# Changelog All notable changes to KillerOS are documented here. Releases use New Features for new capabilities, Added for smaller additions, Changed for updates and removals, and Fixed for corrections. Empty sections are omitted. ## [Unreleased] ## [3.0.8] - 2026-10-18 ### Added - Added `/goal edit ` to update an active or paused goal in place without resetting its turn count, active clock, or token baseline. A quoted file target is re-baselined for the new objective, and blocked or complete goals keep their existing replace or new-objective paths. - Added real-CLI startup scenarios that reject personal instructions in untrusted projects across goal requests, startup cancellation, reload, and ordinary compaction continuations. - Added real-CLI print and JSON scenarios for question and goal rejection, trusted instructions, protocol output, and prevention of proactive compaction. - Added real-CLI saved-tool restoration coverage for native tool modifiers, completed goals, reload, explicit exclusions, and model-only decisions. ### Changed - Raised the minimum supported Pi version to 1.3.0 and aligned the exact development pins, lockfile, CI targets, and TypeBox development dependency. Documented verification and minimum-version updates for each adopted stable Pi release. - Restricted KillerOS to Windows. npm metadata and extension activation reject other operating systems. Removed Linux-only runtime branches and tests, and moved all CI and release jobs to Windows while retaining required-check names and publication safeguards. - Derived Pi requirement checks from the current development pins and peer ranges instead of historical versions. Removed version numbers from cancellation test selection so CI keeps selecting the scenario after a Pi update. - Matched TypeBox to the selected Pi release during compatibility CI installs, alongside Pi AI and TUI, without changing the tracked package files. ### Fixed - Removed the package-test npm shell fallback so Windows paths with shell metacharacters remain literal, including direct Node test runs without `npm_execpath`. - Made RPC test cleanup probe its owned native process handle before PID-based escalation, so delayed exit notifications cannot trigger cleanup of an already exited child. ## [3.0.7] - 2026-10-15 ### Changed - Raised the minimum supported Pi version to 1.2.0 and pinned development packages to that baseline. Removed the retired experimental server dependency and updated the packaged theme to Pi's published schema URL. - Batched the passive Git conversion matrix into three isolated repositories instead of thirty. All 5,940 real-Git comparisons and thirty attribute/configuration cases remain covered, with explicit per-case comparison counts and fewer Git process launches. - Removed unnecessary Pi runtime imports from process controls, footer end-to-end tests, failure-report checks, and bounded-text tests. Directory cleanup now lives in a lightweight shared helper with unchanged Windows lock retries. ### Fixed - Excluded Git-ignored private `docs/` artifacts from linting while retaining checks for repository code, so local documentation helpers cannot block release validation. - Made footer terminal checks wait for a rendered footer before testing command results, preventing reload frames without a footer from satisfying absent-hint checks. - Made the cleanup-disabled process-tree control wait for the descendant's complete late write. Shell exit alone does not prove that a slowly started descendant has finished. - Removed the old personal-instruction copy from goal continuation messages. Pi 1.2.0 now applies the shared startup handler to custom runs, so the copy duplicated instructions on each goal turn and after startup cancellation. - Scoped the unsupported Windows RPC shutdown case to Node 24.19.0, including Pi 1.2.0, and documented Node's 24.20.0 fix. Kept the pilots active on other Node versions. - Restored latest-Pi compatibility installs after Pi 1.2.0 stopped publishing the experimental server package. CI now installs only the matched runtime packages, and test diagnostics no longer require the retired server. - Isolated the real-Pi tool-exposure matrix from the parent checkout's Git state. CLI and SDK fixtures share a checked repository initializer, and the exposure matrix shuts down extensions before disposal so its watchers do not outlive the tests. ### Added - Added real-CLI Pi 1.2.0 startup checks for single-copy personal instructions, custom and user events, queued next-turn messages, startup cancellation, goal turn accounting, reload, and ordinary compaction recovery. CI repeats them five times without forced exit and now checks Windows at both the Node floor and current LTS. - Added bounded failure reports for CLI, terminal, process-control, and Git branch-isolation tests. Nested assertion and cleanup errors remain visible in test output with forced exit, and failed CI jobs retain report-only artifacts for seven days. ## [3.0.6] - 2026-10-12 ### Changed - Rewrote the README with installation and onboarding steps, grouped usage and configuration guidance, development checks, and release and security expectations. - Raised the minimum supported Pi version to 1.1.0, pinned development packages to 1.1.0, and moved all CI Pi targets to that baseline or newer. Cancellation and retry coverage now runs without old-version gates. - Removed repository checks that required exact historical changelog wording while retaining current README, Pi compatibility, package, and release safeguards. ### Added - Added remaining token counts and Pi's configured context capacity to the TUI footer, with capacity-only and percentage-only fallbacks at narrow widths and explicit unknown states. - Added real Pi TUI coverage for context budgets, model switching, automatic-compaction commands, settings failures, reload, and responsive footer output. - Added real-Pi cancellation coverage through the complete KillerOS entry point, checking paused goal state, stopped receipts, and suppressed completion sounds. - Added an installed-CLI goal workflow covering package loading, public command routing, model-issued completion, durable session restoration, and no unsolicited model work. Verified on Windows Node 22.19.0 with Pi 1.1.0; the exact Windows Node 24.19.0/Pi 1.1.0 combination is skipped after reproduced native RPC shutdown crashes. - Added a native-terminal installed-package pilot for question selection after resize, cancellation without partial answers, and multiline editor text across fullscreen transcript navigation. Kept focused question and editor tests, added terminal startup and assertion-failure