v0.9.0

0.9.0 (2026-09-15)

Features

• acp: add standard session list and resume (#914) (c1937df)
• acp: emit structured file changes in tool updates (#999) (faec8ee)
• acp: surface safe browser tool metadata (#1000) (a6ec043)
• exec: default headless runs to the turn-budget ceiling (#1049) (9e609c5)
• tui: interactive terminal attach for tty exec sessions (#1055) (d73ec81)
• tui: offer mid-run model escalation behind --allow-escalation (#1019) (91d921f)
• tui: richer /resume session browser (#1047) (2f53117)

Bug Fixes

• acp: make configured MCP tools callable (#1003) (7f5e5af)
• agent: stop the tool-schema ratchet meaning a different thing per host (#1017) (f909266)
• background: treat POSIX zombie leader as already-exited (#981) (1aacf38)
• config: lock config read-modify-write across processes (#960) (b04fe96)
• config: preserve unknown top-level fields (#984) (488def6)
• daemon: publish status files atomically (#949) (9001421)
• installtxn: put back an install a killed commit left behind (#997) (2837f5e)
• let the configured forward proxy through the loopback guard (#1025) (1e4db7c)
• lockutil: use kernel-held advisory locks (#950) (6fe0d1e)
• mcp: discover OAuth through protected resource metadata (#991) (1b5db17)
• mcp: reject a server-initiated request as a streamable-HTTP response (#1054) (2479d94)
• oauth: force-close loopback callback connections past the shutdown deadline (#1051) (176f5a2)
• oauth: Split an oversized keyring token blob across entries (#1007) (275e248)
• providers: register Atomic Chat as local OpenAI-compatible runtime (#550) (79fa142)
• redaction: split camelCase keys in normalizeKey (#994) (08fbea7)
• sandbox: keep a derived ACL target inside the write root it came from (#1040) (3b43c43)
• sandbox: keep Windows restricted-token SIDs narrow and fail closed on DenyRead (#1006) (0207f2b)
• sandbox: Make WSL backend tests deterministic. (#948) (e59bf78)
• sandbox: protect worktree git pointers (#805) (f30f550)
• sandbox: refcount temporary roots so one holder's cleanup cannot revoke another's (#911) (7acac7a)
• sessions: carry an interrupted turn's work into the resume prompt (#1016) (6ae8396)
• sessions: render resume context fields in key order (#1043) (da244bc)
• specialist: keep the pinned model when a specialist is resumed (#1009) (aadb4a2)
• swarm: stop original member before handoff (#957) (0021475)
• tools: an edit keeps the reads it did not disturb (#908) (1649008)
• tools: make apply_patch tolerant and re-expose edit_file (#956) (2749447)
• tools: reject fuzzy edits with drifted content (#983) (8b3d1b1)
• tools: say when format-on-write ran out of time (#1044) (6937a30)
• tui: move voice capture to Ctrl+Space (#968) (eeea330)
• update: keep Windows failed-restore state in trusted recovery records (#979) (a3852ba)

Performance Improvements

• agent: cheap compaction — dedicated summarizer model, input cap… (#532) (6645f97)
• providers: parallelize isolated provider unit tests and shrink retry backoffs (#955) (d6b25fc)
• reduce startup and turn overhead (#932) (1fde941)

v0.8.0

0.8.0 (2026-08-21)

Features

• security: path-jail primitive, credential-store locking, worktree git hardening (#891) (060d38c)
• update: recognise Homebrew installs and add mise, go install docs (#910) (01c3498)
• use Exa as default search provider (#926) (1ec7219)
• zerogit: auto-create a conventional branch before push/pr on default branch (#671) (d065467)

Bug Fixes

• acp: three defects a desktop ACP client hits (#915) (a78c6c3)
• bump Go to 1.26.6 for stdlib vulnerability fixes (#903) (dc15e82)
• daemon: clean up child after startup timeout (#774) (9c29209)
• dictation: redact API keys from streaming transcriber errors (#852) (64a783b)
• modelregistry: expose reasoning effort for DeepSeek V4 models (#931) (90dcfd1)
• providers: discover ChatGPT capabilities (#890) (2d2450e)
• sandbox: normalize launcher names before the command-prefix denylist (#934) (6edf9a8)

v0.7.0

0.7.0 (2026-08-10)

