0.25.0 — Goal module (autonomous goal mode)

OMP/Codex-style autonomous self-continuation goal mode — reverses the 2026-10-02 decision that dropped pi-plan's /goal (all three peer harnesses ship it: Codex v0.128+, Claude Code /goal, OMP core).

• /goal <objective> [--budget N] (+ status|pause|resume|clear|budget): sets a session goal and fires the objective as the first work turn. After every settled turn a hidden continuation re-prompts with OMP's 6-point completion-audit prompt.
• goal tool (DIRECT, never deferred): get reports state; complete ends the loop — only when repo state proves every deliverable (budget exhaustion ≠ completion). Plan mode blocks it.
• Token budget = OMP goalTokenDelta (input+cacheWrite+output; cacheRead excluded): mid-run goals bill post-goal deltas; fresh-session goals bill from zero (live-herdr fix). Budget flip sends ONE wrap-up turn (followUp+triggerTurn — never a boundary steer).
• Boundaries: turn cap goal.maxTurns (default 50); abort/plan-mode pauses; restart restores PAUSED with terminal tombstones (no cleared-goal resurrection).
• Settings: GLOBAL goal section; /config → Tasks → Goal mode 🎯. Live-verified in a herdr pane.

tsc clean · 2951 tests / 0 fail

0.23.0 — thinking-mode gaps closed

Thinking-mode gaps closed — GLM-5.3 gets its real effort ladder on the router, and the main session's thinking level is classifier-routed per turn.

Research basis: GLM-5.3/5.3-Flash accept only reasoning_effort: low|high|max (forced thinking — none/off are accepted but silently think at max depth; live probe 2026-10-19), high ≈ 93% of max quality at ~⅔ the tokens (Z.ai Code Bench), and overthinking hurts on easy tasks (arXiv 2601.21418, 2604.10739).

Router zai53 map

GLM-5.3 family split out of the GLM-5.2-shaped zai map (router/lib/client.ts):

• off now OMITS the parameter — never sends "none", which would think at max depth (probed)
• the native low tier is reachable (low/medium→low, xhigh→max via pi's clamp)
• combo/ routes keep the CC enum; glm-5.2 keeps the old map
• probe script shipped: extensions/scripts/probe-thinking.mjs (value × route status matrix)

classifier.thinkGate (new)

One Jev score question per user turn sets the session thinking level; baseline restored at settle (classifier/lib/think-gate.ts).

• planGate pattern: default fully OFF, observe-first, 2.5s budget, fail-open everywhere, every verdict audited to classifier.log (ceulen-think-gate tag; missing-model fail-opens audit once per session)
• stands down for the session when the user touches the thinking dial
• skips plan mode, custom messages, and herdr children (CEULEN_THINK_GATE_OFF=1 injected by the subagent module — covers thinking_level_select too, so child panes are fully inert)
• live-verified in herdr: parent pane full cycle (trivial → off(→minimal), architecture → xhigh), child panes zero gate events

Pitfalls encoded as tests

pi emits thinking_level_select synchronously off the set call site with CLAMPED values (ownership = pre-call timestamp arm + effective-level re-read); level-capped models clamp DOWN (xhigh→high regression case covered).

Tests: 2931 tests, 0 failures. Full diff: v0.22.0...v0.23.0

v0.20.0 — pi 1.3.0 compatibility

pi 1.3.0 compatibility pass — no breaking changes (verified surface-by-surface against the managed release).

• peerDependencies for both @earendil-works/pi-* packages widened >=0.99.1 <1.3.0 → >=0.99.1 <1.4.0 — the old range excluded pi 1.3.0 and broke fresh installs on the current release.
• /config → Providers → Protocol gains the Session share destination row (pi.sessionShareDestination, auto/gist/radius) — stock-/settings parity for pi 1.3.0's new /share destination setting.
• AGENTS.md inline peer range updated.

Verified: ExtensionAPI types zero-diff, root exports additive-only, SettingsManager additive, settings schema still open, pi-tui 1.3.0 dist byte-identical to 1.2.0, resumed-session tool restore composes with ceulen's append-only tool_search re-arm. tsc clean, 2878 tests pass, live smoke on managed pi 1.3.0 clean (29 modules, zero stderr).

