerm2, Ghostty, Kitty and VS Code, and a note that interrupt, clear, exit and expand are kept off `alt` so a misconfigured terminal stays recoverable. ## [0.5.32] - 2026-08-23 ### Breaking Changes - The tool-output setting is renamed and its values with it: `toolOutputDisplay` (`collapsed` / `peek` / `standard`) is now `toolOutputView` (`radar` / `glance` / `full`), and the default moves from `standard` to `glance`. Old settings files still load — `collapsed` reads as `radar`, `peek` as `glance`, `standard` as `full` — and the old key is rewritten the first time the view is changed. Nothing is lost, but a session that used to open with every tool result on screen now opens with call lines and folds the bodies away. - Keybindings moved off keys the terminal, the shell, or the prompt editor already owned. The bindings are configurable as before, so a `~/.hoocode/keybindings.json` that pins any of these keeps working: | Action | Was | Now | |---|---|---| | Open model selector | `ctrl+l` | `alt+m` | | Open external editor | `ctrl+g` | `alt+e` | | Voice record | `ctrl+r` | `alt+r` | | Session picker: toggle path | `ctrl+p` | `alt+p` | | Session picker: sort order | `ctrl+s` | `alt+o` | | Session picker: rename | `ctrl+r` | `alt+r` | | Session picker: delete | `ctrl+d` | `alt+x` | | Session picker: named filter | `ctrl+n` | `alt+n` | | Model picker: save | `ctrl+s` | `alt+s` | | Model picker: enable all | `ctrl+a` | `alt+a` | | Model picker: clear all | `ctrl+x` | `alt+x` | | Model picker: toggle provider | `ctrl+p` | `alt+g` | | Tree filters | `ctrl+d/t/u/l/a` | `alt+1`…`alt+5` | | Tree filter cycle | `ctrl+o` / `shift+ctrl+o` | `alt+c` / `shift+alt+c` | | Team roster focus | `alt+n` | unchanged | ### Added - A **view dial** for tool output, on `alt+o` (`shift+alt+o` cycles back), with three stops from least to most: - **radar** — one line per *chain*: a run of consecutive tool calls. While the run is working the line shows its shape, in order, with the failures marked — `◐ grep › read › bash✗ › edit › bash… 4 done · 1 failed · running`. Once the agent moves on it becomes what the run amounted to — `● Edited packages/tui/src/keys.ts 5 calls · 1 failed · 453 lines`. Consecutive repeats collapse (`read ×4`) and long chains elide their middle, but never a failure. `alt+u` turns a chain back into its individual calls. - **glance** — the tool's own call line, one per call, body folded away. The new default. - **full** — call line plus the result body, as before. - **A failure always shows why it failed, in every view.** Previously a failed tool in the folded views was a red dot and nothing else — the one thing you always want to see was the one thing they hid. The footer shows where the dial sits, with a glyph that fills up as the view widens. - `alt+u` opens one thing, newest first, repeating to peel backwards; `shift+alt+u` re-folds. In radar it turns a chain back into its calls; elsewhere it opens a single tool body. `ctrl+o` is unchanged and still expands everything at once. It works from the newest backwards rather than through a cursor because the transcript is bottom-anchored with no app-level scrolling — anything far enough up is in the terminal's own scrollback, where this process can neither scroll nor place a selection, so a cursor would move somewhere you cannot see. ### Removed - The `▸` disclosure caret on folded tool rows. It is a click-target idiom in a TUI with no pointer, it cost two columns on every row, and it advertised a per-row action that could only ever be reached from the keyboard. Opening is now `ctrl+o` (everything) or `alt+u` (one thing, newest first). - `/cd ` moves the whole session to another directory without leaving the process — provider auth, the warmed model list and the terminal all survive. Everything cwd-bound is rebuilt for the new root (tools, context files, project settings, extensions, skills, agents, MCP servers), and because sessions are stored per project, a fresh session starts there; the one you left is still on disk and `/resume` in the old directory reopens it. Bare `/cd` goes home, `/cd -` returns to the previous directory, and the argument completes against real subdirectories. Bound to `alt+w`. - Keys for the cockpit moves that had none: `alt+g` cycles the agent mode (ask → plan → build → debug, taken from the mode command's own list rather than a copy), `alt+s` opens settings, `alt+k` opens the shortcut list, `alt+t` opens the session tree, and `alt+h` resumes from history. `/new` and `/fork` stay unbound by default — one replaces the transcript, the other needs a message picked out of it. ### Changed - The keybinding set is organized into three rings, and which ring a key is in is decided by its modifier. `ctrl` is the view: what is on screen right now. `alt` is the cockpit: what the agent is and where it works. Inside a picker, every `ctrl` key belongs to the query you are typing, so a picker's