Dial v0.2.11

Security

• Refuse unquoted shell expansion in inspection exemptions, native writes into Git metadata,
  and host Git reads with executable filters or text-conversion drivers. Git history inspection
  cannot invoke repository-configured signature verifiers. Remote SSH wrappers no longer depend
  on the login shell's path-quoting grammar.
• Authenticate collaboration hosts and writable guest actions without transmitting the write
  token. Protocol 1004 requires newly generated links and updated clients (docs/collab.md).
• Restrict text-recovered tool calls to offered tools on local/private endpoints and require
  one-shot human approval throughout parent and worker execution. Saved grants, speculative
  reads and batch shortcuts cannot authorize recovered calls (docs/llm-transport.md).
• Allowlist inherited child environments, redact secret debug output, zeroize tokens, and
  warn about the account-policy risk of Anthropic subscription client identity. Existing
  subscription sign-in remains available without an additional opt-in.
• The release signing job also removes its private-key file in an if: always() step, so the
  key is shredded even when the signing step is killed before its exit trap runs. The publish
  job checks every artifact against SHA256SUMS and the signature against the public key before
  creating the release (docs/release-and-install.md).

Fixed

• scripts/release.sh and the release workflow's CI gate list every failed job of the latest CI run (with links) when they refuse to release, instead of only reporting that no successful run exists.
• Windows native edits no longer fail Git-metadata protection on \\?\C:\… paths (the macOS profile's backslash refusal now applies only where a quoted sandbox profile is generated), the collaboration relay treats a peer that drops its socket (broken pipe or reset) as a normal disconnect rather than a relay error, and CI compiles the Wayland/PipeWire feature combinations on Ubuntu 24.04, whose PipeWire headers match libspa 0.9.
• Closing the terminal Dial runs in (a killed tmux server, a closed SSH session) no longer leaves Dial spinning at full CPU: the input reader treats a hung-up terminal as closed and exits instead of retrying its end-of-file forever.
• Ctrl+O and Ctrl+L on a long, tool-heavy session no longer end it with "terminal frame exceeds the byte limit": replayed scrollback is painted in bounded slices across frames. Leaving the terminal writes its mode resets (bracketed paste, keyboard protocol, cursor, autowrap) as a separate frame that is always attempted, so a refused scrollback write can no longer leave the shell in those modes.
• auto worker isolation falls back to the next backend when one passes its probe but fails to set up (an unprivileged or containerized kernel overlay mount without fuse-overlayfs), instead of failing every isolated task; the setup error is shown as that backend's skip reason. The worktree backend now gets the dependency copy, so workers there can run tests that need node_modules, virtual environments or vendor.
• A worker's private git snapshot excludes every build-output and dependency directory the copy backends exclude (target, build, dist, .cache, __pycache__, …); overlay isolation previously added a project's whole target/ (tens of gigabytes) to a temp-dir repository for every isolated worker.
• Background workers stopped because their owner went away (quitting, or a settings change that rebuilds the agent) are recorded as interrupted, so --restore resumes them; only an explicit cancel records cancelled.
• One-shot notes (background job finished, monitor deliveries, hook context, the 80% wrap-up notice) are no longer lost when a reply is discarded after it arrives: a reply that never reaches history (truncation raise, rejected edit preview, repair, guidance regeneration) leaves its notes queued for the retry.
• A model that keeps answering in text while an investigation checkpoint is open gets two "call rewind" reminders, then the turn stops as incomplete; previously the reminder repeated without limit (each one a paid request, with the default unlimited step budget).
• Goal mode counts batched and streamed-reuse tool calls as activity; a continuation turn made of parallel reads is no longer treated as stalled.
• The prewalk and plan-yolo model handoffs install the new model through the shared route installer (authentication config, context cap, cache identity, role caches) and resize the turn's output budget, so a handoff to a smaller model no longer keeps the planner's context window and compaction thresholds.
• The patch engine no longer edits the first of several identical blocks when the hunk meant another: exact and whitespace-tolerant passes report how many places match, so a hunk's line number selects the right occurrence and a context-stripped fallback that matches more than one place is refused instead of applied.
• Patch re-indentation keeps a line the model deliberately re-indented (a dedent, or wrapping lines in a new block) instead of snapping it back to the file's previous indentation when the hunk was matched with different whitespace.