0.19.0 — plan-mode false-block rework

Plan mode stopped fighting investigation work. Mined from two weeks of session history (155 sessions): 54 hard-blocked read-only commands, 28 headless confirm-blocks, 15 rejects — six false-positive classes in the plan-mode bash classifier, several reproduced live while debugging them.

Fixed (extensions/modules/plan)

• Quoted angle brackets are data — jq 'select(.x > "1")', grep -oE "[^<]" and friends auto-run again; the redirect scan is quote-aware. Real redirects (> file) and true writers stay hard-blocked.
• Substitutions classify their inner command — $(…)/backticks/<(…) no longer blanket hard-block: read-only inner runs (sed -n "$(grep -n f)p" file), unknown inner prompts (TOKEN=$(curl …)), write inner blocks.
• Heredocs prompt instead of dying — python3 - <<'EOF' analysis scripts take the confirm tier, not a write block.
• Bare env reads — env | grep -i PI_ was classified as a writer.
• sed stops parsing paths as s-commands — sed -n '800,845p' …/modules/plan/index.ts was 'not read-only' because the path faked s/modules/plan/index with flags containing e. A substitution as the sed script is uninspectable → confirm.
• Research tools auto-allow — web_search, web_extract, web_map, web_screenshot, web_pdf, tool_search, todo join READ_ONLY_TOOLS (web_interact/crawlers/generators stay confirm-tier).

Recommended next step (settings, no upgrade needed)

classifier.planGate.observe: true in ~/.pi/agent/settings.json logs safe/unsafe verdicts for confirm-tier commands (ceulen-plan-gate tag in classifier.log). After a planning session or two, flip classifier.planGate.enabled: true to auto-run the safe ones — that's the remaining Allow-prompt fatigue, absorbed.

29-command regression fixture table pins every command class from the logs; full suite 2877 green.

0.18.0 — pi 1.2.0 compat: theme schema fix + ask_user_question loop dampener

pi 1.2.0 compatibility release (was pushed as a commit 2026-10-14 but the tag step was skipped — npm never received it; publishing now before 0.19.0 lands).

• Themes: all 104 shipped themes are schema-clean for pi 1.2.0's closed theme schema (100 carried non-schema colors keys that failed validation and silently vanished). scripts/validate-themes.mjs gates mirror the schema so this class fails the suite, not boot.
• Peer deps widened to >=0.99.1 <1.3.0.
• steering: before_agent_start union-safety on pi 1.2.0 — custom runs (cron fires, receipts) skip the ds-anchor bootstrap and first-tool hints.
• plan: ask_user_question two-arm loop dampener (near-duplicate containment 0.8 + wording-blind backstop), regression-tested against the 2026-10-14 incident.

Full notes in CHANGELOG.md.

0.17.0 — munin loop fixed

Munin loop fixed (incident report 2026-10-12)

Two sessions on glm-5.3-flash fell into an unstoppable repetition loop — 30 consecutive munin_search / 33 consecutive identical munin_get calls — each time intending munin_store (stated in thinking dozens of times) but unable to emit it even once. Both sessions lost their session-end memories.

Root cause (verified in pi 1.1.0 core): munin_store was a deferred tool, and a deferred tool's declaration depends on the mutable active-tools set that plan-mode baselines, /plan-approve new, and branch restores snapshot-replace. Once dropped, a model cannot emit a tool absent from its request's tool array and loops on the always-declared read neighbors.

Fixes

• munin_store promoted DIRECT — declared in every configured session (plan mode still blocks it via BLOCKED_TOOLS). Registry tier test guards against silent re-deferral.
• Consecutive-call loop dampener on the munin read tools — 3rd identical-args call or 6th same-tool call (any args) returns guidance ("call munin_store directly") instead of executing. Resets on a different munin tool, any non-munin tool call (protocol-compliant sessions never dampen), session start, and after guidance fires.
• Protocol header + skill text aligned: "munin_search/munin_get/munin_store are always declared".

Live-verified post-reload: schema declaration without tool_search, both dampener rules, and the non-munin reset (4 probes).

