CHANGELOG.md

# Changelog

All notable changes to Corbits Code are documented here.

Format loosely follows [Keep a Changelog](https://keepachangelog.com/). Versions
are `package.json` / `vX.Y.Z` git tags cut by `scripts/release.sh`.

**Release sections are generated, not hand-written.** At cut time
`scripts/release.sh` asks GitHub for the notes covering every pull request
merged since the previous tag — each one credited to its author — writes that
in as `## [X.Y.Z] - YYYY-MM-DD`, and uses the same text as the GitHub release
body. Nothing to write, and nothing that can drift from what actually merged.

`/changelog` and the shipped binary read this file, so it still ships with the
release and still works offline. Do not maintain parallel copies under `docs/`
or `scripts/notes/`.

A section written by hand before the cut wins over the generated one, for a
release that deserves narration. Passing `--notes <file>` overrides both for
the GitHub body. Sections below this line predate generation and were written
by hand.

## [0.3.47] - 2026-10-26

### What's Changed
* chore(deps): pin xai-provider to npm 0.1.4 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1570


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.46...v0.3.47

## [0.3.46] - 2026-10-25

### What's Changed
* chore(build): ignore leftover bun compile artifacts by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1565
* test(exec): wait for the active-run handle in the signal fixture by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1563
* fix(tui): keep every approval choice on screen under a tall body by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1566
* fix(mcp): drop placeholder arguments the tool schema would reject by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1568
* test(e2e): cover a denied worker write approved once and retried by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1559
* test(e2e): cover approval outcomes across an agent reload by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1561
* fix(permission): ask once when approving a worker's frozen call by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1567
* fix(subagent): deliver send_input plainly when no escalation is pending by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1562


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.45...v0.3.46

## [0.3.45] - 2026-10-24

### What's Changed
* fix(provider): recover parallel call arguments on done for all responses by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1556
* fix(agent): match muse-wonder models and scope muse rules to leaves by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1557
* fix(prompts): forbid tool-less status announcements in dispatch card by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1558
* fix(tui): seed allowIdleWithFleet false at session startup by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1560
* fix(provider): wire reasoningEffort through OpenCode Go and Zen responses by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1555
* test: make settings laziness and approval migration tests deterministic by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1551


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.44...v0.3.45

## [0.3.44] - 2026-10-23

### What's Changed
* fix(prompts): integrate cumulative operator context in dispatch card by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1552
* fix(prompts): synthesize requirements in planner card by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1553


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.43...v0.3.44

## [0.3.43] - 2026-10-20

### What's Changed
* perf(boot): overlap independent startup file reads by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1535
* fix(session): commit an in-place evidence index append by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1536
* perf(boot): defer schema and isogit construction until first use by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1537
* perf(agent): serialize each tool schema once per drift by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1538
* test(tui): expose native render stats on the harness by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1541
* perf(plugins): skip secret scrub passes without a secret shape by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1539
* perf(tui): stop rejoining streaming markdown on every retext by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1540
* chore(deps): bump @corbits package pins by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1548
* fix(agent): keep gpt shell arguments through dispatch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1542
* fix(permission): auto-allow read-only control-plane tools by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1545
* fix(tui): reject a session-queue op that waits on itself by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1544
* chore(vendor): re-sync the Interchange set and @intx deps to 0.5.0 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1547
* feat(plugins): authorize installed tool calls before dispatch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1543
* feat(provider): add meta device oauth and api key by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1546
* fix(tui): stop a finished session op from rejecting the next one by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1549


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.42...v0.3.43

## [0.3.42] - 2026-10-20

### What's Changed
* feat(session): record the compaction trigger on fold records by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1525
* fix(tui): stop the idle git branch poll by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1506
* fix(session): stop per-turn access probes on the base log by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1527
* ci(session): gate session-store fs.promises counts against a baseline by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1509
* perf(session): memoize project root lookups by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1502
* perf(session): stop re-hashing unchanged segments on each commit by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1511
* fix(session): commit same-second and in-place session edits by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1528
* fix(permission): resolve existing paths like realpathSync by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1532
* fix(logging): rotate the shared log without dropping the other writer by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1533
* test(session): stop pinning the perf-baseline CI comment by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1531


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.41...v0.3.42

## [0.3.41] - 2026-10-19

### What's Changed
* fix(tui): cap mcp connect so a hung dial cannot block resume by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1507
* perf(types): import runtime values from runtime-core by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1505
* perf(permission): defer the grok responses import off reactor boot by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1516
* fix(agent): compact before the completion budget overflows the window by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1517
* fix(tui): fire composed option chords on every advertised surface by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1518
* fix(permission): key worker grants on the dispatched call by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1521
* fix(session): release a settled approval overlay before delivering by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1520
* fix(tui): deliver approvals for parked calls in queue-drained turns by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1519


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.40...v0.3.41

## [0.3.40] - 2026-10-17

### What's Changed
* fix(inference): tolerate null role and tool_calls deltas by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1499


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.39...v0.3.40

## [0.3.39] - 2026-10-17

### What's Changed
* docs(changelog): regenerate the 0.3.38 section from merged pulls by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1419
* fix(compaction): notify and stop when compaction fails by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1446
* fix(authz): discard typed approvals from non-local ingress by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1422
* feat(shell): opt-in os sandboxing via sandbox-runtime by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1428
* chore(deps): drop unused ssri catalog pin by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1447
* docs(tui): record opentui 0.6.4 compatibility spike findings by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1448
* chore(deps): bump @types/bun, oxlint, oxfmt; float hono + drizzle by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1421
* fix(permissions): add typed parent approval by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1440
* test: share signal fixtures and stringify hook signal codes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1445
* fix(authz): redact capability ids and scrub persisted approval args by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1426
* fix(session): surface swallowed store/resume errors instead of silent defaults by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1436
* chore(vendor): re-sync interchange vendor trees to 0.4.0, re-carry patches by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1424
* perf(git): batch context-store index writes on isomorphic-git 1.44.2 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1423
* fix(tui): bump @opentui/core packages to 0.6.4 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1442
* feat(tui): report session state and read clipboard images by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1449
* feat(tui): route runtime notices through the console overlay by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1450
* refactor(tools): derive tool inputSchemas from arktype types by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1425
* refactor(tools): share arg guards, bounded reads, and process spawn by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1444
* perf(session): cut per-turn store walks, re-parses and stringifies by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1434
* chore(gate): drive the dead-export guard with knip, drop ts-prune by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1427
* chore(deps): bump provider pins, remove unused ws devDep by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1429
* chore(vendor): adopt interchange 4cc6972 drift in vendored trees by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1431
* fix(mcp): bump @modelcontextprotocol/sdk to 1.32.x by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1443
* perf(session): coalesce per-turn persistence to ~2 disk-touching writes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1437
* refactor(logging): collapse double-log storms, fix levels, correlate ids by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1430
* chore: delete five verified-dead artifacts by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1432
* refactor(config): fold duplicate flag spellings into single parse paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1438
* refactor(auth): extract shared provider auth helpers (C1-C7) by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1433
* refactor(provider): share error-body reading, adapter mechanics, protocol sets by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1435
* chore: keep the Corbits Triage policy in .corbits-triage.yaml by @corbits-triage[bot] in https://github.com/corbitsdev/corbits-code/pull/1451
* fix(agent): fold gpt tool names for workers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1452
* fix(dispatch): advertise approve_worker_call on the parent surface by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1454
* refactor(agents): one toolset source, one nudge runtime, one lifecycle projection by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1439
* refactor(prompts): extract shared card fragments, one discipline authority by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1441
* refactor(mcp): drop result projection and duplicate tool-call paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1455
* fix(tui): hide the overlay select marker and scroll indicator by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1456
* refactor(tui): keep markdown stream settling beside native render by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1457
* refactor(mcp): drop cross-process mcp auth file locking by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1458
* docs(tui): decline a global keymap and inline mode by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1459
* feat(tui): scroll the transcript and overlay through ScrollBox by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1461
* feat(tui): adopt Code onHighlight and detectLinks by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1464
* refactor(mcp): let the SDK finish HTTP auth and SSE reconnect by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1462
* fix(session): commit folds when handoff carries verify overflow by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1463
* fix(tui): read kill spans from the edit buffer before native deletes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1465
* refactor(tui): read zone rects from Yoga instead of stacking them by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1466
* refactor(tui): rename mark and ramp glyph modules by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1468
* perf(tui): drive motion with Timeline and drop the sticky poll by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1467
* docs(tui): drop the removed shell-output poll by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1469
* feat(permissions): replace global grants with a process file by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1470
* feat(evals): wire @corbits/evals and add dispatch-routing eval by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1411
* feat(tui): route shell shortcuts through opentui keymap by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1460
* feat(session): gate saveCrashState on crashed state by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1478
* docs(config): correct topP/temperature mutual-exclusion comment by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1473
* chore(audit): keep only the pricing refresh log by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1472
* chore(knip): scan eval entry files by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1479
* docs(permissions): clarify project-layer scope and log canonical grant-file path by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1474
* fix(provider): keep a positive Codex retry floor by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1480
* fix(mcp): pin streamable HTTP redirects to same-origin by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1481
* fix(plugins): widen secret-scrub to bare-KEY and credentialed URLs by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1476
* fix(mcp): fail in-flight calls when resume exhaustion redials by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1477
* fix(config): restore --no-workflow as warn-and-ignore shim by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1475
* fix(secret-scrub): redact bare-KEY names in JSON object and text paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1471
* refactor(plugins): drop the duplicate path-escape throw by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1483
* refactor(session): drop the run.json payload skip by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1482
* refactor(session): drop the run.json snapshot debounce by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1484
* refactor: delete unused renderer, event log, and prompt checkpoint by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1488
* docs: drop references to the deleted renderer by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1489
* test: drop hollow prompt and span pins by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1490
* fix(config): recognize subcommands after leading global flags by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1487
* fix(session): stop the base store warning on every session load by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1491
* fix(tui): defer agent reload until the reactor's message run ends by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1486
* fix(tui): rebuild the agent for every MCP tool-set change by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1494
* fix(session): keep a parked approval in the turn log beside its call by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1495

### New Contributors
* @corbits-triage[bot] made their first contribution in https://github.com/corbitsdev/corbits-code/pull/1451

**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.38...v0.3.39

## [0.3.38] - 2026-10-14

### What's Changed
* fix(subagent): apply the latest wrap's sources on continuation OAuth refresh by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1397
* refactor(session): drop dead compactor config, branch, and aliases by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1398
* refactor(config): drop dead guards and duplicate profile expression by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1399
* refactor(permission): drop dead params and duplicate helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1402
* refactor(session): replace compactorNoOpFloor with a constant by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1401
* refactor(config): extract shared apiKey helper by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1400
* refactor(scripts): dedupe percentile and release helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1403
* refactor(packages): drop no-op export, dedupe helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1404
* refactor(tui): drop dead notice field, dedupe helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1405
* feat(permission): auto-approve web search and fetch in edit mode by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1412
* fix(session): concurrent sessions write disjoint transcripts by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1408
* perf(agent): memoize toolSetDigest per tool set by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1410
* fix(provider): align opencode-go model protocols with zen and upstream by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1409
* fix(session): keep concurrent transcripts on the shared log by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1413
* refactor(session): stop excerpting the same tail turn twice in turnCost by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1407
* feat(session): flag-gated append-only session event log by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1406
* feat(tui): show parked worker questions on the prompt box by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1389
* fix(provider): recover Codex parallel call arguments sent only on done by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1414
* feat(tui): show required operator input at the composer by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1393
* feat(subagent): codify outcome-aware worker escalation policy by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1394
* feat(tui): show accepted-but-unread queued input by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1395
* feat(tui): add Reject and stop to the permission prompt by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1388
* docs(tui): state and pin the bounded ask_director stall policy by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1387
* feat(tui): surface off-tag build identity in version badge by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1390
* feat(subagent): classify terminal subagent failures with typed record by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1391
* feat(subagent): enforce one recovery per failure via spawn_agent by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1392
* fix(subagent): attach the send_input followup reply after an interrupt by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1415
* docs(fleet): document behavior changes that landed undocumented since v0.3.37 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1416
* docs(changelog): narrate the 0.3.38 release changes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1417
* chore(release): corbits 0.3.38 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1418


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.37...v0.3.38

## [0.3.37] - 2026-10-11

### What's Changed
* chore(deps): drop unused @intx/hub-sessions pin by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1338
* refactor(subagent): stop importing tui by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1363
* fix(session): make latest symlink update race-safe by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1324
* feat(tui): pause the queue on ctrl+c instead of resuming the run by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1358
* refactor(comments): trim verbose comments across the codebase by @Gustav-Simonsson in https://github.com/corbitsdev/corbits-code/pull/1360
* docs(agents): point infrastructure at interchange first by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1371
* fix(subagent): read shutdown-with-report lanes as done, not cancelled by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1337


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.36...v0.3.37

## [0.3.35] - 2026-10-06

### What's Changed
* fix(compaction): keep growth latch after under-threshold folds by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1315
* fix(compaction): drop thinking blocks from the live tail by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1320
* feat(dispatch): spawn first with no parallelization cap by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1317
* feat(dispatch): concise default with a touch of personality by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1318
* fix(provider): skip top p when custom setup temperature is set by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1314
* feat(dispatch): add QA Lead director for hands-on product proof by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1319
* fix(compaction): keep thinking on the last live tool-use assistant by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1354


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.34...v0.3.35

## [0.3.34] - 2026-10-03

### What's Changed
* fix(subagent): surface scrubbed xAI worker diagnostics by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1306
* fix(skills): assign substantive workflow work to specialists by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1310
* fix(dispatch): delegate substantive work to specialists by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1311
* fix(provider): normalize cached Chat Completions usage by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1312
* fix(agent): rewrite present schema for Muse Spark by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1305
* feat(provider): let custom providers set sampling and token knobs by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1308
* fix(subagent): shrink worker toolsets and sanitize Grok schemas by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1309
* feat(provider): let custom providers declare reasoning effort levels by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1307


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.33...v0.3.34

## [0.3.33] - 2026-10-03

### What's Changed
* fix(inference): surface Codex nested 400 diagnostics by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1228
* feat(subagent): verify requires_tools pre-spawn with fail-closed preflight by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1224
* fix(permissions): resolve advertised tool aliases in approval snapshots by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1223
* feat(permission): add harness-owned worker grant envelope by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1222
* refactor(tui): use native fenced-code highlighting by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1219
* build(bin): embed sourcemaps in the compiled binary by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1213
* fix(resume): cap history hydrate to the newest retained rows by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1211
* chore(deps): bump OpenTUI packages to 0.5.12 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1209
* CL-8988: refresh OAuth credential before continuation infers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1208
* fix(tui): route leading-slash lines by registered command id by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1205
* CL-9341: fingerprint hidden-shell declines through the canonical coercion by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1204
* fix(permission): deny dot-dot walk-out from directory grants by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1200
* Keep stored session model on resume unless flags override by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1198
* feat(telemetry): emit session_end for exec and surface on cli_start by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1197
* feat(agent): add astra-only tool-evasion residual by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1195
* fix(auth): recover stale credential file locks via PID liveness by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1194
* feat(cli): add --version and -V flags by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1230
* feat(mcp): project Linear write and list results by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1231
* feat(read): diagnose blocked file inspection with a next action by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1232
* fix(subagent): digest mailbox reports instead of pasting them whole by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1233
* CL-8991: grant path trust before importing add-by-path plugin code by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1199
* fix(session): surface compaction summarizer stub fallback by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1235
* fix(compaction): keep standing output-format tokens whole on the spine by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1236
* feat(tools): promote discovered tools only on execute by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1226
* fix(read): treat utf-8 pdf names as text and quote pdftotext by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1238
* fix(mcp): keep empty list envelopes and array structured content by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1239
* feat(compaction): fold to a token-capped tail, not recent turns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1227
* fix(subagent): name mailbox digest blobs for parent fetch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1240
* fix(tools): persist idle promotion prune after fold by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1241
* fix(compaction): keep standing output tokens whole across goal caps by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1242
* fix(subagent): count mailbox spill remaining as omitted body by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1243
* fix(session): defer stub fallback notice until the fold commits by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1244
* fix(compaction): keep operator ellipsis and harvest substring tokens by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1246
* fix(session): defer stub notice until after the completeness gate by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1247
* fix(compaction): strip glued spine sentinel from long standing tokens by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1248
* fix(compaction): strip glued sentinel even when the token ends with dots by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1249
* fix(session): skip handoff record when abort discards a stub by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1250
* fix(session): latch abort across compaction controller reset by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1251
* fix(resume): hydrate only the retained transcript tail by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1256
* fix(resume): cap transcript hydration in rows after fold by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1257
* fix(resume): paint truncated history without faking the log base by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1258
* fix(secret-guard): fail closed on dollar-prefixed secret paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1286
* feat(telemetry): report auth success and MCP connection outcomes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1288
* fix(exec): prompt on stdin TTY even with stdout piped by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1289
* perf(tui): avoid reparsing frozen streaming markdown by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1290
* feat(tui): add automatic light theme selection by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1287
* fix(mcp): keep PKCE verifier in provider memory instead of disk by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1285
* perf(subagent): reuse parent setup across spawns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1291
* test(evals): add director-graded cases on the dir-shop fixture by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1245
* fix(subagent): keep fleet-dry parent mail to a digest plus blob by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1237
* feat(agent): project wire tool names per model family by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1253
* feat(agent): mount apply_patch tool for the gpt family by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1254
* feat(agent): streamline prompts, merge skill search, and consolidate director fleet by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1255
* fix(agent): guard apply_patch with secret-guard and realpath bound by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1259
* refactor(shell): remove the unused background shell collect and waiter API by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1261
* fix(permission): follow dangling symlinks when judging sensitive paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1262
* docs(skills): shorten skill descriptions to one-line labels by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1264
* fix(agent): canonicalize wire tool names across director and tui tracking by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1252
* docs(skills): drop the GaaS translation layer from native-integration by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1265
* refactor(skills): drop opsh, ast-grep, lexicon, git-rebase, and the baked-only skills by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1267
* refactor(skills): rename scribe to docs and trim it by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1268
* feat(skills): add issue and pull-request commands that find or create the artifact by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1269
* feat(skills): require git and default to worktrees in the workflow skills by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1270
* refactor(skills): fold the ship loop and integration rules into implement and review by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1271
* refactor(skills): cut style, philosophy, and typescript to five rules each by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1272
* refactor(skills): trim review to a single classify-to-report flow by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1274
* docs(skills): tidy plan, refactor, interview, and worktree guidance by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1275
* docs: describe the ten-director fleet in ARCHITECTURE and PRODUCT by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1276
* refactor(agent): finish renaming the primary director from skywalker to dispatch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1278
* refactor(tools): shorten web_fetch and web_search descriptions by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1280
* refactor(agent): tighten dispatch spawn and review rules by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1281
* feat(skills): add an interchange skill chain by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1282
* feat(skills): add a corbits skill chain by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1283
* refactor(agent): compare tool names through a single helper by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1292
* fix(subagent): narrow late send_input redirect by terminal status by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1293
* fix(subagent): pass inherited MCP tools through to workers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1296
* feat(providers): remove connected provider from model picker by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1297
* feat(providers): offer reconnect for auth-class inference failures by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1298
* fix(providers): suppress stale reconnect replay by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1300
* fix(providers): use catalog provenance for OAuth removal by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1301
* fix(xai): use provider client header constants by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1299
* fix(agent): put input schemas on tool_search cards by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1302
* fix(agent): load tool_search hits onto the next infer by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1303


