# Changelog ## [Unreleased] ## [0.2.201] - 2026-09-18 ### Changed - **Parallel work no longer runs in Git worktrees.** A session or worker that needs to write gets its own private workspace instead: real files, materialized by a native volume clone where the filesystem offers one and by an independent copy otherwise, tracked by Unary's own content store and catalog rather than by Git plumbing. Git keeps exactly the jobs it is good at — history, remotes, and the branches you create yourself — and it is no longer asked to isolate concurrent agents, which is where the old automatic worktrees kept getting stuck: a tree that could not be folded back left work stranded behind a merge conflict nobody asked for. Manual worktrees you create stay untouched and keep their own vocabulary. - **Finishing work is now "Smart Merge to Parent".** A private workspace submits a candidate that is built against the parent's ACTUAL current state; if the parent moved in the meantime, the candidate is prepared again instead of applied blindly. A conflict hands over the complete package — base, your version, the target version and the affected paths — so the later contributor resolves it with full context, and there is no partial apply. Every integration leaves a receipt naming its base, contributors and what was deliberately excluded, and repeating it is idempotent rather than a second effect. - **Interrupted work is recoverable instead of lost.** Crashes, takeovers and cancelled workers leave a visible waiting state with its own recovery step; a coordinator takeover fences the old owner and quarantines generations whose processes may still be alive rather than killing them, and unknown liveness always keeps the data. ### Fixed - **A paused worker is no longer killed for its supervisor's scheduling latency.** When the watchdog suspected a worker had stalled it paused it and asked you to decide — and then gave that pause five minutes to live, measured from the moment it started. But only the session itself can answer such a question, and it can only answer between turns: a long model reply, a batch of tool calls, a compaction or its own wait on other workers eats those five minutes effortlessly. In one measured 19-hour session that single rule destroyed 13 workers whose context was completely intact, every one of them while the session was 5 to 18 minutes deep in other work, and the session had already started polling its workers every 10 to 240 seconds purely to beat the clock — roughly one in seven of everything it did was bookkeeping against this deadline. The clock now starts when the decision actually reaches the session's queue rather than when the pause begins, then runs for 30 minutes, with a one-hour backstop so a session that never wakes at all still cannot pin a worker forever. Nothing about a worker that really is stuck has been relaxed: the repeated-identical-step signal still pauses it immediately. - **A finished session showing “busy” forever is fixed where it was caused.** That spinner was what the five-minute rule above had been introduced for, and it came from counting paused workers as unfinished execution. A worker waiting for your decision is now counted as exactly that — waiting for you — so the session settles on its own and no worker has to be terminated to stop an animation. - **A worker in the middle of an expensive step is no longer mistaken for a dead one.** Pausing a worker is delivered as a live interrupt with a quarter-second window to acknowledge, and three unanswered attempts used to be treated as proof of death. A worker deep in a long reasoning call cannot answer in a quarter second no matter how healthy it is, so the most expensive steps were the likeliest to be aborted — 10 further workers in the same session. Termination now additionally requires that the attempts span at least a minute and that the worker is not observably alive. - **A retry no longer starts with the budget that just proved too small.** A worker that ran out of its time or token ceiling was restarted with exactly that ceiling, so the second attempt spent a full budget arriving at the same wall. Retries after that class of failure now start with a larger allowance; a worker that failed on the quality of its work keeps its original budget, because the budget is not what it failed on. ## [0.2.200] - 2026-09-18 ### Fixed - **A project's sessions are visible again after a branch switch.** The Desktop sidebar routes a project's sessions through three renderers — worktree rows, branch groups, and the flat list — and two of them could hand a session to nobody. `groupSessionsByBranch` dropped every pair whose isolated workspace looked like a managed or foreign worktree, which is correct only while a worktree row actually renders it: once that tree was folded back and removed, no row claimed the session, and because it still matched its project by cwd it never reached the unassigned bucket either. On top of that the flat list and the branch grouping read different sets — the flat list took `activeSessions`, the grouping also took the worktree sessions no row had claimed — while `groupByBranch` requires MORE THAN ONE branch group. A checkout that moved to a new branch therefore marked every session recorded on the old branch as detached (`isDetachedFromMainCheckout` compares the recorded branch against the live one), collapsed them into a single group, and rendered neither that group nor those rows: the project kept its count badge and showed almost nothing. Sessions are now excluded from branch grouping only by the ids the caller says it already renders, and one `planSessionRendering` decision names the renderer AND hands it the exact set, so a pair cannot fall between the flat list and the branch groups. ## [0.2.199] - 2026-09-17 ### Fixed - **Worktree return now explains why it is blocked instead of silently giving up.** Recovery tools can reconnect a session to its own recoverable worktree while preserving files and commits. Ambiguous cases remain safely blocked rather than being reported as a successful return. - **File claims now follow completed turns and workspace changes promptly.** Older operations no longer overwrite newer ownership or erase the next writer's claim. Uncommitted changes remain tracked separately from active editing. - **Chat shows a compact return-status box instead of a perpetual “Folding back…” label.** It displays reported blocking files, owners, conflicts and next steps. Queued returns are not labelled as running, and failed refreshes leave the last report explicitly unconfirmed. ## [0.2.198] - 2026-09-16 ### Fixed - **A branch switch reaches the session list at once instead of up to a minute later.** The Desktop sidebar groups a project's sessions by the branch its checkout is on, but the workspace state relay had exactly one branch-shaped kind — `branch-deleted` — so the most common branch event there is, a plain switch, had no producer at all and the 60 s poll owned the branch subgroup alone. Every checkout path in `crates/unc_rust_workspace/src/git.rs` now reports `HeadChanged` with the new branch, and a switch made OUTSIDE Unary (a terminal `git checkout`) is picked up by a new host HEAD watcher: one non-recursive watch of each registered project's git directory — never the HEAD file itself, whose inode git replaces on every switch — reading the branch out of HEAD rather than spawning `git`, reporting only when the branch actually moved. The sidebar registers the projects it shows (bounded at 64, idempotent, advisory: an uninstallable watch leaves the poll as the backstop), and because the event carries its root, the refresh re-reads ONE project's branch instead of spawning `git branch` per project. - **The first workspace-state event of a burst no longer waits out its own debounce.