Full changelog: https://github.com/ceulen-dev/ceulen/blob/main/CHANGELOG.md

0.16.1 — herdr stall recovery on output evidence

• herdr stall recovery rewritten on output evidence — live probing
  (2026-10-10) showed herdr 0.9.3's status watcher NEVER reports working
  for pi panes (state_change_seq frozen across live turns), so
  agent prompt --wait returned agent_prompt_stalled on healthy
  dispatches (every herdr delegation was affected; the child completed its
  work while the parent reported failure). The subagent module now snapshots
  an output-evidence baseline BEFORE submission (captureEvidenceStamp:
  report-file stamp + pane tail for read-only children) and, on a stall,
  waits on EVIDENCE for the remaining dispatch budget — a changed report-file
  stamp (delivery contract) or a changed-then-quiet pane tail (3 stable
  polls). Window exhaustion reports timeout semantics (pane interrupted,
  may-still-complete disclosure) — never a phantom hard stall. Verified live
  across all five agent types under 4-way concurrency, including a mid-turn
  Z.ai 429 recovery; 6 new regression tests (test/herdr-stalled.test.ts).

0.15.2 — deferred-tier re-evaluation

Usage-driven re-eval of the deferred tool tier (211 transcripts, 13K tool calls).

Promoted to always-declared (4):

• munin_search / munin_get — the Memory Protocol's before-acting rule is a search; the old deferred tier forced a tool_search round-trip in front of it.
• github — top deferred-tier user (61 calls/17 sessions, all pre-dating the deferral); since deferral, release verification fell back to raw bash gh, forfeiting the wrapper's deadline, output cap, and read-only guardrails.
• ux_audit — every ux_* skill routes into it pre-code and the ux module is always loaded; the tier was a pure-latency detour.

52 tools stay discover-only via tool_search (serena, a2a, web cold tools, sg, fff extras, munin store/list/…, jfind, cron, shell, notify, rule_get). Declared tool block ~438 → ~507 tokens — still ~47% below the pre-deferral ~955.

Docs swept (AGENTS.md, README), stale defaultTools docstring fixed, +registry tier guard test.

0.15.1 — pi 1.1.0 compatibility

pi 1.1.0 compatibility. Audit found the 1.0.x → 1.1.0 ExtensionAPI diff purely additive — no breaking changes for ceulen.

• Peer deps widened to >=0.99.1 <1.2.0 for both @earendil-works/pi-coding-agent and @earendil-works/pi-tui (the old range excluded 1.1.0). Dev lockfile refreshed; typecheck + full suite verified against 1.1.0 types.
• advisor: the background review now skips agent_settled events flagged aborted (user hit Escape) — no isolated model review of a half-finished transcript. Absent flag on older pi → unchanged behavior.
• plan: auto-approve never fires off an aborted settle; the plan stays pending and still approves/executes on the next clean settle.

Verified: tsc --noEmit clean against 1.1.0 types, 2767 tests pass, live pi -p on managed 1.1.0 registers all 29 modules with no stderr.

0.15.0 — deferred-exposure pass + config kill-switch removal

Deferred-exposure pass + config kill-switch removal (net −660 lines):

Deferred tools

• 56 cold tools across 19 modules register with exposure: "deferred" — pi declares only hot direct tools in the system prompt (fresh session: 23 tools ≈ 438 tokens, was ~79 ≈ 21K)
• tool_search loads them on demand; the bundle re-activates tool_search on session_start whenever a deferred tier exists
• Registry tools?: string[] → deferredTools?: string[] tier lists; ceulen.disabledTools + lib/tools.ts deleted outright

/config

• Module Enable rows, synthesized Enable-only sections, and per-tool toggle rows removed — ceulen.disabled remains the settings-only escape hatch (no UI)
• Built-in tools section is 9 rows (tool_search removed — ceulen owns its activation)

Usage report fix

• computeContextBreakdown counted ALL registered tool schemas as "System tools" — now counts active tools only (what the model actually receives) and discloses the deferred tier separately: Tools (N active · X tokens in prompt · M deferred not in prompt (Y))
• Fresh-session prompts were never carrying the 21K the old report showed

Housekeeping

• Prompt guidance updated for on-demand loading (serena guidance matches tool_search; munin protocol + rules rulebook point at tool_search first)
• Tests: 2765 pass / 0 fail (+1 deferred-tier disclosure suite); typecheck clean