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.32...v0.3.33

## [0.3.32] - 2026-09-29

### What's Changed
* fix(exec): show MCP spawn args in trust prompt by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1165
* refactor(shell): share transparent command peeling by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1166
* fix(permissions): auto-allow fleet continuation tools by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1168
* fix(permissions): make yolo override auto mode by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1169
* fix(mcp): surface tool failures and structured content by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1170
* CL-8978: prevent recoverable subagent failures from stalling parent by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1171
* CL-8792: allow-once no longer stalls a second destructive command without re-prompt by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1173
* CL-9006: fix automatic compaction governor so post-compact above-threshold sessions latch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1175
* CL-9007: ship shared summary-plus-small-tail pipeline for automatic and manual compaction by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1177
* CL-8980: resume truncated reads by same path plus offset by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1179
* CL-8905: lock MCP promotion schema fidelity for optional and required arguments by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1181
* CL-9026: stop writing duplicate prompt snapshot when identical to live turns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1178
* CL-9362: resolve restricted-worktree carve-out for agentId-targeted fleet calls by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1184
* CL-8990: fix MCP HTTP auth recovery ignoring abort on callBlocks by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1174
* fix(permissions): restore /yolo off hint for default-source skip warning (CL-9385) by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1185
* CL-9361: quote whitespace args in shared MCP trust prompt helper (TTY + TUI) by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1183
* feat(tools): advertise one posix wire set by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1182
* CL-7802: start gated tool elapsed at grant, not announcement by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1176
* fix(auth): recover from provider credential failures by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1188
* CL-9384: migrate persisted approval stores to purge update_plan keys by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1186
* CL-8979: page large read_file responses through to the end by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1180
* CL-9386: runtime-denylist the active --config path holding skip by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1187
* fix(secret-guard): protect envrc and flaskenv files by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1167
* test(compaction): force a fold so path-offset resume cases compact by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1189
* chore(auth): pin oauth-core to npm 0.2.0 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1190
* chore(deps): pin Codex provider to published npm 0.1.1 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1192
* chore(deps): pin xai-provider to npm 0.1.1 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1191
* chore(deps): pin openai-responses to npm 0.2.1 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1193
* fix(search): fail closed on unbounded workspace-root search_files by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1225
* test: add scripted-inference e2e layer and slim the unit suite by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1221


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.31...v0.3.32

## [0.3.31] - 2026-09-25

### What's Changed
* chore(changelog): drop stale hand-written Unreleased section by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1144
* feat(models): add grok-4.7 model support by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1152
* build(workspaces): add agents, workflows, tools, and skills globs by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1145
* test(models): modernize leftover gpt-4.1 fixtures to gpt-5.6 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1146
* chore(prompt-variance): drop unused assemble and resolve by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1147
* fix(skywalker): spawn one focused task per worker by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1148
* feat(builder): ship a short Corbits implement card by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1149
* fix(intern): restore gaas mechanical intern identity by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1150
* feat(compaction): idle recompress past the provider cache ttl by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1151
* feat(session): fold compaction into a fat handoff file with a thin live spine by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1155
* feat(intern): ship intern as a workspace agent package by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1159
* feat(tui): add /compact command with optional summarizer instructions by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1158
* feat(skywalker): shrink primary prompt to a dispatcher card by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1157
* feat(subagent): attach style and philosophy at worker spawn by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1156
* feat(session): verify compaction spine and record adopted handoffs by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1154
* feat(tui): add /handoff to fold context and start the next turn by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1153
* Continue a headless run on an existing session by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1162
* fix(subagent): wait on idle stall pings instead of inferring by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1160
* Replace idle TTL folds with an opt-in Anthropic cache prompt transform by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1161
* Show suggested slash-command parameters in the popup by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1163


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.30...v0.3.31

## [0.3.30] - 2026-09-21

### What's Changed
* fix(codex): serialize shared-credential OAuth token refreshes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1139
* refactor(greybeard): restore OG tone and mandatory skill preload by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1121
* feat(tui): print resume command on session exit by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1134
* fix(inference): treat Codex 404s as expired credentials by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1138
* feat(prompts): promptResidual with grok tool budget, appended once by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1133
* feat(agent): merge grok ceremony lines into the one residual by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1132
* feat(agents): claude xml task_guidance prompt residual by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1137
* feat(prompt): add GPT narrate-before-tools family residual by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1135
* feat(prompt-variance): extract family prompt variance as a versioned package by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1136
* fix(tui): handle composed Option-D in model picker by @bwachman in https://github.com/corbitsdev/corbits-code/pull/1141
* test(prompts): modernize stale gpt-4.1 fixtures to gpt-5.6 by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1142

### New Contributors
* @bwachman made their first contribution in https://github.com/corbitsdev/corbits-code/pull/1141

**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.29...v0.3.30

## [0.3.29] - 2026-09-18

### What's Changed
* refactor(zen): inline zenProtocolForModel pass-through alias by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1111
* refactor(tools-shell): dedupe shared web-fetch, convert, signal, and timer helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1112
* refactor(auth-provider): merge duplicated helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1113
* refactor(tui): dedupe renderer tests, prompt builders, validators, labels, links, truncator by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1115
* refactor(plugins-mcp): dedupe collectors, guards, and register loops by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1116
* refactor(agent-loop): dedup director tests, coordinator guard, error coercion by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1117
* refactor(inference-cost): dedupe twin helpers, traversals, and fixtures by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1118
* refactor: dedup crosscutting helpers across perf/telemetry/crash lanes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1114
* refactor(tests): consolidate duplicated test/infra helpers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1119
* fix(provider): grok-4.5/4.6 heuristic window 256k to 500k by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1125
* feat(agent): shared worker contract, drop harness doctrine from workers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1126
* refactor(gaasbot): restore OG voice and mandatory preload by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1122
* refactor(critic): restore OG evidence rules and mandatory preload by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1123
* feat(directors): draper router + emil narrowed, DESIGN.md contract by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1127
* fix(tui): abort-aware compact lifecycle, visible compaction state by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1128
* fix(tui): abort compact on quit, reset lifecycle on failed rebuild by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1129
* fix(tui): quit-abort ordering, phantom folds, reset generation guard by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1130


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.28...v0.3.29

## [0.3.28] - 2026-09-17

### What's Changed
* docs(prompts): keep AGENTS.md and core schemas on grok prefixes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1094
* fix(permission): authorize aliased tool names and grant trusted plugin reads by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1103
* fix(shell): bound collect wait and fail closed without collect by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1100
* Abort stall after post-tool and post-compact silence by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1095
* fix(tui): auto-abandon resume overlay on reactor approval timeout by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1099
* fix(agent): put tool_search promotions on the next infer by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1098
* fix(tui): wait for occupancy send to settle before continuing by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1101
* fix(director): honor idle-with-fleet on the workflow idle rail by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1093
* fix(tui): keep occupancy and idle-with-fleet on live lanes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1097
* fix(tui): re-issue compact continuation after a superseded hop by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1102
* fix(exec): time out hung MCP connect before first inference by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1096
* fix(tui): bound the primary turn so a silent stall can't freeze it by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1080
* fix(ci): format stall-bound and compact-continue tests by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1104
* fix(agent): point doom-loop warning at an on-wire switch first by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1107
* fix(tui): keep leftover same-name collect under the stall budget by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1108
* fix(subagent): collect terminal wait results even when the wait yields by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1110
* fix(tui): end the silent wake turn when the ask deadline settles it by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1106
* fix(inference): collapse trivial shell churn in doom-loop signature by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1109
* fix(tui): flush mailbox mail before ask wake on settle and gate close by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1105


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.27...v0.3.28

## [0.3.27] - 2026-09-16

### What's Changed
* fix(director): harden coordinator seam with fallback and validation by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1050
* chore(deadcode): purge dead exports and guard the count by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1034
* refactor(auth): trim dead usage formatters and demo by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1031
* feat(evals): add completion-rate baseline harness by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1032
* refactor(director): resolve provider and fleet state without host closures by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1044
* refactor(director): surface task and tool changes as reactor events by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1042
* refactor(chat): express compaction continuation as reactor action by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1041
* refactor(director): make workflow coordination host-owned, drop inert classifier by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1040
* fix(approval): exact parked-call identity, typed discard, and retry re-use by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1077
* fix(approval): settle retried approvals with denial memory by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1078
* fix(prompts): let grants govern outside-workspace plugin reads by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1079
* fix(agent): surface real manage_tasks parse errors by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1084
* fix(prompts): let mid-run operator text steer running workers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1085
* fix(tui): resolve default. and doubled names at tool dispatch by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1086
* fix(subagent): treat in-flight tools as stall activity by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1089
* feat(shell): default 120s foreground run_shell timeout by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1087
* fix(subagent): stop incomplete-report salvage once by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1088
* fix(permission): forget cached denies on a new user turn by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1090
* fix(tui): report reconnecting instead of unknown tool for promoted-but-unmounted calls by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1082
* Detect disconnected MCP servers and automatically reconnect them by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1081
* Improve tests by @Gustav-Simonsson in https://github.com/corbitsdev/corbits-code/pull/1067
* fix(agent): clone manage_tasks args before arktype morph by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1091

### New Contributors
* @Gustav-Simonsson made their first contribution in https://github.com/corbitsdev/corbits-code/pull/1067

**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.26...v0.3.27

## [0.3.26] - 2026-09-15

### What's Changed
* Wait briefly for connecting servers before answering an empty tool search by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/996
* Refuse path-trust migration from corrupt stores by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/995
* Abandon a parked approval only on its own timeout by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/997
* fix(provider): keep the Anthropic cache breakpoint off ephemeral turns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1008
* Do not let OAuth projections overwrite hand-named provider entries by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1007
* Share workspace roots with list_dir and delete_file bounds by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1009
* Route unclaimed popup keys back to the prompt by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1011
* Enforce exec director tool allowlists through tool_search and promote by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1010
* Harden path-escape sanitization for nested and alternate path keys by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1005
* docs(product): remove shipped items from roadmap by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1020
* fix(hardening): small follow-ups from the 0.3.25 review by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1021
* Correct PerfTrace export prerequisites and settings secrets guidance by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1013
* Verify docs/TUI.md against the terminal UI as it behaves by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1016
* Correct MCP trust fingerprint, store path, and auth UX by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1017
* Open transcript URLs on modifier click by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/964
* Correct vendoring doc claims against the vendored tree by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1015
* Restore Emil critique layer from the CMO original at full fidelity by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/999
* feat(tests): make the suite runnable under bun test --parallel by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1023
* Give Muse Spark its own reasoning effort ladder by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/979
* Verify docs/PLUGINS.md against the plugin loader by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1014
* feat(tui): brand the startup transcript with a quiet session header by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1022
* Give Muse Spark tool-discipline rules by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/981
* Only skip the spill URI sandbox for reader tools by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1006
* Re-vendor Interchange trees to main HEAD for the director loader by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1025
* Restore missing Common Patterns in create-issue skill by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/998
* Hold newly promoted tools off the wire until a cache-safe boundary by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1027
* Shard the CI test matrix into four time-balanced slices by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1028
* Resolve transcript link clicks without the removed renderer hit-test by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1033
* Collapse duplicate provider adapters and model catalogs by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1029
* Inline TUI and agent micro-modules and merge the delivery queue trio by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1030
* Rewrite brittle copy-pinned tests as behavior contracts by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1035
* Unify permission verdict path with a mode-invariant catastrophic deny by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1037
* Fold small session, chrome, and compaction helpers into owning modules by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1036
* Correct two stale statements in the vendor patch ledgers by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1039
* Give the two-attempt watchdog stall test an explicit 10s timeout by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1038
* Harden transcript link resolution at markup edges by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1043
* Unify tool, skill, and agent search on one rank-and-cut pipeline by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1045
* Fold Go and Zen model catalogs into one parameterized module by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1053
* Split transcript link helpers into focused modules by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1055
* fix(subagent): queue overlapping steers instead of dropping them by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1063
* Deliver a stashed steer as a follow-up when the run wins the race by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1066
* fix(subagent): reap shell children so interrupt and close settle by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1068
* Fail fast when an approval delivery is never accepted by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1069
* fix(subagent): land steer and shell critique follow-ups by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1070
* fix(tui): keep approved hold across retry and prove shell-guard kill by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1071


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.25...v0.3.26

## [0.3.25] - 2026-09-14

### What's Changed
* Correct PRODUCT.md on tool-less turns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/955
* Reset the tool-less narration count on tool-using turns by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/956
* Restore Critic verify-by-temporary-test workflow by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/957
* Explain grant-mismatch asks with a prompt notice by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/960
* Rotate the submit_result turn token on every steering followup by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/967
* Ship keepstyle guideline split and dedupe worker report envelopes by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/968
* Send parallel_tool_calls true on Codex Responses requests by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/969
* Unify provider identity lists around the first-class registry by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/970
* Strip scheduler restatements from the Skywalker prompt by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/974
* Give empty overlays zero list rows and an explicit empty state by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/975
* Add a Gauntlet director that mutation-checks tests can actually fail by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/977
* Show connected state plainly in the model picker by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/973
* Restore Draper full brand and design critique layer by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/953
* Add measure-only prober leaf director by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/962
* Document catalog credential-removal convergence as rebuild-only by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/972
* Add Migrator director for reversible data migrations by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/963
* Add Lexicon skill owning director prompt drift and size by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/961
* Report first-party skill names on skill_used, bucket the rest as custom by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/959
* Split deep review from pull request surface review by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/971
* Add warden trust-review director for permission and plugin paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/966
* Mark bundled plugin rows with a mountain in listings by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/976
* Re-sign compiled macOS binaries so bun compile output launches on macOS 27 by @brianjfox in https://github.com/corbitsdev/corbits-code/pull/984
* Deny OAuth token stores in the secret guard by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/983
* Report lexicon by name on skill_used by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/990
* Add bug report and feature request issue templates by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/988
* Cut the README to a way in and let the docs carry the depth by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/987
* Convert greybeard to a leaf director; only Skywalker may spawn by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/958
* Generate release notes from merged pull requests by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/986
* Adopt Conventional Commits and make the rules binding by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/985
* Derive prompt size budgets from a checked-in baseline by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/992
* fix(hooks): keep a hook's broken pipe from crashing the run by @brianjfox in https://github.com/corbitsdev/corbits-code/pull/994
* Mount skill search and load tools on every worker by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/982
* Compress Skywalker classification and anti-cascade sections by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/965
* Offer home-relative completions for at-mention paths by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1001
* Refresh stale skill-bake prose left by worker skill mounting by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1000
* Scope credential sidecar denylist and bare row drop to avoid false positives by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1002
* Describe worker skill mounting in ARCHITECTURE by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1003
* Correct flagged-skill reporting split in TELEMETRY by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1004
* Cover EPIPE, truncation, stdio, and enablement in HOOKS by @TheGreatAxios in https://github.com/corbitsdev/corbits-code/pull/1012


**Full Changelog**: https://github.com/corbitsdev/corbits-code/compare/v0.3.24...v0.3.25

## [0.3.24] - 2026-09-13

### Added

- Queued steers and follow-ups now surface in a pending column above the
  prompt: pick with Up/Down, force-deliver with Enter, drop with Ctrl+X,
  exit with Esc, and pop back to the composer with Ctrl+G.
- OpenCode Zen models are discovered live with a seed fallback, per-model
  protocol routing, and a picker overlay.

### Changed

- Builder chain now mandates same-commit regression tests, docs upkeep, and
  criteria-mapped reporting.
- Prompt size budgets are now per-director per-family, and the gaasbot
  ceiling is raised (chars 54800, bytes 56000).

### Fixed

- Shell parsing serial: here-strings stay inline, heredoc terminators match
  exactly, arithmetic and comment openers parse correctly, and secret checks
  run in the right order.
- First-party OpenAI reasoning models now send max_completion_tokens.
- The shell secret denylist resolves symlinks before matching.

## [0.3.23] - 2026-09-12

### Added

- Malformed plugin manifests now surface a warning instead of loading
  silently; a missing manifest stays silent. Swallowed plugin-load errors are
  logged for diagnosis.
- Expanded coalesced transcript lanes show a per-call subject, so grouped tool
  rows stay attributable to the file or pattern each call touched.
- Greybeard review checklist restored in Corbits idiom: verdict-scoped checks
  in checklist order.
- Gaasbot CTO voice restored from the GaaS original; still advisory-only, not
  a gate.

### Changed

- `wait_agents` is now exec-primary opt-in (`mountWaitAgents` in
  `createAgentToolset`; CL-7678). The TUI primary and nested orchestrators no
  longer mount it and collect fleet results through mailbox mail instead:
  spawn then idle, do not poll. Headless `corbits exec` keeps it mounted with
  an advertised allow.
- Headless `corbits exec` unmounts `ask_operator` when stdin/stdout are not
  TTYs instead of advertising a cancel stub. TUI Skywalker still mounts it;
  TTY exec still prompts on stdin.
- Provider `contextWindow` settings now drive occupancy, compaction, and the
  status-bar meter. The same setting no longer changes the per-request output
  budget, which keeps the shared default.
- Sub-agent leaf reports always render all four headings (Summary, Findings,
  Blockers, Paths), with `None.` under headings that have nothing to report.
- A repo-committed `.corbits/permissions.json` no longer auto-allows tool
  calls. Each grant needs a one-time operator confirmation per project, and
  the first encounter surfaces what the file would grant.

### Removed

- Profile files no longer accept a `workflow` field. Workflows start only from
  slash commands; a leftover key is rejected on load rather than ignored. The
  `--no-workflow` CLI flag is unchanged.

### Fixed

- A second same-category credential error in one session no longer fails the
  session on a duplicate error record.
- A model tool call truncated mid-JSON now fails the turn with an actionable,
  retryable error instead of dispatching garbled arguments.
- An unspaced `&` (`a &b`) now splits into two approval segments, so a
  standing grant for the head command no longer covers a hidden payload.
  Redirects (`2>&1`, `&>`, `<&-`) are unaffected.
- Runs interrupted while waiting for admission settle through the normal
  terminal path instead of stranding.
- Internal agent traffic (occupancy wakes and similar system messages) no
  longer paints as operator rows in the transcript.
- Approval overlays on short terminals keep a closed border and at least one
  visible choice instead of collapsing below their minimum size.
- The MCP authorization marker survives a browser-timeout re-auth cycle
  instead of being dropped.
- A missing or unreadable agent-plugin prompt file now surfaces a warning
  naming the plugin, agent, and path instead of silently loading the profile
  without its system prompt.

