LMcode 0.9.25

LMcode 0.9.25

Security and Windows-behavior hardening. Default permission mode is still auto / full-access; opting into workspace-write is now a hard boundary for Bash.

Fixed

• FetchURL SSRF false positive and IPv4-mapped bypass. Hostnames such as fda.gov are no longer treated as IPv6 unique-local. [::ffff:127.0.0.1] / [::ffff:169.254.169.254] are rejected as private addresses.
• Blobref path traversal. blobref: hashes must be a 64-character SHA-256 hex string, so ../ cannot escape the blobs directory.
• workspace-write now denies unrestricted tools. Bash and WolfPack declare no write paths, so they can no longer write outside the workspace under this sandbox, including in yolo.
• Windows Glob is case-insensitive. *.ts matches .TS on NTFS.
• LSP no longer inherits API keys. Language servers spawn with the same env allowlist as MCP stdio (PATH / PATHEXT / USERPROFILE, not *_API_KEY).
• TUI folded history no longer keeps full tool dumps in RAM, and assistant/user snippets run through replaceTabs.
• pnpm clean works on Windows. Package clean scripts use node -e rmSync instead of POSIX rm -rf.

Desktop (also in 0.7.15)

• Conversation virtualization pins to the tail while following the stream, so the latest message stays mounted after 60 rows.
• Remote sessions install approval/question handlers, drop closed SDK sessions, validate JSON frames, and rate-limit auth per IP.
• Tool output pruning no longer Array.froms the entire string.

LMcode 0.9.24

LMcode 0.9.24

Fixed

• GLM-5.3-Flash is now catalogued as vision-capable. Models served via OpenAI-compatible gateways fell through to UNKNOWN_CAPABILITY (image_in=false), so the visual-fallback MCP was injected even though GLM-5.3-Flash accepts image input natively. Pasted images now go through native multimodal input; text-only GLM tiers stay uncatalogued.

Added

• Visual-fallback MCP gating layer. ToolManager.isVisualFallbackSuppressed() hides visual-mcp tools from models with image_in=true; degradeImagesForModel() persists pasted images and points the model at visual-mcp only when the model has no native vision. Documented in AGENTS.md.

Internal

• @lmcode-cli/ltod renamed to @lmcode-cli/liumir (private workspace package, no external consumers): packages/ltod → packages/liumir, ltod-llm.ts → liumir-llm.ts, all imports / type aliases / docs updated, lockfile regenerated.

v0.9.23

LMcode 0.9.23

Hardening release after a full-repo review.

Security

• Default permission is now auto, not yolo. Sensitive files, Git control paths, and out-of-cwd writes still ask for confirmation. Use lm --yolo or /yes for the old behavior.
• Bash is no longer invisible to the file sandbox. Plan mode and read-only sandbox treat Bash as an unrestricted write and block it.
• Bash no longer inherits host *_API_KEY / *_TOKEN / *_SECRET environment variables.
• Desktop remote WebSocket clients attach only after pairing-token auth. Failed attempts are rate-limited. Token comparison is constant-time.
• Desktop IPC Zod schemas are enforced at the secureInvoke boundary.

Reliability

• Context-overflow retry continues only after a compaction actually commits.
• New /goal runs get a default turn / token / wall-clock budget.
• Image/audio/video parts are counted in the token estimate instead of 0.
• WolfPack is no longer default-approved and runs in batches of 8.

UX / performance

• TUI splash auto-dismisses after 1.5s (Enter still skips).
• Footer / welcome / editor animations are cheaper; folded transcript components dispose timers.
• Desktop long conversations window the message list.

DX

• Node engines aligned to >=22.19.0.
• pre-commit now runs lint-staged.
• Scratch capture scripts removed from the repo.