Features

• agent: add PermissionModePlan for interactive read-only planning (#853) (0176ee4)
• providers: live model lists for OpenRouter and OpenGateway (#860) (fb4f293)
• tools: give tool results an image channel and add view_image (#843) (cd0eb19)
• tui: replace /retitle with local /rename (#826) (5886354)

Bug Fixes

• agent: end the additional_permissions retry loop (#864) (4ca4fa7)
• agent: tell the user a prefix approval leaves the sandbox (#885) (2ec5c3a)
• cli: report MCP servers that failed to start (#822) (#827) (021281e)
• lsp: dispatch notifications off read loop (#759) (936aa4e)
• mcp: name the non-text blocks a tool result drops (#874) (027a670)
• sandbox: deny reads of Zero credential stores (#681) (55fa05f)
• sandbox: stop the Windows write jail honouring Everyone-granted paths (#865) (91b413c)
• secrets,worktrees: fix secret redaction leakage and prune stale worktrees (#855) (ff62f73)
• specialist: make overwrites atomic (#757) (30f6d8f)
• suppress gosec G204 warning for trusted local config commands (#848) (c52db05)
• tui: a copied NUL byte no longer panics the TUI on Windows (#876) (cae0269), closes #875
• tui: exclude permission waits from turn time (#820) (15eb16f)
• tui: fall back to CellMotion where AllMotion is unreliable (#872) (7fbd864)
• tui: fill alt-screen frame with theme panel background (#850) (020c28e)
• tui: hide unavailable sidebar shortcut (#821) (845df6c)
• use OAuth credentials in provider health checks (#828) (d37de92)

Performance Improvements

• compact common test output (#846) (edf660a)
• improve harness context efficiency (#838) (8e26679)

v0.6.0

0.6.0 (2026-07-29)

Features

• add persistent session goals (#803) (5d1869e)
• providers: add Fireworks AI provider preset (#772) (58daea7)
• skills: report hash drift in skill info (#795) (9fbdc34)

Bug Fixes

• acp: interrupt idle reads on cancellation (#782) (15b7a54)
• cli: include plugins info in shell completions (#794) (fa8734f)
• config: kill provider-command process tree via job object on Windows (#690) (5c58256)
• config: make the provider-command timeout an upper bound (#811) (#813) (1c38e8c)
• config: stop billing provider-command fixtures to the 5s timeout (#810) (f5fa4ff)
• cron: reserve job IDs atomically (#686) (d9b882e)
• lint: resolve static analysis baseline (#769) (583e653)
• providers: retry provably pre-send transport failures (#447) (#750) (8acd42a)
• sandbox: add platform-specific write lock around grant state file (#752) (#755) (88fb7b6)
• sandbox: clarify scoped permission prompts (#798) (9fe02ae)
• sandbox: deny reads of git's credential stores (#815) (#816) (33c94ec)
• sandbox: preserve user config and retry denied writes (#801) (81a5e6c)
• sandbox: scrub the daemon token file pointer (#677) (#818) (3e7692d)
• swarm: close lifecycle admission on shutdown (#776) (bdbda89)
• tui: fix rendering corruption over multipass + Windows Terminal (#709) (5bb1bc1)
• tui: paste clipboard images with Ctrl+V (#534) (#807) (ec3b822)
• tui: reset quiet clock for new runs (#799) (a4a805a)
• windows: use PowerShell for command execution (#804) (518d2e5)

v0.5.0

0.5.0 (2026-07-22)

Features

• plugins: add zero plugins info command (#773) (2479884)
• sandbox: disable the sandbox via config (#687) (#746) (a21a052)
• sandbox: unify command execution and enforcement (#781) (96859c9)
• tui: add /undo as an alias for /rewind (#698) (#747) (8c6d302)
• tui: add isolated /btw conversations (#748) (2e267bd)
• tui: permission prompt takes free-text feedback inline (#780) (3967d49)

