Latch v0.3.4

Latch 0.3.4

Highlights

• ChatGPT subscription sign-in through latch login or /login, with protected
  local OAuth credentials and subscription Responses transport. API billing
  remains separate; no automatic API-key fallback.
• Provider setup adds accounts without replacing existing families or legacy
  defaults. Multiple instances receive distinct identifiers.
• One provider credential covers its model catalog. New setup enables the full
  catalog; /model all clears local filters and /model refresh fetches current
  service metadata. ChatGPT catalog queries automatically follow the official
  stable Codex version, with cached and embedded fallbacks.
• Historical model descriptors remain available for resume while current service
  listings drive selection. Retired experimental models no longer populate
  offline pickers.
• Empty /skills and /mcp results now explain their status and setup options.
• latch uninstall offers program-only removal by default, explicitly confirmed
  removal of local data/configuration, or cancellation. Windows supports deferred
  self-removal; native tests use disposable binaries.

Compatibility

Linux, Windows x86_64, and Apple Silicon macOS retain their mandatory sandbox
backends. Provider permissions and quotas remain server-owned. Startup and
doctor stay offline. Existing sessions and configured defaults are preserved.

See installation and uninstall,
ChatGPT sign-in, and
release procedures.

Latch v0.3.3

Latch 0.3.3

Latch now ships native Apple Silicon macOS binaries alongside Linux and Windows.
This release also hardens command execution, multi-agent concurrency, provider
streaming, setup, and installation.

• Apple Silicon macOS: mandatory Seatbelt execution backend, native ARM64
  archive and automatic Unix installer selection. Commands retain capability
  approval, protected credentials/state and Git metadata, bounded output and
  sandbox inheritance. The binary is ad-hoc signed after stripping.
• Real terminal qualification: Linux and macOS CI start the actual TUI in a
  PTY, type and edit prompts, execute a sandboxed tool, render two replies,
  switch mode, resize and verify clean exit plus terminal restoration. Actual
  screen captures are uploaded. Native macOS CLI and Web transport tests pass.
• Windows installation: PowerShell 5.1 and 7 compatibility, including
  strict-mode release redirects, bounded retries after transport interruptions,
  and SHA256 verification without Get-FileHash.
  The documented one-liner prepares the current terminal PATH and verifies the
  installed binary. Persistent PATH and existing configuration remain intact.
• Execution safety and reliability: correct Git rename parsing for undo,
  refusal of filesystem-root outside-write scopes, and call-specific approvals.
  Managed output stays bounded during execution, preserves split UTF-8, and
  explicitly marks incomplete logs when saving output fails.
• Multi-agent correctness: serialize first worker starts and reconstruction,
  preserve initial delegation, prevent concurrent group reloads from overwriting
  updates, and avoid shutdown busy loops.
• Providers and media: report malformed Responses tool arguments, parse
  mixed-ending SSE frames correctly, and make identical concurrent image
  ingestion race-free.
• Interactive UI and setup: restore created-file previews, preserve rejected
  setup values with explanations, honor effective provider/model settings and
  wire values, and improve approval, interrupt and printed-answer handling.
• Engineering: recover interrupted reference fetches, fix benchmark and
  dogfood edge cases, protect site build output, pin workflow actions, and
  expand Windows security and Cargo coverage.

Release targets: Linux x86_64 and ARM64 (glibc 2.35+), Windows x86_64, and Apple
Silicon macOS. macOS 15 ARM64 is natively tested; macOS 14 is the deployment
baseline and still needs runtime qualification. Intel Macs, Windows ARM64 and
musl/Alpine binaries are not provided. macOS Developer ID signing/notarization
and Windows ConPTY qualification remain outside this release.

See installation, macOS qualification, and
real TUI tests. No provider credentials or paid calls are
needed by the deterministic acceptance tests.

Latch v0.3.2

Latch 0.3.2

Agent Skills and MCP tools now integrate with Latch's durable session model,
conservative permissions and mandatory platform sandbox.

• Discover Agent Skills from workspace/user .latch, .agents and .claude
  skill directories. Load YAML-frontmatter SKILL.md instructions and bounded
  resources on demand without changing the stable system prompt.
• Connect operator-configured MCP tool servers over sandboxed newline stdio or
  Streamable HTTP (JSON/SSE). Support modern 2026-07-28 and legacy initialization
  protocols, bounded discovery/calls, cancellation and deterministic cleanup.
• Inspect skills and servers through CLI/TUI diagnostics. Child agents own
  independent MCP clients. Server annotations never grant permissions; external
  calls invalidate older validation evidence before execution.