## [0.3.22] - 2026-09-11

### Added

- Plan and counsel workers require substance in Findings (files/paths,
  acceptance criteria, non-goals, risks, ordered steps). Four headings
  with stub Findings salvage as `incomplete-report`, not an attachable
  plan. Implement and review envelope completeness is unchanged.
- Consecutive same-tool transcript calls collapse into one row with a count
  chip (`· ×N`). Settled lanes use a past-tense head (`Grepped ×3 · "corbits"`).
  `spawn_agent` stays one row per dispatch; `manage_tasks` paints no row.
- Pending `run_shell` rows stream up to three live output lines from a
  bounded 8 KiB feed, then a last-three preview and a non-zero `exit N` at
  settle.

### Fixed

- Occupancy injects mailbox mail once when a worker burst finishes: one
  in-flight drive, in-flight ids until send succeeds, and wake copy that
  does not say the reports were already collected. Overlapping flushes
  no longer fill the send queue or replay the same reports as new turns.
- System-originated inbound (`message.received` without the operator flag —
  background shell exits, mailbox mail, fleet-dry and compact continuations)
  paints as a visible system row instead of a user prompt.
- After a parked `ask_director` is surfaced (TUI idle-send wake, nested
  `wait_agents` with a question payload, or a successful `list_agents`),
  further `list_agents` calls fail closed until `send_input` answers or the
  ask is dropped. Do not poll `list_agents`.


## [0.3.21] - 2026-09-11

### Added

- `tool_search`-activated tools persist in `run.json` and are re-advertised
  after resume, rebuild, and compaction. Per-project `pinnedTools` in
  `.corbits/settings.json` keeps chosen MCP tools on the wire without
  activation. Registered-but-unadvertised calls error toward `tool_search`
  instead of silent dispatch.
- Repeated identical tool batches warn in the transcript before the doom-loop
  guard kills the run.

### Changed

- A named profile file that is missing fails closed instead of falling
  through. Resume-picker docs match the unfiltered recent-10 list. Grok
  model-family policy docs match the runtime.

### Removed

- `--force` is no longer accepted. It had no runtime effect; resume and the
  session picker already include failed and done sessions without it.

### Fixed

- Stalled workers get a full `stallTimeoutMs` grace after the first
  continuation nudge before salvage. Stall pings inside that window wait
  instead of counting toward escalation. Mailbox mail re-flushes from the
  fleet stall poll. Dry-fleet occupancy still delivers inbound mail.
- Stale `running` sessions age to `interrupted` after two missed 5-minute
  heartbeats. Leftover newer parseable `run.json.*.tmp` files recover by
  mtime. Resume persists `interrupted` before reopening as `running`. Crash
  and signal finalizers keep `turnsUsed`.
- Subagent follow-up and interrupt are race-safe. Queued messages recover
  when the target agent closes. Retryable worker failures retry once.
  Pending sub-agent nudges append onto existing ephemeral turns. Pending
  poll batches are exempt from the doom-loop guard. Non-fatal reactor
  errors continue; empty extra session segments do not skip a real
  checkpoint.
- Auto mode treats bash combined file redirects as mutations. The agent
  cannot persist its own shell grants into the standing approval store.
  Operators are not asked to approve a path the sandbox will reject.
  Same-process credential writes queue so each gets its own lock window.
- Compaction summarizer is bounded and retried once per failure class.
  Torn write tails heal; failed rewrite commits stay on HEAD. A prompt
  submitted before `/clear` does not land in the new session. Quoted
  image-path mentions keep whitespace and drop false-positive matches.
  Relative filenames in prose quotes do not mint root-path mentions.
- Assistants that print tool-call markup as text get one nudge. Consecutive
  tool-failure recovery audits coalesce. Concurrent mutating lane-overlap
  warnings rate-limit. OpenCode Go worker session IDs forward without a
  catalog. Attributable xAI capacity protocol mismatches retry.


## [0.3.20] - 2026-09-10

### Added

- Occupancy delivers mailbox mail as system inbound when a worker finishes or
  fails, including while siblings still run. Skywalker spawn-then-idle; do not
  poll `wait_agents`. Nested orchestrators still collect with `wait_agents`.
  TUI-primary `wait_agents` yields as a timeout (workers untouched) when a
  queued Enter steer or uncollected mail/ask is ready. Already-collected waits
  return status without a second report body.
- Compaction on the primary keeps a retrievable evidence archive and a fresh
  working context. Failed compact commits do not replace live history. Archive
  search and read go through the posix tools with a result cap.
- Grok and OpenCode Go Responses adapters come from `@corbits/openai-responses`
  and `@corbits/xai-provider`. Codex Responses and Login with ChatGPT come from
  `@corbits/codex-provider`. Host OAuth PKCE, callback, and token store come
  from `@corbits/oauth-core`. Duplicate in-tree adapters and OAuth cores are
  gone.

### Changed

- `search_agents` default results are id, description, and spawn metadata.
  Pass `include_body=true` to include the loaded system prompt / body
  (still truncated).
- Leisure truncation applies to every oversized tool result, not a name
  allowlist. Fleet JSON is pretty-printed so the pager can scroll it. Tool-
  output blobs page by byte windows, not line caps.

### Fixed

- Crash and signal finalizers preserve `turnsUsed` from the in-memory active-run
  handle instead of writing `0`, so a signaled or crashed session keeps the
  turn count already persisted by mid-run snapshots.
- Occupancy takes one dry-episode shot when the parent settles idle even if the
  live fleet 1→0 edge was never observed.
- Dry-fleet transcript and `/status` report the outcome tally only
  (`2 done, 1 failed`). They no longer claim `nothing running` when the
  parent may still continue.
- The prompt-box lockup stays on while a fleet is live or a dry-fleet
  continuation is pending, even if the parent turn has settled. The word
  cycles through a closed live-activity set (`working`, `warping`,
  `buzzing`, `grinding`, `thinking`, `doing`, `cooking`, `creating`,
  `imagining`, `inventing`) instead of going blank.
- OpenCode Go routes Muse Spark 1.2 Contributor and Muse Spark 1.3
  Contributor through the Responses API instead of chat completions.
- Oversized fleet-dry reports spill to a retrievable URI instead of a silent
  ellipsis. `read_file` of a tool-output URI is prompted only when truncation
  named one. A failed `read_file` shows the error on the collapsed transcript
  line.
- Interactive path-arg tools that escape the workspace deny at authorize
  time instead of showing an Accept overlay that path-escape then rejects.
  Yolo / skip-permissions still allows those calls.

## [0.3.19] - 2026-09-10

### Security

- Reactor-gated tool middleware still blocks policy denials. A `decide()` deny
  (authorization hard-deny, auto-shell deny, or headless deny) returns a
  blocked tool error and does not run the call. Ask and allow still skip the
  middleware prompt so an approved re-dispatch never re-asks. Middleware is
  not a second copy of `env.authorize`: it consumes the prior verdict when the
  same call (id, name, and arguments) is cached, and decides on a cache miss.

### Added

- `run_shell` can return immediately with a `shell_id` when `background` is
  true, so long commands do not hold the parent turn. Collect or cancel later
  with `shell_collect`.

### Fixed

- The slash menu exposes `/mcp` only. `/mcps` is no longer an alias for
  the same overlay.
- Sequential TUI ask and permission selectors paint the live question's option
  labels. Overlay rows bind by an ask id minted at emit, not render-order
  index. A stale or empty accept fail-closes as unavailable rather than
  impersonating Reject; Escape still denies.
- After context compaction, ChatGPT Codex requests keep the operating prompt as
  instructions.
- Compaction spacers stamp a reserved harness producer id and a visible
  sentinel. Spacer-only replies are incomplete and stay on open-task and
  workflow rails. Frozen-prefix matching ignores model-emitted copies of the
  marker.
- Spawned workers enforce the parent permission gate. Unresolved worker
  approvals deny with a reason that names the permission subject so the parent
  can grant and retry, without hanging on operator approval.
- A session falls back to the next resolvable provider when the selected
  default or project-local provider is missing or incomplete. `--provider`
  still errors.
- Operator approval resume late-binds to the live agent and keeps the TUI
  busy across the overlay so a reload cannot drop the parked tool call.
- Operator approval drops on session identity change. inFlight occupancy
  owns idle rebuild; delivery generation owns session identity, so interrupt,
  /clear, and /new abort the outstanding overlay, skip minting a grant, and
  notify the operator instead of delivering into a rebuilt agent.
- TUI quit, crash, and process signals await once-only runtime shutdown so live
  shell-guard children are reaped. Teardown failure after a completed session
  exits 1; SIGINT, SIGTERM, and SIGHUP still exit 128+n.
- Persist close_agent surfaces leftover-child dispose failure so a worker
  that survives reap is not reported as a successful shutdown.
- Leftover exec dispose is reported as a failed run (stderr + status failed), and
  parent toolset dispose finishes remaining workers and posix teardown before
  surfacing leftover-child failure.
- MCP OAuth tokens persist after browser auth across overlapping session
  writes. Sibling `resetAuthorization` does not wipe tokens another session
  just saved.
- MCP authorization recovery no longer loops reconnects after a failed or
  timed-out browser re-auth.
- OAuth callback servers bind ephemeral ports and re-read disk state across
  MCP sessions so stale ports and in-memory token copies cannot collide.
- Rate-limit retries honor the Retry-After header and the terminal message
  names the wait.
- Parked director questions wake the parent so `ask_director` does not stall
  behind an idle orchestrator.
- Occupancy resumes the parent when the fleet goes dry with open tasks.

### Changed

- oxfmt formats the tree and oxlint is the lint gate. Prettier and ESLint are
  gone. Dummy CI job names `prettier` and `eslint` stay for protect-main.
  Empty functions and non-null assertions are errors.
- Skywalker may spawn one successor with a changed brief after a failed or
  incomplete-report fleet worker. A parent-initiated interrupt
  (`stop_reason: interrupted`) is a resumable pause — `resume_agent` or
  re-wait, not a successor — unless the session is no longer resumable.
  Operator-cancelled salvage still waits for the operator. Identical briefs
  stay refused at the prompt / spawn-handoff layer. `wait_agents` JSON
  includes `stop_reason` so interrupt vs cancelled vs incomplete-report stay
  distinct. This reverses the 0.3.15 fail-path idle, not operator-cancel.
- Session git and workflow lifecycle run outside the TUI. The shell renders
  state and forwards commands; the native workflow host owns child execution.
- The test suite drops content-pin and cosmetic assertions, closes coverage
  gaps on load-bearing paths, and CI shards the same path union for faster
  feedback.

## [0.3.18] - 2026-09-08

### Added

- OpenCode Go forwards the active Corbits session ID on Chat, Responses, and
  Messages requests, including after `/clear` and `/new`, so Go Console can
  associate requests with the current session.

### Changed

- ChatGPT Codex uses the Corbits system prompt as Responses `instructions`,
  without fetching or injecting the official GPT-5 Codex prompt.
- Main-session permission approvals use the reactor approval-suspend primitive.
  Operator denials reach the model with their reason, hard policy denials remain
  tool errors, and expired late decisions are discarded.
- Builder bakes compact Ponytail guidance with default lite mode and uses the
  smaller native-runtime skill instead of broad native-integration and
  TypeScript guidance by default.
- The TUI shell, provider setup, and runner are split into focused modules.
  OpenTUI services replace custom list and clipboard plumbing. Row updates are
  coalesced to renderer cadence, while chrome recomposes only when inputs
  change. Clipboard failures no
  longer crash the interface, overlay selection survives resize, permission
  choices stay compact with full context above them, and stale or over-frequent
  row repaints are prevented.
- Corbits moves to the Interchange 0.3.x baseline by migrating the 0.3.0 APIs,
  vendoring required packages from one upstream revision, retaining published
  packages where their APIs suffice, reapplying and recording inference
  patches, and documenting provenance and removal conditions.
- Arktype is updated to 2.2.3 with compatible dependency resolutions while
  retaining one Arktype instance across Corbits and Interchange packages.

## [0.3.17] - 2026-09-05

### Added

- Harbor agent adapter wrapping headless `corbits exec` (`evals/harbor`) so Terminal-Bench 2.x can run Corbits.
- Operators can select Anthropic Claude Fable 5.1 (`claude-fable-5-1`) from Connect and `/model`. Adaptive thinking matches Claude Fable 5.
- Operators can select OpenAI GPT-6 Astra (`gpt-6-astra`) from Connect, `/model`, and the Codex fallback catalog. Reasoning effort offers low through max. Context heuristic covers the GPT-6 family.
- Operators can select Z.AI GLM-5.3 (`glm-5.3`) and GLM-5.3-Flash (`glm-5.3-flash`) from Connect and `/model`. Reasoning effort offers low/high/max. Context heuristic covers the 1M GLM-5.3 window.

## [0.3.16] - 2026-09-05

### Added

- Native-integration skill: Corbits runtime mapping for GaaS skill bodies (tools, fleet, non-git folders, GitHub review posting, tracker-agnostic issues). Baked on workers; `use_skill` on the primary. Not a slash.
- Skills listing is names only. The primary looks up descriptions with the advertised `skill_search` catalog tool (resident — not via `tool_search`), then loads a body with `use_skill`.
- OpenCode Go lists models from the live `/zen/go/v1/models` catalog (packaged seed on fetch failure).

### Changed

- Drop unused `@opentui/keymap`, `@opentui/solid`, and `solid-js`. The interactive TUI is imperative `@opentui/core` only.
- Require a counsel / /plan plan before substantial Builder work. Skywalker feature chain is explorer then plan then implement then critic. Tiny parent-DIY stays plan-optional. /implement does not steal planning from /plan.
- Align /create-issue phases and # Background / # Outcome format with GaaS linear-create. Slash stays /create-issue. Tracker selection stays (Linear MCP first, else GitHub/GitLab/MEMORY.md).
- Restore the /review skill body 1:1 with GaaS code-review. Slash stays /review. GitHub posting, Linear In Review, ask_operator, and findings-only stay on native-integration.
- Restore the scribe skill 1:1 with GaaS. ask_operator mapping stays on native-integration. Slash /scribe remains.
- Restore the ast-grep skill 1:1 with GaaS. run_shell mapping stays on native-integration. Slash /ast-grep remains.
- Restore the opsh skill 1:1 with GaaS. Tool/shell mapping stays on native-integration. user-invocable: false stays so it remains use_skill-only.
- Restore the pull-request-review skill 1:1 with GaaS. ask_operator, /review mapping, and GitHub posting stay on native-integration. Slash /pull-request-review remains.
- Restore the refactor skill 1:1 with GaaS. ask_operator mapping stays on native-integration. Slash /refactor remains.
- Ignore GaaS opsh, refactor, scribe, ast-grep, review, and create-issue SKILL.md in prettier so GaaS emphasis/table alignment stays 1:1.
- Restore the git-rebase skill body 1:1 with GaaS. Intern execution recipe stays on native-integration. user-invocable: false stays so it remains use_skill-only.
- Restore the linear-issue-workflow skill body 1:1 with GaaS. Claim-first, In Review, and git-worktrees extras stay on native-integration. user-invocable: false stays so it remains use_skill-only.
- Restore the interview skill body 1:1 with GaaS (AskUserQuestion). Operator-ask mapping stays on native-integration. Slash /interview remains.
- Restore the implement skill body 1:1 with GaaS (TaskCreate, @greybeard, Acknowledgment). Tool-name mapping stays on native-integration. Slash /implement remains.
- Restore the typescript skill body 1:1 with GaaS. bun:test vs tap mapping lives on native-integration. user-invocable: false stays so it remains use_skill-only.
- Restore the philosophy skill body 1:1 with GaaS (including the review acknowledgment). `user-invocable: false` stays so it remains use_skill-only.
- Restore the style skill body 1:1 with GaaS (including the git-repo requirement and review acknowledgment). Non-git-folder policy stays on native-integration. `user-invocable: false` stays so it remains use_skill-only.
- Codex Responses tracks `parallel_tool_calls` continuity and serial tool calls.

### Fixed

- Headless `corbits exec` now registers the active run so SIGINT/SIGTERM/SIGHUP finalize `run.json`.

### TUI

- First idle Ctrl+C clears pending image attachments along with prompt text. Clearing attachments only does not arm the quit window. Corbits-owned ephemeral files are unlinked; operator path-mention files stay on disk. Dispose and a second (armed) Ctrl+C also unlink leftover clipboard files.
- Stop labelling transcript rows with the permission subsystem.
- Chrome zone rows re-fit their text on terminal resize.
- Clock idle landing snow from the landing's own timer; honor reduced motion.
- Dedupe path-mention images by content hash next to pending clipboard images.

## [0.3.15] - 2026-09-04

### Added

- Sub-agent admission queue: `spawn_agent` never refuses for worker count.
  Excess dispatches report `queued` until a burst slot is free. Nested children
  of an already-admitted parent bypass the burst window (not a 429 pause).
  Capacity changes never cancel in-flight work.
- Builder and critic bake a compact less-is-more quality bar (`idiot-proof`:
  deletion, reuse, clean only files you already touch, read first). It is not a
  slash and is not listed for `use_skill`. Critic flags correctness plus hygiene
  the diff introduced and still never implements. Skywalker no longer treats
  that hygiene lens as over-engineering theater.

### Changed

- Collapse the three runtime bootstraps into shared session assembly.
- Skywalker's prompt no longer states a hard cap of 4 workers. Fan-out width
  follows independent lanes; the runtime queues excess rather than refusing.
- Wait/list status includes live `queued`. Resume/followup inference is admitted
  through the same queue.
- Retryable provider 429s freeze new admits via the shared retry remapper.
  `quota_exhausted` does not freeze.
- Skywalker and primary orchestration guidance no longer invite auto-starting
  the next worker after an unfinished specialist.
- Cancelled salvage asks the parent to synthesize Findings and wait for the
  operator instead of auto-starting another specialist.
- Interactive TUI pins OpenTUI 0.5.10 (`@opentui/core`, keymap, solid, and native platform packages in lockstep).
- `bun run check` now runs the full test suite with the same seed CI uses
  (`--randomize --seed 424242`), so a local green can no longer mask a CI test
  failure. CI's test job invokes the same `check:projects-dir-guard` script
  instead of duplicating the test command, and the projects-dir guard no longer
  squats on the `test` script name.
- Implement/review `spawn_agent` dispatches (and their default
  directors) fail closed without non-empty `success_criteria`;
  children stay blank.
- Workers can ask their spawning director via `ask_director` when a brief is
  ambiguous. `wait_agents` returns `awaiting_director` with the question;
  soft `send_input` answers it. The operator is not in that loop unless the
  director escalates. Workers still cannot call `ask_operator`.
- Spawned workers are called fleet agents, not leaves. Director packages still
  use `tier: "leaf"` as the runtime mount key.
- Agents and contributor docs move Linear issues to In Review when a PR is ready
  for review.

