v0.10.4

[0.10.4] - 2026-07-23

Changed

• Updated the managed local sandbox to sandbox-runtime 0.0.67 and A3S Code
  Core 6.4.2.

Fixed

• Passed generated macOS Seatbelt profiles through private mode-0600 files
  instead of the process argument vector, preventing spawn E2BIG when a
  workspace requires many credential or hard-link rules.
• Kept managed-runtime temporary files inside the command's private scratch
  directory so profile-file cleanup follows the command lifecycle.

v0.10.3

[0.10.3] - 2026-07-23

Fixed

• Trusted the official A3S tap before release smoke installation so current
  Homebrew versions can resolve the tap-owned a3s-webview dependency.
• Updated Core so the managed SRT capability handshake tolerates files and
  directories removed concurrently by other workspace processes.
• Included the complete causal error chain in local-sandbox startup warnings
  instead of hiding the actionable workspace or platform failure.

v0.10.2

[0.10.2] - 2026-07-23

Fixed

• Restored Homebrew-rewritten Node shebangs after formula cleanup, verified the
  complete managed SRT tree in brew test, and added release smoke coverage
  for both a fresh install and a same-version reinstall.

v0.10.1

[0.10.1] - 2026-07-23

Added

• Added a one-shot DeepResearch mode to the A3S Web Code composer. Queued turns
  retain the selected mode, execute through the shared host-managed research
  runtime, support cancellation and progress streaming, and expose admitted
  Markdown and sandboxed HTML report artifacts through the session workspace.

Changed

• Changed the default web_search engines to DuckDuckGo and Wikipedia.
  AnySearch is now opt-in through config.acl, while an explicit request or
  ACL engine selection remains authoritative.

Fixed

• Applied one provider-neutral fallback policy to search failures and empty
  results. AnySearch quota exhaustion now appears as a structured
  provider_quota diagnostic before search automatically tries eligible
  fallback engines.
• Strengthened DeepResearch outcome extraction, accountable-source admission,
  citation gates, and report publication so time-sensitive result questions
  produce a direct source-backed answer or an honest degraded artifact.
• Removed the legacy A3S Web Code draft that preselected CLAUDE.md or
  CLAUD.md and inserted the Chinese “inspect the current code file” prompt,
  without deleting ordinary saved user drafts.

v0.10.0

[0.10.0] - 2026-07-22

Fixed

• Resolved user-scoped configuration and component paths through native Windows
  profile variables when HOME is absent, so commands such as
  a3s install webview work in PowerShell and clean Windows CI environments.
• Pinned managed sandbox release verification to the x64 macOS 15 runner that
  still provides Seatbelt, explicitly provisioned its ripgrep dependency, and
  added pull-request coverage for both packaged and first-use behavior. The
  first-use compatibility patcher now also recognizes macOS's symlinked
  temporary-directory paths and ships inside the crates.io package.
• Restored executable permissions for the managed sandbox CLI and native
  seccomp helpers after GitHub artifact transport, and now reject release
  archives that contain non-executable Unix sandbox components.
• Ordered mandatory Linux sandbox child mounts before A3S's stricter parent
  denies and collapsed mounts that converge on the same missing ancestor,
  preventing bubblewrap startup failures in both bundled and first-use managed
  sandbox installations. The runtime's immutable seccomp helper also remains
  readable when the surrounding user home is hidden, without weakening either
  policy boundary.
• Made local Claude Code, Codex, Kimi Code, and WorkBuddy account discovery
  fall back to the native Windows user profile when HOME is unset. WorkBuddy
  now locates its bundled CodeBuddy CLI through standard Windows installation
  directories and registered uninstall metadata, including custom install
  locations.
• Made official installers accept both legacy archives and complete 0.10
  bundles. Web assets, the WebView companion, and managed sandbox support now
  activate as one rollback-safe installation, while transient Windows download
  failures receive bounded retries.

v0.9.8

[0.9.8] - 2026-07-21

Changed

• Updated the bundled Code runtime to A3S Code Core 6.1.0 and A3S Search 2.0.0.
  web_search now uses AnySearch by default when neither the request nor ACL
  configuration selects engines, while explicit AnySearch, Tavily, and
  conventional engine selections remain available.

