v0.2.0

Changed

• Review shows pending agent edits for This turn and Conversation, with comments on selected code lines, resumable drafts and undo after the list becomes empty. Source Control separately stages and unstages files and commits the index. Review decisions preserve Git index and history; Git rows link only to files still pending review. The Git discard, comparison-review and quick-command interfaces are removed; free commands remain available in the terminal.

• Breaking SDK change: review scopes are only session / turn; decisions require explicit file versions. Git file management uses vcs.changes.get, vcs.changes.stage and vcs.changes.unstage, with checkout and version validation.

• A turn's changed files start folded; clicking the card lists them all, scrolling after six rows. Review stays available while folded.

• New conversations can select a globally configured agent product with its own model and streamed text. Agent Connections settings are separate from Collaboration role templates, including seven read-only built-in roles and custom templates. Turning a product off locks its direct conversations until the user explicitly accepts MerakCode takeover; group members go offline while other members continue.

• The homepage can switch local branches or prepare a new worktree from a chosen branch. Working-branch controls live in Source Control, independently of conversation review. Unsaved editor buffers and review comments survive view changes and prevent switching.

• The SDK adds checkout-aware branch operations and HEAD events. Review decisions and undo now require expectedCheckout from the displayed review, so stale operations cannot modify another checkout context.

• The conversation composer shows the sandbox as on or off beside a shield. Hovering context usage, the model, reasoning, the sandbox, or the permission mode says what that control configures, with the current value still on the button. The menu can set the sandbox up (Windows asks for administrator approval once), turn it on, or turn it off, without leaving the conversation. A command waiting only because the sandbox was not ready continues once the sandbox is on, or once you turn it off. An already set up sandbox is warmed when the engine starts.

• The homepage model menu lists Official before Configured, and "Add model" at its bottom opens the provider list in Settings.

• Commands wrapped in env, sudo, nice, timeout, xargs and the like, command lines inside sh -c and eval, and tool options before a subcommand (git -C dir push, pnpm --filter x publish) are judged by the command that actually runs. Read-only commands with options that write files or run other programs (sort -o, rg --pre, git diff --output=) count as file-changing commands.

• A command argument naming a secret file is asked about even as a relative path (cat .env), and ~/.merakcode/data/auth.json, where MerakCode keeps provider keys, counts as a secret.

• Editing MerakCode's own config files (merakcode.json, merakcode.jsonc) asks first even in auto mode, under the new permission key config_write, and the sandbox keeps commands from changing a project's config files, as it does for .git/hooks and .git/config.

• Error hints point to merak provider login and Settings → Models & providers instead of a /provider command, and the sandbox hints say what to do in each case.

• The engine no longer accepts browser requests from *.merakcode.ai.

• Tool descriptions for the model match what the tools do; the ls tool, which was never available, is removed.

• The desktop installers' THIRD_PARTY_LICENSES.txt also lists the packages bundled into the main process.

• The README, SECURITY.md, SDK guide, CONTRIBUTING.md and AGENTS.md are brought in line with the code: a permission rule example that did not apply, SDK examples that did not run as written, and what the sandbox and permission checks can and cannot stop.

Fixed

• The composer and side panel navigation stay usable when the window shrinks, and delayed conversation history no longer replaces completed member replies or restores deleted messages.

• External agent cleanup on Linux and macOS finds the system process tools even when PATH has no system commands.

• The first file search waits for the initial index, so an existing file can be mentioned without typing again.

• Refreshing dropdown options no longer resaves an unchanged setting and interrupts a conversation with a config reload.

• Concurrent project configuration loads retain their own warnings instead of losing or mixing them.

• Git index actions finish refreshing their file list before accepting the next action and preserve background refreshes, so Stage all includes files just unstaged or created during the operation.

• Worktree conversations keep their branch names and merge target when the same project is opened through an alternate directory spelling.

• Open branch menus follow refreshes completed by another picker while preserving the guard against switching with unsaved edits.

• Review comments exclude an unselected line when a native selection ends at its start, and feedback relocated during submission stays pending after the earlier request succeeds.

• After the engine restarts or is killed mid-turn, unfinished native tool calls no longer stay spinning: loading the conversation (or disposing the instance) marks them interrupted, and the next message starts a new turn instead of continuing under the stuck one.

• External conversations with agent products such as Claude Code and Codex are titled from the first message with the configured small model, instead of keeping the default New session - … title.