### TUI

- `/plugins` uninstalls user, project, and path-installed plugins with Alt+X.
  Bundled plugins disable only and stay listed. Claude marketplace plugins
  disable in settings without deleting `~/.claude`. The screen opens with a
  how-to header.
- Operator-question and permission choice labels wrap instead of collapsing
  behind a middle ellipsis. `ask_operator` rejects option labels over 48
  characters so rationale stays in the transcript.

## [0.3.14] - 2026-09-03

### Changed

- Authorization and approval display now use one shared command-segmentation
  implementation, preventing the two views from drifting while keeping executable
  pipeline payloads visible.
- macOS Finder `.DS_Store` metadata is ignored throughout the repository.

### Fixed

- OAuth, xAI, and Codex credential-store updates are serialized so concurrent
  sessions cannot drop profiles or overwrite refreshed tokens.
- Path-restriction cache entries are invalidated when symlink resolution changes,
  preventing stale workspace decisions after filesystem mutation.
- Project-scoped grants cannot replay in a different workspace even when the
  request working directory matches the foreign grant.

## [0.3.13] - 2026-09-01

### Changed

- Implementation-worker guidance requires repository-defined typechecks, relevant
  tests, and every defined full verification command, with exact outcomes and exit
  statuses reported. Skywalker guidance requires Critic review after delegated
  Builder work and Greybeard review when architecture is in play.
- Sub-agent guidance describes completion in terms of the dispatch done-definition
  rather than a fixed inference-turn budget.

### Fixed

- Empty chat turns settle with a valid empty reply instead of ending in a fatal
  reactor error, while preserving checkpoint actions.
- Terminal provider failures show a sanitized category and upstream diagnostic in
  TUI and headless runs without duplicate or stale notices. Sub-agent failures
  return a sanitized category and recovery guidance without exposing upstream
  diagnostics.
- OpenCode Go normalizes null response-delta `role` and `tool_calls` fields before
  strict OpenAI parsing; malformed non-null values remain rejected.

## [0.3.12] - 2026-09-01

### TUI

- `/connect` opens Add Provider from any layout.
- Option+A still opens Add Provider. Terminals that emit å/Å for Option+A
  without the option modifier also open it in `/model` (US/ABC compose).
  Dedicated Nordic å in `/model` is treated as that shortcut when Add
  Provider is offered.

### Breaking

- `task` is removed. Use `spawn_agent` to start workers and `wait_agents` to
  collect reports; `search_agents` profile ids now dispatch through
  `spawn_agent(agent=...)`.

### Changed

- Cancelling a spawned worker or `wait_agents` reports wait status
  `interrupted`, not `failed`.
- Inference no longer fails over to a backup provider. A selected-provider
  failure stays on that provider; switch with `/model`.

### Fixed

- Codex ChatGPT subscription sessions no longer show a public-rate dollar
  cost estimate. Hide follows the live provider identity after `/model`
  switches, not the launch base URL. Coding-plan (Z.AI) hide uses the same
  live-identity rule. Context usage and `/cost` still work; `/cost`
  reports Codex cost as covered by ChatGPT subscription. Metered OpenAI
  API endpoints keep dollar estimates.
- CLI `--help` / `-h` is recognized in any argument position. Value flags no
  longer swallow `--*` or `-h` as their option values.
- `wait_agents` no longer collects a stale completed or interrupted stamp
  when a followup is already in flight.
- `interrupt_agent` flips the wait mailbox so soft interrupt unblocks
  `wait_agents` while the background run is still in flight.
- Credential-refresh and auth send failures tell the user to log in again
  instead of suggesting `/model`.

## [0.3.11] - 2026-08-31

### Changed

- Completing a workflow step is a `submit_output` tagged with that step's id.
  `advance_workflow` is gone. Already-complete and not-current ids are
  acknowledged without advancing. The unused `autoAdvance` workflow field is
  removed.
- `resume_agent(target, message)` starts the next turn on a retained completed
  or interrupted worker and returns immediately. `wait_agents` collects the
  reply. `send_input` steers only an in-flight running turn. Closed workers
  stay closed.
- `corbits resume` orders sessions by last persist. The picker shows the 10
  most recent sessions across all statuses and type-to-filter narrows that
  list.

### TUI

- `/yolo` is listed on the landing screen and on permission prompts.
- Git fatal stderr stays off the TUI when the working directory is not a
  repository.

### Fixed

- Mid-run Enter delivers a steer into the live reactor (`Agent.deliver`)
  instead of starting a second `send`. `/clear` and `/new` drop queued
  input so it cannot land in the next session.
- Failed sessions with an `error` string in `run.json` are valid resume
  candidates, not corrupt files. A truly unreadable session id prints one
  recovery line; parse diagnostics go to the structured log, not the
  terminal. Renaming a session does not overwrite an unreadable `run.json`.
- `ask_operator` no longer pre-authorizes a model-authored shell command when
  the operator picks any option, including Reject. Clarification choices
  cannot mint shell grants.
- Live `/model` switches refresh inference, permission identity, grant
  persistence identity, and advertised tool schemas together. A grant for the
  previous model no longer covers the same action, new grants store under the
  new pair, and Kimi/Moonshot sessions get non-recursive `present` schemas
  immediately (canonical schemas restore when switching away).
- A failed write of a project, global, or provider-model approval no longer
  crashes the session. The grant still applies in memory, the approved tool
  call still completes, and the operator is told remember did not stick.

## [0.3.10] - 2026-08-30

### Fixed

- Session durability checkpoints use the operator's git `user.name` and
  `user.email` when both are set, so allowlisted commit-author hooks no
  longer fail every tool cycle. Machines without a git user still fall
  back to the Interchange harness identity.
- First-run welcome plays the mountain once and holds the filled
  silhouette until continue or auto-advance. The product line is hidden
  on narrow terminals instead of wrapping mid-word.

## [0.3.9] - 2026-08-29

### Fixed

- First-run onboarding shows the orange mountain welcome and local software
  factory intro before opening provider and model setup.

## [0.3.8] - 2026-08-28

### TUI

- `ask_operator` is an inset overlay again so the transcript stays visible while
  the operator answers.
- The `full_shell` overlay mode is removed; every overlay is inset.

### Fixed

- Homebrew release reruns preserve legacy formula rename mappings so old
  `corbits` installs keep migrating to `corbits-code`.
- First-run onboarding preserves OAuth profile projection when started with
  CLI `--config`.
- Settings paths no longer collide when Corbits starts from home or an aliased
  config location; OAuth and model choices recover without writing credentials
  into settings.
- OpenAI OAuth credentials stay staged until setup validation succeeds;
  definitive scope and credential failures are not saved, including via Ctrl+S.
- Known Codex short HTTP 429s normalize to retryable rate limits, while true
  `usage_limit_reached` responses keep quota copy with reset and profile hints;
  terminal credential failures tell operators to log in again.
- Same-turn failover retracts recovered inference error rows instead of leaving
  quota or session-expired lines in the chat.
- Interrupted workers linger on the agents strip for the normal window then
  drop, and no longer inflate sticky clocks or fleet-running counts.

## [0.3.7] - 2026-08-27

### Fixed

- `web_fetch` failures now return the same complete result shape and content
  regardless of whether the default Exa provider or native fetch handles them.

## [0.3.6] - 2026-08-27

### Fixed

- The default Exa-backed `web_fetch` once again enforces HTTP(S)-only URLs and
  per-call timeouts, returns the requested markdown, text, or HTML format, and
  preserves the native tool's public result and error semantics.

## [0.3.5] - 2026-08-27

### MCP

- Exa is now a built-in MCP server enabled by default, connecting without an API
  key to the external `https://mcp.exa.ai/mcp` service. Web requests handled by
  this preset are sent to Exa and are subject to Exa's privacy practices, network
  availability, and anonymous rate limits. Disable it with
  `mcpServers.exa.enabled: false`, or override `mcpServers.exa` with a custom
  transport-bearing server entry.

## [0.3.4] - 2026-08-26

### Telemetry

- Ambient telemetry emits one parent generation per turn with aggregated tool and
  subagent counts, rolls worker usage into one terminal event per dispatch, and
  makes per-call spans opt-in. Ambient events use anonymous processing,
  successful generations support sampling while failures always ship, plugin
  loads deduplicate, and pre-usage fallback failures avoid stale provider
  attribution. A deterministic representative fleet fixture drops from 98 to 18
  billable events, an 81.6% reduction.

## [0.3.3] - 2026-08-25

### TUI

- Idle-with-fleet is real: after Skywalker dispatches workers with `spawn_agent`
  and ends its turn, the session holds itself open while they run. Enter starts
  a new primary turn immediately instead of queueing a soft-steer behind a
  parent tool that no longer exists; Alt+Enter follow-ups still wait for true
  session-idle (parent idle and no live fleet lanes), delivering the moment the
  last worker terminalizes. Ctrl+C stop policy is unchanged.

## [0.3.2] - 2026-08-25

### Agent

- Closed directors are named entities (`skywalker`, `builder`, `explorer`, `counsel`,
  `intern`, `critic`, `greybeard`, and the rest of `DIRECTOR_IDS`) instead of generic
  role ids. Write tools are mounted on every closed director; Skywalker DIYs tiny
  single-file edits and spawns specialists for substantial work. Fleet verbs
  (`spawn_agent`, `wait_agents`, `search_agents`, …) stay on the primary only.
- `spawn_agent` can isolate a worker in a git worktree, pass a tool allowlist, and
  allow nested spawn where the director's spawn rights permit it. `task()` is now
  a fused spawn-plus-wait wrapper around that path — still works, still deprecated
  for new call sites.
- New fleet verbs: `list_agents` (this caller's uncollected workers only) and
  `send_input` (steer a running worker without completing `wait_agents`).
  `wait_agents` is scoped to the caller, unblocks immediately on interrupt/close,
  and no longer waits on a sibling orchestrator's fleet. Interrupted workers that
  still have tools in flight stay inspectable instead of looking idle.
- Cancelled and salvaged workers keep Findings and Paths in the parent-facing
  report. `wait_agents` now sees those salvage records when the parent cancels
  mid-wait.
- Finished leaf workers stop re-inferring after they have already produced a
  report reply. Optional first-party skill bodies are baked into worker director
  prompts so leaves do not have to `use_skill` to load them.
- Skywalker is an idle orchestrator: fire `spawn_agent`, tell the operator who is
  running, then wait — do not fuse into a long `task()` after spawn. Linear work
  must be set In Progress before explore/build thrash.
- Director system prompts (Skywalker, Builder, Explorer, Counsel, Intern, Critic,
  Greybeard, Neckbeard, Bruckheimer, Gaasbot, Draper, Emil, Rand, Shakespeare,
  Testsmith, Tester) and first-party skills (style, philosophy, typescript,
  implement, interview, review, create-issue) were rewritten as current-code
  playbooks. The dispatch skill is gone; Skywalker orchestrates natively.

### TUI

- `ask_operator` uses a full-shell overlay instead of a cramped inset, so the
  question and options are readable on a normal terminal.
- One-shot confirmation flashes (copy, mouse toggle, attach results, reasoning
  effort, stall recovery) now clear themselves after a short TTL. Rate-limit
  waits no longer park on the bottom notice row; the durable error stays in the
  transcript. Live stall notice and landing hold still omit a TTL so they stay
  until replaced.
- Decision-overlay orange is calmer: only the dithered subject spends the accent.

### Fixed

- Responses API cache tokens are no longer double-counted in context occupancy,
  so the fill bar and compaction threshold match actual window use.
- Resume skips mid-file interleaved garbage in `turns.jsonl` instead of aborting
  the session load.
- Oversized tool results pretty-spill into session files and return a
  `tool-output:///` URI (plus an on-disk path when plumbed) instead of a raw
  truncated blob.
- A TTL flash no longer paints chrome after the TUI renderer is destroyed, which
  crashed parallel TUI tests with `TextBuffer is destroyed`.
- Session `stopReason` is set from the typed `ForcedStopReason` only, not from
  free-form strings.

### Security

- **Shell chain approvals no longer skip minting once a chain gets long.**
  Chains of 5+ segments used to be accept-once only — no grant was ever
  persisted, so the same long chain re-prompted every single time no matter
  what had already been approved. Approving a multi-segment chain now mints
  one grant per real segment instead of one grant for the whole string, so
  approving `a && b` also covers `b` on its own later, and long chains behave
  the same as short ones. This is a real change in what a single approval
  buys: granting per segment is strictly more permissive on later commands
  than granting one exact whole-string match was, since a segment now reuses
  outside the chain it was first approved in. Nothing that previously
  auto-approved now prompts, and nothing that previously required a fresh
  decision now silently skips one — chains still ask for any segment that
  isn't already granted.
- Nested interpreter peels (`bash -c 'python -c …'`) that used to misparse and
  auto-allow now fall through to ask.
- Secret-guard denylist paths are realpath'd so a symlink cannot bypass the
  deny under `/yolo` or `--dangerously-skip-permissions`.

### Changed

- First-party skills are how-to playbooks (what to do, in what order, what done
  looks like), not director personas. Identity stays on director system prompts.

## [0.3.1] - 2026-08-24

### Fixed

- Retained worker sessions (`spawn_agent`, resumable via `resume_agent`) now have their own
  retention cap, separate from the TUI's finished-session display cap. Previously they shared that
  20-item cap, so `resume_agent` on an early worker failed with a bare `not_found` once a fan-out
  of more than 20 workers had finished. A session dropped by the retention cap still releases its
  sidecars/reactor/lock entry, always evicts least-recently-used first, and never evicts a running
  session. `resume_agent` against an evicted session now reports its terminal status plus a pointer
  to `read_agent_trace`, instead of `not_found`.

## [0.3.0] - 2026-08-24

### Breaking

- **Turn budgets are gone entirely.** `settings.subagentMaxTurns`, `AgentProfile.maxTurns`, and
  the `maxTurns` argument on `task()` / `spawn_agent` no longer exist. Unknown config keys are
  ignored rather than rejected, so an existing `corbits.json` carrying `maxTurns` will load
  without error and simply stop having any effect. A run now ends on the model's own finish
  signal, an operator interrupt, or a hard error.
- **`AgentProfile.fleetTier` removed** — it was declared but never populated by any loader.
- **`task()` is deprecated** in favour of `spawn_agent` / `wait_agents`. It still works and much
  still routes through it; it will be removed in a later release.
- **Eval harness:** the global soft turn-budget rubric (`--max-turns`, `maxTurns` in case files,
  `overBudget`) is removed. `--agent-timeout-ms` remains as the per-eval bound.

### Agent

- Deleted the sub-agent turn-budget mechanism entirely: `maxTurns` is gone
  from `task()`, `spawn_agent`, `AgentProfile`, director packages'
  `nudge.maxTurns`, and `settings.subagentMaxTurns`; a leaf now runs until it
  produces a report envelope, is cancelled, hits an opt-in wall-clock
  deadline, or stalls — never on a turn count. Removed
  `resolveSubAgentMaxTurns` / `resolveDefaultSubAgentMaxTurns` /
  `clampSubAgentMaxTurns` / `validateTaskMaxTurns` (`src/config/settings.ts`),
  the `turn-budget` stop reason and its report text/parent hint, the
  near-budget `report-forced` wrap-up nudge, and the re-dispatch ledger's
  turn-budget branch (the `higher maxTurns` / re-dispatch-cap hints). This
  also retires the `spawn_agent`/`task()` `nudge.maxTurns` parity fix shipped
  an hour prior — with the mechanism itself gone, that parity is moot.
  `task()` is now marked deprecated in favor of `spawn_agent` + `wait_agents`
  for new call sites; it is not removed since most dispatch still routes
  through it. Removed the false "hard cap 4 workers" claim from director
  prompt text (no such cap exists anywhere in the fleet code). The unused
  `maxTurns` field on project/named profile files (`.corbits/profile.json`,
  `~/.corbits/profiles/<name>.json`) has been removed since nothing read it —
  a silently-ignored knob is worse than no knob. If a run needs stopping, the
  operator interrupts it (`interrupt_agent`) rather than the harness enforcing
  a count.

- Added `interrupt_agent({ target })` and `resume_agent({ target, message })`,
  the second half of reusable worker sessions: `interrupt_agent` stops a
  retained worker's current turn while keeping it and its context alive
  (distinct from the permanent `close_agent`), and `resume_agent` sends new
  work into a retained worker's existing session, reusing its prior context
  and tool outputs rather than starting fresh. Both are gated to orchestrator
  tiers via the existing fleet-verb mechanism, denied to leaves. `interrupt_agent`
  fires a signal scoped only to the in-flight `agent.send()` call, never
  `close()`, so it cannot hit the close()-ordering workdir-lock issue tracked
  separately — the underlying reactor cycle keeps running in the background
  (there is no lower-level stop primitive for that in the vendored agent), so
  this is an approximation: it stops the caller from waiting, not the
  worker's compute.
- `evaluateSubAgentStop` now always requires the final assistant text; the
  omitted-text branch that unconditionally completed a tool-less turn is
  removed, so every call path gets the `incomplete-report` nudge and salvage
  when a tool-using run ends in envelope-less narration.
- `spawn_agent` no longer refuses a second concurrent implement-intent spawn
  against the same working directory — running multiple agents against one
  worktree is allowed by design, and the refusal was guarding against churn
  that resolves on its own, not corruption.
- `fleetRecords` (the store behind `wait_agents`) now caps how many full
  reports it holds in memory; past the cap, the oldest report already
  delivered to a caller is compacted to a status-only tombstone pointing at
  `read_agent_trace` for the detail, so an uncollected report is never
  evicted ahead of one that's already been picked up.
- Worker sessions spawned via `spawn_agent` now persist after their turn ends
  instead of being torn down: a clean completion leaves the session open and
  reusable. Added `close_agent(target)` to permanently close a session
  (descendants closed first, bounded by a ~30s cleanup deadline per session
  so a wedged descendant cannot hang the call) and `resume_agent(id)` to
  reopen a retained, completed session. Sessions now carry an explicit
  lifecycle status (`pending_init | running | interrupted | completed |
  shutdown | not_found`) alongside the existing display status.
- Fixed four resource-leak / false-success bugs in the retained-session
  lifecycle above: a retained session is now released (its close handle
  invoked, its reactor and LSP sidecars torn down) once it falls out of the
  same finished-session cap every other session already used, instead of
  being exempt from any bound; `cancelAll` and session teardown (`/clear`,
  closing a session) now release every still-open retained session, not
  only ones still mid-turn; `close_agent` called while a worker's agent is
  still being constructed now waits for it (bounded by the same close
  deadline) instead of reporting a false "shutdown" over a session nothing
  can ever release again; and a session salvaged by a deadline or a cancel
  no longer reports as resumable once its agent has actually been disposed.

