v1.0.9: Security Hardening, Persistent Shell & Semantic Search

⚡ xdh (xdharness) v1.0.9 Release Notes

This release introduces comprehensive security hardening across plugin loading, session persistence, and network requests, alongside persistent shell state tracking, true LLM-driven context summarization, and ranked BM25 semantic search.

🔒 Security Hardening & Zero-Trust Architecture

• AST Static Plugin Scanner (Bug 1): Inspects plugin files before importing to detect and block unauthorized execution calls (os.system, subprocess.Popen, shutil.rmtree, pty.spawn).
• Path Traversal Guard (Bug 2): Sanitizes session IDs and explicitly verifies paths against the session directory using .relative_to(SESSIONS_DIR) in load_session_by_id, save_session, and delete_session.
• Universal Mutation Safety Guard (Bug 3): Restricts destructive filesystem writes targeting critical operating system paths (/etc, /boot, /system) and sensitive repositories/secrets (.git, .ssh, .env) unless operating in --yolo mode.
• SSRF Network Protection (Bug 8): Resolves hostnames in fetch_url before dispatching HTTP requests, blocking private (RFC 1918), loopback, link-local metadata (169.254.x), and reserved IP spaces.
• Prompt Injection Quarantine (Bug 5): Strips non-printable control characters from .xdhrules and .cursorrules files and wraps user rules in isolated advisory blocks to prevent unauthorized instruction override.

🐚 Persistent Shell State & Tool Context

• Persistent Working Directory (Bug 4): Captures working directory transitions (cd) in background bash executions into harness.current_cwd, ensuring that all file tools (read_file, write_file, replace_file_content, find_by_name) resolve accurately against the active directory.

🧠 Intelligent Context Summarization & Streaming Tag Buffering

• True Context Compaction (Bug 6): Replaced lossy truncation with LLM-driven structured bullet summarization preserving user intent, modified file paths, and pending tasks, with an extractive fallback to ensure zero memory loss.
• Tag Fragmentation Buffer (Bug 7): Implemented chunk buffering in SSE stream processing to handle multi-chunk split <think> and </think> tags seamlessly without tag leakage into markdown content.

🔍 Semantic Search & Fine-Grained Metrics

• BM25 / TF-IDF Semantic Indexing (Upgrade 4): Added score-ranked relevance searching for /index build and /index query.
• Fine-Grained Token & Cost Tracking (Upgrade 8): Tracks prompt and completion tokens separately (prompt_tokens_consumed vs completion_tokens_consumed) with exact model pricing calculations displayed in /session analytics.

v1.0.8: Real-Time Composer Metrics, Rich Thinking & Session Management

Changes in v1.0.8

• Real-Time Header & Composer Metrics: Ctx:X%, Tok:Y, and Mem:ZMB update smoothly in real-time as chunks stream in rather than only after the turn.
• Session Management: Added /new and /session new to start fresh sessions, plus /session del <id> / /session delete <id> to delete old sessions.
• Rich Markdown Thinking: Thought blocks now render markdown styling properly (e.g. bold, italics, inline code) without showing raw asterisks.
• Task Identification: Completed/reopened tasks now explicitly mention the task title in both manage_todos and /todo done <id> (e.g. ✓ Completed task #1: "title").
• Smooth Background Animations: Continuous spinner ticking during active tool and thinking execution.

v1.0.7 - 5-Line Box Clamping, Continuous Loading Spinner & System Env Awareness

🚀 What's New in v1.0.7

📦 5-Line Viewport Clamping & Auto-Collapsing

• Clamped Middle Boxes: Tool inputs/outputs across all tools (replace_file_content, read_file, write_file, list_dir, grep_search, bash, etc.) and LLM thinking boxes are clamped to a max of 5 lines, displaying a clean … (+N more lines, Ctrl+O to expand) hint.
• Unconstrained Assistant Responses: Assistant text and answers remain fully rendered and unconstrained as intended.
• Live Stream Clamping: Live thinking stream preview during token generation is capped to 5 lines for zero terminal flicker and instant responsiveness.
• Auto-Collapse: Pressing Ctrl+O collapses thinking and tool outputs into minimal badges (⚡ Thinking (folded), Output collapsed (N chars)).

⚡ Continuous Loading Spinner

• Added an active background daemon ticker thread (_start_spinner_ticker) that repaints UI invalidation at ~12 FPS whenever the harness is busy.
• The spinner in the header (⠋ ⠙ ⠹ ⠸ ⠼ ⠴ ⠦ ⠧ ⠇ ⠏) now rotates continuously during slow LLM reasoning, waiting on network tokens, or background tool execution, ensuring the user immediately knows the harness has not frozen or hung.

🌐 System & Environment Awareness

• Implemented get_system_environment_info() to detect OS, Android Termux app container sandbox, user, shell, and user home directory.
• Injected system environment context into the agent's initialization prompt (XDHarness.__init__), explicitly alerting the model of the Android Termux sandbox and warning that /root and / are read-only.
• Added friendly error guidance for PermissionError and [Errno 30] Read-only file system in write_file.

🛠️ Visual & Layout Fixes

• Fixed sidecar drawer container dimension in XDHApp using to_dimension for smooth F2 / Ctrl+B toggles without layout exceptions.

v1.0.6 - Ultra-Fast Zero-Lag Streaming & Line Caching

Highlights in v1.0.6

• Zero-Lag Streaming & Line Caching: Solved UI lagging behind network streaming during extended thinking and long output generation.
• Delta Formatted Line Caching: Dynamic history line cache eliminates full-history ANSI re-parsing on each streaming token (from ~500-1800ms down to ~1.5ms per tick).
• Windowed Live Thought Viewport: Renders active rolling tail during generation with line counter indicator, smoothly finalizing full unclipped thought block upon completion.
• Debounced Refresh: Optimized streaming UI refresh interval to keep terminal lockstep with fast LLM network streams.

v1.0.5 - Comprehensive Wiki, MCP & Multi-Agent Documentation

✨ What's New in v1.0.5

• 📚 Comprehensive Wiki & Documentation Refresh:
  • Fully synchronized all documentation in docs/wiki/ with latest engine capabilities.
  • Added dedicated documentation for the 24 built-in agent tools, including code_outline, manage_checkpoint, manage_mcp, create_skill, call_skill, create_agent, spawn_agents, and ask_question.
  • Added in-depth architecture guides covering MCP JSON-RPC 2.0 stdio pipes, multi-agent thread swarms, and 30 FPS debounced TUI rendering.
  • Documented permission modes (safe, auto, yolo), headless pipe CLI operations (-p, --pipe), and MCP server configuration (~/.xdharness/mcp.json).
• ⚡ Performance & Stability Validation:
  • Re-verified cross-platform syntax compatibility and clean standalone execution across Android Termux and Linux.
  • Bumped version to 1.0.5 across xdh.py, pyproject.toml, and README.md.

v1.0.4 - Lagless UI Engine, Frame Debouncing & High-Performance Search

What's New in v1.0.4

• Lagless 30 FPS UI Debouncing: Coalesces rapid token stream updates and terminal repaint events to completely eliminate frame lag and UI stutter on Android Termux and desktop terminals.
• Rich Console Instance Caching: Replaces per-chunk terminal reallocations with thread-local cached consoles in render_rich_to_string().
• Ripgrep (rg) Fast-Path Acceleration: Automatic binary acceleration for grep_search when ripgrep is detected on the host system.
• Non-blocking Background MCP Discovery: Spawns and initialises stdio JSON-RPC MCP servers in background threads without pausing the TUI startup.
• Zero-Latency System Clipboard: Tool caching in copy_to_clipboard for instantaneous clipboard transfers.

v1.0.3 - MCP Client, Headless CLI, Permission Profiles, Checkpoints & AST Outline

What's New in v1.0.3

• Headless & Pipe Mode: Run prompts without TUI via xdh -p "...", --pipe, and pipe stdin/stdout (cat file | xdh -p "..." > out).
• Configurable Permission Modes: --safe (confirm state-changing tools), --auto (default: protect against destructive patterns), and --yolo (unconstrained).
• Model Context Protocol (MCP): Full stdio JSON-RPC 2.0 MCP client with tool discovery and dynamic registration (~/.xdharness/mcp.json, /mcp).
• AST Code Outline: Extract class/function signatures with Python AST and multi-language parser (code_outline, /outline).
• Rollback Checkpoints: Instant snapshots of entire workspaces before refactorings (manage_checkpoint, /checkpoint).
• .xdhignore Support: Automatically exclude ignored paths in search, tree, and index tools.
• Autonomous Task Scheduling: Recurring agent task execution with /schedule <interval_sec> <task>.
• Sidecar Drawer Panel: Toggleable side pane (F2 or Ctrl+B) displaying swarm status, MCPs, checkpoints, tasks, and schedules.

Release v1.0.2 - Skills, Multi-Agent, Plugins, Questions & Resilience

Highlights in v1.0.2:

• 🎯 Reusable Skills System (create_skill, call_skill, /skill)
• 🤖 Multi-Agent Orchestration (create_agent, spawn_agents in parallel)
• 🔌 Dynamic Plugin Management (local & community git plugins, /plugin)
• ❓ Interactive User Question Prompting (ask_question with choices)
• ⚡ Mid-Run User Guidance Interruption (send message while busy to steer/pivot)
• 🛑 ESC Key support to immediately halt ongoing tasks
• 🛡️ 5-Stage Exponential Connection Retry Backoff (+5s intervals)
• ♾️ Unconstrained tool execution (removed artificial 8-round limit)

v1.0.1 - Documentation, Governance & Automated CI/CD Publishing

⚡ xdh (xdharness) v1.0.1

Release v1.0.1 introduces project governance standards, security reporting policies, documentation wikis, and automated PyPI release workflows via GitHub Actions.

---

🌟 What's New in v1.0.1

• 📜 Community & Governance Policies:
  • CODE_OF_CONDUCT.md: Contributor Covenant 2.1 implementation.
  • CONTRIBUTING.md: Development guidelines, local environment setup, and PR checklist.
  • SECURITY.md: Coordinated vulnerability disclosure guidelines and supported versions table.
• 🚀 PyPI & CI/CD Pipelines:
  • Added .github/workflows/publish.yml: Automated PyPI publication using Trusted Publishing (OIDC).
  • Added .github/workflows/ci.yml: Multi-version matrix test runner across Python 3.10 through 3.13.
• 📚 Comprehensive Wiki Suite:
  • Full documentation library covering Getting Started, Providers, Configuration, Theming, and Engine Architecture.
• 🛠️ Build System:
  • PEP 517 / PEP 621 compliant modern pyproject.toml with setuptools.build_meta.

---

📦 Quick Install

git clone https://github.com/PwnedBytes0x1/xdh.git
cd xdh
pip install -r requirements.txt
python3 xdh.py

v1.0.0 - Autonomous Terminal Agent Harness & TUI

⚡ xdh (xdharness) v1.0.0 - Official Release

Welcome to the v1.0.0 release of xdh (xdharness) — an autonomous terminal agent harness and Text User Interface (TUI) engineered for mobile agility on Android Termux, as well as Linux, macOS, and Windows.

---

🌟 Release Highlights

• 3-Segment Layout: Real-time context header (tokens, RAM, latency, provider/model), scrollable history viewport with collapsible blocks, and dynamic multi-line composer.
• Provider Multi-Model Support & Auto-Failover: Native streaming integration with OpenAI, OpenRouter, Anthropic, DeepSeek, Groq, Ollama, LM Studio. Automatically fails over to backup providers on rate limits (429) or server errors (5xx).
• Autonomous Agent Tooling Suite:
  • bash_run: Sandboxed execution with timeout and output capture.
  • read_file & write_file: Atomic file read/write with automatic backup generation.
  • edit_file: Smart fuzzy matching and targeted block replacement.
  • diff_files & /apply: Unified diff generator and staged hunk applicator.
  • web_search & web_fetch: DuckDuckGo query integration and clean text extraction.
  • bg_task: Background task runner with detached output streams.
  • tree_view: Directory visualizer with gitignore-awareness.
• 7 Curated Color Palettes: tokyo_night, dracula, catppuccin, monokai, nord, cyberpunk, and gruvbox.
• Termux & Mobile First: Smooth step-scroll animation for touch gestures, compact mini-banners for narrow viewports (<70 cols), and zero heavy C-extension dependencies.
• CLI Options: Support for xdh --version and -v.
• PyPI Ready: Configured for straightforward distribution via pip install xdharness.

---

📦 Quick Install

git clone https://github.com/PwnedBytes0x1/xdh.git
cd xdh
pip install -r requirements.txt
python3 xdh.py

📚 Documentation & Guides

Check out our comprehensive Wiki Documentation for detailed setup and usage guides.