** `workspace-state:changed` was purely trailing at 250 ms, so a fold-back, a worktree removal or a branch switch spent a quarter second doing nothing before the sidebar even started a worktree measurement that costs seconds. The channel now has a leading edge with a 250 ms throttle, so the burst still collapses to one additional refresh and the first one is immediate. ## [0.2.197] - 2026-09-16 ### Fixed - **A session working in its own worktree no longer asks the user to fold back work the harness is already folding.** The only fold-back text a session ever saw is resolved from a path on every catalog rebuild and may not spawn `git`, so it was state-blind — and it named the user-facing fold-back control beside the automatic path. A session that had finished its work read that as the user's next step and reported the fold-back as homework, while the pending row for its tree was `waiting-owners`/`automatic-transient` with the watcher armed, retrying by itself, waiting only for a foreign live session to release the files it still held. Nothing was stranded and nothing was owed. The live row now rides in the per-request `[Session facts v1]` tail — state, classification, watcher, attempt count, blocking file count and owner — where `waiting-user` is the only state that names a person, `waiting-agent` points at the machine assignment, and an unreadable store reads as "nothing pending", never as "a person must act". The path-derived note no longer mentions the user-facing control at all, because a model that never hears about it cannot hand it over as a task. The pending-fold-back store is read only for a cwd that already has the managed worktree shape, so an ordinary session pays no per-request disk access. ## [0.2.196] - 2026-09-16 ### Changed - **Codex Voice is a voice device now, not a second agent.** It was ported from the Codex CLI with the CLI's own architecture: the realtime model was the conversational front, it owned a `background_agent` tool and a delegation channel, and it handed work to the coding session while it kept talking. That shape shipped a second prompt source — the composer already sends the finished transcript as a user message, so one utterance could reach the session twice — and it made the model's own reasoning and progress chatter audible. The realtime session now only transcribes and reads out. Speech in becomes an ordinary user message to the session model; the only thing ever spoken is that session's finished answer, markdown-stripped, at the real end of the turn — never reasoning, never tool output. No protocol version advertises a tool, a `tool_choice` or a `delegation` target any more, v2 sets `turn_detection.create_response: false`, and a speech gate drops every output audio frame and output transcript that no read-aloud request asked for — including on the WebRTC route, where the composer bar mutes the remote audio element unless that gate is open. The `delegationAckFiller` setting is gone; `speakReplies` now means "read the session's answer aloud", and dictation stays input-only. ### Fixed - **A spoken reply no longer depends on a system notice arriving.** The desktop live feed's end-of-turn speech hook sat in the `system_notice` branch, so a voice plugin read an answer out only when a notice happened to land with that turn and most turns stayed silent. It runs on `agent_end` now, for both voice plugins. ## [0.2.195] - 2026-09-16 ### Fixed - **A worker that had already finished no longer buys a supervision decision turn.** The stall watchdog treated an unreadable sample as a stalled worker: a contended child-snapshot lock — or no active handle at all, which is exactly what a worker writing its handoff looks like — left every evidence field at its default, and the ladder read those unmeasured zeros as "nothing happened", parked the worker, interrupted its active step and woke the parent for a decision. The report then printed `childProcessRunning=false, newOutputBytes=0, filesChanged=false` for measurements it never made, which reads exactly like a real stall. An unobserved sample now yields a check-in and can never nudge, park or terminate; the report prints `snapshotAvailable` and `unknown` for every unmeasured field; a worker whose completion slot is already claimed is skipped entirely; and a park interrupts the child only on loop evidence, because aborting the active step of a merely slow worker destroys the step it was in the middle of. - **A supervision decision the parent can no longer act on is withdrawn instead of delivered.** Staleness was checked only where the decision notice was enqueued, never between that enqueue and the queue drain — so a worker that terminalized seconds after its park still woke the parent, for work whose patch was already applied. The queued wake is now retired by its deterministic id prefix as soon as the record stops awaiting a decision, and the resolution is stamped rather than deleted: resume no longer erases the decision it answered, a cancelled record records `Closed`, any other terminal state records `WorkerTerminal`, and every resolution word now has exactly one production writer. - **File and commit progress are no longer invisible for a whole window after each commit.** The comparison was gated on a non-empty previous fingerprint, so the clean tree that follows a commit — the strongest progress evidence a worker can produce — reported "nothing changed", and a worker without a worktree reported it forever. An unknown baseline is now `unknown` instead of `false`, and a growing message stream with fresh activity withholds the first decision rung's park for a worker that is reading and planning rather than looping. ## [0.2.194] - 2026-09-14 ### Fixed - **A provider pack's own base URL survives the settings pass.** The pass that applies `settings.json` calls `set_provider_base_url(provider, None)` once per provider entry (`None` for an entry that carries only `enabled`/`visibleModelIds`), and `None` means "clear the override". A provider that lives in a pack has nothing to fall back to — it has no entry in the static built-in default table — so the clear wiped the URL the pack declares, on the provider config and on every model row, and the session-level setter did the same to the active model. Every later request then failed with `UnsupportedApi`, "provider … with api … is not implemented in Unary yet", while the dialect, the credential and the pack were all fine and only the endpoint was gone. Both setters now reset to the URL the provider was registered with (the pack's URL first, then the static built-in default), and a provider whose URL exists nowhere else keeps what it carries. - **DeepSeek requests now match the provider's current wire contract.