Desktop app version: 0.7.2.

lmcode v0.9.22

🚀 v0.9.22 — 性能与代码质量优化

基于 code review 的审查优化（包含此前未提交的 --append-system-prompt-file 流式选项）。

⚡ 性能

• 微压缩线性化：findSupersededPaths 由 O(R²) 内层扫描改为按文件路径 O(1) 查找，消除长会话中每次 LLM step 的二次复杂度热点
• token 估算复用：微压缩改用 estimateTokensForMessage，不再为每条消息包装单元素数组
• 桌面端撤销全部 Git 变更：不再对每个变更文件重新执行全仓 inspect（每个文件 4 次 git 子进程），改为跳过已解析路径

🧹 清理

• 移除未使用的 buildMessagesWithSystem() 与 turn/index.ts 中重复的 goal reminder 常量
• 规范化 compaction/strategy.ts 的引号风格
• 移除 footer 背景任务徽章中的无效单复数三元表达式
• 移除 setProcessTitle 未使用的 _sessionId 参数，修正过时注释
• CLI：提取 -S/-r 共享的可选 ID 参数解析器

✨ 功能（并入）

• stream-json 新增 --append-system-prompt-file <path>，支持从文件读取追加系统提示词

✅ 验证

• agent-core：2627 测试通过（173 文件）
• apps/lmcode：947 测试通过（120 文件）
• lmcode-desktop：164 测试通过（42 文件）
• 三包 typecheck + lint 0 错误 + 全包构建通过

v0.9.21

Highlights

• Fixed packaged desktop Playwright support by preserving Playwright as an SDK runtime dependency, vendoring the complete playwright-core package, and validating the packaged Chromium launcher. (#19)
• Hardened self-healing diagnostics so raw paths, file URLs, and percent-encoded absolute source paths are redacted across Windows and POSIX environments. (#19)
• Remediated production advisories in fast-uri, @hono/node-server, tar, and body-parser; production dependency audits now gate CI and npm publishing. (#19)
• Made lint warnings fatal and reduced the repository from 113 warnings to zero, with narrowly scoped test-only allowances for Vitest mock references and ANSI control-sequence fixtures. (#20)
• Added an English README, repository activity badges, and the public roadmap.

Validation

• GitHub Actions passed security audit, build, typecheck, warning-free lint, and Ubuntu/Windows tests.
• 5,208 tests passed across 412 test files; 50 skipped and 2 todo.
• @liumir/lmcode@0.9.21 was published with gitHead 36fda1bc6cb0cea25a16f0101e2a6354a2542563.
• A fresh registry execution of lm --version returned 0.9.21.

Full Changelog: v0.9.20...v0.9.21

v0.9.20

Highlights

• Goal mode now carries durable progress across continuation turns. Working notes, lifecycle state, turn counts, elapsed time, and token usage are recorded and restored so long-running work can continue without losing its execution context.
• Completion claims are independently verified. Explicit or generated acceptance criteria are checked against recent execution evidence; failed reviews return actionable feedback instead of silently accepting partial work, while stale verdicts are discarded if the goal changes during grading.
• Budgets are enforced across the full goal lifecycle. Turn, token, and wall-clock limits are normalized safely, grader usage is included in accounting, and resource exhaustion stops goal execution with a recorded blocked outcome.
• Goal transitions are safer. Resume, interruption, cancellation, approval cancellation, context compaction, side questions, and post-write/spec-critic continuations now preserve a coherent single active execution boundary.
• Coverage was expanded substantially. Contract tests now exercise goal persistence, budget edges, grading, usage accounting, hooks, compaction, interruptions, and lifecycle recovery.

Compatibility notes

• Calling UpdateGoal with complete may now trigger one or two verification model calls. If evidence is insufficient, the goal remains active and the reviewer feedback is returned for another iteration.
• An active goal restored from disk is paused after resume, preventing surprise autonomous work until the user explicitly resumes it.
• Node.js >=22.19.0 remains required. This release is distributed through npm; no native executable artifacts are included.