• Delayed product probes and session updates no longer undo newer settings or takeover decisions. Recreated products require a fresh takeover decision; takeover retains observed steps from failed or cancelled turns without text. Final snapshots remove obsolete fragments, and connection settings show the adapter's reported permission owner and retain MRK error codes.

• External tasks finish process-tree cleanup before releasing their directory. Final replies calibrate streamed text, client clock differences preserve conversation history, admitted turns update recent activity, and group adapter errors retain localized MRK codes.

• A late takeover response cannot block decisions for a new disable cycle or another conversation. Disabled group members consistently show offline, including queued tasks, with localized errors. Products without text streaming show that output arrives on completion.

• External chat history rejects reused message and part IDs, and command connections preserve complete recovery IDs across split output and failed runs. External chat errors follow the selected language and show stable MRK codes.

• Command connections with a session ID pattern and no resume arguments replay conversation history on later turns. Editing or refreshing agent connections discards stale verification reports.

• Setting up the sandbox, or turning it off, no longer lets a file-changing command through when read-only mode or an explicit deny still refuses it. Resetting the sandbox while it is turned off still reports that it can be set up again.

• Hints on the composer bar open just above their controls: context usage, the model, reasoning, the sandbox, and the permission mode.

• Typing /skill-name after a space, including in the middle of a sentence, loads that skill. Skills are read from Claude's .claude/skills and .agents/skills, and from .merakcode/skill and .merakcode/skills. A skill the agent is denied is not loaded.

• Maximizing the review from a new conversation fills the window with the review.

• A subagent's question reaches the SDK's onQuestion of the conversation that started it, and is dismissed without one, instead of leaving the turn waiting.

• A member adapter's request with nothing to check (empty paths or an empty command) is refused instead of allowed.

• The Linux sandbox helper only runs the request the engine wrote for it.

变更

• 审阅只显示本轮和整个对话的智能体待审改动，支持选中代码行评论、草稿恢复及空列表下撤销审阅。Git 管理独立提供暂存、取消暂存和提交已暂存内容；审阅决定不改变 Git 暂存区及提交历史，Git 文件只跳转到仍待审的改动。移除 Git 页的丢弃、分支比对审阅和快捷命令入口，自由命令由终端承接。

• SDK 不兼容变更：审阅范围只保留 session / turn，决定必须携带明确的文件版本；Git 文件管理切换到 vcs.changes.get、vcs.changes.stage 和 vcs.changes.unstage，校验 checkout 和文件版本。

• 每轮的改动文件默认收起；点击卡片标题展开全部文件，超过六行时在列表内滚动。收起时仍可直接审阅。

• 新建对话可以选择全局配置的智能体产品，使用各产品独立模型和流式正文。「智能体接入」与「协作群」角色模板设置分开，提供七个只读内置角色和自定义模板。关闭产品后，单聊锁定输入，只有用户明确同意才由 MerakCode 接管；群成员仅显示离线，其他成员继续工作。

• 主页可以切换本地分支，或选择起点后准备创建新工作树。工作分支操作移至独立的 Git 管理页，与对话审阅分开。未保存的编辑缓冲和审阅评论在切换视图后仍保留，并阻止切换工作分支。

• SDK 新增带 checkout 身份的分支操作和 HEAD 事件。审阅决定与撤销现在必须携带所显示审阅的 expectedCheckout，防止过期操作修改另一个 checkout 上下文。

• 对话栏里沙箱是盾牌图标加「开」或「关」。悬停上下文用量、模型、思考档位、沙箱或权限模式，都会说明这个控件是在配置什么，当前的值仍写在按钮上。点开沙箱可以初始化（Windows 会要一次管理员确认）、开启或关闭，不用离开当前对话。只因为沙箱没就绪才在等审批的命令，会在沙箱打开之后继续执行；你把沙箱关掉之后也会继续。已经初始化过的沙箱会在引擎启动时预先准备好。

• 主页的模型菜单改成「官方供应商」在前、「配置的模型」在后，底部的「添加模型」改为打开设置里的服务商列表。

• 包在 env、sudo、nice、timeout、xargs 等命令里的命令、sh -c 和 eval 里的命令，以及写在子命令前面的选项（git -C 目录 push、pnpm --filter x publish），都按实际执行的那条命令判断。只读命令带上会写文件或执行别的程序的参数（sort -o、rg --pre、git diff --output=）时，按会改文件的命令算。

• 命令的参数写到密钥文件时，用相对路径（cat .env）也会先问；MerakCode 保存模型服务密钥的 ~/.merakcode/data/auth.json 也算密钥。