** The official endpoint receives `max_tokens`, native `low` effort stays low, and Strict Function Calling is no longer advertised on the non-beta endpoint. Thinking requests with tools omit the `tool_choice` field that DeepSeek rejects even when it is `"auto"`; reasoning-content replay remains intact. HTTP 402/422 and `finish_reason: "aborted"` now take their deterministic billing, request-body and cancellation paths instead of generic retries or errors. - **A silent or keepalive-only provider stream no longer looks productive for five minutes.** Unary tracks bytes, complete SSE frames, valid JSON and semantic events separately, applies a bounded first-semantic-event deadline, and reports only sanitized counters and elapsed times. This makes an upstream inference stall distinguishable from authentication, request validation and a disconnected socket. ## [0.2.193] - 2026-09-14 ### Fixed - **A model from a provider pack can now actually run.** Listing a pack's provider was only half the path: five production sites still resolved the *model* through the compiled-in catalog, which by construction cannot contain a model that only a pack contributes. Selecting such a model therefore failed at execution time instead of at selection, with a misleading "provider … with api … is not implemented" error. Model resolution now uses the runtime registry, like the provider list already does. ## [0.2.192] - 2026-09-14 ### Fixed - **A provider added by a provider pack now exists in the app at all.** The provider list was built from the built-in, compiled-in catalog, which by construction cannot contain a provider that only a pack registers. A pack under `~/.unary/extensions//providers/*.pack.json` loaded cleanly, registered its provider in the runtime registry, and resolved its models there — but the one list the settings dialog renders and every model picker filters never saw it, so a self-added provider was invisible everywhere at once with no error anywhere. That list now comes from the runtime registry. ## [0.2.191] - 2026-09-14 ### Fixed - **A provider you added yourself now appears in the model pickers.** A provider contributed by a provider pack (`~/.unary/extensions//providers/*.pack.json`) starts life without an entry in `settings.json` — it cannot have one before it is first visible enough to be edited. The provider list treated that missing entry as "not configured" and overwrote the verdict the credential store had just given it, so a provider with a working API key was listed in Settings but absent from every model picker, the agent-mode model list, research and plugin model selection. A missing entry now means "enabled with defaults", exactly as it already did for local providers; switching a provider off explicitly still switches it off. - **The Open IDE button no longer opens a half-finished second app.** It is disabled with a "Unary IDE — coming soon" tooltip while the Desktop app is the only surface under development. - **The pinned chat header keeps naming the newest request while you read back through a long session.** Reading older history prepends pages and evicts the tail, so the loaded window stops holding the newest real human request while it still holds older user rows — and the header answered with the newest row the window happened to contain. At the top of a long conversation that is the FIRST request, which is what the header then showed instead of your last one. The authoritative anchor now owns the identity whenever that request sits outside the loaded window on either side, and only hands it back to a loaded row while the anchor itself is inside the window. - **Saving settings can no longer lose the settings file.** The writer rendered the new state to a `.tmp` sibling and then, on Windows, DELETED the live `settings.json` before renaming the temp onto it — and deleted the temp too when that rename failed. A process terminated inside that window, or a rename the OS refused, left no settings file at all: the app then started on defaults, silently, with every provider, model-visibility and MCP entry gone and nothing in the log. The rename replaces the target directly now, transient sharing violations are retried, and a refused replace keeps both the previous file and the pending copy, naming the latter in the error. The same delete-then-rename shape is gone from `editors.json` and the IPC registry. ## [0.2.190] - 2026-09-13 ### Fixed - **Worker admission and execution use the same resolved account.** Account-specific rate limits are checked before a worker starts, credential binding is acknowledged by its session actor, and resume prepares against the actual child model rather than a potentially stale role default. Bound workers reject unrelated key overrides while retaining refreshed tokens for their admitted account. ### Added - **A session can move itself into an existing worktree.** When a worktree already exists — created from the Worktrees panel, by an earlier turn, or by another session — the agent can now relocate the session into it (`session` action `switch_workspace`) instead of writing into that tree from the main checkout, where the system prompt names the wrong directory, `search` treats the gitignored `.unary` tree as out of scope and `git` keeps reporting the other checkout. The target must be a worktree of the session's own repository: a bare repository, another repository and a plain directory are refused with the session left exactly where it is. The next tool call already runs in the new tree; the working directory and system prompt follow at the turn boundary (one prompt-cache invalidation). A move back to the main checkout is the same action. The Worktrees panel offers the same move for the focused session, and a session moved into a branch-named tree keeps its Goals board instead of re-keying to an empty one. ### Changed - **The live canary no longer requires a USD ceiling.** Cost limits apply only when explicitly supplied; missing cost measurements remain visible. This does not claim a completed 24-hour endurance test. - **The chat header's worktree button now opens a dialog with a generated branch name.** One click on the branch icon opens "Create session worktree" with the managed `unary/session--` name prefilled — two words instead of the session-id hex — and the name stays an ordinary editable input. The managed destination folder is shown read-only, Create stays disabled on an empty name, a collision with an existing local branch gets a numeric suffix, and a failure appears inside the dialog instead of a chat entry. The branch pill's inline form keeps its own path; both run the same create flow. ## [0.2.189] - 2026-09-13 ### Fixed - **Starting one session no longer blanks the whole "Needs attention" group.** A project the worktree overview could not measure — cut off for budget, or because `git worktree list` raced the fold-back that a session start sets in motion — arrived as `truncated` with empty rows, and both the Desktop sidebar and the Sessions dock treated that emptiness as the truth: every row of the project vanished, including trees nobody had touched, and nothing pulled them back until an unrelated refresh. One shared rule now folds every overview answer in (a truncated project keeps the rows it had), the sidebar retries a raced measurement a bounded number of times, the backend keeps its fallback snapshot across the invalidation a fold-back performs, and a failing listing reports Git's own reason instead of an empty list. The dock's notice also stops calling every truncation a time budget. - **Close and maximize can no longer be pushed out of any dialog header.