Verification

• GitHub CI passed on Linux and Windows for npm source commit bcc4e5a.
• Full local workspace suite: 5,207 tests passed, 50 skipped, and 2 todo across 412 passing test files.
• Typecheck, lint (0 errors), Sherif, full build, publint, package type checks, local CLI smoke, and npm package dry-run passed.
• The dry-run tarball integrity matches the published @liumir/lmcode@0.9.20 registry artifact, and the published CLI reports 0.9.20.

Full Changelog: v0.9.19...v0.9.20

v0.9.19

Highlights

• Hardened LmcodeHarness session lifecycle handling: duplicate explicit session IDs are rejected, concurrent resumes coalesce, and close/delete operations safely wait for in-flight session startup.
• Added a core guard that preserves an already-active session when a duplicate ID is requested.
• Serialized Windows taskkill.exe execution across LMcode processes with bounded waits and a safe direct-kill fallback, preventing concurrent termination hangs.
• Stabilized asynchronous lifecycle assertions that could race under full-suite load.

Verification

• GitHub CI passed on Linux and Windows for commit 3edcee0.
• Full local workspace suite: 5,145 tests passed, 50 skipped, and 2 todo across 409 passing test files.
• Typecheck, lint, Sherif, build, publint, package type checks, CLI smoke test, and npm package dry-run passed.

Full Changelog: v0.9.18...v0.9.19

v0.9.18

Highlights

• Memory is safer and more recoverable. SQLite operations now use a busy timeout and a real closed-state latch; FTS totals, prefix fallback, embedding backfill/retry, model-aware vector lookup, and /dream consolidation accounting have all been corrected. Consolidation now verifies memo snapshots before deletion and reports skipped entries instead of inflating deleted counts.
• Permission and file-tool boundaries are harder to bypass. Windows path rules are case-insensitive by filesystem semantics, symlink/physical-target checks cover write tools, plan mode evaluates declared write access instead of tool names, and cron teardown is idempotent across session and agent shutdown.
• Compaction and long-running work are more resilient. Blocking compaction now scales from 60 seconds up to 300 seconds with context size, retries cleanly after failures, and preserves cancellation behavior. Background shell timers no longer keep the process alive, while rg installation uses timeout-aware staged downloads and atomic replacement.
• TUI state stays consistent across replay and cancellation. /revoke can rebuild transcripts beyond the visible replay window, approval dismissal is recorded as cancelled, AskUserQuestion entries survive replay, streamed preview state resets correctly, and temporary overlays clean up before editor replacement.
• Rendering and status updates are safer. User/tool transcript paths sanitize tabs and home paths, archived thinking is bounded, theme shimmer reads the live palette, and git status uses asynchronous stale-while-revalidate updates instead of blocking the UI.

Compatibility notes

• MemoryMemoStore operations now throw after close() instead of silently reopening the database.
• computeRelevanceScore no longer accepts the obsolete usage-count argument. Rule scoring is normalized and optionally blends 60% rule score with 40% vector similarity.
• Files larger than 256 MB are rejected explicitly by Read.
• Approval-panel Esc/Ctrl+C/D now records cancelled rather than rejected.
• The git footer badge may be empty on the first frame while its asynchronous refresh completes.
• -p help now states the headless permission behavior explicitly.
• Node.js >=22.19.0 remains required. npm publication is pending registry 2FA confirmation; no native executable artifacts are included.

Verification

• GitHub CI passed on Linux and Windows for commit 178d9b9.
• Full workspace suite: 5,141 tests passed, 50 skipped, and 2 todo across 409 passing test files.
• Typecheck, lint, Sherif, build, publint, and package type checks passed.