• 改 MerakCode 自己的配置文件（merakcode.json、merakcode.jsonc）在自动模式下也要先问，对应新的权限键 config_write；沙箱也不让命令改项目的配置文件，和 .git/hooks、.git/config 一样。

• 错误码的提示改为指向 merak provider login 和「设置 → 模型与供应商」，不再提不存在的 /provider 命令；沙箱相关的提示写清了每种情况该怎么办。

• 引擎不再接受来自 *.merakcode.ai 的浏览器请求。

• 给模型看的工具说明和工具的实际行为对齐；删掉了从来没有启用过的 ls 工具。

• 桌面安装包里的 THIRD_PARTY_LICENSES.txt 也列出了打进主进程的依赖包。

• README、SECURITY.md、SDK 手册、CONTRIBUTING.md 和 AGENTS.md 按代码重新核对：修正了不生效的权限规则示例、照着写跑不起来的 SDK 示例，并写清了沙箱和权限审批能挡什么、挡不住什么。

修复

• 窗口缩小时，消息输入框与右侧面板导航仍可正常使用；延迟返回的对话历史不再覆盖已完成的成员回复或恢复已删除的消息。

• Linux 和 macOS 上，即使 PATH 不包含系统命令，外部智能体清理仍能找到系统进程工具。

• 首次文件搜索会等待初始索引完成，引用已有文件时不必再次输入才能看到补全结果。

• 下拉选项刷新时不再重复保存未改变的设置，避免配置重载中断刚开始的对话。

• 多个项目并行加载配置时，告警按各自项目收集，不再丢失或串到其他项目。

• Git 索引操作在文件列表刷新完成后才接受下一次操作，并保留期间的后台刷新，“暂存全部”也会包含刚取消暂存或在操作期间新建的文件。

• 同一项目使用不同目录写法打开时，工作区对话仍能显示正确的分支名和合并目标。

• 已打开的分支菜单会同步其他选择器完成的刷新，同时继续阻止带有未保存编辑的分支切换。

• 原生代码选区结束在下一行行首时，审阅评论不再包含未选中的行；发送期间重新定位的反馈在旧请求成功后仍保留待发送。

• 引擎在中途重启或被强杀后，未完成的本地工具调用不再一直转圈：打开对话（或销毁实例）时会标为重启中断，下一条消息会开新一轮，而不会挂在卡住的那一轮下面。

• 使用 Claude Code、Codex 等智能体产品的单聊会在第一条消息后使用配置的 small model 生成标题，不再保留默认的 New session - … 标题。

• 延迟的产品探测和会话更新不会覆盖新设置或接管决定；删除后重建的产品需要重新确认接管。接管保留无正文失败或取消任务的已记录步骤，最终正文快照清除过时片段，接入设置按适配器报告显示权限归属并保留 MRK 错误码。

• 外部任务清理完进程树后才释放目录占用；完整回复会校准流式正文，客户端时钟偏差不再遗漏对话历史，成功接收的轮次会更新最近活动时间，群适配器错误保留本地化提示与 MRK 编号。

• 过期接管响应不会阻止新禁用周期或其他对话中的确认。停用群成员在排队阶段也统一显示离线，错误提示支持中英；不支持正文流式的产品会标明“完成后输出”。

• 外部对话历史会拒绝复用已有消息和正文片段 ID，命令接入在分块输出和执行失败时仍保存完整恢复 ID。外部对话错误按所选语言显示，并提供稳定的 MRK 错误码。

• 仅配置会话 ID 识别、未配置续接参数的命令接入会在后续轮次回放对话历史。编辑或刷新智能体接入时会丢弃过期验证结果。

• 初始化沙箱或关掉沙箱时，只读模式或明确拒绝仍挡住的改文件命令不会被放行。沙箱关着的时候重置，仍会显示还可以再初始化。

• 对话栏上的悬停说明出现在控件正上方，包括上下文用量、模型、思考档位、沙箱和权限模式。

• 在空格后面输入 /技能名（包括写在句子中间）会加载该技能。技能从 Claude 的 .claude/skills、.agents/skills，以及 .merakcode/skill、.merakcode/skills 读取。智能体被拒绝使用的技能不会加载。

• 在新对话里铺满审阅时，窗口显示的是全屏审阅。

• 子智能体的提问会交给发起它的会话的 SDK onQuestion，没给 onQuestion 时会被跳过，不再让这一轮一直卡着。

• 成员适配器发来的没有可检查内容的审批请求（paths 为空或 command 为空）改为拒绝，不再放行。

• Linux 沙箱的辅助进程只执行引擎为它写好的那条请求。