** The window controls now live in their own fixed track next to — never inside — the shrinkable action row, so a dialog whose action row is too wide clips that row instead of spilling over its own controls. - **The image viewer's close button can no longer be pushed out of its header.** The dialog title grew to absorb the header's leftover space while the action row — zoom group, Regenerate region, Show in File Manager — asked for the same leftover with a zero flex basis, so the two split it and the actions box landed short of its own rigid content. The row spilled past the panel's right edge and the header's clip ate the window-control group first: a detached image window had no visible X, even though the button was in the DOM and focusable (measured live — the close button laid out at x=1908..1951 on a 1904px-wide window). The title now takes its own width and the actions row owns the leftover — the same rule and the same reason the file preview has carried since 2026-09-08. - **The pinned chat header now always names the newest user message instead of the one before it.** The header resolved its identity from the scroll position — "the newest user row that has left through the top edge" — so it kept naming the previous request for as long as the newest one was still on screen, which is exactly the state right after sending, and it named an older message again whenever you scrolled back through the transcript. The identity is now the newest real human request (the newest loaded one, or the authoritative anchor when that request is outside the loaded window), and the measurement decides one thing only: whether that request's own row is on screen, in which case the header stays hidden rather than duplicating a message you can already read. ## [0.2.188] - 2026-09-12 ### Changed - **Maintenance release — no user-visible behavior change.** The runtime is the same code 0.2.187 shipped; the only committed difference is the documentation for how a compacted session is handed back, re-measured and corrected. ## [0.2.187] - 2026-09-11 ### Fixed - **An image produced by a tool now reaches the model on every dialect that can carry one.** A `read` of a PNG, a snip capture or a screenshot arrives as a tool-result block, and the OpenAI Responses family, Amazon Bedrock and LM Studio each discarded it with no error and no note — while the same picture attached to a chat message went through. That asymmetry is why the complaint reproduced on one provider and was impossible to reproduce on another. Responses now lifts the image into the user message that follows `function_call_output`, which has no image slot of its own, exactly as the Chat Completions dialect already did; Bedrock emits Converse image blocks in user content and inside tool results, where it previously accepted only text; LM Studio carries tool-result images the same way it already carried attached ones. Where an encoder genuinely cannot carry an image, it now leaves a note saying so instead of leaving nothing. - **One predicate decides whether a model accepts images.** The wire encoders tested for the exact capability token `image`, while the harness's own capability check also accepted `images`, any token containing `image`, and any token containing `vision`. A model the picker advertised as vision-capable could therefore have every image dropped by the encoder in silence, with the two layers disagreeing in a way neither of them could see. ## [0.2.186] - 2026-09-11 ### Fixed - **The fold-back button works again after a mid-run move into a worktree.** When a session was relocated into its managed worktree while running, the chat's fold-back button could answer with a context-free "This worktree was not folded back." because the live session handle still pointed at the parent checkout. The button now passes the worktree it already knows, and the harness accepts it as the fold target — but only when that tree demonstrably belongs to the session. A genuine refusal now names its reason instead of showing an empty dialog. - **DeepSeek keeps its wire format behind a custom base URL.** A DeepSeek gateway reached through a reseller or a self-hosted endpoint was recognised by hostname alone, so it silently fell back to plain OpenAI semantics — `store`, the developer role and a forced `reasoning_effort: low`. The dialect is now decided by the provider id as well, so a custom DeepSeek base URL keeps its thinking format and its reasoning-effort map. - **DeepSeek thinking turns always replay `reasoning_content`.** DeepSeek's thinking mode requires the assistant's `reasoning_content` on every replayed turn; a tool loop whose turns carried only tool calls, or whose thinking signatures had been restored or compacted away, sent none and the request failed with a 400. Such a turn now falls back to an empty `reasoning_content`, the same way Kimi's does, so the loop continues instead of erroring. - **A tool call refused for a misplaced field now names where that field belongs.** `additionalProperties: false` is the right contract, but its own sentence said only that `maxSources` was unexpected in `config` — next to a list of valid actions, which reads as though the action were wrong. A refusal now resolves the offending value's path and names its accepted home, e.g. `config.advanced.maxSources` for a `maxSources` sent directly under `config`; a name with no home there gets the properties its node does accept instead of a guess. ## [0.2.185] - 2026-09-11 ### Fixed - **The context meter's breakdown popover opens through the shared portal anchor.** It no longer clips inside the composer on narrow panels, and the popover-position policy guard covers the component again instead of exempting it. ### Changed - **One click from the chat header to a session worktree.** A branch icon left of the auto-commit-and-push button opens the worktree form with the managed `unary/session-…` branch name prefilled, so moving a session into its own worktree no longer needs the detour through the branch pill. - **The IDE chat toolbar's model picker refreshes the model registry when it opens.** Newly enabled providers and models appear in the picker without restarting the app, and the same refresh backs the chat's open-picker catalog. - **Inco Kimi K3 and GLM 5.3 expose their reasoning-effort gradient.** Both models now offer low/high/max effort in the model picker instead of hiding the control; the effort mapping follows the gateway's documented gradient and is recorded as unverified in the provider notes until a live check confirms it. - **Qwen Cloud Token Plan is a separate provider.** It now has its own `qwencloud-token-plan` identity, Qwen Cloud credential name, catalog and provider pack instead of being represented internally as an Alibaba provider. Existing saved Token Plan configuration migrates to the new identity; Qwen Cloud Pay-per-token remains an independent provider with its own key and billing realm. - **A successfully folded-back session carries a "Folded back" state in the session lists.