own verbs are all on `alt`. That last rule is what most of the moves above are: the session picker took `ctrl+a` (start of line), `ctrl+u` (kill to start) and `ctrl+d` (delete character) out of its own search field, and the model picker put "save" on `ctrl+s`, which is XOFF on a terminal with flow control on. Every default is checked against what a terminal without the Kitty keyboard protocol actually sends. Only `alt+` and `alt+` survive there, and legacy `alt+p`/`alt+n` double as `alt+up`/`alt+down`, so no scope binds both halves of either pair — that is why the model picker's provider toggle is `alt+g` rather than the obvious `alt+p`, which would have fired the reorder key sitting next to it. `test/keybinding-layout.test.ts` holds all of this. - `ctrl+n` no longer means two things. It was both "cycle the task panel" and the session picker's named filter; the filter moves to `alt+n`. - `/hotkeys` is grouped by ring — Flow, View, Cockpit — instead of by Navigation / Editing / Other. ### Fixed - A self-rendering tool's call line (`edit`) sat one column left of every other row while its body was folded away, because it skipped the padded shell its own diff frame needs. Harmless while `peek` was opt-in, visible on every edit now that `glance` is the default. - The startup banner names the working directory and never re-read it, so after `/cd` it kept advertising the directory you had left. - `edit`'s call line sat one column right of every other tool's in the folded views. Its render component pads horizontally to carry the diff's header band, and with no band to draw that padding was just an indent. It now pads only when the band is there. - A failed call's reason now hangs off its radar row instead of starting back at the left margin. ## [0.5.31] - 2026-08-23 ### Added - `/settings` has an **External tools** category. hoocode ships five optional Rust binaries — `rg`, `fd`, `embsearch`, `webtools`, `voicetools` — that expand what it can do, and nothing in the product ever said so. hoocode works without every one of them, which is exactly why they stayed invisible: search silently got slower, semantic ranking silently never happened, and web and voice were features nobody knew were there. Each row shows live status (installed / found on `PATH` / env override / not installed), and opens a detail view naming what it enables, what hoocode does instead when it is missing, where the release comes from, and the env vars that steer it. - hoocode can ship skills of its own. It read them from `~/.agents/skills`, `.hoocode/skills`, `.claude/skills` and installed packages — every source except itself — which is why it shipped three subagents and zero skills while telling users skills are the extension unit. Built-ins are catalogued in `core/builtin-skills.ts` and load at lowest precedence, so a skill of the same name from anywhere else wins and the collision is reported. A skill costs its description on every turn, so each built-in can be gated on the feature it serves rather than on everyone's token budget. - The first one: `plugin-authoring`, the craft half of `ProposePlugin`/ `UpdatePlugin` — when a capability is worth extracting, naming and describing it so it triggers again, portability rules, and the hook trap where a changed command adds a second hook instead of replacing one. Gated on `enablePluginTools`, which is off by default, so a default session pays nothing for it. Built-ins are materialized to a content-addressed cache under `~/.hoocode/cache/builtin-skills/`. A skill is loaded by reading its file, so its location has to be a real path, and the compiled standalone binary has no install directory to read from; materializing the same embedded copy everywhere keeps the skill set identical across npm, pnpm, source and the binary. If the cache cannot be written the built-ins are absent and everything else runs normally. `--no-skills` and `--light` suppress them. - An agent-selection eval: `bun run agent-eval` scores the built-in agent roster against a gold set of real tasks, reporting how often each agent is chosen when it should be, how often the parent correctly keeps work inline, and a confusion matrix naming which agent loses to which. It reuses the plugin G4 trigger harness rather than adding a second one, and describes each agent with the summarized text `` actually emits. This exists to settle whether `plan` and `explore` are two agents or one: they ship with the same tools, the same isolation and the same background flag, and `complexity` on the Task tool already expresses the only other difference. That was being argued from intuition; it is now measurable. ### Fixed - The G4 plugin trigger gate never had a judge. `trigger-eval.ts` takes its model call as a parameter so scoring stays testable, and nothing in the tree ever passed one — so every G4 run has reported `not-run` since it was written. `createLlmTriggerJudge` is that