Fixed

• Kept raw A3S Use MCP tools hidden from the primary Code model while allowing
  the dedicated Use worker to execute its exact built-in Browser, Office, and
  OCR surface. Provider installers and newly projected extension tools now
  retain Ask policy and settle through the parent TUI confirmation flow.
• Added a real Windows Code TUI-to-Use regression covering the verified Use ZIP
  layout, all 31 Browser core tools with Microsoft Edge, every native Office
  operation and view, confirmed OfficeCLI installation, and confirmed local
  PP-OCRv6 installation and extraction.
• Registered a3s-webview as a verified first-use component and made
  a3s code install its platform release before terminal takeover when policy
  permits. The managed path is passed directly to RemoteUI and Agent Island,
  Windows assets use their Rust target ZIP names and protocol-aware health
  probe, and a release-page/checksum fallback survives GitHub API rate limits.
• Increased the Windows main-thread stack reserve for the a3s executable so
  a3s code can complete TUI session startup without a stack overflow, with a
  Windows-only startup smoke test covering the regression.

v0.9.7

[0.9.7] - 2026-07-19

Added

• Added /checkup, a secret-free setup audit with typed, read-only checks for
  component health, duplicate or shadowed PATH installations, ACL semantics,
  skills, applicable AGENTS.md files, MCP state, and terminal capabilities.
  Findings enter the strict Plan workflow and stop at Approve, Revise, or
  Abandon before any remediation can change the system.
• Added the system-wide Agent Island integration. It is enabled by default,
  can be changed with /island on|off|status, aggregates A3S, Claude, Codex,
  Cursor, Gemini, and WorkBuddy activity into one native singleton, and exposes
  authenticated one-shot approve, deny, stop, cancel, and reply controls with
  task status and elapsed time.
• Added a workspace-scoped a3s web start|stop|status|logs|open lifecycle,
  including --replace for gracefully replacing only CLI-managed instances,
  file-lock convergence for concurrent starts, and structured output for
  automation.
• Added strict two-phase Plan turns with an explicit Approve, Revise, or
  Abandon review boundary, plus Ctrl+O Send now for promoting a prompt ahead
  of ordinary queued follow-ups after settling the active turn.
• Added a scoped Code TUI approval flow with allow-once, exact session grant,
  exact project grant, and denial-feedback choices. Project grants are bounded,
  parsed and generated with a3s-acl, and atomically stored in
  .a3s/permissions.acl without following symbolic-link targets.
• Added /permissions, a searchable inspector for exact session and project
  grants. Grant details expose the canonical matching arguments; revocation
  requires a second matching action and affects future checks only.
• Added /tasks and Ctrl+B as a live delegated-work control panel. It reads
  authoritative Core task snapshots without interrupting the parent turn,
  retains running tasks plus bounded recent history, preserves semantic
  selection across one-second refreshes, searches progress and output, opens
  full task details, and requires a second matching action before invoking real
  subagent cancellation.
• Added pinned-root TUF registries for external Use packages, including full
  metadata refresh, review/apply-bound install plans, signed provenance
  receipts, and source-preserving upgrades. Registry upgrades query only the
  recorded registry and channel, reject identity drift and version downgrades,
  and converge without downloading an already installed target.
• Added deterministic component operation plans, cross-process component
  locks, immutable plan digests, and preflight checks so reviewed installs,
  upgrades, and removals fail before payload download or mutation when their
  inputs change.
• Added policy-aware A3S Use preparation to Code TUI startup. A missing Use
  component is installed from its verified release before terminal takeover
  when networking and automatic setup are allowed; offline mode and
  A3S_NO_AUTO_INSTALL=1 remain strict zero-network, zero-receipt boundaries.
  Browser, native Office, built-in OCR, and verified external MCP/Skill
  surfaces are then projected into the dedicated restricted use worker.
• Added /history and Ctrl+R fuzzy prompt search for the current TUI
  session, with bounded results, keyboard and mouse navigation, and draft-safe
  selection.
• Added reliable TUI session sharing. /copy copies the latest assistant
  source Markdown, /copy transcript requests the complete semantic session
  through the native clipboard or bounded OSC 52 path, and /export [path]
  atomically creates a private no-clobber Markdown snapshot inside the current
  workspace. Exports preserve visible messages, tools, and delegated results
  while excluding private reasoning, transient terminal chrome, and hidden
  duplicate cells.