** The fold stamps the session header with the moment its worktree landed in the parent checkout; the sidebar row and the sessions panel show the state word from the worktree vocabulary until you open the session, and re-isolating the session retires the state. No color coding: the state is the word, like "Not folded back". ### Fixed - **Folding one worktree no longer blanks the whole needs-attention group.** The overview builds its rows from `git worktree list`, which answers nothing while the fold removes a tree; that empty answer was cached and served as authoritative and erased every row of the group until the next refresh. A degraded measurement now serves the previous rows (or reports itself truncated so the sidebar keeps its state), and the sidebar keeps its attention counts on transient fetch errors. ## [0.2.184] - 2026-09-10 ### Fixed - **The image viewer opens as its own window with working edit and fullscreen controls.** The Desktop chat's image dialog stayed an in-app overlay even where the app can give a dialog a real window, and the detached viewer mounted the bare shared dialog without the region editor, so "Regenerate region" handed the composer a raw image source where it expected an edit draft instead of opening the editor. The chat path now detaches first — same window, remembered size and bridged actions as every other dialog, with the web build keeping the overlay — the detached window mounts the same wrapped viewer as the overlay, and the header's zoom presets and meta row collapse via container queries at narrow widths so the edit, reveal and fullscreen controls are never pushed out of the header. - **A session worktree fold-back completes in the installed app instead of failing forever.** The final removal step ran `git worktree remove` with the app's inherited working directory, which is outside any repository — Git answered "not a git repository" on every attempt, the fold rolled everything back, and the retry loop preserved the same tree five times per sweep, which is also why the needs-attention row kept disappearing and returning. Removal is now rooted at the parent checkout, and a regression guard refuses bare un-rooted removal calls. A successful explicit fold-back also emits `harness-sessions-changed`, so the folded session immediately appears under its project instead of vanishing from the session lists until an unrelated reload. ### Added - **Tool failures have individual audit evidence.** Memory Errors separates recorded calls from older summaries, preserves available worker and turn identity, and shows missing evidence and export limits instead of treating recurring errors as confirmed defects. ### Changed - **A worktree fold-back that hits a conflict is resolved by the session that owns it, not parked for you.** Closing a session, quitting, the crash-recovery sweep and the retry watcher all used to leave a conflicted session worktree under "needs attention". Every path now hands the conflict to the owning session's agent: the session is resumed if it was closed, it rebases inside its worktree, and the fold runs again in the same turn. You see a conflict only when the agent has tried and explicitly reported which file it could not decide. A worktree you chose yourself is no longer listed as needing attention while it simply waits; its `Fold back` action stays available. ## [0.2.183] - 2026-09-10 ### Fixed - **Decision cards accept JSON-wrapped question arrays.** `request_user_input` now applies the existing schema-guided argument repair before its early hook validation, instead of rejecting valid questions before the executor can repair them. Invalid JSON and invalid card content remain rejected. ## [0.2.182] - 2026-09-10 ### Fixed - **Long-running workers remain supervised and actionable.** Watchdog checks follow the next deadline, stalled workers send durable decisions to the parent without bypassing a manual Stop, and a running subprocess alone no longer counts as progress. Stale acknowledgements cannot reopen a completed worker, and temporary monitoring failures retain a bounded retry schedule. ### Added - **The checkout remembers what happened the last time something was built.** When several sessions work in one repository, a session that hit a build error had no way to know whether the error was new, since when it existed, or that a sibling had already seen it. Every `cargo_check` and every build or test command run through the shell now records its outcome and the exact error identities into one facts-only ledger per repository (shared across linked worktrees, keyed by commit and worktree so a divergent worktree's red build is never mistaken for the parent's). The agent reads it with `diagnostics` `action=repo_ledger` — red builds, open errors with first-seen session and commit, recently fixed ones — and gets a one-line brief at the start of a turn only when the ledger changed since it last looked. Nothing in it blocks anything, and nothing is injected into another session: reaching the session that saw the error stays an explicit `session` `send_input` or `finding`. ### Changed - **The compaction handover is a set of pointers again, not a digest.** It used to inline every assistant answer, every reasoning digest and the Goals rows three times over — while the Goals board is durable and handed over anew at the start of every turn anyway. It now inlines every failed tool use, only the newest twelve successes, the newest reasoning digest and a count for the rest, and tells the model exactly where to look for anything missing (the segment ledger, the tool result by id, the repository ledger, the other live sessions). The handover ceiling dropped from 32 KiB to 12 KiB. ## [0.2.181] - 2026-09-09 ### Fixed - **A provider you switched off no longer offers its models.** Turning a provider off in Settings left its selected models in the picker, because every path that builds that list read the visible-model selection and ignored the enabled flag. Choosing one sent the request to the provider you had just disabled — and where two providers ship models with identical names, that arrived as a bare `Invalid API-key provided.` from the wrong account. - **A pinned model names its provider.** The pinned block is the one place a row carries no provider header, so two providers offering the same model name were indistinguishable there. ## [0.2.180] - 2026-09-09 ### Added - **GPT Image 2.5 is selectable for image generation through the ChatGPT (Codex) account.** The Codex image path sent no model at all, so it could only ever produce whatever the backend happened to default to. The image slot now offers GPT Image 2.5 Sunburst, GPT Image 2.5 Flare and GPT Image 2 under the OpenAI Codex provider, and the chosen line is sent with every generate, edit and inpaint request. Leaving the slot on the plain account entry keeps the previous behaviour. ## [0.2.179] - 2026-09-09 ### Fixed - **A tool call that dies mid-flight no longer bricks the session for good.** When a call ended without ever producing a result, the transcript's last message advertised a `tool_use` nothing would ever answer, and the provider refused every later request in that session — on every account, permanently, with `tool_use ids were found without tool_result blocks immediately after`. The encoder now completes the pairing at the end of the transcript too, so a dead call reads as a failed step instead of a wall. - **A pending chip disappears once its message is on screen.