## [0.2.109] - 2026-08-24

### Agent

- Removed `AgentProfile.fleetTier`: no loader ever populated it from any config
  format, so it was declared but unreachable. Fail-closed behavior is
  unchanged — a profile-sourced orchestrator is still denied `task`/
  `search_agents` with no supported opt-in.
- Removed the default 30-turn leaf sub-agent ceiling; an unset `maxTurns` now runs unbounded (explicit budgets still apply).
- Deleted two unenforced orchestrator prompt rules: a "4 workers at once" fan-out cap and a same-agent lane-disjointness rule.
- Sub-agent forced-stop outcomes (turn budget, no-progress, deadline,
  cancelled, etc.) are now classified from the structured stop reason the run
  reports directly, not by re-parsing the parent-facing report's prose.
  Removes the `isXxxSubAgentReport` classifier family and per-reason parent
  hint functions in favor of a single structured switch.
- Removed the `never-edited`, `never-acted`, and `no-ship` sub-agent salvage
  classes and the sticky hard-block that refused an identical re-dispatch
  after one fired. `task` re-dispatch is never refused now; turn-budget
  salvage still throttles repeated same-brief retries. Also removed the
  now-dead shell-write half of the shell-evidence detector (read detection
  for `requireEvidence` is unchanged) and the shell-write contribution to
  `editedPaths` diagnostics.

### Internal

- Removed the dead Ink-era kill ring copy (`src/tui/kill-ring.ts`); the OpenTUI
  prompt kill ring (`src/tui/prompt-kill-ring.ts`) is the sole implementation.
- Extracted the shared timeout-race helper (`src/util/budget-race.ts`) used by
  the shell-guard search budget and the tool-execution watchdog, replacing two
  independent copies of the same `AbortController` + `setTimeout` race.
- `runtime-bridge.ts` now re-exports `mapReactorLike` from `stream-event-map.ts`
  instead of wrapping it in an identical local function.
- Removed degenerate-repetition detection outright: the streamed-text loop
  detector, the tool-fingerprint period/cycle thrash check, the
  turns-since-user-message backstop, and the leaf no-progress (identical
  tool-call) counter. These were pattern-matching heuristics layered on top
  of the transport/policy line the harness actually needs — provider stream
  error handling, connection retry/backoff, and the turn budget — and had
  become a source of false-positive stalls without a clear win rate. The
  turn budget stop and the director's soft tool-only check-in nudge are
  unchanged; nothing else in this run/stop chain was touched.

## [0.2.108] - 2026-08-24

### Agent

- Tier 3 leaf workers can now report via `submit_result`, a typed channel alongside
  the markdown envelope that validates against a director-declared shape and
  returns a correction (capped at 3 rounds) on an invalid submission.
- **`spawn_agent` / `wait_agents` split the fused spawn+wait out of `task()`.**
  `spawn_agent` starts a worker and returns immediately with `{ agent_id,
  status: "running" }` — it never awaits the worker's completion. `wait_agents`
  blocks until any of the given (or, if omitted, all currently running)
  agent ids reaches a terminal state, or `timeout_ms` elapses (default
  30s, clamped to a 300s max); a timeout is not an error and never touches
  the workers — they keep running and stay waitable. Lets an orchestrator
  fire several workers in one turn instead of serializing one `task()` call
  per worker. `task()` is unchanged and remains the single-call spawn+block
  primitive for the common one-worker case.

- **Fleet authority tiers are now runtime-enforced, not documented in a prompt.**
  Every director package carries a required `tier` (`orchestrator` /
  `nested-orchestrator` / `leaf`): skywalker gets full fleet control, greybeard
  (and any package with `spawn.maySpawn`) is scoped to its own subtree, and every
  other director gets no fleet verbs at all. The gate lives in code
  (`src/subagent/authority.ts`, wired into `runSubAgent`'s tool-mount point) and
  fails closed: a caller whose tier cannot be resolved — including a
  project-local or plugin agent profile with `orchestrator: true` that has not
  explicitly opted in via `fleetTier: "nested-orchestrator"` — is denied
  `task`/`search_agents` rather than silently trusted. This is the foundation
  the next fleet-control verbs (spawn/list/steer a live agent) land against;
  the subtree-scoping rule for those is written and tested but not yet wired to
  a live call site. `task()` is unchanged and still the only spawn verb.

- **Retry recovery no longer multiplies with the harness's own retries.** The
  director's inference-recovery layer previously re-issued a full-context
  `infer()` call for `timeout`/`retryable` errors even though the harness's
  own retry policy already retries and exhausts those categories before
  surfacing them — compounding to up to 9 identical full-context sends per
  logical turn in the worst case. The director now only recovers
  internal-recovery aborts (a category the harness never retries on its
  own), so the two layers no longer multiply. Attempt counts are now logged
  on each recovery so retry storms are visible in traces.

- **`read_agent_trace` lets an orchestrator inspect a worker's on-disk trace
  directly**, so a cancelled or interrupted worker's completed work is no
  longer invisible just because its in-memory session record is gone. Reads
  turns, tool calls, and tool errors straight from the worker's
  `turns.jsonl`, tolerating a partially written or malformed line without
  failing. Every response is bounded on four independent axes — turn window,
  entry count, per-entry characters, and total output characters (the first
  three multiply, so a total-output ceiling caps them together) — each with
  a hard maximum the caller cannot exceed, and a truncated response says
  exactly what was left out and how to page for the rest. A Tier 2 nested
  orchestrator can only read its own descendants' traces, enforced by
  reusing `SubAgentSessionStore`'s existing parentSessionId chain
  (`assertCanTargetAgent`'s first live call site); leaf directors never see
  the tool at all. `progress_note` for leaf workers is a separate,
  not-yet-implemented follow-up.

### Permissions

- **Quoting or backslash-escaping a redirect target, a dangerous flag, or a
  program name no longer bypasses auto mode's shell rules.** The auto-shell
  policy used to blank out quoted text before matching its rules, so `echo hi
  > "file"`, `echo hi >|file`, a quoted `-c`/`-i` flag, a quoted `install`
  subcommand, or a quoted upload-tool name all slipped past the
  file-mutation, dependency-install, and network-upload rules — including one
  level of quoting inside a `bash -c` payload. Matching now dequotes the
  command the way a real shell would (only the operator characters `> < | &
  ; \`` are neutralized when they occur inside a quote, everything else stays
  literal, and a backslash-escaped quote never opens or closes a span), and
  the file-mutation redirect pattern now also recognizes the `>|` / `>>|`
  clobber form.

### Fixed

- **Interrupting a turn no longer risks a startup crash.** If an interrupt hit
  the agent mid-teardown, a failed close could leave its in-process workdir
  lock stuck held, and the immediate rebuild threw "an agent is already open"
  as an unhandled rejection. A failed close now short-circuits the rebuild
  with a clear, catchable error instead of retrying a doomed second
  acquisition.
### TUI

- **The approval overlay no longer pushes the prompt box off screen or clips
  itself at the bottom.** On a short terminal the fixed context budget behind
  a permission/operator approval could ask for more rows than its frame had,
  so the resolver fell back to sizing it below its own render minimum — the
  overlay's border and choices painted past the frame, or vanished entirely,
  while the prompt box was still on screen but the thing the operator needed
  to answer was not. The overlay's context text now shrinks (down to dropping
  it entirely on the shortest terminals) so the header, every choice's row
  budget, and the prompt box at its floor always fit together; choices win the
  row budget over context detail when a terminal is too short for both.

## [0.2.107] - 2026-08-24

### Agent

- **Oversized tool output is recoverable instead of lost.** When a result from
  grep, `run_shell`, `search_files`, `web_fetch`, or an MCP tool exceeds the
  inline cap, the full output is now written into the session's blob store —
  committed alongside the turn that produced it — and the truncation notice
  names the `tool-output:///` URI to read it back with `read_file`. Previously
  the tail was discarded, so recovering it meant re-running the command.

- **A worker's write scope is checked against other live workers, not declared
  up front.** The static per-director write-path allowlist is gone; it could
  never express what actually matters (this dispatch owns these paths), and no
  shipped director ever set it. Concurrent lanes sharing a working directory are
  now recorded as a conflict the operator can see, rather than pre-locked.

### Interface

- **Short xAI rate limits are no longer reported as quota exhaustion.** A brief
  HTTP 429 from xAI/Grok was classified as a spent plan, so the transcript said
  "Quota exhausted — usage limit reached" when the operator could retry
  immediately. Those are now retryable rate limits with the matching copy, and
  genuine usage-limit responses still surface as quota exhaustion.

### Internal

- Reasoning effort is a first-class axis for the capability eval runner
  (`--effort`, or a third segment in a matrix cell), and `--config` now composes
  with provider OAuth credentials instead of silently discarding them — every
  authenticated run with a settings override previously failed before its first
  turn.
- Dispatch outcome records carry the model that actually served the run, so
  intervention figures have a denominator and can be read as rates.
- Tool-name classification is unified behind one module; auto-allow membership
  is unchanged and pinned by a test.
- Director prompts no longer reference tools their tier cannot call, and the
  four-heading report contract is stated once rather than three times.
- Removed `report.requiredSections`, which every director declared and nothing
  read.

## [0.2.106] - 2026-08-23

### Agent

- **`apply_patch` can update files again.** Its Update operation read the target
  through the line-numbered `read_file` view and then tried to match the patch's
  raw context lines against it, so every context-bearing update failed with
  "failed to find expected lines in file." Updates now read the file's real
  content. This was the codex-family edit path, and its most likely symptom was
  the model retrying the identical patch.

- **A worker that succeeds is no longer refused on its next dispatch.** Salvage
  classification matched free-text substrings, so a finished report whose Summary
  merely mentioned "no progress," "cancelled," or "long silence" was recorded as a
  forced stop and blocked an identical re-dispatch for the rest of the session.
  Classification is now exact. A parallel wave where one worker salvages and
  another succeeds also stops leaving the brief blocked.

- **Large files read in one pass instead of many.** A truncated `read_file` now
  returns a continuation handle that resumes exactly where it stopped, rather
  than telling the model to re-read the same path at a new offset. Following a
  spent handle explains what happened and names the file and offset to resume
  from, instead of a bare "not found."

- **Edits show what changed.** `edit_file`, `write_file`, `delete_file`, and
  `apply_patch` return a bounded diff of the change, so nothing needs a
  verification read to confirm the edit landed. The harness already re-read and
  compared after every write; that result now reaches the operator and the model.

- **Reasoning survives resume, and corrected retries win.** On the Responses
  adapters, reasoning items were dropped whenever a turn carried no model field —
  including on resume — while the tool calls they produced were kept, a shape
  known to degenerate reasoning models. Duplicate tool results also kept the
  stale first copy, discarding a corrected retry. Tool names now route through
  the wire-safe codec on all three adapters.

- **Compaction stops discarding the prompt cache.** Compacted prompt prefixes are
  byte-stable across passes, so a compaction no longer invalidates the cache in
  full, and a shallow reclaim no longer re-triggers compaction immediately.

- **Per-model loop visibility.** Mid-stream degenerate-repetition aborts are
  recorded per detector with the measured value beside its threshold, so the loop
  rate can be read per model instead of inferred.

### Interface

- **The context meter tells the truth after `/new`, `/clear`, and compaction.**
  It resets rather than reporting pre-clear usage, and re-syncs to the compacted
  size rather than blanking to zero.

- **Compaction is visible when it happens.** Folding turns away now shows in the
  TUI instead of the transcript quietly shrinking.

- **The status indicator no longer flashes "awaiting response" mid-fan-out.**
  During parallel tool calls the first tool to finish used to mark the turn idle
  while its siblings were still running.

### Safety

- **Connecting a provider verifies the token can actually be used.** OAuth
  onboarding completed on tokens carrying no API scope, so the first real request
  failed in a way that looked like a Corbits bug. Onboarding now probes the
  provider and blocks with an actionable message when the token definitively
  lacks access — a network failure or rate limit does not block.

- **Approval volume is measurable.** Every permission ask and how it settled is
  recorded — tool, rule, mode, outcome, and timings, with no command text, path,
  or argument in the record — with `bun run scripts/approval-forensics.ts` to
  read it back.


- **Resuming a session no longer shows a blank error when the saved history
  has one corrupted line.** A malformed or schema-invalid line anywhere in the
  saved transcript used to abort the entire resume load. The TUI's resume view
  now skips just the bad line (logging it) and still shows the rest of the
  history; a corrupt file still surfaces as an error during live conversation
  loading, where correctness matters more than availability.

- **Every stop and nudge is now logged, and so is what each dispatch produced.**
  `interventions.jsonl` in the worker's trace dir records each intervention with
  its measured value beside the threshold it crossed, the model family it fired
  on, and the run state at that moment — plus refused parent re-dispatches and,
  now, one outcome record per completed dispatch (the salvage kind or a
  clean-complete marker, plus the dispatch count). `bun run
  scripts/intervention-forensics.ts` aggregates them: counts by family, value
  distribution against threshold, two context columns (stops on runs that had
  already edited files, stops before half the turn budget — not a measured
  false-positive rate), and outcome counts by kind. Threshold changes can now
  cite data instead of judgment.

- **Shell file work counts as evidence.** A worker that edited with `sed -i`, a
  heredoc, or `>` redirection had `editedPaths` empty and salvaged as
  `never-edited` — a sticky hard block that then refused the parent an identical
  re-dispatch; one that read with `cat`/`head` salvaged as `incomplete-report`.
  Both are real work classified as no work. `run_shell` commands are now scanned
  for file reads and writes using the same subject expansion the auto-shell
  policy uses, so `bash -c` and `env -S` payloads are inspected rather than
  trusted.

- **Re-read pressure no longer stops a worker.** The `reReadLimit` thrash hard
  stop and its soft `re-read-nudge` are removed: reading one file four times
  while editing another, paging a large file, or re-running a grep to verify an
  edit could all end a healthy worker with a sticky hard block that refused
  re-dispatch. Fingerprint period detection already catches a genuinely
  repeating read cycle, on the evidence that it repeats. `src/subagent/thrash.ts`
  now only tracks read/edit evidence for the `intent=implement` and critique
  completeness checks, plus the near-budget wrap-up nudge.

## [0.2.105] - 2026-08-23

### Permissions

- **Every approval ask and how it settles is now logged.** `approvals.jsonl`
  in the session dir records each consequential decision — auto-mode
  allow/deny, or an operator prompt's allow-once / allow-with-scope / deny /
  timeout / abort — with the classifier rule that triggered it, queued /
  displayed / settled timestamps, and shell chain segment count. No command
  text, path, or credential is ever recorded; writes are fire-and-forget and
  never fail a run. `scripts/approval-forensics.ts` aggregates across local
  sessions.

### Agent

- **Context estimate syncs incrementally on append.** `syncFromTurns` keys
  prefix turns by object identity and estimates only the new suffix. A rewrite,
  shrink, or middle-turn identity break still fully recomputes so image-aging
  cannot leave a stale total.
- **Thinking-only replay no longer collapses into an identical request.** Assistant turns with no text or tool_call (empty content, leftover thinking/citation) are replaced with a stable `[thinking-only turn omitted]` marker so the turn is kept, roles still alternate, and the next `buildRequest` body differs from the previous one.

- **Compaction keeps scored work, not retry loops.** Errored tool results are no
  longer auto-pinned; identical errors collapse to one representative. Anchors
  are scored (writes, successful task completions, plan updates) and pair
  closures count against `maxAnchorTurns`. The LLM summary is workflow-aware
  and skips degenerate assistant text.

- **Prefix-stable summaries and growth hysteresis.** Existing compacted user
  turns stay byte-identical across later passes; new folds become later summary
  turns with an assistant spacer so the prompt prefix can stay in the KV cache.
  After a compact that remains over the high watermark, the governor waits for
  usage to grow by 10% of the window before re-arming. Overflow recovery still
  compacts immediately.

### Plugins

- **`run_shell` no longer defaults to a 15s timeout.** Omitted timeout arms no
  timer (match Pi). Pass a per-call `timeout`, or set `shell.timeoutMs` in
  settings, to bound a command. `shell.maxTimeoutMs` still clamps a resolved
  timeout and does not invent one on its own. Abort and the output-byte cap are
  unchanged.

### Sub-agents

- **Sub-agent `maxTurns` no longer hard-caps at 100.** Default remains 30 when
  unset; values must still be integers ≥1. `task(maxTurns)`, profile
  `maxTurns`, and `settings.subagentMaxTurns` may exceed 100 for long jobs.

### Internal

- **`inference.error` partials keep the provider error.** `partial.jsonl`
  records for `inference-error` now include `error` (`category`, `message`,
  `statusCode` when present) even when the cycle streamed no text.
- **Exec `turnsUsed` follows the run-sink.** Mid-run and terminal `run.json`
  snapshots use `getTurnCount()` the same way the TUI does, instead of
  writing the initial zero until send finishes.

### Docs

- **`latest` is a symlink, not a session.** Naive globs of a project
  sessions directory double-count unless they skip `latest` (`listSessions`
  already does).

## [0.2.104] - 2026-08-23

### TUI

- **Taller live chain-of-thought preview.** Parent reasoning still paints
  through the existing thinking row (one fold per turn, settle-to-opener +
  expand) — no separate mid-turn stream lane. The hard-capped live wrap rises
  from 3 to 10 inset lines (`LIVE_THINKING_MAX_LINES`) so mid-turn CoT is
  glanceable; reveal rate stays 28 chars/sec. Sub-agent Task-row thinking is
  unchanged. Assistant mid-turn text continues to grow the open streaming
  assistant row from `inference.text.delta`.

- **Live agents sit in a chrome strip above the prompt.** Running and
  finished workers no longer compete with the transcript for vertical
  space; the strip stays parked over the input, finished rows linger
  briefly, then it clears when idle. Transcript task-row rewrites pause
  while the strip owns live status.

### Tools

- **`edit_file` filler args no longer count as a second mode.** Models pad
  the unused mode with `start_line: 0` / `end_line: 0` / `old_string: ""`.
  Those now count as absent, so substring vs line-range is chosen from the
  real fields. Mixed-mode calls still reject, and the error names exactly
  which fields to drop so a retry can differ.

- **`task` rejections name only the missing field.** A typed brief that
  omitted `prompt` used to be told both `description` and `prompt` were
  required, so the model retried the identical call. The error now names
  the actual gap and echoes the valid field back.

- **Truncation no longer promises a retrievable remainder.** Tool results
  cut at 80,000 chars now say the discarded tail is gone and re-running
  yields the same cut, instead of pointing at a `tool-output:///` blob that
  only held the truncated text.

### Sub-agents

- **Parents and the TUI see why a child stopped.** Forced stops (repetition,
  stall, deadline, turn-budget, no-progress, operator cancel, thrash) carry
  a machine-readable `Stopped:` line on the report and a reason on the
  child's session. Fleet rows announce `<lane> stopped — <reason>` instead
  of a silent done/cancelled.

- **Repetition detection covers short-phrase, counter, emoji, and
  zero-width floods.** The periodic window floor drops to 8 chars (with a
  higher repeat bar so healthy lists stay quiet). A digit-folded pass
  catches incrementing counters and fence/emoji floods; a contentless-growth
  check flags streams of invisibles that used to normalize to healthy text.