cleanup controls, and added five-run no-forced-exit CI checks for the installed pilots and changed cancellation lifecycle before the normal-concurrency full suite. Terminal failure logs retain selected versions, sanitized launch arguments, and bounded screen and raw-output diagnostics. ### Fixed - Fixed release validation for the README's rewritten npm and Git pin examples while retaining stale-version rejection. Made the executable-mode Git oracle refresh index metadata before comparing changes, preventing metadata-only CI failures without changing its assertions. - Show the footer's manual `/compact` hint at the existing rounded 15% warning threshold only when KillerOS automatic compaction is known to be off. Commands and turn-end settings reads refresh the hint, including external changes and read failures, without changing automatic triggers or Pi's independent compaction behavior. - Fixed unhandled RPC test-driver stdin errors when a child exits during a write. A real-process control now verifies write rejection, retained diagnostics, and orderly cleanup. - Fixed the native-terminal test driver's exit race by draining queued screen parsing before rejecting final-output waits or disposing the parser. Kept the native capability probe alive until its input confirmation is observed before orderly shutdown. Successful cleanup waits for queued parsing and tracked native callbacks to quiesce before disposing the parser; cleanup errors are surfaced and the observer is disabled on every close path. - Fixed RPC fixture cancellation checks before sending commands or returning cached records. Added subprocess controls that reject unauthorized writes and prevent PID-tree escalation after the parent exits but inherited pipes remain open. ## [3.0.5] - 2026-10-08 ### Fixed - Used Pi 1.1.0's final cancellation signal for `Stopped` task receipts and silent completion notifications, including cancellation after a normal assistant response or without an assistant result. Kept observed changes and checks and the Pi 1.0.4 fallback. - Stopped accepted goal continuation after final request cancellation while preserving compaction recovery through its completion and cancellation callbacks. ### Added - Added real Pi 1.1.0 cancellation, busy-error retry, native Mistral transport retry, and additive tool-selection checks. Documented native tool modifiers and reliable extension-tool exclusion through `--exclude-tools`, including Pi 1.1.0's modifier limitation. Kept the Pi and Node support floors and locked development packages unchanged. ### Changed - Moved question input to Pi's native dialogs, with KillerOS coordinating bounded multi-select, filtering, custom answers, recent-answer history, and paged text previews. Each step uses native dialog controls and Pi 1.1.0's blocked-status reporting. Preserved the question tool's inputs and results, TUI restriction, and sequential model-only exposure; cancellation and session changes prevent stale steps or partial success. ## [3.0.4] - 2026-10-07 ### Changed - Made the explicitly enabled `prepublishOnly` lifecycle the single release-validator invocation at npm publication. The release workflow now publishes the source directory with `npm publish . --ignore-scripts=false`, preserving the existing release checks and trusted publishing. - Added current release-metadata validation and isolated publication-lifecycle tests with release-pinned npm to the Node-floor quality check. Extended the existing packed-package Pi test to check all required files and package identity without another pack operation. The package smoke job remains until replacement coverage lands and the required-check migration is approved and verified. ### Fixed - Allowed later verified ordinary work to complete the same saved blocked goal without resume, clear, or extra automatic turns. Completion retains the original objective, file baseline, and accounting, respects native tool selection, and prevents compaction from restarting completed work. - Stopped false CRLF change counts in the footer and task receipts for text files with `eol=lf`. Added a differential Git-oracle matrix covering attributes, `core.autocrlf`, text and binary contents, plus mode and symlink comparisons. Fixes #47. - Gave each real Pi decision-tool exposure scenario its own bounded timeout so slower Windows TUI scenarios do not cancel the remaining codemode and RPC coverage. All behavioral assertions remain unchanged. ## [3.0.3] - 2026-10-07 ### Changed - Raised the minimum supported Pi version and all four locked Pi development packages to 1.0.4. Compatibility CI now targets the exact 1.0.4 minimum and latest `>=1.0.4 <2`, with unchanged stable check names and package-file immutability guards. - Documented Pi 1.0.4's native wildcard tool filters, MCP availability under explicit tool allowlists, and codemode image reads. - Updated Azure footer naming and fast-mode exclusion tests for Pi's renamed `azure` provider. Documented the required Azure configuration migration, the unchanged Responses API identifier, native editor/transcript navigation, and saved codemode images. - Gave Pi compatibility CI checks stable minimum/latest names so future Pi version changes do not require renaming GitHub's required checks. Documented the one-time protection migration without weakening existing safeguards. ### Added - Added real Pi regressions for wildcard decision-tool selection and exclusion, codemode-only provider prompt rules, and pending-stream cancellation retries that preserve one goal turn and defer receipts and sounds until settlement. - Added real Pi contract coverage for Azure Responses and Foundry Chat Completions requests both before and after reload, preserving sampling settings and deployment names without applying OpenAI priority service. - Added custom-editor coverage for Pi 1.0.3's separate line-navigation and fullscreen transcript Home/End shortcuts. ### Fixed - Fixed a process-tree test startup race by waiting for the complete descendant PID instead of readiness-file creation. Hook termination assertions remain unchanged. - Reused bounded cleanup retries throughout real Pi integration tests so transient Windows directory locks do not fail CI after the assertions pass. Added a repository contract against unbounded fixture cleanup. ## [3.0.2] - 2026-10-05 ### Changed - Raised the minimum supported Pi version and locked Pi development packages to 1.0.2. Compatibility CI now tests the exact 1.0.2 minimum and latest stable 1.x; users on older Pi versions must upgrade. - Documented Pi's native thinking-level sampling configuration and trusted-project MCP overrides without adding