** The chip was released only when it carried an in-memory mark that a reload — or any append path that did not go through the resolver — never set, so it sat in the composer next to the very message it was waiting for. A transcript row stamped with the chip's id now releases it, because that row exists precisely because the chip was delivered. ## [0.2.178] - 2026-09-09 ### Fixed - **Folding a session back is a decision, not a dead end.** When the parent checkout carried its own uncommitted changes in the same files, the fold refused with git's raw error, the tree parked under "needs attention", and there was nothing to act on because the decision row had just been cleared. A conflict now always names the overlapping files and both ways out, and it is offered as `Keep your version` / `Overwrite from worktree` / `Later` instead of being handed to the agent as a rebase that cannot clear a blocker living in the parent's working tree. - **A session is no longer a foreign owner of its own work.** The fold-back asked both file-owner lookups with an empty session id, and a claim exists for every write — so every changed path answered with the folding session's own id, the tree waited for "another session" that was itself, and no other session had to be running for it to happen. This affected every session, not one tree. - **A leftover worktree no longer folds what the parent already has.** A fold that applied its changes and then failed to remove its tree left a leftover whose content was already in the parent; git still rejected the patch because the surrounding code had moved on, so every retry read as a content conflict. Paths that are byte-identical to the parent are now dropped before the patch is applied. - **Automatic fold-back retries converge instead of repeating forever.** The watcher re-armed the same tree every 30 seconds without a ceiling, and its salvage path rebuilt the row from the snapshot the retry started with — discarding the blockers the refusal had just recorded. Retries now stop after five identical failures and hand over a decision that still names its files. - **A per-file fold-back decision can no longer delete unfolded commits.** `Keep your version` and `Overwrite from worktree` cover uncommitted changes only, but the path continued into worktree removal and a forced branch delete, destroying every commit the session had made. It now refuses while those commits exist and names both remedies. - **Shell commands containing an umlaut, an accent or an emoji no longer crash the tool call.** The Windows `nul` redirect rewriter copied the command byte by byte through a string slice, which split the first multi-byte character and panicked the whole call with "is not a char boundary" — with or without a redirect. - **The composer's Fold back button keeps its size.** With no goals, no changes and no lane to show, the status strip renders nothing and the fixed-size chip inherited the strip's growth rule, stretching into a full-width bar over the composer. ## [0.2.177] - 2026-09-08 ### Changed - **The composer's context gauge opens on click, not on hover.** Moving the pointer across the context fill ring used to unfold a 420px breakdown panel over the composer. The gauge is now a toggle: click opens it, clicking it again or anywhere outside closes it, and Escape closes it too. - **The Memory panel's subtabs show their own content.** Review and MEMORY.md are content-connected 10px subtabs, and the MEMORY.md tab renders the complete document even when no entry maps to it. ## [0.2.176] - 2026-09-08 ### Changed - **Memory writes are immediate.** Agents can store durable repository or global knowledge directly without a review queue. Historical ungrounded candidates are not silently activated, and automatic reusable-artifact capture is opt-in. - **Dream uses a model and a fixed interval.** A global app-owned timer classifies eligible memories across repositories with the selected model; session-end triggers are no longer needed. Failed classification preserves the previous conclusions, and Dream cannot overwrite a direct memory just because its title matches. - **On-demand tools no longer preload their long usage guides.** MCP keeps compact tool summaries; the browser, desktop, research and memory families receive full guidance at activation. Exact names, action schemas and persistent safety boundaries remain available. ### Fixed - Corrected the fold-back deadline watcher's weak session-registry type so the harness builds without a nested `Arc` mismatch. ## [0.2.175] - 2026-09-08 ### Fixed - **MCP tools no longer need a new session after install.** A catalog refresh (an MCP server installed, a plugin toggled, a settings write) that arrived while a turn was still running was dropped, so the new tools stayed invisible until the user opened a new session — which the install message then told them to do. The refusal is now recorded and settled at the next safe turn boundary: the tools are advertised from the next turn of the same session, and the install message says so. - **Compaction markers say why they ran and what they freed.** A context compaction in the transcript names its trigger in plain words ("Auto-compacted", "Compacted on request", "Compacted after context overflow", "Compacted to continue the turn") and the token delta before → after. A failed compaction states that the context was left unchanged, and a marker never implies a delta it did not measure. - **A removed file preview says why it is gone.** The browser runtime records a bounded reason for every removed preview session, so a viewer polling one that was already dropped gets the cause — a window-ownership reap versus ordinary cleanup — instead of a bare "was not found", and the reap can no longer close a session that was started after its window died. ### Changed - **Yolo mode is permission, not minimalism.** The mode prompt said "make the smallest change that works", which read as a quality cap and produced quick fixes instead of production-ready work. It now frames the mode as pure permission — everything allowed, no gate or ceiling, plan and switch to execution — and asks for a complete, production-quality solution instead of the first patch that touches the symptom. - **The Quick profile defers verification without lowering the bar.** The verification-policy line now states that it governs only when builds, tests and lints run, never the quality of the change itself: quality comes from how the work is built, not from running checks, and a Quick session ships the same production-ready solution while handing the verification commands to the user instead of running them. ## [0.2.174] - 2026-09-07 ### Fixed - **Pilot reports underlying controller failures instead of hiding them behind a generic stop message.** Provider errors retain bounded details, and interrupted controllers preserve available supervision evidence without claiming that the user pressed Stop. ### Changed - **Pilot receives bounded desktop tasks rather than whole programming jobs.