Bug Fixes

• agent: stop write_stdin session_id probing thrash (#702) (#749) (fbf8598)
• cli: warn when ZERO_PROVIDER overrides a providers-use selection (#767) (3524f79)
• doctor: detect missing native binary during runtime checks (#450) (7796022)
• lsp: make the real-gopls check opt-in so a broken gopls can't fail the suite (#684) (#766) (b1f4173)
• make extension installs transactional (#762) (baa4be1)
• oauth: refuse redirects on credential POSTs (#729) (#741) (974fc03)
• oauth: validate discovered endpoints before merge/use (#511) (#739) (ce4a996)
• perfbench: absolutize the bench binary and make errored tasks first-class (#730) (dbd9443)
• perfbench: grant write tools so mutating tasks measure real edits (#763) (e1975c1)
• perfbench: keep the stamped answer file out of negative oracle greps (#737) (015452c)
• providers: stop "provider not found" for env-derived profiles (#716) (4cbd144)
• sandbox: AST second opinion for interactive-command bypasses (#473) (#745) (f079b90)
• sandbox: bind Windows elevated ACL setup to one no-follow handle (#765) (4945684)
• sandbox: don't auto-allow shell when re-entrancy skips wrapping (#727) (#744) (6849011)
• tools: give write_stdin's invalid-session errors the same recovery guidance (#749 follow-up) (#768) (da9fb50)
• tools: read_file recovers a backwards line range instead of erroring (#779) (89bdc67)
• tui: cache settled alt-screen transcript (#647) (d74ceb1)
• tui: model rows labelled by id when the description is prose; keep the sidebar under the / palette (#775) (b30c397)
• tui: stop the permission card clashing on cool themes (#778) (722bb31)

Performance Improvements

• agent: concurrent read-only tool batches via capability gate (#715) (31d45d5)
• agent: execution profiles with one-shot posture escalation (PR10b+PR10c) (#740) (378d538)
• agent: posture-escalation signals and controller (PR10a) (#736) (af875df)
• agent: preserve prompt cache prefixes (#760) (739a47e)
• openai: optimized turn session — background prewarm and prefix telemetry (PR8) (#723) (60dc84e)
• output: add token-aware semantic output budgeting (PR11) (#717) (e5670c4)
• providers: provider capabilities and default turn-session adapter (PR7) (#720) (30e2c3f)
• turn-bench: Phase 0 — strengthen oracles so pass rate can't be misread as correctness (#712) (727ad4d)

v0.4.0

0.4.0 (2026-07-17)

Features

• aimlapi: AI/ML API provider with guided onboarding (top-up + key issuance) (#655) (6b9c2f0)
• cli: show ZERO wordmark on --version (#673) (9acb411)
• cli: wire MCP serve WorkspaceRoot and --add-dir scope (#694) (75a78e7)
• npm: ship the native binary as platform optionalDependencies (#626) (5e1405d)
• perf: emit prompt-prefix hash fingerprint per turn (#704) (1c5c6e7)
• providers: add AI/ML API preset (rebased onto main) (#621) (d66a9dd)
• providers: refresh MiniMax model coverage (#665) (fa3052a)
• skills: discover shared ~/.agents/skills with multi-root skill loading (#696) (7d57999)
• tui: Ctrl+X leader chords and emacs menu navigation (#699) (7f669f4)
• tui: press up to edit queued messages (#656) (4c986d3)