judge, shared with the agent-selection eval. - `/new-skill`, `/new-agent` and `/new-command` scaffolded different content depending on whether `--platform` was set. Each command has two write paths — the per-vendor emitters and the plain `.hoocode/` writer — and each carried its own copy of the body, which had drifted in both directions: the `.hoocode/` command body documented the `${@:N}` / `${@:N:L}` slice placeholders that the platform path silently omitted, and the `.hoocode/` agent body identified the agent as running inside hoocode where the platform one did not. Both paths read one definition now, and the richer text won in each case. ### Changed - The four built-in mode prompts have one home. `templates/modes//system.md` is now the only copy: `core/mode-prompts.ts` re-exports the embedded copy as `DEFAULT_MODE_PROMPTS` instead of carrying a second, hand-written set. The two had already drifted — `/init` scaffolds the template text into a project, so a user who ran it and a user who did not were getting differently worded mode rules from the same version. - The `/grill` phases moved out of TypeScript into `templates/prompts/*.md`. They are prose the runtime injects verbatim — no interpolation, no branching — so they are edited as prose now. The message `/grill` produces is unchanged. - The Task delegation appendix moved to `templates/prompts/task-main.md` and its two `task-background-*` variants. At ~600 tok/turn it is the largest block of always-on text hoocode emits once the Task tool is on, and it had exactly one interpolation slot in otherwise static prose, so a string constant bought nothing. The rendered prompt is byte-identical on both the with- and without-background-agents branches. - `ProposePlugin` and `UpdatePlugin` shed ~55% of their always-on prompt guidance (~626 to ~301 tok/turn when the plugin system is enabled). What was removed was how-to-author-well guidance, which is not a tool contract and now lives in the `plugin-authoring` skill; what stayed is the trigger, the transparency rule for autonomous authoring, the hook trap, and the two hard prohibitions. Several removed lines also restated the tools' own descriptions or each other. - Settings rows that are inert without one of those binaries now say so. The `web` and `semantic search` tool-group switches, the web tools timeout and the voice silence window carry a `needs ` marker and explain the fallback and whether hoocode will fetch the binary. The rows stay settable — the setting is what makes hoocode fetch the binary in the first place, and hiding a row when its dependency is missing would recreate the same silence. ## [0.5.30] - 2026-08-23 ### Added - `/settings` prices what it is about to cost you. A line under the pane reports the fixed per-turn surface — system prompt plus active tool schemas, the text re-sent on every request — and each tool carries its own schema price beside its switch, including the tools that are off, where the price is what turning one back on will cost. The numbers are the same measurement `--print-token-surface` prints, re-measured after every change, so a toggle that moves the surface shows what it moved. - The `light` preset is editable from `/settings`. It was the one low-token control with no home in the pane, which is backwards for the setting whose entire purpose is the token budget. It reads at startup, so it applies on the next session. - `/settings` grouping: a **Context** category now holds auto-compact, context GC and the light preset. Those three decide the token budget and were in three different places — auto-compact alone at the top level, context GC filed under tool settings, light nowhere. Tool output display joins the truncation caps it belongs with under one **Tool output** row, and every top-level row now opens something rather than cycling in place. ## [0.5.29] - 2026-08-23 ### Added - `enablePluginTools` is editable from `/settings` too, as **Plugin system** at the top of the same **Plugins** category. It is the one gate for the whole autonomous plugin system — the lifecycle tools, `ProposePlugin`, and the plugin-reuse nudge — and was flag- and file-only. The tools are wired up when a session is built, so they arrive on the next session; the nudge re-reads the setting and follows immediately. - The artifact platform targets are editable from `/settings`, under a new **Plugins** category. `platform` decides the vendor layout hoocode writes when it authors a plugin or scaffolds with `/new-skill`, `/new-agent` and `/new-command`, but it was reachable only through the `--platform` flag or by hand-editing settings.json — which made a per-environment choice look like a per-invocation one. The pane row writes the global settings file and applies the change to the running session, so it is set once per machine. The three tokens (`claude`, `github`, `agents`) are independent toggles rather than a cycle, because the setting is