** Native API and batch artifact preparation stays with the main agent; desktop controllers are instructed to observe the screen before extended planning and work in short UI steps. ## [0.2.173] - 2026-09-07 ### Added - **Detached file previews open at the size they were designed for, and remember where you put them.** A preview opened in its own window derives its placement from the geometry you last gave that window, or from the view's own design size clamped into the monitor's work area, instead of an arbitrary default. Below 860px the secondary header actions collapse into the shared overflow menu while the primary toggles and the window controls stay flat, and a preview session now belongs to the window that started it — closing that window ends it, and a session the runtime no longer knows about shows a designed "session ended" state with Retry instead of a raw error. ### Fixed - **A message you sent while the agent was idle no longer arrives after the next one.** A steering message that missed the run loop's drain point stayed queued until the following prompt started and was then appended *behind* that newer prompt — measured once at 75 seconds early, delivered 1 millisecond late. Queued messages are now flushed first, in the order the UI shows them, so the transcript matches the order you sent them in. - **Terminals and shells no longer see the Windows verbatim path spelling.** A canonicalized root (`\\?\L:\Repo`) is correct for comparing two paths and wrong for everything else: PowerShell cannot map it to a drive and rendered the provider-qualified `Microsoft.PowerShell.Core\FileSystem::` prompt, and a terminal group keyed on it silently forked one repository into two — so the new tab was created in a group nothing rendered. The prefix is now stripped once per language at the ingestion points, project entries written by earlier builds are repaired on read, and comparison sites keep canonicalizing. - **The "Plan ready" card disappears once you answer it.** Accepting or declining a plan the model wrote into chat submits a harness-authored reply rather than a user message, and the check that decides whether a plan is still awaiting an answer only stopped at user messages — so it walked straight past your decision and remounted the card on every state rebuild for the rest of the session. - **Clicking a folder in the editor opens its entry file instead of claiming "Permission denied".** Windows reports a directory read as access-denied, which surfaced as a file-permission error for paths that were simply directories. Reading a directory now says so, and the editor retries the usual entry files (`index.ts`/`tsx`/`js`/`jsx`/`mjs`/`svelte`, `mod.rs`, `__init__.py`) and opens the one it finds. ### Changed - **Both Qwen Cloud realms are one brand, and a realm mismatch says so.** The credits-based Token Plan and pay-per-token DashScope International are one product line bought in one place, but the surfaces named them so differently that a valid Token Plan key refused by the metered host read as a broken credential. They are now "Qwen Cloud (Token Plan)" and "Qwen Cloud (Pay-per-token)", listed next to each other in settings and the model picker, and a 401 on either host names the sibling provider as the likely realm. Provider ids are unchanged, so stored accounts and picked models keep working. - **A session worktree now folds back entirely on its own.** After every turn, a session that was isolated into a managed worktree returns automatically: its commits are cherry-picked onto the branch recorded when the tree was created (switching the checkout back itself when it drifted, never forcing past uncommitted work), the session reopens in the parent checkout, and the worktree and its branch are removed — no button, no dialog. If the fold stops at a real conflict, the session's own agent is woken with a machine instruction to rebase its worktree onto that same recorded branch and resolve the conflicts there; the automatic fold retries the moment that turn ends. Blocked files are retried by the existing release hook the moment their claim drops, and the automatic return survives an app restart. A `Fold back` remains as one action for the times you want it immediately: it runs the same automatic fold and hands a conflict to the session the same way — the choice between "Automatically" and "Via session" is gone, because both ran the same fold and differed only in exactly that handover. - **Machine-assigned instructions reach the model again.** Instructions the app composes on its own — a plan to execute, a fold-back conflict to resolve — were stored as a message type that was never projected to the model, so the model silently never saw a single one of them. They now ride as a distinct machine message the model reads verbatim, shown in the transcript as a system notice instead of an invented user entry. - **Session titles are always generated by the session's own model.** The dedicated rename-model setting is gone end to end: auto-rename (and its refresh pass) runs on the model the session is already using, with no configured override and no fallback model in between. The settings UI keeps only the generation's thinking effort. ## [0.2.172] - 2026-09-07 ### Added - **A session folds back only into the branch it left.** Folding a session's work back into its parent checkout now checks the branch recorded when the session started: an automatic fold-back into a parent that switched branches in the meantime is refused, and the explicit path names the mismatch instead of silently writing into the wrong branch. The action also reads the same in every surface now — chat, menus and dialogs share one canonical label. Isolation can no longer nest inside a managed worktree, and sessions isolated at a write seam return to the parent checkout automatically. - **Worktrees that already gave up their work no longer linger.** When a worker's patch is already applied in the parent, its worktree is recognized as equivalent and cleaned up on close instead of being preserved as "not folded back"; a worker preview shows the parent state before the close decides, a worktree that is still busy reports its path instead of failing anonymously, and a retried worker receives bounded context about what its predecessor changed. - **The memory store keeps a locator where it used to keep your words.** Evidence that captured verbatim user quotes is scrubbed to a reference to the turn where the words were said, across every memory scope in a one-time migration — and new captures record the reference instead of the raw text. ### Fixed - **A single question and answer now shows its span and token tally.** The seam between assistant turns only appeared from turn 2 onward, so the most common case — one prompt, one answer — showed neither elapsed time nor cost. The first turn now gets the same seam, measured from the moment the prompt was sent. - **Parallel worker batches with a shared contract no longer fail on each other's code.** When one worker implements a new interface and its siblings consume it, each consumer's change was compile-checked alone and rejected for missing definitions that existed only in a sibling's unapplied patch. The check now overlays the whole batch, tests the union, and waits within a bound for a sibling that has not delivered yet. - **A worker integration that goes sideways now says what it did and why.