zagent 0.0.237

• Fixed the first-run sign-in chooser on a credential-less terminal
  (found by the new flock pty card class on its first real exercise):
  chooseSignIn() used await rl.question(...) on plain
  node:readline, whose callbackless promise resolves undefined
  instantly (nodejs/node#57035) — the card printed and zagent exited 2
  before anyone could type 1/2/3. The chooser now wraps the callback
  form (ctrl+D still declines), zagent login runs after restoring
  cooked termios, and the pasted API key no longer echoes — including
  a typeahead burst between the two prompts.

zagent 0.0.236

• zagent onboard no longer stalls through the whole live smoke turn on a
  bad credential (flock finding 2026-09-17): a classified Coding Plan
  credential probe now runs between the doctor checks and the smoke turn —
  a rejected or missing key fails in about a second with the sign-in
  guidance instead of tens of seconds ending in an opaque
  Turn execution failed, and a provider-reported exhausted window
  (business codes 1308/1113) fails fast with the reset pointer. An
  OAuth-signed-in user, a bare monitor rate-limit, or a transport flap stay
  inconclusive and still run the real smoke turn. The flock card pool gains
  onboard-bad-key-fast-fail.

zagent 0.0.235

• zagent models test <provider/model> on a provider this machine does
  not have configured now fails before the runtime is even spawned —
  provider 'x' is not configured on this machine with the sign-in next
  step — instead of relaying the kernel's unlocalized registry error
  (Provider Registry 中不存在 Provider) verbatim; kernel-side registry
  misses on registry-native ids are translated to English too (flock
  triage 2026-09-18). zagent login --help now names the sign-up path
  and the ZAI_API_KEY alternative, and zagent -p --help groups
  --target under "not valid with -p" and explains what every
  permission mode does (plan/build/edit/yolo/auto) with the kernel's own
  semantics. The flock card pool gains help-guidance-and-locale.

zagent 0.0.234

• Remembered permission grants are no longer opaque: each grant in
  ~/.zcode/cli/grants.json now stores a bounded, secret-redacted,
  terminal-safe pattern beside its hash, so /permissions and the new
  zagent permissions command show WHAT was allowed — Bash(npm test) — allow_always — instead of a bare tool name (flock findings F14a/F14d).
  zagent permissions [list|revoke <pattern|all>|--reset] [--json] lists
  grants and revokes by pattern substring or tool name; all/--reset
  clears the store, and an empty or absent store reports no persisted permission grants without creating the file. The flock card pool gains
  permission-grants-surface.

zagent 0.0.233

• zagent -p --help now discloses the dangerous default: the --mode
  row says that yolo runs every tool with no confirmation and names
  --mode plan as the opt-out, and a safety: note under the options
  table repeats it (flock finding F13). The flock card pool also gains
  yolo-default-disclosure, and the home-path-privacy card now ships
  its sandbox rules block like every other card.

zagent 0.0.232

• zagent quota --json failure envelopes now carry a class field —
  auth, limit, network, or null when unclassified — on both the
  {http, ...body} failure object and the {"error"} envelope, so a
  script can branch on the problem kind without parsing prose (flock
  finding F15). An unprovisioned device identity reports auth like a
  missing credential, and the http field can no longer be overridden
  by a server-supplied body field.

zagent 0.0.231

• zagent quota errors now say WHICH problem they are: a rejected or
  missing credential is a "sign-in problem" that names the fix (zagent login or ZAI_API_KEY); HTTP 429 and business codes 1308/1113 are a
  "quota-window problem" that point at the reset and quota reset
  tickets; transport failures are named network problems. The same
  classification reaches quota balance|preview|reset (flock finding
  F11).
• quota status/usage now also resolve the Coding Plan key that
  zagent login provisions into ~/.zcode/v2/provider_config.json
  (new keySource: "provider-config") — signing in fixes quota on the
  first retry instead of needing another zagent run to materialize
  the key. A CLI config whose provider key is still empty falls through
  to the provisioned key instead of erroring.

zagent 0.0.230

• --json error paths now emit the JSON error envelope on stdout instead
  of failing silently: -p --json credential and no-runtime gates print
  the envelope (num_turns: 0, human card stays on stderr, exit codes
  unchanged), and quota --json failure/usage/refusal paths print
  {"error": ...}. zagent sessions on a fresh install no longer warns
  about an absent tasks index.
• zagent goal list [--all] [--json] enumerates sessions from the task
  index (read-only; empty state prints no sessions and points at
  goal show --session <id>); zagent plugins list is now a verb
  (previously treated list as a plugin name); a bare zagent mcp on a
  TTY or empty stdin prints usage guidance and exits 2 instead of
  exiting 0 silently.
• Privacy: paths under the user's home directory now render as ~/...
  in doctor, import (human + JSON), inspect, the TUI /doctor and
  /status mirrors, and -p error output — no more absolute home paths
  in copied output (flock findings F7/F12).

zagent 0.0.229

• On a credential-free machine, quota balance, quota preview, and the
  quota reset family now print No ZCode credentials; run \zagent login`
  to sign in firstinstead of a raw ENOENT path — the same no-credential gatequota status` already had. A credential store missing the JWT gets
  the same message (flock finding F6).
• Internal: the real-user flock harness now draws from a model pool
  (muse / union-alpha / nemotron free tiers) and a living scenario pool
  that grows with every shipped fix — coverage compounds per release.

zagent 0.0.228

• zagent -p --browser-use now preflights the resolved kernel for
  playwright-core before spending the turn: when the runtime cannot
  resolve it (e.g. the desktop-bundle 3.12.1 kernel, whose headless
  browser support needs the app-managed runtime), a stderr warning
  names the limitation up front instead of failing mid-turn. The flag
  still forwards verbatim — the warning is advisory, not a gate.