a list and dual-emission is supported. Turning all of them off removes the key: the per-consumer defaults come back (`claude` for plugins, `.hoocode/` for scaffolds), which is not the same as targeting nothing. ### Fixed - A `/settings` row whose key the project's `.hoocode/settings.json` also sets looked like it took and then reverted: rows write the user file, which the project file is merged over on the next session. The Plugins rows now say so in their description. - `pluginInstallScope` was unreachable in `/settings`. The row and its callback existed, but the row belonged to no category after the pane was grouped, so nothing in the UI could open it. It now lives under **Plugins** alongside `platform`, and a test walks the pane to keep every setting reachable. - `/settings` search matched category labels only, so typing the name of a setting — "theme", "transport" — returned nothing once the pane grouped its rows into categories. A category now searches by the labels of the settings inside it. - A numeric setting edited by hand in settings.json no longer snaps to a preset on the first keypress. Image width, autocomplete size, the voice silence window, the web-tools timeout and both tool-output caps now include the value in force in their cycle, as the `/learn` thresholds already did. ## [0.5.28] - 2026-08-22 ## [0.5.27] - 2026-08-22 ### Added - hoocode can answer questions about itself. The startup banner already promised "hoocode can explain its own features and look up its docs", but nothing put a docs path into model context — `getDocsPath()`'s only caller printed paths to the human on an auth failure. The agent could not find them on its own either: its cwd is your project, so searching there turns up your docs, never hoocode's. The system prompt now lists the shipped docs (~215 tokens, filenames only), and a `SearchHooCode` tool retrieves them at the heading level, returning a file path and line number to read. It also indexes the session's skills, slash commands, and subagents, so "what can you do?" has one place that answers it. MCP tools remain with `ResolveMcpTools`. - New documentation for features that had none: `plugins.md` (marketplaces, the trust model, plugin formats), `mcp.md` (server config, transports, deferred schemas), `modes.md` (ask/plan/build/debug and the plan → grill → approve → goal workflow), and `canvas.md`. `usage.md` gains the 13 slash commands that were shipping undocumented, including `/plugin`, `/mode`, `/loop`, `/canvas`, `/cost`, and the `/new-*` scaffolds, plus the 12 CLI flags that were missing from the reference — the optional tool bundles (`--enable-todowrite`, `--enable-webtools`, `--enable-search-tool`, `--enable-plugintools`), the subagent flags, `--light`, `--print-token-surface`, `--platform`, `--team`, and `--disallowed-tools`. Every slash command and CLI flag hoocode accepts is now documented. ### Fixed - Capability search could not match a plural: a query for "theme" missed a heading reading "Themes". Singular forms are now indexed alongside the originals, so exact tool names still match exactly. - Capability search ranked on question filler. "how do I add a custom theme" was won by a section matching "add" and "how" over the one titled "Creating a Custom Theme". Function words are now dropped from queries. - The dense capability index is a shared store keyed on a content hash, but the MCP loader seeded it from only its own tools, evicting any other producer's vectors. It now seeds from the full registered set. - Corrected the global config directory throughout the docs. Paths were written as `~/.pi/agent/` or `~/.hoocode/agent/`; the real directory is `~/.hoocode`, with no `agent/` segment. Every global path — `settings.json`, `keybindings.json`, `auth.json`, `sessions/`, `skills/`, `extensions/`, `themes/` — pointed somewhere that does not exist. ## [0.5.26] - 2026-08-21 ### Added - `/new-canvas` now takes a description, not just a name, and builds what you describe. `/new-canvas a kanban board for the release checklist` scaffolds the extension, derives and reports a directory name, opens the canvas, and hands the agent a brief to build it — you steer it like any other turn. The old shapes still work: `/new-canvas my-board` gives you the template to edit by hand and starts no build, and `/new-canvas my-board: ` lets you name it yourself. - `/canvas reload [extension]` and a `reload_canvas` tool, so a canvas can be changed while you are looking at it. Editing an extension's code used to do nothing at all while it was open — the running process was forked from the old code, so neither the open page nor a newly opened second instance saw the change, and the only way to see one was to restart the session. Now the agent reloads after each edit and the new capability is immediately callable. The new code is forked and asked for its declarations *before* the old process is stopped, so an edit