Bug Fixes

• acp: make truncateHint rune-safe (#614) (ddc4927)
• agent,tui: resolve git branch detection when starting Zero in subdirectories (#613) (0184581)
• agent: raise default and deep-mode turn budgets (#650) (635c93a)
• cli: prevent consuming positional arguments as flag values (#619) (5b4f48d)
• config: enforce MCP trust boundary so project config cannot override user disable (#609) (4d8c31c), closes #512
• config: surface unknown/typo'd config fields instead of silently dropping them (#645) (893b7b4)
• cron: prevent cron job Mutate from clobbering concurrent updates (#630) (e4bd703)
• daemon: handle os.ErrPermission as collision during O_EXCL lock creation (#616) (8ea5384)
• exec: stop false INCOMPLETE downgrades on conversational final messages (#608) (b6117af)
• harden MCP credential boundaries (#597) (fdddb05)
• hooks: fail closed on launch failures for beforeTool hooks (#629) (dc06fe7)
• hooks: run sessionEnd hooks after Esc/Ctrl+C interrupts (#606) (824ecdb)
• keyring: pass generic password via stdin on macOS (#574) (91ea6de)
• lock: prevent POSIX lock file overwrite and leak on Windows/Unix (#628) (da41c3a)
• openai: omit prompt_cache_key for openai-compatible providers (#636) (1af5882), closes #624
• plugins: resolve relative executable paths against plugin root (#627) (2efe6d5)
• sandbox: remove windowsWriteRestricted flag to fix DenyRead bypass (#612) (3d96ac7)
• sandbox: scrub dynamic credential env vars (#682) (9043bae)
• sandbox: scrub sensitive credentials from sandbox environment (#660) (6fc1220)
• sandbox: unblock git fetch/commit/add under the write-restricted sandbox (#654) (5c4815a)
• sandbox: use WRITE_RESTRICTED token when no DenyRead paths are configured (#658) (a5d2e32)
• securefile,credstore: call Sync on temp file before close and rename (#631) (212734a)
• securefile: reclaim stale lock files to prevent permanent DOS (#615) (8536cc8)
• swarm: wait for job.Runs directly in scheduler skip test (#667) (1bb6b57)
• tools: classify silent wrapped Windows command failures as sandbox denials (#659) (8bd9742)
• tools: preserve SysProcAttr during PTY fallback (#618) (f78b36c)
• tui: resolve pending askUser callbacks to prevent runner hangs (#620) (aa73a76)
• tui: stop the composer cursor blinking while typing or unfocused (#672) (2b42cd5)
• windows: resolve absolute path for taskkill to prevent hijacking (#617) (2db00ee)

Performance Improvements

• tools: add explicit effect metadata for safe concurrency (#705) (8ef8576)

v0.3.0

0.3.0 (2026-07-09)

Features

• gate project-scoped hooks, plugins, and MCP servers behind workspace trust (#529) (a880ce8)
• modelregistry: infer reasoning efforts for Hunyuan and vendor-prefixed model ids (#599) (92a92ce)
• providers: OAuth login profiles and list-first /provider manager (#560) (1655056)
• tui: remember recent provider+model selections in /model picker (#568) (d0c4e62)
• tui: show CLI version on the startup home screen (#538) (fd69233)
• voice dictation (speech-to-text) (#557) (87158a1)

Bug Fixes

• address bugs found in a multi-agent codebase audit (#481) (008bc9b)
• agent: keep tools exposed for max-turn finalization (#533) (3f0503b)
• auth: persist OpenRouter API key after login (#595) (2a062aa)
• bump Go to 1.26.5 for crypto/tls fix (GO-2026-5856) (#607) (a7cfb99)
• gitignore Windows sandbox helpers and npm version marker (#578) (25653f6)
• mcp: silence startup warning for unconfigured default servers (#563) (302f58b)
• mcp: skip RFC 8414 discovery when OAuth endpoints are preconfigured (#586) (8a52d98)
• modelregistry: reject oversized models.dev cache responses (#602) (66a6396)
• provider: stop dropping custom no-auth providers on restart (#558) (ba99fa8)
• sandbox: Windows-appropriate suggestions when blocking interactive commands (#414) (ba4c007)
• tools: block MSYS and WSL shells under the Windows sandbox (#587) (0666818)
• tools: platform-specific pager suggestions, quote/caret-safe cd detection (#543) (8b248f4)
• tools: Windows cmd.exe quoting guidance and clipboard escaping fix (#468) (f10ed0c)
• tui: bypass toggleSidebar and toggleMouse global shortcuts when composer is non-empty (#576) (c7346fb)
• tui: paste protection for Termux char-by-char paste (#573) (8e9149f)
• tui: update picker_test for switchProviderModel 4-value return (#589) (8f15650)
• update: clearer error on unsupported release platform (android/termux) (#603) (1fc9b2d)
• update: support safe symlink extraction during updates (#575) (ce9cb91)
• warn about untracked scratch files left behind after a run (#571) (062328b)

Performance Improvements

• grep: stop content scan after head limit (#601) (8a05e64)

v0.2.0

0.2.0 (2026-07-06)