### Providers

- **Cross-provider replay no longer 400s the rest of the session.**
  Switching model/provider mid-session used to replay foreign thinking
  signatures and output-only blocks the new adapter cannot encode. Every
  adapter now sanitizes persisted history before `buildRequest`: drop
  unmappable blocks, strip foreign signatures, and synthesize dangling
  `tool_result`s.

- **Grok and OpenAI Responses set `prompt_cache_key` per session.** Codex
  already did; xAI and Go Responses did not, so Grok threads cached at
  ~66–72% versus Codex's 92%+. Parent and each sub-agent thread get a
  stable, distinct key.

- **TUI first inference waits for Codex instructions refresh.** The TUI
  used to fire the refresh un-awaited, so turn 2's request prefix could
  change under a live cache key and force a full miss. Delivery now waits
  for that promise (non-Codex profiles skip it; a failed refresh still
  falls back to cached/bundled copy).

- **Codex Responses no longer sends `reasoning.summary: "auto"`.** ChatGPT
  Codex rejects that value for gpt-5.6-terra / gpt-5.3-codex family models
  (HTTP 400 at turn 0). The adapter now sends `{ effort }` only, matching
  Codex CLI catalog `default_reasoning_summary=none`.

- **Codex native tools proxy onto Corbits tools.** `apply_patch`,
  `exec_command`, and `update_plan` from Codex-family models land on the
  real file, shell, and `manage_tasks` handlers instead of being rejected
  as unknown names.

### CI

- **Required checks are `prettier`, `eslint`, `typecheck`, and
  `build-and-test`.** The old combined `lint` job (cached, continue-on-error)
  never reported the status contexts the main ruleset required, so every PR
  sat blocked. Lint result caches are gone in CI; local `bun run lint` still
  uses `--cache`.

## [0.2.103] - 2026-08-23

### TUI

- **In-flight tool rows show elapsed time.** Ordinary pending calls (MCP,
  search, shell) tick a live clock the same way Task rows already do, so a
  slow-but-alive call is distinguishable from a hung turn.

- **The stall notice comes down the moment activity resumes.** It is a live
  diagnosis, not a sticky banner: a tool finishing or the turn settling
  clears it on that paint, even if the monitor tick has already been
  cancelled.

### Tools

- **MCP tool calls arm their own watchdog.** Default 5 minutes
  (`settings.mcp.timeoutMs`), still capped by `tools.maxTimeoutMs` when set.
  Expiry returns a model-reactable tool error; the turn is not aborted.
  `task` and `run_shell` behavior is unchanged.

### Sub-agents

- **Successful leaf `task` completions re-arm the primary backstop.** A
  productive fleet no longer hard-pauses solely from turns-since-operator
  volume. Failed or salvaged leaf reports get no credit, so true tool-only
  no-progress still nudges then pauses.

- **Leaf no-progress repeat limit raised from 2 to 5.** Legitimate polling
  / retry streaks survive longer before salvage.

### Auth / evals

- **Exec refreshes Codex instructions before first Codex inference**, same
  shared path as the TUI, with best-effort fallback to cache/bundled copy.
  Capability eval cells also stamp instructions hash, built-in tools, and
  requested reasoning effort for triage.

- **New capability eval cases:** misleading-symptom, flaky-diagnosis,
  broken-toolchain, hidden-contract-inventory (held-out tests), and
  impossible-spec (reward-hacking bait).

### CI

- **Codex instructions unit mock restores `node:fs` in `afterAll`.** The
  leaked in-memory fake had been poisoning later suites under
  `bun test ./src ./tests ./evals` since the mock landed.

## [0.2.102] - 2026-08-22

### Permissions

- **Workspace containment returns canonical real paths.** Writers receive the
  realpath from the containment allow, closing the symlink-retarget window
  between check and write; the write-path allowlist compares both sides in
  canonical space so symlinked cwds don't false-deny.

- **Dangling or looping symlink components fail closed.** A path component
  that exists but cannot resolve (dangling link, symlink loop) is denied by
  containment and the write-path allowlist instead of being treated as a
  missing tail; genuinely-new file paths still resolve via the nearest real
  ancestor.

### Trust

- **Project-trust stores are keyed by realpath.** The same repo reached via
  symlink twins (e.g. `/tmp` vs `/private/tmp`) now finds the same grants;
  the saved `repo` field and validity compare canonicalize consistently.

### TUI

- **Typeahead popups no longer leak queued permission gates.** Both the
  @-mention popup and the slash-command palette refresh their suggestion
  lists in place instead of close+reopen, so a queued gate can't open (and
  swallow keys) mid-filter. Zero matches shows "(no matches)" without
  releasing the popup; Enter there preserves the typed text.

## [0.2.101] - 2026-08-22

### Permissions

- **`/yolo` persists as the user-global skip-permissions default.** Exec
  inherits it; `--dangerously-skip-permissions` still forces the current
  process. Secret-guard and authz still apply. The TUI shows a startup notice
  (and exec a stderr warning) when prompts are disabled by the saved default.

- **Always-allow for `git worktree *` now covers later worktree commands.**
  Contained and permitted-sibling worktree add/remove segments no longer hit
  the restricted-path guard before grant matching, so a standing grant
  applies instead of re-prompting on every dispatch. Force flags, chained
  commands, and genuinely-outside destinations still prompt.

- **Empty workspace roots can no longer disable path containment.** An empty
  string in the roots list used to make every absolute path count as
  contained; it is now rejected before the prefix compare.

### TUI

- **The stall watchdog no longer aborts healthy waits for the model.** A run
  that is merely awaiting the model's next token (after submit or after a
  tool batch resolves) surfaces a persistent stall notice but is never
  auto-aborted; auto-abort is reserved for a stream that started emitting
  and then died mid-flight. Live sub-agents and open permission gates keep
  their existing exemptions.

### Sub-agents

- **Thinking-token loops now trip the repetition detector.** Thinking deltas
  feed the same cycle buffer and abort path as visible text, with a
  short-period digit-folded check that catches monotonic counters (`0/1 1/2
  2/3 …`) without flagging healthy templated enumeration; the looped window
  is flushed to `partial.jsonl` for diagnosis.

### Trust & plugins

- **Project-trust stores are atomic, serialized, and cwd-correct.** Saves go
  through temp-file + rename behind a per-store mutation queue; a store
  missing its `repo` field is invalid (empty grants); plugin trust paths
  resolve against the project cwd, never the process cwd, and relative
  entries are dropped on load.

- **Repo plugins with `defaultEnabled` load agent profiles**, matching how
  skills already gate; tool plugins remain consent-gated. A later same-id
  install can no longer silently turn a bundled default off.

### CI

- **ESLint + Prettier land with a split concurrent CI** (lint / typecheck /
  build-and-test) with dependency and lint caches; `bun run check` is the
  single pre-PR gate. The lint job is non-blocking until the repo-wide
  mechanical fix batch lands.

## [0.2.100] - 2026-08-22

### Plugins

- **Requested `run_shell` timeouts are no longer capped at 10 minutes.** The 15s
  default when timeout is omitted is unchanged. `shell.maxTimeoutMs` still
  clamps the command when set.

- Capability evals accept `--concurrency <n>` (env `CORBITS_EVAL_CONCURRENCY`,
  default 1); overlapping `httpFixture` cells isolate `EVAL_HTTP_URL` so
  parallel web-bait runs do not share a process.env origin.

### TUI

- **Tool `run()` no longer has an implicit 11-minute wall-clock abort.** The
  outer watchdog arms only when Settings set `tools.timeoutMs` /
  `tools.maxTimeoutMs`, or when `run_shell` passes a positive `timeout`
  (requested plus slack, so this layer cannot beat shell-guard). Unset
  settings leave `task` and other tools unbounded; parent cancel, maxTurns,
  and eval `--agent-timeout-ms` still bound the run. `tools.maxTimeoutMs`
  still clamps non-shell tools when set and does not cap a longer requested
  `run_shell`.

- **`task` (sub-agent dispatch) is always exempt from the generic tool-execution
  watchdog**, even when Settings arm it. Workers past 11 minutes with healthy
  activity complete and return their own report instead of surfacing as
  operator cancels; maxTurns, no-progress, thrash, and the opt-in `deadlineMs`
  remain the operative bounds.

### Directors

- **Skywalker spawn-target for product code is `build`.** Prompt and
  skill copy that still said `spawn implement` / `task(agent="implement")`
  now dispatch `build`. Intent graph `explore → implement → critique`
  and slash `/implement` are unchanged.

- **Skywalker may DIY tiny product writes (CL-6629).** Path tools
  (`write_file` / `edit_file` / `delete_file`) remount on the primary
  session. Tiny/single-file/one-route bounded edits are the exception;
  spawn remains default for substantial/multi-file/parallel/specialist
  work (hard cap 4 workers). Docs/design still spawn shakespeare /
  bruckheimer / brand-reviewer except one-line fixes. Greybeard stays
  write-free. Shell file-writes stay denied. Spawn is a judgment call,
  not a tool ban.

- **Exec and capability evals can run as a chosen primary director.**
  `corbits exec --director <id>` (and eval `--director`) overlays that
  package's system prompt and initially-advertised tool set on the product exec path.
  Omit / skywalker keep the default Skywalker session. Directors that
  cannot spawn (for example build) do not mount `task`. This is an
  exec/eval/CI override, not a TUI or single-agent mode.

## [0.2.99] - 2026-08-21

Skywalker is the primary orchestrator over a closed director fleet: product write tools stay off the primary, and you cannot spawn Skywalker as a task leaf. Workers are not done until they return the four-heading report. First-party action skills ship as slashes; eval runners require an explicit provider/model pair; the style skill no longer refuses non-git folders.

### MCP

- **Late-connected MCP tools are callable the same turn they appear in `tool_search`.**
  `@intx/agent` snapshots dispatch names at `createAgent`, and the post-connect
  reload that used to rebuild that snapshot waited for every server — including
  one stuck on OAuth. Cataloged `mcp__*` tools then returned `unknown tool`.
  Construction now dispatches misses through the live runner, so Linear/Exa
  (and any other server that finished) work even while another server still
  needs auth.

### TUI

- **Model picker rows are model-first.** Each leaf is `model * [provider]`;
  `(current)` still marks the live session model. **Alt+D** persists the
  focused pair as the default (global `defaultProvider` + provider
  `defaultModel` + project-local selection) without switching the live
  session or closing the picker.

- **Settled permission and operator prompts no longer recap into the chat.**
  The overlay is the question; answering it used to leave a grey
  `permission` / `operator` card restating the same command and the chosen
  option. After a decision those recap rows are gone — the tool row that
  follows is the outcome. Expanding a collapsed payload while the overlay is
  still open still writes the full payload into the transcript, because that
  text would otherwise be unreachable before approval.

### Directors

- **Shipped directors have no writePaths lock.** Docs/design leaves
  (shakespeare, brand-reviewer, bruckheimer) still mount write tools, but
  package `writePaths` is omitted. Lane routing (P/A/I, DESIGN.md, product
  discovery) is spawn policy, not a file lock. Optional `writePaths` remains
  and the permission gate still enforces it when a profile sets it.
- **Skywalker is not a task leaf.** `task(agent=skywalker)` is refused. The
  spawn catalog (`directorProfiles()`) lists the other 15 closed directors;
  the primary session is still Skywalker.

### Sub-agents

- **Tool-less mid-run narration is not a finished report.** A worker that
  stops tooling with Summary-only (or other incomplete) prose is not
  complete. The director injects one wrap-up nudge asking for the four
  headings (Summary / Findings / Blockers / Paths), then salvages as
  incomplete-report if the next tool-less turn is still missing the envelope.

### Plugins

- **First-party skills catalog is on out of the gate.** `corbits-skills`
  ships action slashes `/implement`, `/plan`, `/refactor`, `/review` (was
  `/code-review`), `/pull-request-review`, `/create-issue` (was
  `/linear-create`), `/scribe`, `/interview`, `/ast-grep`. Dispatch,
  git-rebase, linear-issue-workflow, style, philosophy, typescript, and
  opsh stay `use_skill` only (`user-invocable: false`). Draper and emil
  are not skills or slashes — closed directors via `task(agent=…)` only.
  `/plan` is the eng change-plan recipe (`task(agent="plan")`; does not
  implement or file tracker issues). `/create-issue` remains the tracker
  command: Linear MCP when available; otherwise `ask_operator` for the
  platform and persists `Preferred issue tracker` in `.corbits/MEMORY.md`
  (GitHub via `gh issue create`). Each recipe tells Skywalker to spawn
  closed directors — the operator types the slash; the primary does not
  do the work. Turn the catalog off in `/plugins` if you want those
  commands gone.
- **Style skill no longer refuses non-git folders.** Edits, tests, and
  reports are allowed without a repository. Do not `git init` unless
  asked. Commits, amends, rebases, and isolated worktree dispatch still
  require an existing repo.

### Evals

- **Capability eval workdirs are git repos.** After copying the fixture
  and seeding skill stubs, the runner initializes the tmp workdir (`git
  init`, `git add -A`, one unsigned hermetic `eval fixture` commit) so isolated
  workers have HEAD and git-aware skills have a baseline.
- **Eval runners require an explicit model pair.** `eval:capability` and
  `eval:public-swe-one` take `--provider` / `--model` (capability also
  accepts `--matrix` with complete cells) so local `.corbits/settings.json`
  is not the implicit target.
- **Capability eval records `task` tool calls.** `taskToolCallCount` is derived
  from the turn stream (informational). Older result files without the field
  default from `toolCallsByName.task` so the frozen baseline still parses.
- **Capability eval smoke cases for dispatch and recall.** `complex-dispatch-spawn`
  requires at least one `task()` plus a working GET /readyz.
  `complex-recall-after-bulk-read` plants a token, asks the agent to read the
  fixture, then write it back. Informational only — not in the frozen
  baseline-0286 gate until a deliberate refreeze. Neither case proves
  compaction fired or that the primary skipped implementing the route.

### Session

- **Resume is keyed to this checkout's git toplevel.** Linked worktrees no
  longer share (or list) each other's sessions — `--git-common-dir` made
  every worktree show every other worktree's history. Sessions previously
  created from a worktree remain under the main checkout key; resume from
  the main path to recover them.

## [0.2.98] - 2026-08-17

Corrupt resume state no longer kills sessions, Codex quota errors name the
reset window, and provider/model selection is more reliable across restarts and
mid-session switches.

### Session

- **Poisoned resumes recover.** Resume loads no longer die on null-padded
  `turns.jsonl` data after a stale compaction window. Usable turns are recovered,
  valid metadata is preserved, and pending gates re-arm instead of leaving the
  session wedged.

### Codex

- **Quota errors explain the reset.** Codex `usage_limit_reached` responses are
  parsed as quota exhaustion, show the plan/profile when available, include the
  reset ETA, and point `/model` at another subscription instead of looping on a
  doomed retry.

### Sub-agents

- **Workers follow a mid-session model switch.** Sub-agents spawned after you
  switched models kept running against the provider the session started on, so
  switching away from an exhausted or disconnected account left every new
  worker failing until a restart. Provider, model catalog, and settings are now
  read live at spawn time, so tier settings written mid-session are visible too.

### Breaking

- **Single-agent session mode is gone.** The primary session is always
  orchestrator-capable (`task` / `search_agents` always available). The first-run
  mode picker and Settings → Session rows are removed. Legacy `sessionMode` in
  settings files still loads without error and is ignored (CL-5814).
- **Dual-column fleet rail removed.** TUI geometry is stack-only forever
  (`layoutMode: "stack"`, `railWidth: 0`). `DUAL_MIN_COLUMNS` / `RAIL_WIDTH_*`
  constants and dual absolute-positioning of the agents box are gone. Live
  fleet status remains `● Task` transcript rows; the agents chrome zone stays
  empty.

### Fixed

- **Parent live reasoning no longer sideways-scrolls.** Streaming thinking used
  a one-line marquee onto the newest tokens. It now paints a short wrapped
  preview (up to three inset lines of the newest revealed prose); expand still
  opens the full block. Sub-agent Task-row thinking is unchanged.
- **Skywalker dig fleets cascading into stalled Task floods.** "Why stalled /
  why no thinking / spawn looks broken" asks were reclassified as orchestration
  and fanned into parallel explore waves; Grok leaves then sat quiet mid-think
  or looped, which looked like spawn failure and invited another dig wave.
  Skywalker now hard-caps concurrent leaves at 4, classifies digs/screenshots/
  why-how as COMMUNICATION (answer or one explore leaf), and forbids re-fan-out
  diagnostic waves when leaves stall or salvage.
- **Grok sub-agent stall false positives.** Live fleets on grok-4.6 show routine
  60–180s gaps between tool cycles while the model thinks. UI stall paint and
  Grok's salvage kill were far shorter, so healthy thinking looked hung and got
  nudged/stopped mid-inference. `DEFAULT_STALL_MS` and parent `STALL_NOTICE_MS`
  are both 300s (aligned with the 5-minute `subAgentStallTimeoutMs`). The
  grok-responses path asks for `reasoning.summary: "detailed"` so summary
  deltas keep the activity clock moving (auto summaries were tiny vs billed
  thinking tokens).
- **Live fleet status is `● Task` transcript rows again.** The FLEET board /
  dual-rail agents chrome restated the same workers above chat and made
  progress hard to read. `task` calls paint live rows (clock + current tool)
  via `syncAgentProgress`; `formatChromeZones` keeps the agents zone empty and
  suppresses the manage_tasks checklist while any lane is running.
- **`web_fetch` / `web_search` always advertised.** They were registered but only
  discoverable via `tool_search`, so strict providers (and thrashy models) never
  saw them on the wire despite Skywalker saying they were mounted. Both are now
  in `CATALOG_TOOL_NAMES`. Capability `web-bait` hard-requires
  `webFetchToolCallCount >= 1` via `requireBehaviors`.

### Added

- **Public SWE-bench one-shot smoke.** `bun run eval:public-swe-one` runs Corbits
  product exec on a single SWE-bench Lite instance (default
  `psf__requests-3362`), taking `--provider` and `--model` on the CLI, and
  writes `preds.jsonl` under `evals/public/results/`. Official Docker
  resolved/not-resolved grading stays optional/manual.
- **Capability eval: `complex-stock-gate`.** Multi-file stock-gated `POST /orders`
  (404/409/201 + stock decrement) on the demo-comparison fixture; sync API grader.
- **Capability eval: `complex-idempotent-orders`.** Header-driven Idempotency-Key
  on POST /orders (201/200/409) with multi-file order store; sync API grader.
- **Capability eval: `complex-bugfix`.** SWE-bench-style issue→patch→tests on the
  new `tests/fixtures/buggy-service` fixture (intentional post GET bug; users green).
- **Capability eval: `complex-pagination`.** Query `limit`/`offset` on GET /products
  (demo-comparison); sync Response grader + slice semantics.
- **Capability eval: `complex-rename-user`.** Cross-file rename of user `name` →
  `displayName` on multi-file-service; runtime + source checks.
- **Fixture: `tests/fixtures/buggy-service`.** multi-file-service clone with a
  deliberate post-route defect for bugfix capability evals.
- **Director API-contract loop (launch tuning iter1).** Implement preserves sync
  public surfaces; critique ranks sync→async signature drift as blocking;
  Skywalker puts stated signatures into success_criteria, skips explore/critique
  on tiny green ships, re-dispatches implement on blocking critique findings,
  and routes URL reads through mounted `web_fetch` (no shell thrash). complex-jwt
  case prompt states the sync Response contract.