that does not run leaves the canvas you are looking at exactly as it was and reports the error. Instances keep their ids and the input they were opened with, but each gets a **new url** — the extension binds a new port and mints a new token on every open — so the previous browser tab is dead and the replacement url is printed. - An arrow-key games canvas, hoocode's first canvas of its own, at `.agents/extensions/arrow-key-games/`. Open it with `/canvas open arrow-key-games`. Snake and a randomly carved Maze are yours alone; **Duel** is a turn-based coin race you play against the model — you move with the arrow keys, it moves through `invoke_canvas_action`, and the board updates live for both of you. It was built by running `/new-canvas create lightweight games that can be played with keyboard arrow keys` and iterating with `reload_canvas`, which is what the two entries above are for. - `/canvas rename ` and `/canvas remove `. A canvas's name lives in four places — the directory (which *is* the extension id), the canvas's own `id`, its `displayName`, and its header comment — and getting the `id` wrong by hand drops the canvas you are looking at on the next reload. Rename does all of it at once, closes what was open first, and prints every line it rewrote. It only touches a string that is *entirely* the old name, so a sentence mentioning the canvas is reported rather than rewritten. Remove asks before deleting, refuses when there is no surface to ask on, and both refuse a canvas that came from a plugin, pointing at `/plugin` instead. - Reloading now reports which actions the edit **added, removed or changed**, so writing a new action tells you whether the host can see it. Previously a typo inside `actions: [...]` failed silently — the action just was not there. "Nothing changed" is reported too, since silence reads as success. - `/canvas list` names the actions of each open canvas. They were visible only to the model, so the person steering the session could not see the surface they were being asked about. ### Changed - `/new-canvas` moved from the `/new-*` scaffold family to the canvas surface. It is no longer a file-writing command: it opens what it creates and drives the agent loop. - `/new-canvas` derives a much better name from a description. It was naming the *request* rather than the thing — `create lightweight games…` became `create-lightweight-games`, `help me compare two benchmark runs` became `help-compare-two` — because opening words like "create", "build", "show" and "help me" landed in the directory name, and `-ing`/`-ed` words crowded out the nouns. On twelve realistic descriptions, seven were wrong; all of them now read as names for the thing: `lightweight-games-keyboard`, `dashboard-flaky-tests`, `compare-benchmark-runs`. - The scaffolded template names itself once, in `ID` and `NAME` at the top, instead of repeating the name in six places. Existing canvases are unaffected — rename handles both shapes. - The build brief now tells the model to leave the canvas's `id` alone and rename `displayName` instead. Renaming the id drops the instance the person is watching on the next reload — correct behaviour, since the canvas the instance was opened against no longer exists, but a trap the model walks into because the scaffold names the canvas after a directory derived from a sentence. ## [0.5.25] - 2026-08-20 ### Added - `/new-canvas ` — scaffold a canvas extension. Writes `.agents/extensions//extension.mjs` (or `.github/extensions/` with `--platform github`), pre-wired with a declared canvas, one agent-callable action, and a token-gated loopback server. It runs as scaffolded, so `/canvas open ` works immediately — no `/reload`, because canvases are discovered when `/canvas` runs rather than loaded at session start. Scaffolding trusts the workspace, the same grant `/plugin install --scope project` makes and for the same reason: a canvas lands in the working tree, which is where the trust gate looks, so without it the canvas you just asked for would be refused with "came with this repository" seconds after you created it. The grant is wider than the one canvas — plugins committed here may then run hooks and MCP servers — so it is stated in the output and `/plugin untrust` reverses it. - Plugins can ship canvases, and `/canvas` now finds them. Both real catalog layouts are read: the Copilot manifest's `"extensions": "

