v2.68.0

fix: generalize tool-tag leak detection around the known tool vocabulary

v2.67.0

fix: detect malformed tool-tag emissions in leaked tool-call recovery

v2.66.0

docs: list the recovery flags in the environment overrides table

v2.61.0

fix: repeat channel false stops - shape note needs unchanged results,…

v2.59.0

Changed

• lesson set closes the review TODO - the review flag means "blocked repeatedly without killing the error — inspect and rewrite the correction", yet nothing sanctioned could ever clear it: a curated gate re-appeared in doctor's REVIEW-FLAGGED forever (17 gates stayed flagged after their corrections were rewritten through lesson set itself). A rewritten correction IS the inspection the flag asks for, so lesson set now deletes review in every owning scope as part of the same locked write; heal/retire clearing it is unchanged, and doctor's report stops re-listing finished reviews.

v2.58.0

Fixed

• Shape-loop loop-break speaks to the call, not the task - the shape-loop ladder reused the blocked-variant message verbatim ("(1) what you finished, (2) what you verified, (3) what remains … this text reply IS your final report"), so a call that was never blocked was answered with a whole-task abort report: a survey session that had over-read one file was ordered to stop and report, ended its turn, and the run sat idle until the user poked it twice (its own words: "dejavu прав — дочитал достаточно", then it read the file once more). The shape-loop injection now says the result is already in context, forbids re-issuing, and tells the agent to continue the task on its next turn; the blocked ladder keeps the report framing (there the call genuinely cannot run); the text-only force — the one stimulus that reliably ends a loop — is unchanged in both, pinned by new smoke checks.

v2.57.0

Fixed

• Red-green iteration is not a stuck loop - scanTailWindows' skipEditRounds only dropped the edit-landing round from the count, so same-shape rounds on EITHER side of an edit still accumulated: an agent running flutter test after every code edit — results genuinely changing each run (compile fail → 2/3 → 3/3 pass), the exact red-green verification the workflow requires — earned LOOP DETECTED + BLOCKED on the 4th run (survey: two independent sessions, both false positives; the second was repeated reads at different offsets around edits). The shape-loop scan now takes stopOnEditRounds: a round that landed an edit/write ENDS the backward walk — an edit is a state change, so pre-edit occurrences belong to a different era and never merge with post-edit ones. Three same-state post-edit runs still fire; the byte-identical repeat channel and the windowed-repeat path (skipEditRounds: false) keep their semantics.
• Long-running guard no longer matches server names inside quoted data - isLongRunningCommand tested SERVER_STARTERS regexes against the RAW command string, so git push … && gh pr create --title "…" --body "…text mentioning vite dev…" was denied as LONG-RUNNING because the vite rule matched inside the quoted PR body (survey: one session, three false positives, this mechanism confirmed — matches inside PR bodies, messages and echo payloads are data, not launches). Starters now anchor to SEGMENT HEADS, the 2.52 diagnostic-verb philosophy applied to the guard: chain segments via splitChainTagged, cmd /c payloads unwrapped (a quoted COMMAND payload still fires), wrapper heads skipped (env assignments, navigation, nohup, the PowerShell call operator &, runner/time/env/sudo wrappers), and Start-Process scans its quoted argument as the command it carries. Every canonical launch shape keeps firing (npm run dev, next dev, python -m http.server, & python -m http.server 8000, nohup npm run dev without &, Start-Process 'npm run dev' -Wait, mid-chain and cmd /c wrappers); interpreter one-liner payloads unwrap the same way — bash -c "npm run dev", sh -c "vite", pwsh -Command "npm run dev" (including -NoProfile -Command sequences) fire like cmd /c payloads, while -File script paths and quoted data inside a payload stay inert; isDetached is untouched.

