v1.0.0

Halis Code 1.0 — the first stable release. A deep audit pass over every
package: the agent loop, the wire protocols, the file tools, the shells,
the ui and the release pipeline. No new features — this is the version
where the existing ones stop losing data. Full details in the changelog.

---

The product

• desktop: git -C heuristics, windows glob spellings, bright ansi backgrounds, live tool row css
• desktop: auto-compaction checkpoints fold into the stored history
• desktop: cap diff size, prune sessions by mtime instead of re-parsing everything
• cli: queue-able input mid-run, scrolling palette, picker resets, mock survives aborts
• cli: sessions hashed per directory, written atomically, shape-checked on load
• cli: print mode gates risky commands and exits nonzero on failure
• cli: flagged commands always ask again, the target follows the live config
• core: glob anchors, single-file grep, symlink listings, looser git heuristics
• core: compaction prunes a copy, token estimate sees tool args, anthropic reads bare data frames
• core: jobs flush before notifying and report settled kills honestly
• core: literal edit replacement, drained bash output
• core: web_fetch closes the private-address bypasses
• core: pair every tool call with its result on every exit path
• cli readme: npm landing page and package metadata
• core: keep crlf files and case-insensitive filesystems working
• core: run shell commands through the platform shell, not just bash
• desktop: electron-builder config for dmg, deb and exe packaging
• cli: package as halis-code for npm
• core: prune fat tool results before the compaction summary
• cli: catalog picker, new slash commands, approvals modes, background shells
• core: the models.dev catalog, anthropic protocol, background jobs and new tools
• tui screenshots and readme catch-up
• a mock provider for developing the tui without a key
• tui: real token counts, plan cards, halis -c, paste submit
• core loop: usage counts, compaction, repeat guard, web_fetch, todo_write
• readme and agents.md for the monorepo
• add the halis tui and its pixel penguin
• add @halis/core: agent loop, file tools, streaming provider
• move the desktop app into apps/ and workspace the repo
• implied rows commit, parked item text surfaces
• key refresh swallows its own rejection
• stray table text surfaces instead of dying
• drop the unused models refresh channel
• key changes reach the status cache
• grep agrees with read about the last line
• row groups close the row they interrupt
• smoke asks git its own scope, permutes guard keys
• dcs bodies stop leaking into the terminal
• settle keeps the tail host attached
• one escape closes one overlay
• gate notes no longer become sessions
• reads stop counting the phantom last line
• dotdot-prefixed names stay patchable
• a failed taskkill stays quiet
• sloppy lists and tables survive the fetch
• a destroyed window cannot wedge the tray hide
• rejections report again, crash exit stops the jobs
• smoke pins the fixes
• deferred workspace cd, truthful prompt
• ctrl+b/j/n yield to typing
• tree edits survive a re-render
• stop lands during the send, notices stay in their chat
• failed open-external stays a warning
• bound the workspace search by bytes
• assess the de-quoted command, cover the missing destroyers
• compaction stops undercounting cjk text
• quit force-kills the detached shells
• dead streams release the pipes, truncated searches admit it
• file refs and html tables keep their content
• grep matches crlf line ends and bounds its walk
• patches keep a trailing blank line
• untangle the colliding classes, drop the dead stylesheet
• ime commits, stale tabs and terminal races behave
• overlays own the keys, queued sends stop getting lost
• a throwing listener no longer steals the update
• cap the env probe, keep proto a plain key, allow the electron install
• default-deny permissions and tighten the ipc edges
• one report per rejection burst, and collision-free names
• write the small caches atomically
• share one key-store load among racing callers
• escalate to sigkill when the terminal ignores term
• count thinking tokens and surface compaction failures
• stop background jobs on quit, and warn before doing it
• abort mcp calls when the run stops, answer the server's pings
• widen the risky net without flagging chmod a+x
• dedupe patch targets and stop grep from lying about misses
• keep string tokens from bleeding across lines
• close code fences by length, not by luck
• guard search redirects and stop draining bombed bodies
• clamp the table colspan a web page can ask for
• make the stores survive torn writes and transient read errors
• bound the provider streams and enforce the subagent blocklist
• bound the search walks and keep html conversion honest
• stop file edits from mangling newlines, endings and locations
• tighten the web fetch and search guards
• stop the css and html highlight rules from going quadratic
• close the renderer races around sessions, dialogs and input
• keep the terminal alive across cd, floods and closed windows
• settle jobs even when their output file cannot be written
• drop borrowed-work phrasing from the comments and token names
• report subagent failures and fetch retries accurately
• fix session saves, queue drains and terminal trims
• make job output handling reliable
• speak the mcp protocol to external tool servers
• delegate bulky exploration to a subagent
• keep the smoke test list in agents.md honest
• add /init to draft an agents.md for the workspace
• name new sessions with the model
• nudge about stale todos and flag interrupted turns
• run long commands as background jobs
• honor retry-after when backing off
• inject environment context with git state
• read user-level agents.md on top of the workspace one
• require a fresh read before edits land
• spill oversized tool output to disk
• coerce malformed tool arguments against the schema
• mention npm start in the readme
• match the icon generator to the shipped asset
• typecheck the smoke tests alongside the app
• harden the snapshot sync and write it atomically
• recopy static files while watching
• ignore key repeat in the global shortcuts