"` path key (`Redth/mobile-canvas-ghcp`) and the Agent Plugins vendor content namespace `com.github.copilot/extensions//` (`github/awesome-copilot`). A plugin whose root itself carries `extension.mjs` counts as one canvas named for the plugin. Installed canvases are listed and opened exactly like hand-placed ones, and a canvas from a project-scoped plugin goes through the same workspace-trust gate as one in `.github/extensions/` — it arrives in every collaborator's clone the same way. - Subagents in the `com.github.copilot/agents/` namespace load. This is where `github/awesome-copilot` publishes all 125 of its plugin agents; they were previously read as nothing. - Canvases appear in the startup and `/reload` surface — a counted cell, and a detail row per canvas carrying either `/canvas open ` or the reason it is withheld. Installing a canvas plugin used to report "1 plugin" and give no sign a canvas existed, which is a large part of why the gap below went unnoticed. ### Fixed - `github/awesome-copilot` plugins install with their content. hoocode cloned the repository's default branch, where a `plugins//` directory holds only `plugin.json` and `README.md` — the real content lives in top-level trees and is materialized into each plugin directory by CI on the `marketplace` branch, which is the branch the vendor's own installer reads. Every entry therefore installed as an empty shell and reported that it contributed no capabilities. The marketplace is now pinned to that branch, and a cache left on the wrong ref is re-cloned rather than kept up to date forever. `/plugin install arcade-canvas@awesome-copilot` now lands a working canvas and says so. The pin names a branch hoocode does not control, so a retired one falls back to the default branch with a note saying entries there may be unbuilt, rather than dropping the marketplace outright — and a fallback clone stays put instead of being discarded and re-downloaded on every run. - `/plugin list` and `/plugin install` refresh the curated marketplace indices before reading them, as `SearchPlugins` already did. The human path never did, so a stale — or, after the fix below, a *wrong-ref* — cache could persist indefinitely: someone who only ever typed `/plugin install` would have kept installing unbuilt stubs with no way to know why. TTL-respecting, so it is free when the cache is fresh, and it says so before a fetch that will take a moment. - Starting a new session, resuming one, or forking one shows the same loaded resources `/reload` does. The listing was rendered — extensions rebind before the transcript is reset — and then wiped a moment later by that reset, so every session change but `/reload` reported nothing. ## [0.5.24] - 2026-08-20 ### Fixed - Extension loading no longer depends on the sibling workspace packages having been built. `getAliases()` resolved every workspace alias eagerly and threw if any one of them was missing, so a single unresolvable specifier took down every extension — including extensions that import nothing. The fallback also used `import.meta.resolve`, which is undefined once the module goes through a bundler or test transform (`__vite_ssr_import_meta__.resolve is not a function`). Aliases now resolve via `require.resolve` and an unresolvable one is omitted rather than fatal. ## [0.5.23] - 2026-08-19 ### Added - `/canvas` — run GitHub Copilot canvas extensions in hoocode. A canvas is a shared interactive surface an agent and a person both drive: the agent mutates state and navigates the view, the person reads and edits on the same page. Copilot canvas extensions are directories of plain `.mjs` with no dependencies except one host-provided import, so satisfying that import runs the community catalog unmodified — verified against `pr-artifact-explorer` from `github/awesome-copilot`, which opens byte-identical to upstream with nothing written into its directory. `/canvas list` shows what is installed, what is open, and what is being withheld; `/canvas open [:]` opens one behind a spinner you can cancel with escape; `/canvas close ` closes it. Extensions are read from `.agents/extensions/`, `.github/extensions/`, and `~/.copilot/extensions/`. An extension that arrived in the repository is **listed but never run** until the workspace is trusted (`/plugin trust`), on the same grounds as a plugin's hooks and MCP servers: it is a process that also binds a listening socket. Unlike a plugin it has no passive half — even its name comes from running its code — so it is withheld whole rather than partially. While a canvas is open the agent gets two tools, mirroring the shape Copilot names in its own SDK: `list_canvas_capabilities` and `invoke_canvas_action`. There is deliberately no tool to *open* a canvas — that forks a process, which stays a person's decision. The pair costs ~235 tokens of prompt surface and nothing at all in a session that never opens one. Canvas support needs a reachable Node 20.6 or newer, which is what `module.register` requires: the npm install forks itself, and the standalone binary forks a `node` from PATH. Where none is reachable, `/canvas` says so instead of half-working. See `docs/canvas-extensions-design.md`. ## [0.5.22] - 2026-08-18 ### Fixed - Dispatching a subagent no longer duplicates rows in the TUI. `beginDispatch` wrote its `[DISPATCH]` line straight to the terminal with `console.error`; stdout is reserved for the event stream, but stderr is not free either