Full Changelog: v0.9.17...v0.9.18

v0.9.17

Highlights

• Project conventions (AGENTS.md) actually reach the model now. A wiring bug in prompt context preparation sent only file paths where the template promised file contents — user-level and project-level AGENTS.md instructions were silently invisible to the agent. Contents are now injected as designed, for the main agent and subagents alike.
• Command output keeps its true tail. For outputs over ~50KB, the truncation builder froze the "tail" mid-stream and silently dropped the real end — usually where build and test errors live. The tail ring buffer now rotates through the entire stream, and truncated-byte counts are accurate.
• More reliable compaction. After a full compaction, the recent tool results it deliberately preserved were immediately replaced with placeholders by a stale micro-compaction cutoff — the model went blind to its own recent work. The cutoff now resets when a compaction applies.
• Goal drives are stoppable again. Resuming a paused/blocked goal left the session with no active turn: cancellation was a no-op, and steer/RPC/cron could start a concurrent turn writing to the same context. The drive now re-establishes the active turn.
• Safer plan reviews and memory. A session-scoped approval can no longer skip review of a new plan body; deleted memories no longer leak ghost keywords into new ones through the FTS index; /dream merges keep memos in their project when all originals agree; dream session counting no longer inflates via subagents.
• TUI modal fixes. Approval/question panels no longer leave the agent waiting forever when the /tasks browser owns the screen, and dialogs they covered are properly restored afterwards (the activity pane no longer stays hidden).

Compatibility notes

• Plan review is no longer skipped by session-scoped approvals. Every new plan body asks for review (matching the TUI's existing semantics); the SDK session-scope path now behaves the same.
• The permission model is unchanged. The README now documents that auto mode's sensitive/git-control/outside-cwd checks cover file tools only — Bash, MCP, and user tools are approved without those checks (as before).
• Node.js >=22.19.0 remains required. This release is distributed through npm; no native executable artifacts are included.

Verification

• Full workspace suite: 5,124 tests passed, 41 skipped, and 2 todo across 406 passing test files.
• Typecheck, build, lint (0 errors), Sherif, and package lint passed through the publish gate chain.
• 15 new contract-level regression tests, each verified to fail (or hang) against the pre-fix code.

Full Changelog: v0.9.16...v0.9.17

v0.9.15

Highlights

• More reliable agent and session lifecycles. Shutdown, resume, compaction, LSP, MCP, and SDK race conditions now converge cleanly; late provider responses can no longer write into closed or replaced sessions.
• Better memory retrieval. Hybrid keyword/vector search now includes semantic-only matches, ranking is more balanced, and SQLite/legacy JSONL migrations plus embedding writes are safer under concurrent use.
• Improved Google GenAI compatibility. Function-call IDs, thought signatures, media tool results, usage metadata, thinking settings, and filtered responses now follow the current @google/genai protocol.
• More accurate TUI behavior. /mcp shows each server's effective configuration source and safely removes overrides; /revoke stays synchronized across compaction and archived transcript boundaries; large diff previews use bounded memory and sanitize terminal content.
• Safer source installs and updates. New source installs keep code in ~/lmcode and user data in ~/.lmcode; existing layouts remain supported. /update is fast-forward-only, uses a frozen lockfile, enforces bounded process execution, and automatically selects a compatible pnpm 11 release.
• Security hardening. File tools validate physical paths around symlinks, MCP subprocesses inherit a reduced environment, configuration parsing resists prototype pollution, Goal completion fails closed when verification is unavailable, and WolfPack output is bounded.

Compatibility notes

• Directory symlinks are no longer recursively traversed by Glob. This is an intentional security-first behavior change.
• Node.js >=22.19.0 remains required.
• This release is distributed through npm; no native executable artifacts are included.

Verification

• Full workspace suite: 5,086 tests passed, 50 skipped, and 2 todo across 404 passing test files.
• Typecheck, build, lint, Sherif, package lint, and dependency audits passed.
• Windows installer tests and WSL POSIX installer security smoke tests passed.
• CLI packaging was validated through npm publish dry-run and runtime smoke tests.

Full Changelog: v0.9.14...v0.9.15