v0.9.18

Highlights

• Memory is safer and more recoverable. SQLite operations now use a busy timeout and a real closed-state latch; FTS totals, prefix fallback, embedding backfill/retry, model-aware vector lookup, and /dream consolidation accounting have all been corrected. Consolidation now verifies memo snapshots before deletion and reports skipped entries instead of inflating deleted counts.
• Permission and file-tool boundaries are harder to bypass. Windows path rules are case-insensitive by filesystem semantics, symlink/physical-target checks cover write tools, plan mode evaluates declared write access instead of tool names, and cron teardown is idempotent across session and agent shutdown.
• Compaction and long-running work are more resilient. Blocking compaction now scales from 60 seconds up to 300 seconds with context size, retries cleanly after failures, and preserves cancellation behavior. Background shell timers no longer keep the process alive, while rg installation uses timeout-aware staged downloads and atomic replacement.
• TUI state stays consistent across replay and cancellation. /revoke can rebuild transcripts beyond the visible replay window, approval dismissal is recorded as cancelled, AskUserQuestion entries survive replay, streamed preview state resets correctly, and temporary overlays clean up before editor replacement.
• Rendering and status updates are safer. User/tool transcript paths sanitize tabs and home paths, archived thinking is bounded, theme shimmer reads the live palette, and git status uses asynchronous stale-while-revalidate updates instead of blocking the UI.

Compatibility notes

• MemoryMemoStore operations now throw after close() instead of silently reopening the database.
• computeRelevanceScore no longer accepts the obsolete usage-count argument. Rule scoring is normalized and optionally blends 60% rule score with 40% vector similarity.
• Files larger than 256 MB are rejected explicitly by Read.
• Approval-panel Esc/Ctrl+C/D now records cancelled rather than rejected.
• The git footer badge may be empty on the first frame while its asynchronous refresh completes.
• -p help now states the headless permission behavior explicitly.
• Node.js >=22.19.0 remains required. npm publication is pending registry 2FA confirmation; no native executable artifacts are included.

Verification

• GitHub CI passed on Linux and Windows for commit 178d9b9.
• Full workspace suite: 5,141 tests passed, 50 skipped, and 2 todo across 409 passing test files.
• Typecheck, lint, Sherif, build, publint, and package type checks passed.

Full Changelog: v0.9.17...v0.9.18