KillerOS commands or settings. ### Added - Added real Pi contract coverage for capacity-error recovery within one logical goal turn, with task receipts and completion sounds deferred until settlement. - Verified that native OpenAI fast mode preserves thinking-level sampling overrides across API-key and ChatGPT subscription requests, extension reloads, and provider retries. ### Fixed - Kept POSIX process-group cleanup pending after a timed-out or cancelled hook's shell exits, preserving forced termination and reporting bounded uncertainty unless group exit is confirmed. Fixes #42. - Preserved goal-request ownership through settlement so automatic compaction cannot restart completed or blocked goals as ordinary work. Active-goal recovery, later ordinary requests, and compaction error reporting remain supported. Fixes #43. - Corrected the process-tree timeout fixture's marker argument and delayed descendant writes beyond cleanup. Added a real cleanup-disabled control that detects surviving descendants and checks explicit uncertainty. Fixes #44. ## [3.0.1] - 2026-10-02 ### Changed - Expanded Pi peer ranges to `>=0.99.2 <2` and pinned development packages to 1.0.0. Compatibility CI now runs the full quality suite against the exact 0.99.2 minimum and latest stable 1.x with matched host packages, without changing the tracked manifest or lockfile. - Documented Pi 1.0's fullscreen default and the regular-mode override for terminal-owned scrollback. - Documented the protected PR-based release process and merge-commit requirement for automatic `main`-to-`dev` synchronization. CI now validates release metadata before package smoke testing, so mismatched versions, missing release notes, and stale README tags fail before merge. ### Fixed - Reused bounded cleanup retries in passive Git footer tests so transient Windows directory locks do not fail CI after the security assertions pass. - Preserved an authorized goal continuation when a replacement becomes stale during its idle wait, instead of leaving the surviving goal active but idle. Navigation, clear, turn limits, and competing continuation holds remain respected. - Rejected recognized credential assignments in Markdown handoffs, including list items, bold labels, and inline-code labels, before creating a destination session. - Discarded pending goal mutations after committed navigation or a competing goal mutation during confirmation, idle waiting, or file-baseline inference, including goals set and then cleared. Overlapping commands retain their own continuation holds. Cancelled navigation preserves valid pending commands. - Preserved concurrent changes to independent `/auto-compact` fields by merging the effective preference under the settings lock. - Removed C1 terminal controls from custom activity tool names. - Clipped collapsed and expanded transcript lines to the terminal width, including wide Unicode characters at one column. - Treated failed Git HEAD lookups as unavailable instead of inventing added files, while retaining support for repositories without commits. Footer scans and task receipts share the same HEAD resolution. - Paused normally stopped goals without an accepted decision even when automatic compaction succeeds or skips a session-too-small request, preventing repeated same-turn requests from bypassing the turn limit. Interrupted-turn recovery and accepted next-turn decisions remain supported. - Saved `/handoff` context before reporting success so the linked session survives immediate exit and resume without another prompt or an automatic agent turn. - Discarded pending task receipts after committed tree navigation, preventing late scans from attaching the abandoned branch's receipt to the selected branch. Cancelled navigation still preserves receipts. ## [3.0.0] - 2026-10-01 ### Changed - Raised the minimum supported Pi version and locked Pi development packages to 0.99.2, with matching CI and lockfile contracts. Users on older Pi versions must upgrade. ### Added - Added a Windows CI job on Node.js 22.19.0 that runs the full quality suite, with a repository contract protecting the job's required checks. ### Fixed - Canonicalized Windows short-path aliases in passive Git executable checks, preventing repository-local shims from being selected through paths such as `RUNNER~1` and fixing the Node.js 22.19.0 Windows CI failure. Removed temporary receipt debug logging. - Applied `/codex-fast` priority requests and the footer's `fast` label to eligible native OpenAI Responses models at the official endpoint, for both API-key and ChatGPT subscription authentication. Legacy Codex behavior, command strings, and the process-local opt-in preference are unchanged; priority acceptance and billing remain OpenAI-controlled. - Kept `question` and active `killeros_goal_update` directly declared in codemode-only sessions using Pi's native `model-only` exposure, which also prevents scripts and other tools from executing them. Goal activation and TUI-only question behavior are unchanged. - Discarded pending change receipts after session replacement or reload and kept late activity and completion-sound handlers from using the old context, preventing stale-context extension errors during receipt finalization. - Updated the `brace-expansion` override to patched 5.0.12, fixing recursion and quadratic-time denial of service in development and CI installs. - Removed the stale `undici` override so development and CI installs use Pi's patched 8.10.2 dependency, resolving GHSA-3wwx-pv8p-q78v. - Refreshed cached change-receipt baselines when `HEAD`, `core.filemode`, or `core.symlinks` changes between responses, while still rejecting `HEAD` changes made during a response. - Made passive footer scans and change receipts honor `core.symlinks=false` placeholders and `core.filemode=false` without masking file-type changes. - Preserved parent traversal in relative goal paths so directory links cannot redirect file proof to a lexically normalized target or collapse distinct targets. - Made the Windows hook cleanup test wait for its child to start and verify that both processes terminate, avoiding false failures when `taskkill` cannot confirm an already-finished cleanup. - Showed stable provider-reported model IDs on settled receipts when they differ from the selected alias, including GitHub Copilot Claude models. - Reported CRLF worktree content as modified when indexed attributes require `eol=lf`, matching Git in footer counts and change receipts. - Kept quoted prose goal destinations on model-reported completion; inferred file proof now requires a path-shaped destination. - Isolated passive footer, change-receipt, and