** A worker that broke files it does not own integrates with an explanatory note instead of being silently preserved when the parent workspace is dirty or unmeasurable, and a stalled integration flush reports what it is waiting on — retry state, completed writes, sidecar path — instead of hanging without a word. - **On Macs, GPU embedding picks a real GPU.** The index's GPU lane could end up on the CPU when adapter selection failed on macOS; it now selects a physical Metal GPU and validates the adapter before running. ## [0.2.171] - 2026-09-07 ### Added - **A fallback vision model can take over when the configured one cannot serve an image.** Settings → AI Agent gains "Fallback vision model" (`visionFallbackModel`): it is tried whenever the primary slot fails — every account of its provider refused, the call errored or timed out, or its own configuration is broken — and a fallback-only selection carries the whole route, so a text-only active model still gets its images read. Pilot tool-result images inherit the same fallback, and a turn whose every attempt is blocked still fails closed, naming both reasons. - **Deep Research now searches as broadly and as deeply as its depth setting claims.** A job no longer sends four fixed phrasings of one topic to a single page per provider. Query variants are generated per job — the exact phrase, the current and previous year, and the angles a research question actually needs (documentation, comparison and alternatives, limitations, measured performance, migration, how-to) plus sub-questions parsed from your instructions — and every provider is asked for more candidates than the final evidence budget and paginated, so host diversity has something to choose from. Standard depth issues 8 variants and over-gathers 2×; deep issues 12 and 3×. - **Full text is fetched for the sources that deserve it instead of waiting on the model.** The search wave upgrades the highest-ranked snippet-only sources to full text on its own, preferring one source per independent host before taking a second from any host, and follows primary-source-looking links inside fetched pages. `followLinksDepth` was a setting every job stored and nothing read; it now bounds that chasing. - **A research job can investigate rather than search once.** Up to two further waves derive their queries from terms that appear across at least two independent hosts and are not already in the topic, and every wave is deduped, host-diversified and domain-filtered by the same rules as the first. - **Four controls for that breadth and depth**, in Settings → Research and in the per-run dialog: query variants, gather multiplier, fetch depth and expansion rounds. Each defaults to "auto — from depth", each shows the derived value, and each states what it costs in provider requests rather than only what it does. - **The local half of a research run is held to the same contract as the web half.** `mode: both` is the default, so half of every run is workspace retrieval — it now issues the same generated variants, attaches real file content for its top-ranked hits instead of metadata alone, collapses near-duplicates through one identity, ranks instead of returning whatever came back first, and reports a missing or stale index as a distinct status with a reason. - **Research quality is measured, not only reviewed.** A new offline evaluation scores a recorded job — citation precision and coverage, host independence, fetched ratio, provenance completeness, engine coverage, identity hygiene, contradiction preservation and cost per cited source — against golden fixtures, so a change to the ranking or the gate produces a number instead of an impression. ### Fixed - **Vision helpers now rotate provider accounts the way a chat run does.** An image transcription used to resolve one API key and call the provider once, so a rate limit, auth failure or quota error surfaced as a dead vision model while the chat model rotated past the very same account. It now walks the provider's enabled accounts under the executor's own rotation policy, attributes the limit headers to the account that earned them, and names every account spent or skipped — plus how much rotation is left — in the note the model reads. - **The search scraper tier no longer bypasses the SSRF protections the fetch tier already had.** Public-web scraping used a plain HTTP client that followed redirects with no per-hop address validation, so a redirect or DNS answer pointing at a private or link-local address could be fetched and parsed into evidence. Scraping now goes through the same protected client as page fetches: redirects validated per hop, every DNS answer checked, ambient proxies disabled. - **A search that ran and found nothing is no longer reported as "skipped".** Engine status now distinguishes failed, zero-result and completed-with-warnings, keeps the provider name with each error instead of discarding it, and never produces an empty reason — so a silently failing search provider shows up in the job instead of looking like an engine you never enabled. - **The evidence budget can no longer be filled entirely with unfetched snippets.** The rule that at most half of the sources may be snippets was enforced on one insertion path and not on the ones used when appending a source or persisting a search, so a job could finish with nothing but snippets and nothing to cite from. - **A cited paragraph is no longer excused by the paragraph above it.** The finalization gate skipped headings without closing the current paragraph, so a cited claim, a heading and an uncited claim counted as one cited paragraph. Uncited paragraphs now fail the gate. - **Job files are written atomically and job ids can no longer alias.** Saving a job used a fixed temporary filename with no sync, beside a correct atomic writer the same code already owned, and two different job ids that sanitize to the same string addressed the same file. Saves now go through the atomic writer, a non-canonical id is rejected before any path is built, the stored id is verified against the requested one, and job files that cannot be parsed are reported as `corruptJobs` instead of silently vanishing from the list. - **A crashed finalization no longer imports the same report twice.** The intent to import is persisted before the side effect, a retry adopts the document the earlier attempt created, and the import carries a stable identity so the doc side updates the existing page rather than adding a duplicate. - **Cached and revalidated content says so.** A 304 revalidation was recorded as the source's own status code, making a stale body look like a fresh non-200 response, and a persistent cache hit entered the evidence with no sign it came from cache. The origin status is recorded and a cache hit is annotated with when it was stored and when it expires. - **Research evidence no longer names a browser engine that does not exist.** Persisted source notes said a page was "rendered with direct Playwright" and a health check reported Playwright as available unconditionally, for a runtime that was removed. Both now name the managed Chromium runtime and report whether it is really reachable. - **An unterminated `