See configuration, compatibility and limits.
Existing extensions, providers, durable history and evidence ownership remain
unchanged. Optional MCP interactions and deprecated HTTP+SSE endpoint transport
are not advertised. This release does not add Mods, marketplaces or computer use.

Binary release targets are Windows x86_64, Linux x86_64, and Linux ARM64.
Both Linux builds use Ubuntu 22.04 with a glibc 2.35+ baseline. The Linux
installer detects the host architecture and selects the matching archive.

Latch v0.3.1

Latch 0.3.1

This patch release completes scoped Windows workspace and localhost support while preserving the mandatory native sandbox.

• Read and modify ordinary NTFS workspace files without per-object source ACL changes or WRITE_DAC, including host-readable foreign-owned files. Sensitive paths remain protected and unsafe cases fail closed.
• Reduce command startup preparation on large mutable workspaces. A 100,033-object disposable NTFS fixture passed with unchanged source ACLs; an entire live home directory remains unqualified.
• Support explicitly Network-authorized localhost TCP clients/listeners and UDP over IPv4/IPv6 without machine-wide firewall changes or broad loopback exemptions.
• Fix headless PowerShell 7 extension startup and native cmd UTF-8 output for Chinese filenames.
• Close the DOS 8.3/long-path sensitive-mask bypass and strengthen sensitive ACL sealing, cancellation and recovery regressions. Unsupported x86 descendants fail closed.

Validation

Linux release checks and native Windows security, runtime, developer-tool and Web transport checks pass. Real paid OpenCode Go acceptance completed a Windows coding workflow with 21 model requests, 29 successful tool calls and durable completion Verified. Independent checks confirmed unchanged supplied tests and exact Unicode/localhost artifacts. See Windows evidence.

Install or upgrade

Linux:

curl -fsSL https://jinshuo-li.github.io/latch/install.sh | bash

Windows PowerShell:

irm https://jinshuo-li.github.io/latch/install.ps1 | iex

Installers select the latest stable release and verify SHA256SUMS. Linux requires glibc 2.35+, Bubblewrap, ripgrep and Git. Windows requires x64 Windows, Git, ripgrep and a focused NTFS workspace; the native sandbox is embedded.

Remaining Windows qualification

Physical power-loss recovery, hostile host races, an entire live home directory and broader application/architecture compatibility remain outside the proven scope. Private LAN needs separate endpoint qualification. See issue #7. There is no unsandboxed fallback.

Latch v0.3.0

Latch 0.3.0

This release brings the browser interface to the published Linux and Windows binaries, sharing the same kernel, durable sessions, approvals and mandatory sandbox as the terminal interface.

• Start with latch --web; use --web-port for a local port or --ssh for SSH forwarding instructions.
• Configure providers and models, resume sessions, send images, inspect diffs, approve tools and steer running tasks from the browser.
• Manage and delete session history from the TUI or Web interface. Deletion hides sessions while retaining raw events and validation evidence.
• See provider and tool activity in both interfaces, with elapsed and inactivity times. Reasoning text is not exposed.
• Improved terminal wrapping, Markdown tables and scrolling performance; the browser also renders Markdown tables.
• Fixed managed-process exit reconciliation and completion reporting, and excluded kernel snapshots from working-history rotation pressure. The default conversation-history threshold is now 64,000 tokens, based on recorded calibration; durable history remains intact.
• OpenCode Go DeepSeek V4.1 Flash supports image input by default.

Install or upgrade

Linux:

curl -fsSL https://jinshuo-li.github.io/latch/install.sh | bash

Windows PowerShell:

irm https://jinshuo-li.github.io/latch/install.ps1 | iex

The installers resolve the latest stable release and verify its archive against SHA256SUMS. Linux requires glibc 2.35+, Bubblewrap, ripgrep and Git. Windows requires Git, ripgrep and a user-owned NTFS workspace; the native sandbox is embedded.

Known Windows limits

Large or actively changing workspaces can have high sandbox startup costs. Existing objects must permit temporary ACL changes; foreign-owned objects can fail closed. Sandboxed access to local development servers and broader recovery/compatibility cases remain qualification gaps. Use focused, stable, user-owned workspaces. See Windows diagnostics.

Latch v0.2.3

Latch is a terminal coding agent for Linux and Windows, with durable sessions, mandatory sandboxing, and validation tied to workspace state.

What’s new

• Official x86_64 Linux and Windows binaries, checksum-verified user-local installers, and automated version-tag releases.
• A redesigned product site with installation commands, real TUI captures, and the recorded 25-task benchmark.
• Validation can certify several requirements against the same workspace generation; Linux proving pipelines preserve upstream failures.
• Bounded correction for missing completion claims after edits, and a kernel report of recorded changes when a completion summary is empty.
• Terminal mouse capture defaults on to keep wheel scrolling from recalling input history. Set LATCH_MOUSE_CAPTURE=0 to opt out.

Install

Linux (Bash):

curl -fsSL https://jinshuo-li.github.io/latch/install.sh | bash

Windows (PowerShell):

irm https://jinshuo-li.github.io/latch/install.ps1 | iex

Linux requires glibc 2.35+, Bubblewrap, ripgrep, and Git. Windows requires Git for Windows, ripgrep, and a user-owned NTFS workspace; the native sandbox is embedded, so binary installs need no MSVC toolchain or WSL.

Both installers verify the archive against SHA256SUMS. Archives include BUILD_INFO, the MIT license, and an example configuration. Follow the installer’s PATH instructions, run latch, configure your provider with /setup, then run latch doctor.

Installation, version pins, and troubleshooting · Full changelog

Latch v0.2.2

Latch v0.2.2 makes the agent scriptable, coordinated, and harder to fool. It
adds a stable machine interface (latch run, resume, sessions, doctor)
for scripts, CI, and benchmark harnesses, durable agent groups for parallel
workstreams, and a deterministic release gate that CI runs on every change.
Security and evidence got stricter: sandboxed processes and native tools cannot
reach Latch credentials or its state directory, an approval can never grant
something the sandbox cannot execute, and only kernel validation can call a
changed workspace verified.

Highlights

A stable machine interface

• latch run, latch resume, latch sessions, and latch doctor are the
  non-interactive surface for scripts, CI, coding agents, and benchmark
  harnesses. They never open the TUI, never wait for a human, and never mix
  diagnostics into stdout. latch still starts the TUI, and latch -p "..."
  (also with --resume) now runs through the same machine implementation.
• Prompt sources are exclusive: exactly one of --prompt, --prompt-file, or
  --stdin. --workspace resolves and canonicalizes before session selection,
  policy, prompt compilation, and tools.
• --output text (the default) preserves the historical one-shot behavior and
  streams assistant text. --output json prints exactly one versioned object
  ("schema_version": 3) with command, session, workspace, run status, resolved
  provider/model/effort, durable task state, scoped usage, context accounting,
  and event/graph summaries. --output jsonl streams semantic records
  (text_delta, tool_result, durable_event, final).
• Usage is scoped to the invocation (usage.scope = "invocation_graph"): a
  resumed run counts only ModelUsage events emitted after it began, existing
  children exclude prior history, and children spawned mid-invocation count from
  their own beginning. Provider categories that were never reported stay null
  instead of being fabricated as zero.
• Run status stays distinct from durable completion. status=completed means
  the invocation ended normally; use task.completion, task.evidence_count,
  and task.validation for the kernel's durable state.
• Exit codes are stable: 0 completed, 1 runtime failure, 2 CLI/config error,
  3 permission unresolved, 4 cancelled. SIGINT or SIGTERM cancels a run and
  still emits the final structured result with status=cancelled.
• Machine mode is fail-closed for permissions: an Ask the policy cannot
  resolve without a human is durably denied and exits 3. There is no --yes or
  skip-permissions flag, and existing invocations keep working.

Preflight doctor

• latch doctor checks the machine a run depends on: the mandatory Bubblewrap
  sandbox (probed with a minimal sandboxed command), the rg search runtime,
  Git, the effective config path and state directory, the resolved
  provider/model/effort, and that the provider credential resolves.
• It never contacts the provider, never runs a task, and never prints secret
  material: a credential is reported only by its symbolic reference
  (env:NAME, file:NAME).
• Human-readable by default, one versioned JSON object with --output json.
  Exit 0 when every required check passes, 1 for a runtime prerequisite, and 2
  for a CLI or configuration error.

Agent groups

• Agent groups add durable coordination on top of child agents: a shared task
  DAG with validated dependencies, atomic compare-and-set claims with exactly
  one winner, a durable peer mailbox delivered exactly once at safe model
  boundaries, and replayable progress state. Groups never own workers, are
  created lazily on first use, and ordinary single-agent and subagent use is
  unchanged.
• Three fixed tools expose coordination: group_task, group_message, and
  group_status. spawn_agent { task_id } joins a child and assigns a ready
  task atomically; only its assignee can start, complete, block, or release it,
  and only the root can cancel or reassign.
• Root terminal complete is refused while required group tasks are still
  pending, claimed, in progress, or blocked. An interrupted child keeps its task
  until an explicit release, reassignment, or completion, so a crash cannot
  duplicate work. Completing a task is coordination truth, never root evidence.
• Messages are information-only and never wake an idle child or copy
  transcripts. Workspace conflicts are advisory warnings from declared paths,
  never hard blocks; depth stays 1.
• The sidebar shows a compact GROUP block with task counts and active owners,
  and /group prints the full coordination view.

Cross-session cache locality

• The provider system field and tool schemas are now session-independent:
  workspace, repository instructions, and mode moved into the first
  provider-visible message as an explicitly delimited kernel block, so the
  cacheable prefix is reused across sessions and mode switches. The session
  block stays distinct from the user request, and Anthropic merges adjacent
  user roles into ordered, separate text blocks instead of one concatenated
  string.
• Measured against OpenCode Go with two fixtures differing only by AGENTS.md:
  the second session's first request read 4096 tokens (88.7%) from the provider
  cache (was 0), and aggregate cache_read/input rose from 0.769 to 0.922.
• Prompt fragments are ordered least-volatile first, with mode as the trailing
  fragment, and the system prompt was trimmed ~12.8% (1489 -> 1298 estimated
  tokens) plus tightened tool schemas without changing any tool name, parameter,
  enum, or semantic. Read-only inspection, narration, and validation discipline
  are now explicit instructions.
• Bounded recall selects the newest matching rows first and presents them
  chronologically, so a later correction survives /compact and resume even
  when older turns repeat the term.

Security and truthful completion

• Credentials are isolated from sandboxed processes: the resolved state
  directory and symlinked secret targets are masked for shell and extension
  processes, and the kernel-native read_file/read_image/search/write/
  patch tools refuse the state directory and symlink aliases into it.
• Approval can no longer grant what the sandbox cannot execute: unknown tools,
  external write targets that cannot be mounted, and Latch state or credential
  targets are refused before a normal approval prompt, and a grant cannot
  override those refusals.
• Whole-file writes require strict compare-and-swap: base_hash must match the
  current bytes exactly, so one agent can no longer silently overwrite another
  agent's newer write. The stale error names the path and both hashes, and the
  agent can re-read and retry.
• Read-only Git queries are classified per invocation, so git config --get,
  git status, and .git-excluding path filters no longer trigger spurious
  metadata-write approvals in machine mode. .git stays read-only in the
  sandbox, so this only narrows the Ask heuristic.
• Passing validation certifies only its durable workspace generation: guarded
  edits and write-capable shell commands advance the generation, a running
  write-capable managed process blocks certification until it exits and
  revalidates, and resume rebuilds the same state without deleting history.
• Verification is separate from loop termination: only Verified ends a run on
  the strength of its own claim. A run that actually mutated the workspace and
  is about to finish ImplementedNotVerified gets exactly one corrective turn
  to validate or record why verification is unavailable, and no correction can
  ever promote a run to Verified.
• Tool failures stay typed across providers: is_error survives the durable
  projection, Anthropic uses native tool_result.is_error, and the
  Chat Completions and Responses adapters use a small
  [latch:tool:ok]/[latch:tool:error] envelope instead of inventing an
  unsupported field.
• read_file/read_artifact are bounded (64 KiB per call, paged line windows,
  explicit continuation markers), search pages with a total count, and binary
  or invalid UTF-8 input is rejected honestly.

Reliability

• Every extension lifecycle stage is bounded end to end by the central
  [extension_lifecycle] policy: spawn/initialize, ready, ordinary RPCs,
  shutdown, and graceful exit. A missed deadline kills and reaps the child, and
  startup observes cancellation, so a silent extension cannot block Latch.
• The sidebar derives the latest durable user request from kernel events, so
  live and resumed sessions show the same request state.
• OpenCode Go's default endpoint now targets the versioned gateway
  (https://opencode.ai/zen/go/v1), fixing HTTP 404s; endpoint detection, the
  stable x-opencode-session header, and model selection are unchanged.

Architecture and CI

• docs/RUNTIME_CAPABILITY_MODEL.md defines the kernel invariants extensions,
  backends, and clients may not bypass, the replaceable-port rules, and the
  implemented-vs-deferred port map. A narrow ContextEngine port replaces the
  direct continuity dependency (request/result objects, no EventStore or
  SQLite in the contract), propagates to children through one factory, and
  fails closed rather than silently falling back. Default behavior stays
  byte-identical.
• bash scripts/release-gate.sh is the deterministic release gate: a Bubblewrap
  namespace/mount probe, formatting, locked Clippy with -D warnings, the
  kernel invariant tier, the full workspace suite, and a locked release build.
  CI runs the same gate on an ephemeral Ubuntu 24.04 runner with Bubblewrap and
  user namespaces enabled.
• The optional Docker dogfood harness runs the machine CLI against a disposable
  workspace in a non-root container without host networking or baked
  credentials, records image/source provenance, and includes deterministic,
  credential-free integration checks.

Inst...

Latch v0.2.1

Latch v0.2.1 is the first release with multimodal image input. You can attach
images to a prompt in the TUI or CLI (/attach, --attach), and the agent can
inspect image files in the workspace with the new read_image tool. Images are
durable, provider-neutral artifacts, and provider serialization stays truthful:
the kernel validates capabilities up front instead of sending bytes a model
cannot accept.

Highlights

Image input in the TUI and CLI

• /attach <path>, /attachments, and /detach <index|all> keep a pending
  attachment line above the composer; images ride the next user turn or a live
  steer while a task runs.
• latch -p --attach shot.png "what is wrong here?" and interactive startup
  use the same ingestion path. The CLI also accepts the --image alias.
• The transcript renders a compact [image: name · WxH] summary; no base64 is
  ever rendered, logged, or stored in the event log.

read_image

• The agent can inspect PNG/JPEG/WebP files inside the workspace with
  read_image, which reuses read_file's path policy and records observation
  freshness. read_file on an image now points at read_image instead of
  dumping bytes.

Durable, provider-neutral media

• MediaRef is content-addressed (sha256) and stored write-once under the
  session artifact store; raw bytes exist only there and are resolved at the
  provider boundary. Old text-only sessions deserialize with empty media and
  serialize unchanged.
• Images work with resume and steering; if a source file changes or disappears,
  the durable artifact still replays exactly what was sent.
• Limits are enforced from actual bytes: PNG/JPEG/WebP only, 5 MiB per image,
  8000 px per side. GIF and other formats are rejected honestly.

Capability-aware models

• Model metadata gains input_modalities with precedence user config > built-in
  catalog > conservative text-only. Text-only models fail locally with an
  actionable message before any provider request, covering pending input and
  replayed history.
• /model marks image-capable models. OpenCode Go built-ins stay conservative
  text-only by default; set input_modalities = ["text", "image"] to opt in.

Provider adapters

• OpenAI Responses: input_image content parts in user turns and the
  documented function_call_output.output array for tool images.
• Anthropic Messages: base64 image blocks in user turns and tool_result
  content, preserving thinking replay.
• OpenAI-compatible chat completions: multimodal image_url content; tool
  images arrive in a single adjacent observation turn so tool transactions
  stay atomic.

Context accounting

• /context reports image count and estimated visual tokens; images are never
  priced as base64 text, and provider-reported usage stays authoritative.

Install

Download latch-v0.2.1-x86_64-unknown-linux-gnu.tar.gz below and verify it
with SHA256SUMS, or install from the repository:

cargo install --path crates/latch-cli --locked

Runtime prerequisites are bwrap (mandatory sandbox) and rg (search).

Validation

• cargo fmt --check, clippy with -D warnings, the invariant tier, and
  cargo test --workspace are green.
• Live: attached and read_image images were answered correctly through
  OpenCode Go chat completions (kimi-k3) and Anthropic Messages
  (qwen3.8-max); the opt-in vision live-acceptance scenario passes. Text-only
  models were verified to fail locally instead of sending unsupported input.

Full Changelog: v0.2.0...v0.2.1

Latch v0.2.0

Latch v0.2.0 makes the agent cache-aware and sandbox-first. Compared to
v0.1.1, provider-visible history is now append-only within durable cache
epochs, every command runs inside a mandatory bubblewrap sandbox,
mode/safety/permissions are orthogonal controls, and a running task can be
steered without weakening durable state.

Highlights

Prompt-cache locality: durable append-only cache epochs

• Replaced the sliding recent-context window with cache epochs: ordinary turns
  only append, and already-sent messages are never front-evicted or rewritten.
• Kernel context (canonical state, evidence and validation updates, failure and
  re-ground updates, recall, archival index, extension context) is persisted as
  durable snapshot/delta events instead of a regenerated synthetic tail, so
  previous context never silently disappears and resume replays the exact
  provider-visible history.
• Rotation is hysteretic and whole-unit: it happens occasionally under
  sustained pressure, retains a large working set (roughly three quarters of
  the budget) plus growth headroom, never splits a tool transaction, and never
  deletes raw history. /compact remains the only explicit reset.
• Canonical state stays authoritative while history stays provenance, with
  explicit higher-revision supersession of old decisions, constraints, and
  evidence.
• The compiled system prompt is session-stable again: canonical task state no
  longer churns the reusable prefix.

Cache observability

• Three distinct measurements replace the conflated "cache hit": estimated
  architecture cacheability (common_prefix_tokens / request_tokens), provider
  prefix utilization (cache_read_tokens / common_prefix_tokens), and the
  actual provider-reported hit rate (hit / (hit + miss)). Provider usage stays
  authoritative.
• The sidebar exposes compact epoch diagnostics: generation, turns since
  rotation, last rotation reason, and retained tokens.
• Cached tokens are no longer double-charged, unknown provider cache categories
  stay unknown instead of being fabricated as zero, and common-prefix
  measurement stays on UTF-8 character boundaries.

Mandatory sandbox with orthogonal safety controls

• All command execution now goes through bubblewrap: there is no unsandboxed
  fallback, and a failed startup probe refuses to run with an actionable
  diagnostic.
• Mode (ASK/PLAN/WORK), Safety (Strict/Standard/Autonomous), and Permissions
  (human/AI/auto approval) are separate, composable controls with /safety and
  /permissions selectors and durable resume.
• Hard deny is independent of every profile and resolver; external writes,
  network access, and Git metadata mutation become explicit, auditable asks. A
  safety/sandbox regression matrix now covers the composition.

Live steering

• A running task can be steered from the TUI: messages are recorded durably as
  normal user turns and consumed at safe model boundaries, never between an
  assistant tool call and its results.
• The handshake is atomic: an accepted message is consumed by the running turn
  or rejected, never queued into a later run. Not-yet-started side-effecting
  calls are superseded, and every tool call still receives exactly one terminal
  result.

Reliability and long-horizon behavior

• Durable transitions fail closed: a live state change is never reported
  successful before its event commits.
• Incremental, indexed history access keeps long sessions fast without
  weakening continuity; working memory decays gradually and the archival
  episode index is built incrementally.
• read_file returns a smaller token-aware window with continuation offsets;
  undo survives resume, including whether a change created the file.
• Failure signatures ignore elapsed timing, so unchanged failures still
  accumulate toward re-ground instead of resetting the streak.

Architecture and CI

• The agent, tools, and TUI god-files are split into responsibility modules.
• CI is now a small architectural philosophy gate (fmt, clippy, and the
  deterministic tests/invariants.rs tier); detailed and stress suites run
  locally. Cache epochs are performance boundaries, not memory boundaries, and
  cache locality never overrides long-horizon correctness.

Install

Download latch-v0.2.0-x86_64-unknown-linux-gnu.tar.gz below and verify it
with SHA256SUMS, or install from the repository:

cargo install --path crates/latch-cli --locked

Runtime prerequisites are bwrap (mandatory sandbox) and rg (search).

Validation

• cargo test --workspace is green across kernel, providers, sandbox,
  continuity, TUI snapshots, and extensions.
• 48-turn cache stress: 3 rotations with 94% high prefix reuse, versus 30% for
  the old sliding window, while canonical truth, unresolved work, recall, and
  the full raw event log are preserved.

Full Changelog: v0.1.1...v0.2.0

Latch v0.1.1

Latch v0.1.1 establishes the first complete V0.1 coding-agent baseline.

Highlights:

• durable resumable coding sessions and continuous context virtualization;
• token-native context accounting and long-horizon agent execution;
• kernel-owned validation, evidence, provenance, and guarded edits;
• bounded file/search/artifact tools and managed long-running processes;
• real human approval flow for policy-gated operations;
• modern Ratatui interface with a scrollable multiline composer;
• semantic transcript with inline red/green diffs and Markdown table rendering;
• live-model acceptance testing and inspection-loop supervision.

This release freezes the V0.1 architecture before the next permission/safety-policy redesign.