startup branch Git scans from inherited repository-selection environment variables. - Rejected passive Git executables reached through repository-owned directory links while continuing to safe later `PATH` entries. - Prevented single-file goal proof from masking unquoted `Makefile`, `Dockerfile`, or `.gitignore` list items. - Prevented single-file goal proof from overlooking additional extensionless targets extracted by goal action and destination clauses. Equivalent path spellings still share one exact-path verification contract. - Prevented single-file goal proof from masking additional filenames that extend version or Node.js prose. Goal parsing now keeps spaces and trailing punctuation in quoted paths and matches exact Node.js prose case-insensitively. ## [2.1.32] - 2026-09-24 ### Fixed - Restored tok/s on completed worked-for receipts using reported output tokens over observed model-response intervals, including reasoning and mixed-model tasks; incomplete or failed calls omit the rate. - Prevented file-verified goal completion when an objective names another unquoted relative file, such as ``Fix `a.ts` plus b.ts``. - Added release-metadata checks for ordinary npm publication and the GitHub release workflow, including the README's pinned version example. ## [2.1.31] - 2026-09-22 ### Fixed - Made `/handoff` honor Pi context edits by using the canonical session projection when available while retaining compatibility with Pi 0.85 and 0.86. - Omitted worked-for throughput unless the provider explicitly reports zero reasoning tokens. ## [2.1.30] - 2026-09-21 ### Added - Added measured assistant output-token throughput to settled worked-for receipts, excluding first-token latency, tool execution, and gaps between model calls. ### Fixed - Prevented competing stale-settings-lock recovery attempts from removing a new writer's lock and losing settings updates. - Recorded change receipts in repositories using Git's reftable reference backend while still rejecting receipts when `HEAD` moves during a response. - Serialized global `killeros.json` updates across Pi processes so concurrent automatic-compaction and notification changes no longer discard successful writes or fail during Windows file replacement. - Accepted `/handoff` summaries with `## ` lines inside fenced code blocks instead of rejecting the complete summary for an extra section. - Changed the footer's `ctx` percentage to show context remaining, matching `/auto-compact` threshold direction while preserving urgency colors and the `/compact` hint. - Reported `/goal` objectives with unsupported terminal content separately from the 4,000-character limit. ## [2.1.29] - 2026-09-19 ### New Features - Added `/auto-compact [status|on|off|]` to inspect and update the global automatic compaction preference without restarting Pi. ### Fixed - Kept normalized CRLF checkouts clean in passive Git scans while respecting text attributes and binary files without running filters. - Detected same-size tracked-file rewrites even when tools restore the indexed modification time. - Resolved change-receipt repository ownership at the start of every response so nested or replaced repositories cannot reuse a stale monitor. - Kept the 100% automatic-compaction threshold active for later user requests and goal turns without compacting the generated ordinary continuation. - Prevented automatic footer and change-receipt scans from starting clean or process filters, including filters added and removed while a scan is running. ## [2.1.28] - 2026-09-15 ### Added - Appended the selected model ID as a gray `· ` suffix to every TUI activity working message, retained for the full request cycle and falling back to `unknown model` when no usable ID exists. ### Changed - Simplified goal presentation without changing goal behavior: transcript history shows one iconless event row per lifecycle change (`Goal started`, `Goal replaced`, `Goal paused`, `Goal resumed`, `Goal cleared`), progress and blocker outcomes render once through the goal tool result, the footer shows compact `/goal active · 1/20 · 10s` status, the `/goal` panel leads with status then objective then `Pause goal` / `Resume goal` / `Clear goal` actions, and duplicate TUI success notifications are suppressed while RPC confirmations remain. Active-goal labels use muted teal `#6FAEB2` through the packaged theme's extension-label role. - Removed the legacy `✻` marker from version-1 `Worked for …` transcript rows; stored entries are unchanged and remain readable. ### Fixed - Kept resumed blocked goals and goals paused by truncated provider errors readable after reload. - Made goal continuation explicit: each settled turn now needs one accepted `continue`, `complete`, or blocker decision. Missing decisions, repeated continuation reports, unavailable goal tools, and runtime failures pause without scheduling another turn; compaction recovery resumes the same logical turn. - Preserved accepted goal decisions across automatic compaction: a `continue` or blocker audit recorded before compaction now authorizes exactly one next turn instead of being discarded and re-decided. Duplicate compaction and settlement callbacks cannot start a second turn. - Scoped goal pause reasons to the current paused state: resume and manual pause no longer surface an earlier automatic reason, terminal states keep no pause reason, and contradictory persisted states fail closed instead of starting automatic work. ## [2.1.27] - 2026-09-12 ### Added - Added `/codex-fast status` to report whether Codex fast mode is enabled without changing it. ### Changed - Removed `/init` and its `killeros_init_*` tools, prompts, workflow APIs, runtime state, and lifecycle handlers. Upgrading leaves existing `AGENTS.md` and recovery files untouched, and commands from other providers named `/init` pass through KillerOS unhandled. ### Fixed - Restricted automatic startup, footer, and change-receipt Git scans to trusted projects, preventing repository executables and configuration races from launching commands before trust is granted. - Resolved passive Git executable discovery without starting a locator or repository executable. Footer and change-receipt scans now use an absolute Git path outside the inspected repository and report unavailable when none exists. - Closed the filter-configuration race in automatic Git inspection. Footer and change-receipt scans now run Git without `PATH` resolution, re-check effective filters after status, and skip results the scan cannot produce without an extension process or remote fetch. Change receipts no longer fetch missing objects from partial-clone remotes. - Stopped