• A shell command that reaches the automatic background threshold keeps running in the foreground under its own timeout when no background owner can take it (bg not enabled, or all eight slots in use); previously the refused hand-off stopped the command and discarded its output.
• Captured shell output never splits a multi-byte character at the head/tail cut (box-drawing tree output no longer shows replacement characters when nothing was omitted).
• A line ending in \r\r\n keeps its own carriage return when an edit changes a different line.
• grep and glob scoped to a subdirectory honour the .gitignore files of its parent directories (build output such as dist/ no longer consumes the page budget), while an explicitly requested ignored directory is still searched.
• A wide grep page no longer evicts the edit witnesses of files the model read or edited: new search-only witnesses enter at the old end of the store, and superseded snapshots are trimmed before whole files are evicted.
• A session whose last append was torn by a crash or full disk no longer reports corruption on every later resume: the writer removes the unloaded partial line when it claims the journal, instead of sealing it into a malformed interior line with the next append. A complete final entry that only lost its newline is kept.
• Checkpoint review diffs are bounded to 500 ms of edit-script search (a coarser but correct diff past that), and compare-before-restore checks the review token without rebuilding the diff while holding the checkpoint lock.
• Recheck session-writer identity after locking, retain locks through removal, version SQLite
  schemas transactionally, and preserve process-group ownership when waiting for child exit.
• Load Git-overlay status/diffs off the input thread, reject stale replies and unsafe hunk
  fallbacks, and route Unix termination signals through normal terminal cleanup without
  erasing scrollback. Bound relay admission and report actor panics to RPC clients.
• Honour bounded provider retry hints with exponential backoff/jitter; handle CR-only SSE
  framing and checked configuration deadlines. Clarify Linux test prerequisites before running
  the Rust suite, while continuing independent test binaries after failures.
• A refreshed OAuth token, a rotated pooled API key, an account or model switch no longer breaks Responses, Codex WebSocket and native-compaction sessions with "start a clean chat": native items owned by another account, endpoint, credential or model are never replayed, and those turns are sent in portable form instead. Gemini tool history from another model, route or credential is replayed as plain text rather than refused, without inventing function-call signatures.
• Anthropic signed blocks (thinking, server tool results) are recorded with the host that produced them (dial_provider_origin) and replay only there; a turn from another Anthropic-protocol provider (z.ai, MiniMax, Vercel, Cloudflare) is sent as portable text and tool calls. Claude subscription tokens are re-read on every retry attempt, so a retry that outlives the token no longer fails with an authentication error.
• A streamed Responses context_length_exceeded failure is classified as a context overflow (compaction) instead of a transient failure retried with the same prompt; usage_not_included and usage_limit_reached are quota exhaustion. The Anthropic "input length and max_tokens exceed context limit" refusal is recognized as an overflow.
• Chat-completions finish reasons are normalized: max_tokens, model_length, model_context_window_exceeded and max_output_tokens mean length, and error/network_error are incomplete streams, so truncated or aborted replies are no longer accepted as complete answers. A tool call cut off by the output limit on Gemini, Responses or Ollama is dropped and reported as length (raising the budget) instead of failing the turn.
• Idle cache warming stops once the combined cost of its replays would exceed the single cache miss they prevent (previously each replay was judged alone, so long idle windows cost more than the miss).
• A tool-call delta whose index is reused by a different call id starts a new call instead of concatenating two calls.
• The steering runtime probe no longer routes loopback requests through an environment proxy.
• Oversized images are resized once and reused on later requests (bounded cache) instead of being decoded, Lanczos-resized and re-encoded on every request; the saved model catalog is parsed once per file version; and request fingerprinting reuses the built request body instead of re-parsing the serialized request.
• A running tool's live output no longer grows its runtime body without bound: the body keeps the first 1 MiB (prefix-stable,...

Dial v0.2.10

What's Changed

• release: Dial v0.2.9 package metadata by @github-actions[bot] in #4

New Contributors

• @github-actions[bot] made their first contribution in #4

Full Changelog: v0.2.9...v0.2.10

Dial v0.2.9

Full Changelog: v0.2.8...v0.2.9

Dial v0.2.8

Full Changelog: v0.2.7...v0.2.8

Dial v0.2.1

Full Changelog: v0.2.0...v0.2.1

Dial v0.2.0

Full Changelog: v0.1.22...v0.2.0

Dial v0.1.22

Full Changelog: v0.1.21...v0.1.22

Dial v0.1.19

Full Changelog: v0.1.18...v0.1.19

Dial v0.1.18

Full Changelog: v0.1.17...v0.1.18

Dial v0.1.17

Full Changelog: v0.1.16...v0.1.17