- **Closed director fleet (CL-5818 Level 6 wiring).** Sixteen director packages
  under `src/agent/directors/<id>/` (prompts, tool envelopes, spawn rights, nudge
  budgets, report contract) register in `DIRECTOR_REGISTRY`. `task(agent=…)`
  resolves directors without requiring plugin profiles; `task(intent=…)` maps
  implement/explore/plan/review→critique (`general` is refused). Default agent
  profiles are the closed fleet via `directorProfiles()`.
- **Primary is Skywalker by name.** System role answers "Skywalker"; agent id
  `skywalker`. Product mutation tools are not mounted on the primary session
  (structural never-implement), not only prompt policy.
- **Director identity at spawn.** Every package system prompt is prefixed with
  agent id, model role, and optional skills; profiles include `agent id:` in
  description so search_agents / re-spawn are unambiguous.
- **modelRole drives leaf effort.** Spawn effort cascade is pin → package
  modelRole default (intern=low) → orchestrator/leaf → parent. Env block adds
  arch + runtime alongside platform/date/git.
- **No general leaf at the wire.** Bare `task` (no `agent`, no `intent`) and
  `intent=general` fail closed; nested directors enforce `spawn.allowlist`
  (greybeard → intern/explore/critique).
- **Director write-path locks.** Docs/design packages may write only under
  package `writePaths` (shakespeare: PRODUCT/ARCHITECTURE/IMPLEMENTATION;
  brand-reviewer: DESIGN.md; bruckheimer: PRODUCT.md + docs/*), enforced in
  the permission gate.
- **PRODUCT / ARCHITECTURE / IMPLEMENTATION** document the closed director
  fleet, spawn matrix, intent map, and tool envelopes.

### Providers

- **Named API-key instances.** First-class API-key providers (OpenAI key,
  Anthropic, Google, OpenCode Zen/Go, Z.AI, ...) ask for an instance name before
  the key, so personal and team keys can coexist (`openai/default`,
  `anthropic/work`, ...). Reusing an existing name replaces that instance after
  an explicit confirm. Custom endpoints stay free-form and single-entry.
- **API-key connect keeps the project selection.** Connecting an API-key or
  Custom provider now writes the same project-local provider/model selection
  OAuth already wrote, so a restart in that repo resolves to the account just
  connected. Secrets stay in global credential storage only.
- **Grok 4.6 is selectable.** xAI OAuth accounts now list `grok-4.6` alongside
  Grok 4.5 and Composer 2.5 Fast.

### TUI

- **Custom from Alt+A.** The add-provider selector now includes Custom alongside
  first-class kinds, so free-form OpenAI-compatible endpoints are reachable from
  the model picker without dropping into onboarding. Custom still uses the full
  manual form (name, base URL, key, model).
- **MCP auth is `mcp !` on the prompt box.** A server waiting on authorization
  no longer takes a notice-row sentence (`mcp granola needs auth (/mcp)`). The
  top rule carries a compact `mcp !` immediately left of the model label;
  `/mcp` still names the servers.

### Docs

- **Contribution rules are codified.** The pull request template and agent docs
  now spell out the expected commit, review, and Linear-linking discipline.
- **Models-only connect prose.** PRODUCT, IMPLEMENTATION, and operator-facing
  error strings document `/model` as models-only with **Alt+A** to add a
  provider. Stale bare-`c` / Ctrl+A / in-list "connect ->" instructions are gone.

## [0.2.97] - 2026-08-10

Codex connect works again: streaming responses no longer die on a missing
header, multiple ChatGPT accounts can be connected by name, and providers are
added from the model picker with Alt+A.

### Providers

- **Codex streaming repaired.** Some Codex models (the gpt-5.6 family) stream
  valid responses with no Content-Type header, which failed every turn with
  "Cannot detect response kind". The response protocol is now recovered from
  what the request asked for, so those models work; genuinely malformed
  responses still fail loudly.
- **Named accounts with re-auth.** Browser sign-in asks for an account name
  first, so any number of ChatGPT or Grok accounts can be connected side by
  side (`codex/work`, `codex/personal`, …). Reusing an existing name
  re-authorizes that account after an explicit confirmation — the recovery
  path for expired sign-ins. Second sign-ins can no longer silently overwrite
  an existing account's credentials.

### TUI

- **Alt+A adds providers.** The model picker lists only connected accounts
  and their models; Alt+A opens an add-provider selector that always shows
  every provider with its connected-account count, so adding a second account
  is never blocked. After connecting, the picker reopens focused on the new
  account.
- **Connect works mid-session.** Adding a provider from a running session no
  longer crashes with a renderer conflict; the sign-in surface shares the
  session's screen and hands control back when done.
- **Pickers stay on screen.** Overlays opened after using one on the launch
  screen no longer render below the prompt box.

## [0.2.96] - 2026-09-08

Drag-select auto-copy, a flat type-to-filter model picker, install-aware upgrade
notices, quieter long-session compaction, and layout breathing room.

### TUI

- **Drag-select auto-copy.** With mouse capture on (the default), finishing a
  drag selection in the transcript writes the selected text to the system
  clipboard on mouse-up. Highlight clears immediately; the status flash waits
  for the clipboard write (`Copied …` on success, `Copy failed` on error).
  Alt+C structured copy uses the same honesty. Alt+M still hands the mouse
  back for native terminal selection.
- **Flat model picker.** Choosing a model is one type-to-filter list of
  `provider / model` rows — no nested provider drill-down. Type to narrow,
  Enter selects; Alt+F still toggles favorites when wired.
- **Install-aware upgrade notice.** When a newer GitHub release exists, a
  non-blocking startup notice names the running and latest versions and the
  right upgrade step for Homebrew, source/Bun, deb, release binary, or
  unknown. Network and detection failures skip quietly.
- **Bottom breathing room.** The prompt box sits one blank row above the
  terminal's last line on tall enough terminals, so the layout no longer
  feels flush against the frame edge.
- **User-message breathing room.** Your turns in the transcript keep a blank
  bar row above and below the message text, so prompts are easier to spot
  while scrolling.
- **Landing survives MCP connect failure.** An MCP status failure still shows
  as a system notice and no longer wipes the mountain landing screen.

### Session

- **Quieter re-reads under compaction.** When the same file is read more than
  once in a long session, older successful `read_file` results become a short
  stub and the newest stays whole, so context is not filled with duplicate
  file bodies. Chunked reads of different ranges stay distinct. Errors stay
  verbatim.
- **Changelog watermark honesty.** Upgrade notes are no longer marked as
  “already shown” when nothing was actually displayed.

## [0.2.95] - 2026-08-09

Tool-only auto-pause that no longer stops healthy work, resume the last session
in a folder, and `/feedback` that just sends.

### Tool-only pause that tracks real thrash

- **Hard pause requires a repeating tool-call cycle**, not a bare tool-only turn
  count. Period detection catches identical repeats, A/B alternation, and longer
  fixed rotations; a short identical poll (re-run a flaky test, check a build)
  no longer false-positives.
- **Soft wrap-up nudge at 25 tool-only turns** for every model family — a
  check-in, never a stop. Grok drops its miscalibrated 6/10 pair and shares the
  default; its shorter sub-agent stall timeout and finish-bias residual stay.
- **Raw-count backstop** for cycles above the period ceiling or phase-broken
  patterns: first a progress-summary nudge, then a hard pause only if another
  full interval passes with no genuine operator message. Synthetic system sends
  (compaction continuations and the like) no longer reset the counter.
- Shared **period-detection** helper lifts the character-stream repetition search
  so tool fingerprints reuse the same shape; a local forensics script re-derives
  thresholds against real session traces.

### Resume and continue

- **`corbits resume` / `corbits continue`** reopen the latest session for the
  current project folder, a specific session id, or the interactive picker.
- Invalid ids error instead of silently falling through to “last”; id and
  `--pick` cannot be combined. Legacy session trees still migrate on resume by
  id.

### Feedback

- **`/feedback`** sends free-text product feedback when you choose to. Bare
  `/feedback` waits for the next line; text on the same line sends immediately;
  empty Enter cancels. Other slash commands clear a pending arm.
- The reply is a short system notice (**Thanks — feedback sent.**), not a model
  turn — no busy state, no queue.

### Usage analytics

- Settings describe optional ambient analytics clearly, and say when an
  environment setting has disabled them so the toggle cannot re-enable.
- Generation properties use PostHog cost names: `$ai_cache_read_input_tokens`,
  `$ai_cache_creation_input_tokens`, `$ai_reasoning_tokens`.
- Broader auth and slash product events.

### TUI and CI

- Markdown settle waits for body paint so heading-only frames no longer flake CI.
- `--help` exits 0 cleanly.

## [0.2.94] - 2026-08-09

Orchestrator-first release: a truthful fleet board, thrash salvage that stops
false completes, steering that keeps your input, and one TUI root. Goal mode
is gone. Coupled Interchange packages are vendored at head.

### Fleet

- **One fleet board** replaces the agents strip and task panel — identity,
  elapsed time, and what each leaf is doing, clamped to the rows it was granted.
- **Lane tools show a subject**, not just a tool name: a bounded, secret-scrubbed
  preview of path / command / pattern on the board and dispatch trailer.
- **Task dispatch collapses to a sentence** (description, else prompt) instead of
  dumping raw argument JSON; expanded detail uses real line breaks.
- **Fleet progress reports without a prompt**; bursts settle to one row per agent;
  a mid-rebuild drop surfaces a not-delivered notice.
- **`/new` and `/clear` wipe the painted transcript** and cancel live sub-agents
  so orphans do not keep burning tokens under the old session.

### Thrash and leaf salvage

- **`intent=implement` that never edits is not a successful complete.** Tool-using
  leaves that never write salvage as never-edited and hard-block identical
  re-dispatch (same path as never-acted and thrash).
- **Soft mid-run re-read nudge** before the hard thrash stop: implement leaves are
  asked to edit or wrap up; explore leaves are asked to expand findings or change
  approach — never forced into edit.
- **Format characters no longer break loop detection.** Zero-width spaces, BOM,
  bidi marks, soft hyphens, and word joiners are stripped before period detection.

### Steering and interrupt

- **Queue and steer are one mid-run gesture**; stop-and-reinject cuts the current
  turn and puts a new instruction in its place.
- **Queued operator input survives Ctrl+C** instead of being discarded.

### Permissions and workspace

- **`--dangerously-skip-permissions` reaches pre-gate sandboxes** (path-escape,
  delete, list_dir, shell cwd). Secret-guard path denies and authz hard blocks
  are unchanged.
- **Contained git worktree ops auto-allow in auto mode**, through the same
  workspace-containment authority as shell path restrictions.
- **`manage_tasks` no longer asks for approval.**
- **Queued approval timers arm only when the gate is shown.**

### Goal mode removed

The goal subsystem is gone end to end — runtime, TUI chrome, slash commands, and
docs. Continuous work is the orchestrator plus task dispatch.

### TUI

- **OpenTUI shell flattened into `src/tui/`** — one product root (path rewrite only).
- **Landing snow paints**; mountain and hero survive startup load notices.
- **Slash popup** shows `/name` only; Ctrl+O palette and bare `?` are removed.
- **Semantic activity ticker**; skill and agent names highlight in the prompt;
  duplicate pasted images are rejected by content hash.
- **MCP auth banner clears** after mid-session re-auth succeeds.

### Sessions and process

- **Active-run liveness is one write**; crashed sessions no longer list as running
  forever; a rotated session stays crash-coverable.
- **SIGINT / SIGTERM / SIGHUP terminate the process**; a detached throw restores
  the terminal before exit.

### Providers and onboarding

- **In-session provider connect actually connects**; onboarding validates a
  credential before reporting a provider as configured.
- **Model picker no longer overwrites the persisted default** when you only
  inspect models.
- OAuth success footer links the product site and GitHub.

### Vendoring, telemetry, hygiene

- **`@intx/types`, `@intx/storage-isogit`, and `@intx/inference` vendored at
  Interchange head** (local inference patches reapplied); licenses recorded and
  re-sync documented.
- Process-wide session id on every capture; PostHog AI events in privacy mode;
  expanded anonymous product event catalog.
- **Grep results go through the secret scrub.**
- Shared helpers for grep truncation, MCP tool identifiers, pricing tree walks,
  and grant scoping; nightly random-seed CI job dropped.

## [0.2.93] - 2026-08-08

Running several sub-agents at once was close to unusable. The watchdog meant to
catch a hung run was killing healthy ones, approvals piled up one at a time and
printed twice, and the panel showing what each agent was doing had collapsed to
a line of counts. This release fixes that path end to end.

### Sub-agents were being killed mid-run

- **The stall watchdog aborted healthy parallel fan-outs.** Any silence counted
  as a hang, and in a fan-out the first sub-agent to finish flipped the run back
  to awaiting-a-response while the rest still worked. Since the parent emits
  nothing while children run, the whole run read as silent: a no-response notice
  at ninety seconds, then an abort of everything in flight at fifteen minutes.
  The watchdog now consults the outstanding tool calls it was already tracking.
- **The clock also ran while you read an approval.** Blocked-on-the-operator is
  now part of the turn state rather than something only the painter derived, so
  the watchdog and the phase line read one source. Gates still queued behind
  another are covered, not only the one on screen.

### Approvals

- **A grant no longer has to be given once per agent.** Minting one now settles
  every queued request it already covers. The reconciliation lives in the
  permission layer behind a single idempotent settle, so it holds for any
  surface and cannot double-resolve or strand a request. Session teardown denies
  whatever is still queued instead of abandoning it.
- **Every approval wrote two transcript rows.** A screen of approvals read as
  twice as many requests as had happened. There is now exactly one row per
  decision — including denials, timeouts, and aborts, which previously wrote
  nothing, so a refused permission was indistinguishable from a hang.
- **Project-scoped grants never matched a sub-agent.** A grant was stamped with
  the session root while a sub-agent asks from its own git worktree, and the two
  were compared as plain strings — so the agents generating the approvals could
  never benefit from an earlier answer. Both sides now resolve through the
  worktree registry that already governs path containment, by exact match rather
  than prefix.

### Watching the work

- **The live agents panel is back above the prompt** — one row per running
  sub-agent with elapsed time, current tool, and whether it has gone quiet.
  Rows hold position instead of reordering on each event, the zone shrinks a row
  at a time under a short terminal rather than disappearing, and when a fan-out
  exceeds the space the quietest agent stays visible. Rows are measured in
  terminal columns, so a wide-character description cannot overflow the zone.

### Turns that never ended

- **Goal mode stuck at "working" indefinitely.** Two events registered the same
  tool call under different identities — one by id, one by name — so a call was
  counted twice and cleared once, and the turn waited forever on work that had
  finished. Goal mode was worst affected because it continues on its own and
  never emits the fallback that settles a stalled turn.
- `run.json` records its turn count at every turn boundary rather than only at
  session start and end, so a resumed session reports what it actually did.

## [0.2.92] - 2026-08-07

A second sweep over the OpenTUI cutover, plus a rebuilt model surface. Two of
these faults could end a session outright, and several were behaviour that had
been fixed once already and lost when the renderer was replaced.

### Model selection

The picker lists providers first and descends into models on select, with
Escape returning to the provider level. Recents and favourites stay flat at the
top, and each account appears as its own row.

- **Model tiers are gone.** `settings.tiers`, `profile.tier`, and the
  `task(tier=)` argument no longer exist, and `/fast`, `/standard`, and
  `/clever` are retired rather than remapped — a tier was a per-name fallback
  chain, which neither a favourite nor a pinned model expresses. Per-agent
  selection continues through `profile.inference`. A settings file containing
  `tiers` still loads; the key is dropped on save.
- **The context meter was wrong by nearly four times** for any provider with a
  custom name. An account-qualified identity did not match the registry, so a
  500k window read as the 128k default. Resolution now tries the identity as
  given, the bare model id, and the canonical provider/model form, and marks a
  figure as estimated only when it genuinely falls back.
- The current model is read from the live session rather than inferred from the
  most recent pick, which mislabelled any session that never opened the picker.

### Sessions could be killed outright

- **Switching models poisoned the conversation permanently.** A reasoning
  signature issued by one provider was replayed to another that could not
  decrypt it, and every subsequent turn failed with HTTP 400. Signatures now
  carry the provider that issued them, so two backends sharing a model name
  cannot replay each other's. Switching accounts on the same provider still
  preserves reasoning continuity.
- **A model that fell into a loop ran unbounded.** Repetition is detected by
  character period within a streaming cycle, and by comparing cycle
  fingerprints across tool calls, so a loop that emits a tool call each pass is
  still caught. Ordinary narration repeated before successive tool calls is
  not.

### The screen

- Plugin diagnostics wrote raw to stderr and corrupted the frame. They now go
  through the log sink, and the warnings that used to vanish with them are
  surfaced where the operator can see them.
- The provider setup screen garbled its own text on short terminals — rows were
  compressed into one another instead of clipping.
- The command palette matches the prompt box width, drops its marker column,
  kind column, and title rule, and marks the selected row by colour rather than
  a grey band.
- An open overlay reserves its own border, title, and content rows before any
  other chrome is allowed to starve it.
- **`/resume` was offering sessions that did not exist.** Demo fixture data was
  shipping in the production bundle and rendering whenever a dependency was
  missing. A missing dependency now produces an honest empty state.
- Dialog choices read as plain English rather than internal names.

### Context and state

- Compaction stopped hollowing out the turns it had just decided to keep. A file
  edit inside the recent window keeps its content.
- `run.json` is finalized when the process crashes, without reading from disk on
  the crash path.
- An `@`-mentioned file outside the workspace is inlined once rather than
  blocked, gated by the sensitive-path list and a total byte cap. That list now
  covers shell histories, system credential files, keychains, browser cookie and
  login stores, and cloud credentials.

### Agents and the machine

- **An agent could rewrite your global git configuration to push**, altering
  every repository on the machine. That now requires operator approval, and a
  scoped push path applies credentials per invocation with nothing written to
  any config file.
- `present`, `manage_goal`, `manage_tasks`, and `lsp` are advertised only when
  they apply.
- Live progress appears on a dispatched sub-agent's transcript row.
- The most recently queued message can be cancelled.

### Development

- **The test suite only passed in one order.** Bun mutates the namespace object
  returned by `await import()` when a module is later mocked, so the usual
  capture-then-restore idiom silently reinstalled the mock process-wide. Under
  randomized order the suite produced over a hundred failures; it now passes
  across every seed tried, and CI runs a fixed seed on each change plus a
  rotating seed nightly.
- `docs/TUI.md` states how the terminal UI is meant to look and behave —
  overlays, selectors, the palette, the prompt box, scrolling, and key macros.
  Nine documents describing the finished migration are retired.