attaching single-file verification to goals that name several files. Multi-file goals now complete through the model-reported path. - Shared one passive Git status policy between footer telemetry and change receipts. Both scans now disable filesystem monitors and clean/process filters, and skip status when filter discovery is unavailable or unsafe. - Recorded focused Node test runs in response receipts without persisting their test paths. - Kept passive footer Git status from running configured filters, bounded loose and packed receipt blobs, and stopped stale `/handoff` summaries from replacing sessions with new work. ## [2.1.26] - 2026-09-08 ### Fixed - Restored Pi lifecycle loading, blocked footer Git status from invoking configured filesystem monitors, and kept replaced `/init` guidance at a disclosed recovery path so late writes remain recoverable. - Preserved Unicode blocker evidence when restoring goals, rejected cancelled goal updates before completion is saved, and read untracked symlink destinations instead of their targets in change receipts. - Kept `/init` isolated from proactive compaction, refreshed Git filter safeguards for each receipt scan, and preserved compaction recovery after cancelled session replacements. ## [2.1.25] - 2026-09-06 ### Changed - Replaced the boxed startup card with a three-row masthead: coral fade mark, versions, model and reasoning level, directory and branch, and an italic tip. - Swapped the working indicator to the 10-frame Braille orbit at 80 ms per frame. - Restored the leading `❯` prompt marker in white in the chat editor. - Rendered footer model names and the `fast` badge in non-bold white. - Showed the current Pi version beside the KillerOS version in the startup header. - Removed the `/variants` reasoning-level command in favor of Pi's native `/thinking` selector. ### Fixed - Left-aligned settled `✓ Done` receipt lines so every row shares the assistant text edge. ## [2.1.24] - 2026-09-05 ### Added - Appended the settled model display name to version 4 worked-for receipts for single-model TUI runs. ### Changed - Rendered settled `Done` receipts without the `✓` marker, keeping `■ Stopped`, `× Failed`, and version 1 history unchanged. - Raised the locked Pi development packages and minimum supported Pi peer version to 0.85.0, including `@earendil-works/pi-server`. ## [2.1.23] - 2026-09-04 ### Changed - Simplified `/goal` to five forms with proof-by-prose and silent file proof, removing configured completion checks. ### Fixed - Kept the automatic 20-turn goal pause silent as documented. - Stripped sentence punctuation from unquoted inferred goal paths and picked token units after rounding so 999.6 shows as 1k and 999999 as 1M. - Increased change-receipt Git timeouts to five seconds and stopped timeout failures from showing warning notifications. ## [2.1.22] - 2026-09-03 ### Added - Added named goal completion checks, per-goal turn limits, and branch-aware `/goal history`. - Added per-response TUI receipts for net Git changes and recognized verification results. ### Changed - Defaulted new goals to 20 turns, added safe `/goal checks` discovery, preserved blocker evidence in history, and separated pure goal parsing and history formatting. - Refreshed footer Git telemetry from throttled filesystem changes instead of every completed turn, while retaining branch and 30-second fallback scans. ### Fixed - Prevented Linux CI test workers from waiting indefinitely on extension-owned handles after their tests finish. - Made change receipts use a final repository scan, disable current Git filters, report line-ending-only edits, and recheck file goals after completion commands. - Released automatic-compaction request state when Pi rejects an ordinary continuation before accepting its hidden message. - Resumed ordinary tasks exactly once after automatic compaction and interrupted-turn settlement, keeping the hidden continuation pending until Pi accepts it. - Allowed Git footer scans up to five seconds, contained rejected refreshes, and kept the last successful file-change status after transient failures. - Recorded only exact check commands in response receipts, replaced verification claims with observed-check copy, and reserved `/goal` command words so malformed controls cannot start objectives. - Rejected unsafe persisted goal counters, contained file-verification inference errors, and prevented stale completion checks from completing a newly restored goal. - Kept lifecycle hooks stable for corrupt payload serialization, `NaN` direct timeouts, abort races, stream errors, and synchronous process completion without tightening custom process adapter contracts. ## [2.0.22] - 2026-08-30 ### Changed - Replaced the footer's changed-file total with a colored modified, added, and deleted breakdown. ### Fixed - Preserved the existing `createGitStatusRefresh` changed-file count callback contract. - Rejected linked `AGENTS.local.md` files before reading personal instructions. - Confirmed Windows hook process-tree cleanup before settling cancellations and timeouts, even when `taskkill` is absent from `PATH`. ## [2.0.21] - 2026-08-29 ### Changed - Bounded goal verification and Pi compatibility, reduced Git status polling, reserved handoff context, and separated goal state and question UI logic. - Blocked moderate dependency advisories in CI and updated TypeBox within the supported 1.x line. - Preserved seconds in footer and goal elapsed times after one minute. - Added a muted top border to the prompt editor. - Colored the footer workspace path `#F0F89A`. - Added a live changed-file count beside the Git branch when the worktree is dirty. - Synced `dev` back to successful `main` releases after publishing. ### Fixed - Kept likely secrets out of `/init`, restricted personal-instruction imports to Pi's agent directory, and replaced injectable handoff framing with validated JSON. - Hardened releases against stale CI runs, mismatched existing npm artifacts, and tag conflicts discovered after publication. ## [2.0.20] - 2026-08-25 ### Changed - Added a typescript-eslint type-checked lint gate (`npm run lint`) alongside `tsc --noEmit`, and cleaned up the dead imports and untyped boundaries it surfaced. ### Fixed - Treated Pi's exact `Nothing to compact (session too small)` rejection as an expected automatic-compaction skip: no failure notification, silent retry on the next eligible turn, and active goals resume through a dedicated skip recovery instead of pausing for `/goal resume`. - Made `/handoff` resilient to an unreadable `killeros.json`: explicit `KillerosOptions` budgets bypass the file, while other summaries fall