• keep dialog keys working when focus moves away
• settle failed runs cleanly and close the send race
• neutralize literal placeholder markers in markdown
• hold chunk boundaries in ansi and streaming markdown
• remap editor tabs under renamed and deleted folders
• stamp the cache on 304 and validate the snapshot floor
• expand each env placeholder on its own
• count tool schemas toward the compaction trigger
• run tool commands in their own process group with utf8 streams
• keep marking the crash phase after a reload
• validate the read ipc payloads like the write ones
• key terminal exits to the process and decode streams as utf8
• kill the whole command tree when a tool run ends
• restore the maximized flag on launch
• pass the run window through the approval hooks
• refuse to write through a dangling symlink
• scan grep targets in a worker with a deadline
• match glob and search patterns inside their scope
• cover the new risky flags in the smoke tests
• make edit_file and patch respect the file they touch
• flag more destructive commands for approval
• replay anthropic thinking blocks across tool rounds
• follow redirects by hand and recheck the ssrf guard on every hop
• make the smoke tests pass strict typecheck
• resolve models, endpoints and wire protocols from the models.dev catalog
• swap the bundled model catalog to models.dev
• mention the new tools in the prompt and readme
• let edit_file replace all matches and keep tool output tails
• add an ask_user tool with a question card in the chat
• add the patch tool with the codex-style format from opencode
• add web_fetch and web_search with a dependency-free html converter
• add glob and grep tools, ported from opencode and the harness
• fix the renderer: diff card totals, folder expand recovery, search line jumps, stray rejections
• boot the renderer without a preload bridge instead of hanging on the splash
• harden the main process: trash outcome check, bounds without the tray, mid-stream provider errors, binary preview guard
• swap the screenshots for a 20-shot tour, document the default model
• catch disguised rm, pkill, dd and force pushes in the risk heuristics
• fix the agent loop: no mid-stream replay, anthropic role merges, compaction checkpoint, read_file past eof
• harden the main process: cache validation, symlink escape, terminal cleanup, ipc guards
• fix the renderer: mount the approval/queue docks, editor save races, tree refresh, key dialog errors
• default to muse spark 1.3 free, keyless out of the box
• drop the key chip and the settings key/model pages
• pop the key dialog when a picked model needs one
• let local providers run without a key, surface provider http status
• drop 302.AI from the model catalog, refresh the snapshot
• fix the wordmark mask eating the code badge
• add app screenshots to the readme
• mount the slash menu into the composer
• fix ipc handlers calling themselves at boot
• raise tsc strictness, fix the fallout
• rebuild the ui on the harness design language
• add smoke tests and project docs
• bring approvals, slash commands and diff cards into the chat
• port the harness agent ideas into the main process
• extend the shared bridge with approvals, notices and settings
• color terminal output and strip escapes in tool rows
• add a jump to latest pill and copyable user messages
• keep unsent drafts across restarts
• stop the run with escape
• queue messages typed while the agent is busy
• show file edits as diffs in tool rows
• highlight code blocks in chat
• re-render only the tail while markdown streams
• add a text and link context menu
• validate ipc senders against the app main frame
• keep the window from navigating away from the app
• leave fullscreen before hiding to the tray
• keep the maximize button in sync with the window
• quit without prompting when the os is shutting down
• capture renderer failures in crash reports
• pick up the login shell environment on mac and linux
• remember the window size and position between launches
• save chats to disk and bring them back from the history menu
• compact long histories into a checkpoint before sending
• let the agent keep a todo list
• write crash reports before showing the fatal dialog
• add a native application menu with devtools shortcuts
• keep the app alive in the tray when the window closes
• ask before quitting while the agent or a command is still running
• let the explorer create, rename and delete files
• fill in the settings view
• add workspace search to the sidebar
• run shell commands in the terminal panel
• make the editor editable with tabs and save
• add file write, search and fs mutation endpoints
• show agent tool activity in the chat panel
• loop tool calls through agent runs
• stream tool calls from openai and anthropic
• add workspace tools the agent can call
• Delete README.md
• update readme for the chat runtime
• wire chat panel to streaming models
• render chat messages as markdown
• add streaming agent runtime in main
• add provider api key vault
• add model picker to chat composer
• load model catalog in main process
• vendor models.dev catalog from opencode
• update readme
• wire up renderer entry
• add editor, chat and terminal panels
• add renderer shell and styles
• add electron main, preload and shared ipc
• init project

Tooling and docs

• docs: changelog for 1.0.0
• docs: the build script bundles core from source, dev:desktop builds then launches
• ci: release create needs contents write to publish the release
• deps: bump @types/node from 24.19.2 to 26.6.5
• readme: rewrite for the public repo
• docs: changelog for the first two releases
• docs: architecture, development, releases and security notes
• ci: releases cut from tags, notes from the commit log
• ci: codeql, dependency review and scorecard
• ci: path-gated jobs, bundle check and workflow lint
• readme: tag the fenced blocks
• repo: dependabot, codeowners and editorconfig
• repo: issue forms and pull request template
• repo: contributing guide, security policy and code of conduct
• license: switch the repo to mit
• readme: cross-platform notes
• ci: typecheck and smoke on all three platforms
• ci: npm publish and desktop release builds on release

Full changelog: e095c4e...v1.0.0