Changed

• Refined the bundled A3S Web workspace with more precise Markdown typography,
  syntax-highlighted tool commands and arguments, live execution previews, and
  Simplified Chinese Monaco and editor-tab context menus.
• Updated the release baselines to A3S Code Core 6.0.0, A3S TUI 0.1.13, and
  A3S Use 0.1.2. /checkup uses the TUI's conservative terminal capability
  profile instead of guessing support from a single environment variable.
• Expanded /relay into a bounded session and background-work dashboard with
  stable selection across manual or 15-second refreshes, multi-field search,
  per-source selection memory, wheel navigation, task preview, and live native
  session status.

Fixed

• Reject symbolic-link, non-regular, replaced, or hard-linked component lock
  files before truncation, and reject symbolic-link lock directories, so a
  crafted runtime path cannot redirect cross-process lock writes.
• Made a3s web reuse a healthy instance for the same workspace, quarantine
  stale records, summarize unavailable saved-session models, and refuse to
  signal an unknown listener or an unmanaged A3S process. Release archives and
  installation prefixes now serve their packaged Web assets from an otherwise
  empty workspace. Cargo installations fetch the CLI's exact-version Web
  release once, verify its SHA-256, safely extract it into a versioned data
  directory, and reuse that cache across workspaces. Offline and disabled
  automatic-setup policies remain zero-network, and detached startup checks a
  foreign port before downloading anything.
• Applied the same blank-row rhythm to completed reasoning in the semantic
  transcript as live reasoning and assistant Markdown, and revoked Agent
  Island controls immediately when Send now interrupts the active turn.
• Made TUI Auto mode genuinely non-interactive for every operation that
  survives explicit policy and workspace hard denials, including tool-owned
  confirmation escalation. Late confirmation events resolve automatically in
  both directions, queued turns retain their submission-time mode, and Plan
  remains strictly read-only.
• Wait for the initial A3S Use MCP projection within a separate bounded startup
  budget, so the first model turn receives ready Use routes through task.
  Slow or broken surfaces remain non-fatal and continue converging in the
  background.

v0.9.6

[0.9.6] - 2026-07-17

Added

• Added signed-in Kimi Desktop and Kimi Code account models to the shared CLI
  and /model catalog. Credentials remain in Kimi-owned state, OAuth refresh
  uses locked atomic rotation, and requests use Kimi's direct account transport.

Changed

• Styled every /model provider tab with its corresponding brand color: A3S
  blue, Claude coral, Codex green, Kimi blue, WorkBuddy teal, and OS Gateway
  violet. Active tabs use the brand color as their background; inactive tabs
  retain it as their foreground color.
• Updated the embedded A3S Code Core baseline to 5.3.5.

Fixed

• Made the committed DeepResearch event snapshot authoritative at the report
  boundary, retained bounded source facts for checking, and rejected reports
  with uncovered tracks, unaccepted citations, or unsupported quantities.
• Installed the shared risk-aware permission policy and a real HITL manager for
  a3s code exec. Auto mode now executes bounded workspace edits, unresolved
  approvals terminate immediately with a nonzero approval.required result,
  and a stream cannot report success without a terminal completion event.

v0.9.5

[0.9.5] - 2026-07-17

Fixed

• Kept emoji presentation and joined grapheme sequences intact when fitting
  terminal rows, so the Code TUI scrollbar remains in one continuous final
  column instead of soft-wrapping on affected assistant headings.

v0.9.4

[0.9.4] - 2026-07-17

Added

• Added native Web workspace file discovery, Git status and diff support,
  atomic create-only writes, and SHA-256 file revisions shared by the workspace
  APIs.
• Added Web editor quick open, navigation history, task-scoped persistence,
  keyboard-complete explorer workflows, and explicit line-ending controls.

Changed

• Kept Monaco models alive across editor transitions and aligned streaming and
  finalized TUI assistant messages with one blank row above and below their
  content.

Fixed

• Made TUI auto mode silently approve every operation that reaches the Core
  confirmation boundary while preserving non-bypassable hard permission
  denials.
• Made Web saves conditional on the last observed file revision, return HTTP
  412 for stale content without overwriting disk state, and provide explicit
  reload or overwrite recovery. Invalid write requests now return HTTP 400.