Features

• add --auto flag for LLM-generated commit messages (#423) (b0abde7)
• add zero changes push and pr subcommands, and extra repo-info metrics (#391) (2312abe)
• agent quality, caching, retry, and tooling upgrades (#506) (3c81fea)
• agent: curb over-engineering the solution in the editing discipline (#517) (f4c998a), closes #516
• agent: inject per-user config.UserConfigDir()/zero/ZERO.md guidelines into system prompt (#475) (7b10aab)
• openai: forward prompt_cache_key for server-side prefix cache routing (#515) (87e7e69)
• providers: add zero providers models to discover a provider's models (#386) (0bc8074)
• providers: add KiloCode and OpenCode provider support (#388) (b1ccb6d)
• providers: add Meituan LongCat catalog preset (#424) (b4275e3)
• providers: split minimax zai into intl cn (#398) (aaad4d2)
• require manual approval before npm publish + drop release-as pin (#369) (bd89a1f)
• sandbox: unelevated Windows fallback tier instead of prompts-only degrade (#427) (b9ddd6f)
• support shift enter for composer newlines (#462) (daf65e0)
• tui: /loop — repeat a prompt or command on an interval or self-paced (#502) (387fe67)
• tui: add search/filter to provider picker in setup wizard (#400) (2fcea71)
• update: add zero upgrade command to apply self-updates (#461) (5f36349)

Bug Fixes

• action: keep provider key scoped to zero step (#448) (407a927)
• add android platform support for Termux npm install (#455) (9bd93c6), closes #449
• agent: reject a malformed additional_permissions payload before prompting (#453) (e4f760e)
• allow non-TLS connections to private-network provider endpoints (#444) (1d86384)
• auth: route zero auth login chatgpt to the dedicated ChatGPT flow (#443) (305a62c)
• config: fall back to a usable saved provider instead of forcing full re-onboarding (#410) (c60ad87)
• config: let a gateway ANTHROPIC_BASE_URL resolve as anthropic-compatible (#497) (30dd7c3), closes #479
• config: unbrick first-run setup — default google/anthropic models, enter setup on fixable config errors (#385) (72eed06)
• config: use ~/.config on macOS and enter setup when no provider (#371) (#372) (027a8f2)
• docs: rename AGENTS.MD > AGENTS.md (#438) (4266baf)
• gemini: strip unsupported JSON Schema fields from tool declarations (#374) (39e7100), closes #373
• install: persist install dir to user PATH on Windows (#407) (bdb1b0e)
• mcp: block cross-origin credential redirects (#396) (f915f70)
• oauth: treat Windows ERROR_ACCESS_DENIED as lock contention in createSecretFile (#445) (d05e914)
• openai: handle Ollama reasoning stream deltas (#486) (f6c0606)
• preserve conversation context in exec prompts (#460) (949ee43)
• provider-wizard: allow multiple custom OpenAI-compatible providers (#403) (3fbbd28)
• sandbox: fix nested pipe creation under the Windows restricted token (#456) (563a6db)
• sandbox: gate /tmp test assertions on GOOS, not path existence (#426) (f653dca)
• sandbox: self-heal a corrupt unelevated setup marker (#437) (8d0c5fe)
• specialist: cap max specialist nesting depth (#491) (177442c)
• Termux/Android support — PRoot scroll, SIGSYS sandbox, build docs (#509) (0f69d99)
• tools: Block MSYS coreutils under Windows sandbox (#476) (81aad58)
• tools: CRLF line ending mismatch in edit_file tool on Windows (#378) (33dc7ae)
• tools: fix cmd.exe /S/C corrupting commands with embedded quotes (#465) (190241b)
• tools: flag piped POSIX utilities before running on Windows (#412) (5658a36)
• tools: make grep and glob respect run cancellation (#464) (ba6c026)
• tools: require permission before web_search requests (#382) (960db96)
• tui: compose help overlay through the viewport overlay pipeline (#421) (5b2b4de)
• tui: keep the profile name on /model sw...

v0.1.0

0.1.0 (2026-07-02)

Features

• publish zero to npm via release-please (#367) (8eccc26)
• tui: FILES sidebar panel with click-to-select and file drill-in (#365) (142c548)

Bug Fixes

• auth: propagate credentials to every provider-build surface and pin children to the live provider (#366) (6e0a665)