while the TUI owns the screen. The renderer is differential and repositions by relative row deltas from its own bookkeeping (`hardwareCursorRow`), so a write it did not make scrolled the terminal underneath it and every later partial repaint landed a row off — painting a second `Agent [explore]` row for a single dispatch, wedging fragments of the log line into the transcript, and scrambling the frame outright with two or more concurrent spawns. The damage persisted until something forced a full repaint, which is why expanding and collapsing tool output (`ctrl+O`) appeared to "fix" it. Operational log lines now go through a small `agentLog` sink (`core/agent-log.ts`) that stays silent while a TUI is attached and is unchanged in every other mode (`--print`, RPC, CI). Nothing is lost interactively: the dispatch is already on screen as its tool row and task-panel row, every field of the `[DISPATCH]` line is persisted to `dispatch-log.json`, and warm/inherited-model fallbacks already surface as a `⚠` note on the task row. `HOOCODE_DEBUG_AGENT_LOG=1` tees the suppressed lines to `hoocode-debug.log`. The same hazard is closed for the `[WARM]` cold-spawn fallbacks, the inherited-model retry notice, and the lifeguard's stall report, which could corrupt the frame the same way. ## [0.5.21] - 2026-08-16 ### Fixed - Plugin hooks no longer crash the process when a hook exits without reading its stdin. `runHookCommand` wrote the JSON payload inside a `try`, which catches only synchronous throws: a hook that exits first (`exit 2`, any script ignoring its input) made the write fail asynchronously, and `child.stdin` emitted an unhandled `EPIPE`. Intermittently fatal in real sessions, and the cause of the `bun-test (coding-agent)` failure on `main` where every test file passed but the run still exited 1. ## [0.5.20] - 2026-08-16 ## [0.5.19] - 2026-08-16 ### Breaking Changes - The `workflow` category is gone, and `learnMinWorkflowRepeats` with it. It mined tool sequences and proposed them as skills, and in practice it proposed nothing at all: on a real corpus, 30 candidates were mined and not one ever cleared its threshold, because the threshold was three identical model-invented names for a tool sequence across separate sessions. Nor is it worth reimplementing deterministically — counting tool trigrams over the same corpus yields 170 "workflows" led by `bash -> bash -> bash` at 1142 occurrences. Tool names carry no procedural meaning. - `learnMinWorkflowRepeats` is replaced by `learnMinRequestRepeats` (default 3), which gates the new `request` category below. ### Added - `/learn` proposes **slash commands** for work you keep asking for by name. The miner was explicitly told not to report task requests — and those discarded requests were the strongest unexploited signal in the corpus. A directive is *how* work should be done; a request repeated across sessions is *what you keep asking for*, which is the definition of a slash command. Held to a higher bar than directives: a rule stated twice is a rule, but a job asked for twice may just be a job that came up twice. - The digest routes a proposal three ways instead of two — rule, skill, or slash command — and names the destination for each, along with what it costs: a context file is loaded every turn, a skill's description is always loaded but its body on demand, and a slash command costs nothing until it is invoked. - The digest states the boundary with `ProposePlugin`: skills and commands proposed from mined evidence are local habits written under `.agents/`; `ProposePlugin` packages something already proven useful into a portable artifact. Hooks and MCP servers are never proposed from this evidence, which records what was said and what failed — far too weak a warrant for anything that executes. ### Changed - `/learn` names occurrences in one global pass instead of asking the miner to name them per session. The miner was told to emit a label — its canonical name for what was meant — and the reduce step grouped on exact label equality, but a session mined in isolation is being asked to hit a shared vocabulary it has never seen. On a real corpus that produced 188 distinct labels from 191 candidates: `use-bun-not-npm` and `prefer-bun-over-npm` are the same rule and never met, and nothing ever reached the repeat threshold. Naming now happens once, with every candidate visible at the same time, which is the only vantage point from which "is this the same point as that" is answerable. - Cached candidates no longer carry a label, which makes the mining cache model-independent. A label was frozen at mining time, so changing the `fast` model tier forked the vocabulary permanently — old sessions and new ones naming the same thing differently, with every count split across the seam and no sign that it had happened. - The naming pass is given the labels already on record and told to reuse them. State keys are `directive: