Bake 0.3.2

• Ctrl+G shows each subagent's recorded model selection: automatic, explicitly selected, or default, with the effective model and reasoning effort, task difficulty, and the router's reasons. Cautious decisions, missing context, and fallback remain visible after resume. Model calibration labels inherited quality estimates separately.

• Security: the status line's git status poll no longer runs outside the sandbox for a sandboxed session. Such a session can write .git/config and .gitattributes, and git status runs a core.fsmonitor hook and clean filters named there, so a sandboxed command could plant a command that the poll then ran unconfined every two seconds. These reads now run under read-only confinement with the fsmonitor hook off. Where no sandbox backend can confine them, the git field is left out. danger-full-access sessions read as before.

• A foreground bash or pwsh command that changes files in a git workspace shows those files under its output, with the changed lines numbered and colored as an edit call shows them. A sed -i or Python edit is now as visible as an edit, even when the command then exits non-zero. The report is display only: the model's result is unchanged, and changeReport: false turns it off. Git is read before and after the command against a copy of the index, with its fsmonitor hook off, and under read-only confinement for a sandboxed session. On this repository, a command that changes nothing takes about 33 ms longer at the median.

• The download service at bake.justar.dev counts active installs: an installed Bake that checks for updates counts once that day, sent to gissx.org's admin as a daily salted hash of its address, which never leaves the service. BAKE_NO_UPDATE_CHECK=1 turns the check off and keeps the install out of the count. Nothing is counted until the service has its GISSX_ACTIVITY_URL, GISSX_ACTIVITY_TOKEN, and BAKE_ACTIVITY_SALT variables.

• The subagent sheet (Ctrl+G) shows how each delegated child was routed: Auto when the task router chose its model, Selected when the call named one, or Default. It names the effective model and reasoning effort, the router's explanation and difficulty estimate, and a cautious assessment or missing context. A router fallback says why the default was kept. Each decision is logged as an ignorable subagent/routing-decision event, so it survives resume while older Bake versions skip it, and it never reaches model history. Routing stays a beta that is off by default.

• A delegated task longer than 20,000 characters reaches the task router as its opening and its end, the way the router judges it. Bake sent only the opening, so the ask at the end of a pasted log never reached the router.

• dsh headless honors the subagent-model-selection setting as the terminal does: once it is enabled, the subagent tool offers its allowed routes, and with its router on, a delegation that names no route asks the router for one. Headless runs ignored the setting. While it is off, the tools are unchanged.

• With subagent model selection on, subagent and list_subagent_models read a blank provider, model, or reasoning_effort as left out, and a refused provider or route names the allowed routes. GPT models send every optional field, with an empty string for each they leave out. Both tools refused the empty provider, and the errors never named a route GPT could use, so in the eval GPT-6.1 Sol made up to 20 failing calls in one delegation and never reached the router.

• A headless run stopped by SIGTERM, SIGINT, or SIGHUP no longer reports dsh: session "…": flush on a closed handle and a JSON error event. It writes dsh: stopped before the task finished; continue it with --resume <id> and exits with the signal's code; the session log was already saved, and the hint resumes it. A session flush that races the session's close now settles with that close, so the goal driver, subagents, and the checkpoint policy no longer see the same false failure.

• A workflow script's agent() accepts a structured-output schema with any root, such as {type: 'string'}, and resolves to that value. It refused every schema without an object root, which GPT models tried in the eval.

• /resume no longer lists sessions that were opened and left without ever starting a turn. They showed as Untitled session with nothing to return to.

• A write or edit that rewrites a large file no longer freezes the terminal while its diff is computed: a 10,000-line rewrite took 16 seconds. Past 1,000 changed lines, the diff shows one block from the first differing line to the last.

• bash and pwsh take timeout and timeout_ms, as a number or a numeric string, as timeoutMs when it is absent. Models used to other harnesses send those names, and the timeout was ignored: a session that asked for 20 minutes had its test run killed at the 60-second default. An unusable value is now refused instead of ignored.

• A workflow script that does not parse reports the line and quotes it under the error, or says that the script ended inside an unclosed bracket, brace, parenthesis, string, or template literal.

• A subagent refused at the active-subagent limit, and a job_output or job_kill call given a subagent id, both say that a subagent's result arrives as a notice when it finishes, so the model retries then instead of calling the job tools to wait.

• The edit description no longer tells the model to avoid shell scripts. Whether to change a file with edit or with a shell command is the model's choice. With the line in place, Claude Opus still made 12 shell edits to 6 edit calls in one session, while GPT and Gemini made no shell edits in any eval run.

• Refreshing CLIProxyAPI's model list keeps a model's saved effort levels, limits, and adaptive thinking when the proxy's listing leaves them out. The proxy had stopped listing efforts for Claude Sonnet 5.5, and the refresh then removed them, so every request at an effort level was refused.

• The agent-loop eval runs four more models by default: GPT-6 Astra and Claude Opus 5.5 through CLIProxyAPI, and DeepSeek V4.1 Flash and V4 Pro through DeepSeek's own API. EVAL_MODELS=standard runs the original three.