back to the default budget with a visible warning. - Named `/handoff` output truncation instead of reporting "did not finish", raised the default summary budget to 8192 tokens for reasoning models, and made the budget configurable through `KillerosOptions` or the `killeros.json` `handoffMaxTokens` key. ## [2.0.19] - 2026-08-24 ### Changed - Hardened JSON and caught-error boundaries, made goal and `/init` target states constructive, added exhaustive outcome handling, and replaced unsafe test doubles with checked adapters. - Deprecated positional `executeHook` arguments in favor of object options; the compatibility adapter will be removed in the next major release. ### Fixed - Paused active goals during automatic compaction and resumed the exact paused revision once after compaction and turn settlement succeed. - Restored active goals saved by v2.0.18 shutdown checkpoints that omitted their stopped clock timestamp. ## [2.0.18] - 2026-08-24 ### Added - Added a real Pi SDK lifecycle test for package activation, shutdown-before-reload, fresh registration, and stale-context rejection. ### Changed - Raised the locked Pi development packages and minimum supported Pi peer version to 0.84.3. - Made Pi lifecycle compatibility coverage install the generated npm tarball offline before activation and reload. ### Fixed - Preserved provider-managed OAuth routing during `/handoff`, fixing GitHub Copilot `421 Misdirected Request` failures. - Repaired incompatible process-global `/codex-fast` state during extension updates while preserving a valid saved enabled flag. - Stopped lifecycle-hook failures from echoing configured shell commands, which could expose inline credentials in Pi diagnostics. - Kept lifecycle-hook configuration paths terminal-safe and single-line in warnings. - Limited trusted lifecycle-hook configuration to a 64 KiB regular, non-linked file in the project's real `.pi` directory and verified the opened file identity before parsing it. - Sanitized dynamic slash-command descriptions and omitted unsafe command names from KillerOS autocomplete. - Rejected explicit file goals when their starting filesystem baseline cannot be inspected instead of treating every error as a missing file. - Kept custom model and provider labels single-line and terminal-safe in the shell header and footer. - Sanitized model-reported `/init` policy conflicts before returning, storing, or notifying with them. - Kept session-storage failure details terminal-safe when an explicit goal pause falls back to in-memory state. - Stripped terminal commands and unsafe controls from saved goal objectives before clear confirmations. - Kept rejected `/variants` arguments terminal-safe and single-line in error notifications. - Kept provider and model identifiers terminal-safe and single-line throughout `/variants`. - Flushed partial UTF-8 lifecycle-hook output on process close instead of silently dropping final diagnostic bytes. - Contained synchronous lifecycle-hook process-start failures inside normal hook failure handling. - Kept header and footer paths single-line and terminal-safe for unusual cwd or home-directory names. - Sanitized manual-compaction abort diagnostics before saving recovery-eligible goal state. - Stripped terminal commands and unsafe controls from saved goal text before showing status panels or notifications. - Sanitized provider and storage diagnostics before persisting or announcing an automatically paused goal. - Routed handoff generation and session-replacement failures through the shared terminal-safe error reporter. - Stripped terminal commands and unsafe control bytes from caught errors before showing KillerOS failure notifications. - Stripped terminal commands and control bytes from cwd and session names before emitting the KillerOS terminal title. - Removed filesystem source paths from personal-instruction prompt wrappers so unusual project paths cannot alter prompt structure. - Stripped terminal commands and unsafe control bytes from lifecycle hook failure notifications and tool block reasons. ## [2.0.17] - 2026-08-23 ### Added - Added per-task token usage to settled TUI receipts for ordinary requests and individual goal turns. ### Changed - Limited push CI to `main` and `dev`; feature branches run through pull request CI without duplicate push runs. - Removed obsolete Pi tool API casts, shared caught-error formatting, and expanded the non-repeating startup tip and editor suggestion banks. - Clarified that the README's pinned Git tag is an example rather than the current package version. ### Fixed - Limited retired-feature repository checks to tracked and non-ignored files so ignored private notes cannot fail the suite. ## [2.0.16] - 2026-08-23 ### Fixed - Kept `/handoff` input inside a cancellable TUI loader so buffered editor text cannot cross the session boundary. - Prevented a cancelled handoff from starting provider completion when authentication resolves late. - Made repository contract tests validate README facts without depending on discarded prose. ## [2.0.15] - 2026-08-23 ### New Features - Added `/handoff [focus]` for fresh linked sessions with visible continuation context. ### Fixed - Compared pre-existing goal deliverables by content instead of file size and modification time. - Made `/init` evidence directory listing follow case-insensitive Windows path semantics. - Kept the interactive question component within a zero-row terminal height. ## [2.0.14] - 2026-08-22 ### Fixed - Prevented direct tag pushes from publishing commits that have not passed CI on `main`. - Kept oversized hook payloads valid JSON and marked their bounded preview as truncated. - Stripped terminal escape sequences and unsafe controls from model-controlled question and goal text. - Aligned hook timeout validation and execution on the documented five-minute maximum. - Required file-backed goals to create or change their deliverable after the goal starts, including after session restore. - Removed a CI test dependency on an intentionally untracked internal document. ## [2.0.13] - 2026-08-21 ### Added - Added the process-local bare `/codex-fast` toggle for Codex priority requests, with a bold inline `Fast` footer indicator while an active Codex model uses it. ### Changed - Converted all tracked test suites from JavaScript to strict TypeScript while keeping Node's built-in test runner. ## [2.0.12] - 2026-08-18 ### Fixed - Resumed active goals exactly once after Pi reports automatic compaction complete. ## [2.0.11] - 2026-08-17 ### Changed - Removed the decision-gated workflow subsystem, its skill-specific policy, public extension interface, and YAML dependency. Skills