## [0.2.91] - 2026-08-07

A bug-fix release on the OpenTUI cutover. Most of these faults had no visible
symptom: sessions that hung with no way out, memory that grew without bound,
and session state that quietly corrupted itself.

**One behaviour reverses from 0.2.90.** That release gave the mouse to your
terminal so drag-select and copy worked normally. Scrolling then landed in the
prompt instead of the chat, because a terminal with mouse reporting off
translates a wheel tick into arrow-key bytes indistinguishable from a real
keypress — and arrows drive prompt history. The main session shell now takes
the mouse: the wheel scrolls the transcript, arrows still cycle prompt history,
and click-to-expand on tool rows and drag-to-scroll work without pressing
Alt+M first. The cost is native drag-select in the transcript; Alt+M hands the
mouse back when you want to select text, and Alt+C copies a message, tool
output or diff without the mouse at all. The onboarding and session pickers
keep native selection either way.

### Fixed

**Sessions could hang with no way out.**

- Pressing Esc on a permission or operator prompt abandoned the request the
  agent was waiting on. The session hung permanently and Ctrl+C did not
  recover it — the interrupt path never reached that promise. Dismissing now
  resolves it as a denial.
- Goal-mode auto-deny and the tool-watchdog abort were both inert. The
  producer sent a timeout and an abort signal; a locally redeclared event type
  in the renderer silently dropped both, so an unattended run could park on a
  permission prompt forever.
- A permission or operator prompt raised before any transcript row existed
  rendered its title and footer but clipped its choices, because the layout
  asked for room for exactly one option regardless of how many there were.
- Messages typed while the agent was working were queued and never sent. The
  drain waited on a signal that fires once at shutdown rather than at each
  turn boundary.
- A detached throw left the process alive with the event loop held open. Real
  `uncaughtException` and `unhandledRejection` handlers now write a crash
  report and exit non-zero.

**Memory and state grew or drifted without bound.**

- Transcript rows were retained for the life of the process; a 600-row cap was
  lost during the cutover and never restored.
- History past 500 rows could not be reached by scrolling, and every appended
  row rebuilt the whole painted window.
- Concurrent writes to a session's `run.json` are serialized per session, so a
  late progress snapshot can no longer resurrect a finished run as `running`.
- Resuming a session reset `turnsUsed` to zero and dropped its connected MCP
  servers.
- Quitting during an @-mention lookup or a clipboard read could write into
  freed renderer memory.

**The context meter lied, and compaction could not act.**

- The meter read only provider-reported usage with no fallback, so a provider
  that omitted usage left it frozen while real occupancy climbed. It now falls
  back to a local estimate and marks the number as approximate.
- The meter and the compaction governor computed context size from different
  fields, so they could disagree by the full size of the prompt cache.
- The system prompt and tool schemas are counted, having previously been
  omitted from the estimate entirely.
- Compaction armed at a turn count where the compactor was guaranteed to do
  nothing, then re-armed, spinning without progress. Both now derive their
  floor from one definition.

**Input and rendering.**

- Pasting several lines into a terminal that does not negotiate bracketed
  paste sent each line as a separate message.
- Markdown headings no longer flicker while the text below them streams.
- Parallel `task` dispatches paired results to calls by tool name, so three
  concurrent sub-agents could resolve the wrong rows and append orphans. They
  are keyed by call id.
- The onboarding and session pickers no longer turn on mouse reporting, so
  drag-select works there.

### Changed

- The sub-agent concurrency cap is removed. Sub-agents run unbounded, and the
  `maxConcurrentSubAgents` setting no longer exists — an existing settings
  file containing it still loads. Setting it to `0` previously disabled
  sub-agents entirely; that capability is gone with it.

## [0.2.90] - 2026-08-07

The interactive TUI is now OpenTUI. The Ink renderer is deleted, not
feature-flagged, so rollback is the prior tag rather than a setting.

**What moved under your hands.** Ctrl+Enter (or Ctrl+J) inserts a newline;
Shift+Enter only works on terminals that report the modifier. The mouse belongs
to your terminal by default, so drag-select and copy behave normally — Alt+M
takes the mouse when you want click-to-expand or drag-scroll. Quitting is
unchanged: Ctrl+C interrupts, twice exits.

### New Features

- **OpenTUI renderer** — zone-based geometry resolver with per-zone minimums and
  an explicit collapse order, replacing React reconciliation.
- **Multi-line composer** that wraps and grows to 40vh before it scrolls.
- **Copy mode** (Alt+C) writes to the system clipboard on macOS, Windows, and
  Linux, with an OSC 52 fallback for content selection cannot reach.
- **Free-text answers to operator questions** — type a reply instead of picking
  from a list, which the tool had always promised and the interface never had.
- **Live status for hooks, subagent progress, MCP connections and grants**,
  which were emitted but had nothing listening.

### Fixed

- **Standalone binary could not start.** `build:bin` excluded its own native
  module, so a distributed binary had no `node_modules` to resolve it from.
- **Terminal-owned selection.** Mouse reporting is off by default; while it is
  on, the terminal forwards drags to the app and cannot select text.
- **Copy wrote nowhere.** Alt+C had always written to an in-memory array.
- **A crash left the terminal wedged.** An uncaught throw kept the alternate
  screen, mouse reporting and raw mode, and the process survived.
- **Bidirectional overrides reached the approval overlay**, so text could read
  as one thing and run as another at the moment of approval. Model output is
  sanitized too, including sequences split across streaming deltas.
- **Search output ignored its byte cap** on a breach, and had no cap at all on
  hosts without ripgrep.
- **Repeated tool calls dropped every result after the first.**
- **A retried turn painted itself twice.**
- **Approval text wrapped by code units, not columns**, so wide characters
  overflowed the subject being approved.
- **Native buffers leaked** on every transcript repaint, landing clear and
  shell dispose.
- **Onboarding truncated a pasted API key at 1000 characters** without saying so.
- **A question could arrive with no way to answer it** when another overlay
  already held the screen.
- **Resumed sessions dropped `view`, `plan` and `tasks` blocks** silently.
- **Ctrl+D quit mid-edit.** The host claims no key of its own now.

### MCP

- **Authorization moved out of the transcript and into `/mcp`.** A server
  needing OAuth used to dump a raw authorization URL as a transcript row at
  session start — unactionable, uncopyable, and gone once it scrolled away. The
  notice row now names the servers waiting (`mcp granola needs auth (/mcp)`)
  and clears when they connect; nothing blocks usage, an unauthorized server
  simply has no tools.
- **`/mcp` is a real surface** listing every configured server and its live
  state — connected with tool count, needs auth, or failed with the reason.
  Enter on an unauthorized row opens its authorization page in the browser and
  copies the link, so the flow also works over SSH.
- **The OAuth callback page carries the brand.** One page now serves MCP
  servers and inference providers alike, on the terminal's own palette, with
  the mark animating through the same dithered draw/fill timeline as the
  landing. It names what happened — "Linear connected successfully", "Granola
  failed to connect" — and humanizes server names and error codes on the way
  in. Entirely inline: a local authorization callback makes no network call.

### Permissions

- **Shell-block messaging** cites host safety and OOM risk, and names the
  bounded `grep`/`search_files` tools as the alternative, rather than reading as
  a tool-routing preference. Open-ended `find`/`rg`/`grep -r` still hard-deny.
- **Pure directory listing outside the workspace auto-allows again** — `ls`, and
  `tree` bounded by `-L`/`--max-depth` to depth 10. Content readers still ask.
  Unbounded recursive listing (`ls -R`, bare or over-deep `tree`) asks even
  inside the workspace.
- **`tree -o` no longer auto-allows** — a listing command that writes a file is
  not a listing command, and it had been bypassing `write_file` review. Long
  `--recursive` spellings on `ls`, down to every unambiguous abbreviation, are
  caught too.

### Known Issues

- **Shift+Enter** does not insert a newline on terminals that do not report the
  modifier. Ctrl+Enter and Ctrl+J do.
- **Markdown flickers mildly while streaming.** The deterministic cause is
  fixed; a residue remains from the async highlighter.
- Transcript history past 500 rows cannot be scrolled to, and rows are retained
  for the life of the process.
- A detached throw or a signal can leave a session marked running.

## [0.2.89] - 2026-08-05

Patch: models-first `/model` picker and OpenCode Go subscription billing pin.

### New Features

- **Models-first `/model`** — open on a Recent / Favorites / all-models list; Alt+A / Alt+F for favorites; connect is auth-only for Tier A first-class providers.
- **Tier A connect catalog** — OpenAI dual-path (ChatGPT login vs API key), Anthropic, xAI, Z.AI, OpenCode Zen, OpenCode Go; no OpenRouter/Copilot in the first-run list.

### Fixed

- **OpenCode Go billed as Zen PAYG** — central `isOpenCodeGoProvider` / `isOpenCodeGoProviderId` identity; force subscription `OPENCODE_GO_BASE_URL` at catalog load, `buildProviderEntry`, `resolveProvider`, and inference source build so a wrong disk `baseURL` cannot mis-bill.
- **Go model on Zen path** — `isGoModelOnZenPath` warning when a known Go model sits on a credits-billed Zen provider.
- Recent/favorite model prefs serialize writes so concurrent toggles cannot clobber each other.
- Empty success toasts and double-recording of recent models on apply.

## [0.2.88] - 2026-08-04

Hotfix: Homebrew standalone binary failed on first TUI launch.

### Fixed

- Standalone release binaries no longer externalize `react-devtools-core`, which broke first TUI launch after Homebrew install (`Cannot find package 'react-devtools-core'`).

### Changed

- Homebrew formula is **`corbits-code`** (`brew install corbitsdev/tap/corbits-code`). The CLI binary remains `corbits`.

## [0.2.87] - 2026-08-04

Patch release: always-on PerfTrace measurement stack, session state under `~/.corbits/projects`, post-upgrade release notes in the interactive banner, and related Codex/TUI polish.

### New Features

- **Always-on PerfTrace** — in-process span API, ring buffer, and privacy-strict tag allowlist (`src/perf/`). One span model for turns, inference (TTFT/stream), tools, permission waits, and subagents. No settings required for local measurement.
- **Offline dump + rollup** — `dumpSpans` and pure rollups by phase/turn/session; TTFT vs stream shares.
- **Attribution report** — exclusive wall-time shares (inference / tools / permission / subagent / other), open-turn stall dumps, CLI `bun scripts/perf-report.ts`, operator guide in `docs/perftrace-attribution-guide.md`.
- **Opt-in OTEL export** — settings/env surface (`OTEL_EXPORTER_OTLP_*`, `~/.corbits/settings.json` `otel` block) plus OTLP HTTP JSON sink. Fail-closed config; dump-safe header redaction. Targets Phoenix, PostHog OTEL, or any OTLP collector — separate from PostHog product analytics.
- **Latency eval harness** — assert phase presence and relative magnitudes in tests (`assert-spans`, multi-tool fixture).
- **Reasoning effort by agent role** — orchestrator vs task-leaf defaults so high-effort leaves stop multiplying wall time.
- **Session state under `~/.corbits/projects`** — project key from git toplevel (worktrees share); dual-read migrate from in-repo `.agent-state`; path-restriction exception for the global state root.
- **Post-upgrade release notes** — on a fresh interactive start after upgrade, show bounded Keep-a-Changelog sections in the session banner; stamp `lastChangelogVersion` in global settings; first install is quiet; `/changelog` and `/changelog full` for on-demand history. Ships `CHANGELOG.md` next to release binaries.
- **Streaming stall / loop detection** — trailing-window repetition detection; preserve partial streamed output in exec and TUI; partial-capture lifecycle owned by the cycle recorder.
- **Nested UI polish** — quieter chrome, context meter, task/shell rows, observe-leave behavior.
- **Approval queue re-eval** — when a grant widens, re-check the pending queue; stored approvals evaluated through `@intx/authz`.
- **Task re-dispatch cap** — parents stop re-dispatching identical thrashing / budget-exhausted briefs.

### Fixed

- Hard-deny shell authz through `env -S` / split-string payloads (including empty payload and end-of-options forms).
- Streaming markdown tables stay on one column-width set (no mid-stream realign / raw-pipe degradation).
- Shell approval modal scroll, expand, and agent-label display; shared scroll-window math.
- Worktree preserve: do not drop stash when unknown or detached HEAD advanced; count gitignored-but-present files as content worth keeping. (related main commits)
- Judge shell auto-allow and restriction against the process cwd; queued-grant coverage uses the session path restriction.

### Changed

- Package rename: root package is `@corbits/code` (was `corbits`).
- Homebrew release tap points at `corbitsdev/homebrew-tap`.
- TUI root and event log split into focused modules (assembly vs presentation).
- Sub-agent tool description no longer claims an incorrect working-tree isolation model.

### Docs / tooling

- `docs/PERFTRACE.md` — local sink, OTEL config, collector examples, relationship to product telemetry.
- Codex request parity checklist (spike, no production behavior change).
- Codex SSE golden fixture pack + parse tests.

## [0.2.86] - 2026-07-30

Patch release: agents use the core tools. Every behavior change validated by a before/after eval matrix on grok-4.5 — pass rate 19/21 → 21/21, total turns 312 → 106, input tokens 2.8M → 1.1M, zero sub-agent churn on the stall fixture.

### New Features

- Built-in `web_fetch` (native fetch, markdown output, SSRF guards) and `web_search` (keyless hosted providers) replace the plugin-only web tools ().
- Per-project `settings.env` supplies shell environment as configuration instead of commands.
- Model-family policy drives the directors: main sessions get a wrap-up nudge and a loud auto-pause on runaway tool-only loops; silent sub-agents get a continuation nudge then a clean stop; grok thresholds tightened ().
- A shared prompt discipline block steers every model to dedicated tools, single-purpose commands, and finishing behavior ().
- The capability eval is now a behavior gate: bait cases, behavior metrics, repeat runs, provider pinning with loud mismatch failure, and honest baseline comparison ().

### Security

- Command substitution inside double quotes stays visible to grant replay ().
- Persisted grants no longer key on model-authored comment lines ().
- Chains of five or more segments are approved once only; env assignments (including `env -S` smuggling, scanned deny-first) and upload-shaped network commands now ask ().

### Fixed

- Sub-agents receive the web tools and project env the prompt promises them; the family policy reaches interactive sessions; approval and error copy states thresholds and next steps.

## [0.2.85] - 2026-07-29

Patch release: shell permission hardening, sub-agent dispatch controls, and a live TUI test suite.

### Security

- Command substitution (`` `...` ``, `$(...)`) no longer auto-allows, and substituted paths stay visible to the restricted-target check.
- Authz-hard-blocked commands deny at the gate instead of showing an Accept button.
- Restricted targets are re-checked when replaying a stored grant.
- Glob metacharacters are escaped in persisted exact-command grants.
- Relative `pluginPaths` entries are dropped at trust migration instead of resolving against the launch directory.

### New Features

- Task tiers resolve OAuth providers from the live catalog.
- Typed task spawn contract: intent, success criteria, do-not list, report focus, with intent-driven soft defaults for tools, tier, and turn budget.
- Sub-agent thrash detection with re-read caps and a one-shot wrap-up nudge near the turn budget; Grok leaf agents get a finish-bias prompt residual.

### Fixed

- A stale approval-prompt resume no longer unfreezes a newer tool-budget pause.
- The TUI test suite runs again (1105 tests were dark from a Bun isolate regression).

## [0.2.84] - 2026-07-29

Patch release: permission-approval hardening and plugin trust fixes.

### Fixed

- Tool timeout freezes while a permission prompt is open; toggle via Settings → Tools.
- Path-added plugin trust is global, revocable from `/plugins`, and survives directory changes.
- Install docs and package metadata point at corbits-code and the `dist/corbits` binary.

### Changed

- Chained shell commands prompt once for the whole chain; multi-segment grants are exact-match only and the modal strips spoofing characters.

## [0.2.83] - 2026-07-27

Patch release: reverts the inline transcript renderer.

### Fixed

- **Alternate-screen transcript restored** — the inline renderer emitted committed history into the terminal's native scrollback, so a running session could be scrolled out of, and a live tail shorter than the viewport left a large blank region between the transcript and the prompt. Reverts the differential-inline cutover, bringing back the full-screen alternate buffer, mouse-wheel scrolling, and the app-owned viewport.

## [0.2.82] - 2026-07-26

Patch release: safety, subagent performance, TUI polish, persistence correctness, and first-class release packaging. Everything merged after `0.2.81` through `3084b44`.

### New Features

- **`corbits exec` + local capability eval harness** — non-interactive product path and fixture-based capability suite for regression gates.
- **FIFO operator approval queue** — plan, permission, and operator modals no longer race; one gate at a time.
- **Release packaging** — `scripts/release.sh` builds macOS/Linux binaries, checksums, debs, GitHub release assets, and Homebrew tap formula.
- **Diff polish** — background washes on edit hunks and `+N/-M` stats on collapsed rows.
- **Theme-routed chat chrome** — input and slash menu colors go through the theme.

### Safety

- Scrub and truncate MCP tool results; strip terminal control sequences from tool output.
- Secret denylist covers cloud and keychain credential shapes.
- Fail-closed shell pre-approval: no multi-segment grants.
- Auto-mode shell asks when the command targets paths outside the workspace.
- Shell guard allows piped search without unblocking open-ended tree walks.
- Reject `tool-output://` URIs before they reach ripgrep or the filesystem.
- Constrain `@`-mention file resolution to the workspace root.
- Allow sibling worktree paths past pre-realpath path confinement.

### Tools

- `edit_file` line-range edits always run post-write verification.
- Reject conflicting `edit_file` modes (substring vs line-range exclusive).
- Partial `grep` results on ripgrep size cap or timeout.
- Cap long error output and show a pass/fail glyph on shell failures.
- Coalesce stray redirect fragments back into their owning shell command.

### Subagents & performance

- Cache subagent session snapshots by revision instead of cloning on every notify.
- Dedup tool names on the `tool_call.start` path in the session store.
- Skip retaining full turn history when no lifecycle hooks are configured.
- Gate stream drain intervals to streaming and flush on stop.

### Correctness

- Validate persistence boundaries with arktype and unify goal-status enums.
- Record real cache-write token counts instead of hardcoding zero.
- Fall back to 256-color values on non-truecolor terminals.

## [0.2.81] - 2026-07-25

### Changed

- Rename Intercode → **Corbits Code** with `corbits` CLI hard cutover.
- Migrate legacy `.intercode` settings on first Corbits run.
- Minimal anonymous PostHog telemetry with hard opt-out (see `docs/TELEMETRY.md`).

## [0.2.80] - 2026-07-24

### New Features

- Inject full agent profile bodies into `search_agents`.
- Sub-agents can re-read parent `tool-output://` blobs.
- Cancel salvage and optional `task` tier override.
- Claude marketplace plugin discovery when opted in.
- Never-acted salvage when a sub-agent uses no tools.