v2.56.0

Added

• Snowball guard - an agent re-issuing its own previous bash command verbatim as a strict prefix with a new section appended (command accretion; the incident: a research subagent issued 30+ growing calls, re-executing every answered query — 46 minutes, no deliverable) is denied BEFORE execution on the third consecutive growth call, with a teaching message (issue only the NEW query as a fresh command; the cd/setup prefix belongs in the workdir parameter; independent questions are parallel calls). Exact repeats stay the repeat channel's business; # dejavu:proceed bypasses (logged); DEJAVU_SNOWBALL_CHAIN_MIN (3) tunes the depth; per-session state rides EphemeralState, so the short-lived CLI host stays inert by the documented degradation.
• Tool-error signatures can teach - event-channel tool-error signatures (<tool>:tool-error:<prose> — the MCP/background-tool failure surface) could never leave watching: canRemind required a key=value literal while error prose has none, so a 56-failure/43-session pattern stayed measured-only forever. The prose head with ≥3 literal word tokens now counts as identity — such gates promote to reminding (never blocking), and the migrate catch-up lifts existing watching gates on next init.
• Version-drift self-surfacing - a store whose lastInitVersion stamp is NEWER than the running plugin (a stale OpenCode window writing with weeks-old logic — 2.26.0 writers were live in the field data) logs a warn plus a version-drift event at init, before reconcile re-stamps the file. Numeric semver compare, once per process per store, long-lived hosts only (the CLI opts out; doctor remains its surface).
• Flappy-terminal policy - a gate promoted 3+ AND retired (healed/taught) 3+ times over its lifetime (retiredCount, a new lifetime counter summed by mergeGate, preserved by coerceGateShape, incremented in heal and taught-retire paths only) never re-promotes mechanically: watching + feedbackDemoted + a demoted event telling a human how to re-enforce. retireBaseline damped the oscillation speed; this ends the loop (wc -l at 6 promotions / 5 retirements was the field record).
• Chronic-reminder exit - reminding gates whose taught retirement was blocked forever by 1-2 historical blind re-runs (19 gates at 10-39 reminders in the field data, no exit below the anti-nag bar) retire at CHRONIC_REMINDERS (10) when reoffense stays below ANTI_NAG_REOFFENSE: retired-chronic event, watching, damped re-promotion. The partition is preserved — 0 reoffense → taught at 6, 1-2 → chronic at 10, 3+ → anti-nag at 5.

Fixed

• Rotating temp-scratch suffixes no longer defeat the shape loop - shape normalization keeps paths/strings by design (different commits stay different shapes), so a model re-running the same call against a disposable %TEMP%\…\head_cr.md → head_cs.md → head_cp.md evaded SHAPE LOOP detection at any count (the incident: ~50 analogous forensic calls, identical answers each time). Scratch paths under the temp root (%TEMP%/%TMP%, $env:TEMP/$env:TMP, $TMPDIR, /tmp, /var/tmp, full …\AppData\Local\Temp) collapse to <tmppath>: the family is one shape and the note fires on the third call in the window. Project directories named tmp keep distinct files distinct.

v2.53.1

Fixed

• Banner-first output keeps the real error as evidence - detectFailure scanned forward and the exit banner (Exit code 1) is failure-shaped, so harness renderings that put the banner ABOVE the compiler output stored the banner as the snippet and lost the error TS… line (bare-exit snippets also disable errorMoved, compounding iteration pressure). The bare-exit banner is now last-resort: the first non-banner failure line wins, banner-only output keeps its snippet and its matched verdict (text-channel detection semantics unchanged), natural order and the success-shaped guard are untouched.

v2.53.0

Fixed

• Project-dir identity fully canonical - canonicalDir (resolve + win32 drive-letter uppercase) is the single canonical form at every boundary: git-root lookup, explicit --store, recordFailure, index parse, AND gate projects[] at the gates parse boundary (legacy forward-slash/case spellings collapse to one entry - no more MAX_PROJECTS slot pressure or cosmetic dupes in global gates); mergeGate no longer propagates a stale textOnly mark from a merged source (the target's own latest evidence wins).
• env with flags keeps diagnostic immunity - env -u FOO pytest / env -i tsc were block-eligible because the flag token became the segment head; the wrapper skip now consumes env's flags (and -u's argument, per POSIX env semantics).
• Literal-? mojibake detected - console-codepage loss that turns Cyrillic error text into runs of ? before the hook payload now trips the same readable-output re-run teaching as U+FFFD mojibake instead of quoting garbage in corrections.

Added

• Claude Code SessionStart gate digest - a new session-start hook phase injects the project's top-5 enforced gates (blocking first, then reminding, lastSeen-desc within a tier) as additionalContext at session start: the agent is taught upfront instead of losing a first call to a reminder. Read-only stores, never denies, fail-open in the harness's own allow dialect, 2000-char whole-line budget over sanitized fields; the installer wires SessionStart with SessionEnd parity and uninstall/hooks --check recognize it.