now remain instruction-only. ### Fixed - Made automated npm publication and GitHub release recovery idempotent, aligned the documented and tested Pi floor, and made machine-identifier casing locale-independent. - Extended strict type checking to release scripts and typed test suites, while correctly identifying JavaScript-only suites as `.js`. ## [2.0.10] - 2026-08-16 ### New Features - Added proactive turn-boundary compaction with Pi-owned settings and safe continuation for ordinary prompts and active goals. - Added reusable multi-activation decision-gated workflow registrations while preserving exact-match behavior. ## [2.0.9] - 2026-08-15 ### Added - Highlighted exact, currently registered slash commands in the TUI editor with the theme's shared command-blue link role while preserving autocomplete boundaries and ANSI cursor styling. ## [2.0.8] - 2026-08-15 ### Added - Added a reusable, opt-in pre-turn gate for explicitly activated decision-gated workflows. It opens the shared structured question UI before skill expansion, keeps the selected policy active, blocks unknown and disallowed tools, and clears safely across lifecycle boundaries. - Added a disposable decision-gated workflow fixture and focused coverage for activation ordering, pending safety, policy allowlists, lifecycle cleanup, adapter reuse, and Pi 0.84.2 compatibility. ### Changed - Removed KillerOS's always-on concise response policy and provider-specific concise defaults; Pi now owns response-style guidance. - Raised the locked direct Pi development packages to 0.84.2 while keeping the peer dependency floor at 0.84.1. ## [2.0.7] - 2026-08-13 ### Changed - Raised the supported and locked Pi baseline from 0.82.1 to the current matched 0.84.1 AI, coding-agent, and TUI packages. - Added a compact two-deck footer beneath the prompt and removed the work-trail widget. - Replaced the framed prompt and shuffled activity verbs with a focus-aware single-arrow editor and event-derived working copy. - Made settled timing entries report `Done`, `Stopped`, or `Failed` while keeping existing `Worked for` history readable. ### Fixed - Separated response output from the prompt editor while keeping footer telemetry close beneath a quiet muted divider. - Kept `/variants` within the active terminal height, preserved the focused reasoning level across resizes, and initially focused the current level. - Rendered `/variants` controls from the same Pi keybinding manager that handles input, including installations with separate package module instances. - Rendered active, paused, and blocked `/goal` status text consistently in the footer's far-right slot. - Kept the private goal-update tool inactive outside active `/goal` runs and rendered its real execution errors instead of malformed blocker-audit fields. - Verified exact persisted paths for clearly declared file-deliverable goals before completion, while preserving model-reported completion for general objectives. - Accepted explicit `1`/`1` bounds for single-select questions and applied the same bounds validation before rendering and execution. - Prevented reload and branch navigation from preserving or reconstructing stale manual-compaction recovery eligibility; only Pi's live event in the current session can resume the interrupted goal safely. - Restricted goal deliverable verification to explicit destination phrases so source and reference paths cannot be reported as completed output. - Kept saved goals fully inactive in print and JSON modes, including the private update tool and shutdown checkpoints. - Rejected concurrent `/init` starts during preflight, cancelled pending preflight work on shutdown, and settled active `/init` command handlers when their session closes. ## [2.0.6] - 2026-08-11 ### Added - Added a durable `✻ Worked for …` transcript line below each settled TUI response, including stopped and failed runs. - Added optional multi-select to the `question` tool with bounded checked options, one additive custom answer, a dedicated multi-word filter editor, and compact expandable results while preserving single-select defaults. ### Changed - Automated GitHub releases after successful `main` CI version bumps, with package, lockfile, changelog, tag, and verified-commit checks plus a manual tag recovery path. ### Fixed - Entered automatic `/goal` continuations into durable goal-turn state before dispatch so turn numbers advance and blocker audits work on Pi custom-message turns. ## [2.0.5] - 2026-08-11 ### Added - Added shuffled session-stable suggestions to the empty three-line prompt editor. ### Fixed - Preserved complete UTF-8 characters in truncated `/init` evidence and chunked lifecycle-hook output, and kept filesystem-root paths visible in notification titles. - Kept the startup-tip shuffle deck across session rebinds so every tip appears before the bank repeats. - Rejected matchers on `agent_settled` lifecycle hooks instead of silently bypassing their tool-name guard. - Made the goal update status schema compatible with Google models while preserving strict completion and blocking values. - Kept multiline custom-answer drafts within tiny terminal row limits by rendering a clipped single-line preview. - Preserved existing spaces and tabs after the cursor when applying slash-command autocomplete. - Made `/init` abort safely when Git ignore inspection fails or returns untrusted output, preventing ignored files from entering model evidence. - Wrapped long interactive questions to the current terminal width while keeping the question UI within the terminal height. - Made `/goal pause` and `/goal clear` save terminal state before immediately stopping active goal work. - Kept failed goal edits and replacements visible and fail-closed without restarting a stale objective. - Required one durable blocker key on three consecutive goal turns before a goal can be marked blocked. ## [2.0.4] - 2026-08-10 ### Changed - Rebuilt `/init` around a packaged four-section guideline-synthesis workflow that preserves compatible root policy without requiring an external skill. - Removed live blue slash-command coloring while retaining slash autocomplete, the framed multiline editor, and Shift+Enter. ### Fixed - Prevented `/init` from reading Git-ignored files, known secrets, private keys, linked or non-regular files, other guidance, dependencies, and files outside its frozen evidence map. - Protected root `AGENTS.md` from concurrent replacement and reported incompatible policy conflicts without writing. - Made `/clear` confirm before aborting active work, wait for settlement, and then start the new session. - Preserved explicit Responses API verbosity and reasoning-summary settings while applying concise defaults only to absent fields. - Cancelled lifecycle hook process trees with bounded cleanup when Pi aborts the parent request. - Kept `/init` middleware from freezing shared tool input and preserved custom editors installed by other extensions. - Removed private Pi editor-state access in favor of public rendering contracts. ## [2.0.3] - 2026-08-09 ### Added - Added an opt-in global completion sound with `/notification` and an enabled-state Nerd Font bell in the terminal tab title. - Moved active goal status to the footer's right side in warning yellow, replacing the path with `/goal is active (...)