v0.2.0

Full Changelog: v0.1.99...v0.2.0

v0.1.99

Highlights

• Added delimiter-safe untrusted-context handling across repository, memory, summary, advisor, MCP, search, and shell data.
• Made concurrent tool validation race-safe and inference slot limits per-server.
• Hardened lifecycle hooks with cancellation, timeouts, process-group cleanup, and secret-scrubbed environments.
• Added a default-off batched-tool-call experiment with safe provider fallback and benchmark request-count measurements. Public configuration remains gated on live llama.cpp Qwen3VL acceptance.
• Added the three-file benchmark task and reconciled release/backlog documentation.

Verification

• go test ./...
• go vet ./...
• go test -race ./...
• git diff --check

Full Changelog: v0.1.98...v0.1.99

v0.1.98

Full Changelog: v0.1.97...v0.1.98

v0.1.97

Full Changelog: v0.1.96...v0.1.97

v0.1.96 — atomic writes, fail-closed sandbox, retryable HTTP, bound validation

v0.1.96

Round 2 of hardening (10-iteration improvement loop, audited via codex, each fix verified against source and covered by a regression test).

Safety / correctness

• fs_write / fs_edit atomic write — temp file + fsync + mode preserve + rename; a crash/disk-full no longer truncates the file.
• shell_exec fails closed by default — sandbox: "" auto-confines to the workspace via bubblewrap when present; with no bubblewrap it refuses to run unconfined (opt in with unsafe, which warns in the result). Previously "" ran approved commands unconfined.
• fs_read paging validation — negative offset/limit rejected (were silently ignored), limit capped at 2000.
• config vram_threshold_tps bounds — NaN/Inf/negative/abnormal values rejected in env, /set, and YAML.

Robustness (weak local model)

• Retryable HTTP statuses — 429/500/502/503/504 retried with bounded backoff, honoring Retry-After (capped 60s); 4xx stay fatal. A briefly overloaded server no longer aborts the run.

Combined with v0.1.94 (crash-safe checkpoint restore) and v0.1.95 (SSRF / MCP risk / env-leak hardening), Yagent's local-agent safety surface is materially tighter.

v0.1.95 — SSRF, MCP & env-leak hardening + local-model robustness

v0.1.95

Security and local-model robustness hardening, each audited via codex, verified against the current source, and covered by a permanent regression test.

Security

• web_fetch SSRF hardening — scheme-only guard replaced with full host-range rejection (loopback / RFC1918 private / link-local incl. 169.254.169.254 / unspecified), DNS-rebind-safe resolution, and per-redirect re-validation. New web.allow_local_fetch config (default off) opts in only the local dev servers you explicitly trust.
• MCP tools default to RiskWrite — an MCP delete/deploy/send tool can no longer bypass the approval gate. Only a server's mcp.read_only_tools allowlist downgrades named tools to read-only.
• shell_bg env scrub — background/bwrap jobs no longer inherit the agent's API keys / tokens; they use the same scrubbed env as shell_exec.

Robustness (weak local model)

• Streamed tool_call index bound: out-of-range indices rejected as a protocol error (no gigantiac slice allocation).
• subagent fan-out cap: blank tasks dropped, batch capped at 8 with a bounded worker pool, per-task capped at 4 KiB, over-large batches rejected with guidance.
• checkpoint List/Prune exclude hidden state (restore-staging regression fixed).

v0.1.94 — crash-safe checkpoint restore + install target

v0.1.94

Added

• Crash-safe checkpoint restore — checkpoint.Restore stages the snapshot into .yagent/.restore-staging before clearing the live tree, so a failed/interrupted restore (disk full, permission error, snapshot corruption) can never wipe the workspace. Live tree removed only after a full staged copy exists; on error the staging area is cleared and the tree is returned untouched. Two regression tests lock this in.
• make install — builds and installs yagent into ~/.local/bin (override PREFIX/DESTDIR for system-wide installs).

See CHANGELOG.md for the full v0.1.93 + v0.1.94 entries.

v0.1.93 — session rename/pin, reduced-motion, PTY-size smoke coverage

Completing Codex's unfinished TUI batch:

• Persistent session rename & pin — in /sessions, n opens a rename input (persisted; empty clears back to the auto-title), and */P toggles pinning so pinned sessions sort to the top with a 📌 marker. CLI equivalents: yagent sessions rename <id> <title>, pin <id>, unpin <id>. The store gained SetTitle/SetPinned and a pinned column, auto-migrated on existing databases.
• ui.reduced_motion — replaces the animated spinner with a static indicator and stops spinner ticks, for vestibular sensitivity or log-scroll contexts. Live-applied via /settings and /set.
• PTY-size smoke coverage — tests render every TUI modal (settings, sessions, tools, workspace, model) at a 40×10 terminal and assert no panic; modalRows at tiny heights keeps the selection visible with omission markers. This exposed two latent panics — nil-cfg in headerView and nil-ag in statusView — now guarded.
• Accessibility tests — setIconMode ASCII swap/restore, high-contrast theme lookup, and ui.accessibility/ui.reduced_motion config validation + round-trip.

Unit tests + go test -race clean.

v0.1.92 — TUI tool filters, session preview/sort, workspace drawer, accessibility modes

Second TUI batch — tool-inspector filters + navigation, session browser preview/sort, workspace drawer, and accessibility modes:

• /tools filters — f cycles All → Failures → Writes → Running, keeping keyboard selection within the filtered list. PgUp/PgDn move five calls, Home/End jump to the first/last in the active filter, and g closes the inspector and jumps the transcript to the selected call's activity line.
• Session browser preview/sort — p shows the selected session's metadata (title, message count, updated time); s toggles recent-first / title order.
• Persistent workspace drawer — on terminals ≥ 96 columns wide, a compact row below the header keeps workspace, branch, tool count, undo availability, and queued-work state visible during active turns.
• Accessibility modes — ui.accessibility: high-contrast (black background, high-contrast semantic colors) and ascii (emoji → ASCII labels for terminals without emoji fonts), applied live via /settings and /set; NO_COLOR suppresses color styling.
• Fix: the session browser's s/p keys were unreachable (they landed in the settings key handler by mistake) — moved to the sessions handler, with an early return so the preview text isn't cleared. Covered by TestSessionsSortAndPreview.

Unit tests + go test -race clean; ASCII mode live-smoke-tested ([C]/[T] icons render, modals don't crash).

v0.1.91 — TUI tool activity inspector, workspace overview, queued input, safer approvals

TUI overhaul — inspectable tool activity, workspace overview, queued input, and safer approvals:

• /tools — browse the session's tool calls; press Enter to expand a call's arguments and captured result. Compact transcript rows show running / completion / failure, elapsed time, cache status, and output line count — without echoing successful tool output.
• /workspace — workspace path, git branch, context use, tool counts, undo turns available, and whether a follow-up message is queued.
• /sessions <query> — filter sessions by ID or generated title before the browser opens.
• Queued follow-up input — Enter while a turn is running queues one message (a later queued message replaces it); the prompt is only added to the transcript when it actually starts.
• Safer approvals — write approvals now lead with a mutation-specific summary (target path, size, or hunk/file count) before the existing diff; multi-hunk fs_patch review adds a (accept all remaining hunks) and x (reject them).
• Short-terminal modals — settings, models, sessions, skills, checkpoints, and diffs keep the selected content visible with omitted-row markers instead of overflowing.
• Credential-safe settings — saved *_api_key values render as (set; hidden); editing remains an explicit action.

Backed by agent.OnToolResult (post-execution callback with elapsed time) wired through the REPL, TUI, and goal/research/playbook modes.

Unit tests (queued input semantics, bounded modal selection, safe activity summaries, masked keys, approval summaries) + live-smoke-tested the new TUI modals. go test -race clean.