` and exact seconds. ### Changed - Returned compaction timing, summary generation, manual instructions, retries, file tracking, and overflow recovery to Pi's public lifecycle. - Continued active goals only after Pi reaches its settled boundary and preserved `/goal` as the sole durable objective and status owner. ### Fixed - Added fail-closed, revision-bound recovery after successful manual compaction, including reload and branch navigation recovery without reviving stale or explicitly paused goals. - Rendered question help from the effective selector keybindings across supported Pi versions. ## [2.0.2] - 2026-08-08 ### Changed - Replaced the static activity Spark with a 12-frame orange glyph loop at 120 ms per frame. - Styled activity verbs orange and added the gray `(esc to interrupt · thinking)` status with bold `esc`. ## [2.0.1] - 2026-08-08 ### Added - Added a height-bounded question viewport with configured Pi controls, progress labels, and compact expandable history. - Added an interactive `/goal` status and actions panel in TUI mode. - Added live command-blue highlighting for recognized slash command prefixes in the prompt editor. ### Changed - Made reasoning colors contrast-safe, moved commands and links to the themed command-blue role, and changed activity to a static Spark with shuffled 2.5-second verb updates. - Reserved footer goal status for active, paused, and blocked work; completed goals remain in history and `/goal` status. - Made startup Git lookup asynchronous, cached footer session cost between content changes, and aligned the browser visual reference with v2.0.1 runtime behavior. ## [2.0.0] - 2026-08-07 ### Changed - Focused the package, runtime, tests, and documentation on KillerOS's current TUI, repository initialization, long-running goals, reasoning controls, interactive questions, command aliases, and concise-response guidance. ## [1.5.8] - 2026-08-07 ### Fixed - Bounded question filter input to 4,000 characters and 16,000 UTF-8 bytes, with a clear rejection notice for excess input. - Reported goal start, resume, and edit success only after continuation dispatch succeeded, and paused the goal when dispatch failed. ## [1.5.5] - 2026-08-05 ### Changed - Replaced default deterministic context compaction with model-backed summaries at 40% remaining context, preserved manual focus prompts, and disclosed deterministic fallback after model retries fail. ### Fixed - Overrode vulnerable transitive `brace-expansion` and `undici` versions with patched releases in the development and CI install tree. ## [1.5.4] - 2026-08-04 ### Fixed - Added guarded automatic context compaction at 30% remaining, with structured summaries and goal continuation after the compaction is saved. ## [1.5.3] - 2026-08-03 ### Fixed - Made `/exit` abort an active run before requesting Pi's graceful shutdown. ## [1.5.2] - 2026-08-03 ### Changed - Hardened always-on concise guidance around low-friction action, visible multi-turn state, evidence-backed outcomes, material ambiguity, diagnostic resets, and explicit safety and correctness precedence. ## [1.5.1] - 2026-08-03 ### Changed - Added a fixed pragmatic response style, low GPT-5 Responses API verbosity, and concise reasoning summaries without changing reasoning effort. ### Fixed - Scoped native concise settings to supported Responses APIs while leaving completion and unrelated provider payloads unchanged. ## [1.5.0] - 2026-08-03 ### Changed - Split the main extension into feature modules under `killeros/` while keeping `Killeros.ts` as the stable entry point. ## [1.4.9] - 2026-08-02 ### Changed - Scoped atomic `/init` reads and writes. ## [1.4.1] - 2026-08-01 ### Changed - Hardened CI with Node floor/LTS checks, locked-dependency auditing, dependency review, package-content validation, and CodeQL analysis. ## [1.3.0] - 2026-07-31 ### New Features - Claude Code-style `/init` that builds a bounded repository snapshot and generates a concise root `AGENTS.md` with one controlled write. - Codex-style `/goal` with durable branch-scoped state, automatic one-turn continuation, pause/resume/edit/clear controls, and explicit model-reported completion or blocking. - Trusted `AGENTS.local.md` personal guidance and project lifecycle hooks for tool-call, tool-result, and settled-agent events. ### Added - Focused coverage for goal transitions, recovery paths, branch restoration, mode gating, footer cutdowns, and repository initialization safeguards. ### Changed - Extended the responsive footer with goal activity and terminal states while preserving context pressure at narrow widths. - Hardened `/init` and `/goal` failure handling so interrupted work, provider errors, failed writes, and failed continuation starts stop safely. ## [1.2.0] - 2026-07-30 ### New Features - A 52-column Compact startup card with inline version, polished model/provider identity, reasoning level, `/model`, working directory, and conditional Git branch. - A responsive footer that preserves model and context while progressively removing lower-priority telemetry. - Packaged KillerOS theme with coral accents and one neutral tool-call surface across pending, success, and error states. ### Added - A shuffled startup-tip deck that keeps one tip stable per session and exhausts the bank before repeating. - Single-glyph Spark activity indicator with a restrained color pulse. - Claude-adjacent activity word bank that advances between agent runs. - Static `└ Thinking…` label for hidden reasoning blocks. - Responsive header and footer tests across narrow terminal widths. ### Changed - Replaced the animated startup illustration and capability inventory with the Compact startup card and one external tip. - Standardized product branding on mixed-case `KillerOS` and the neutral lockup used in the v1.2.0 release. - Made theme neutrals achromatic while preserving the coral accent. - Replaced the footer progress bar with direct `percent left (tokens)` context telemetry and a critical `/compact` prompt.