v0.4.8

Added

• gemini-2.5-pro as a second Google Gemini menu option. Aegis previously single-pointed Gemini support on gemini-3.1-pro-preview. Preview endpoints carry no SLA guarantee from Google — when the preview model is throttled at Google's serving layer (which can happen unpredictably), Gemini becomes unavailable in Aegis even though other variants on the same OAuth credentials work. The new GA-stable gemini-2.5-pro entry gives users a reliable fallback path; the existing 3.1 Pro Preview remains selectable for bleeding-edge use.

Changed

• Mid-session /model recovery now mirrors initial model selection on validate failures. Previously, /model selecting a provider whose validate() returned a transport/capacity-class error (e.g. HTTP 503) printed a generic "Couldn't verify... Staying on the current model" message and silently bailed back to the conversation. Now both flows route through a shared validation function and surface the same four-option recovery menu (Retry validation / Pick a different model / Save anyway / Abort) with the same auth-vs-transport classifier wording. The user can recover from a transient capacity issue mid-session without exiting and restarting.
• Google menu labels sharpened to communicate preview status: Google Gemini 3.1 → Google Gemini 3.1 Pro Preview; the new GA entry shows as Google Gemini 2.5 Pro.

v0.4.7

Added

• License-grounded project identity discovery. The scanner now reads LICENSE, LICENSE.md, LICENSE.txt, LICENSE-MIT, LICENSE-APACHE, LICENSE-APACHE-2.0, COPYING, COPYING.md, and COPYING.txt files and surfaces them as PROJECT LICENSE EVIDENCE in the scan briefing. The discovery prompt now grounds project license claims in observable file evidence or direct user confirmation rather than inferring from adjacent context (e.g. a mentioned foundation-layer license).
• Extraction shape normalization for typed-object arrays. Legacy string-array forms in extracted policies (e.g. tech_stack.key_libraries: ["pytest", "ruff"]) are now repaired to their required object shape ([{name: "pytest", purpose: "..."}]) before schema validation, so extraction reliably produces schema-valid output on the first attempt across all typed-object fields in constitution, governance, role, and ledger schemas.
• Identity-grounding language in the discovery system prompt to distinguish project claims from claims about dependencies, foundation layers, forks, upstream templates, or adjacent context.

Changed

• Streaming UI replaces the bounded live-tail with progressive line commit. As each wrapped line of an Aegis turn completes, it moves into the persistent conversation history immediately; only the currently-in-progress line stays in the dynamic region. Visible incremental progress is preserved for long messages while still rendering each line exactly once.

Fixed

• Long Aegis turns no longer produce duplicate first-line content in terminal scrollback when the response exceeds the viewport.

v0.4.6

Added

• Discovery completion salvage now accepts long-form user affirmations. A user message ending with a clear go-ahead (e.g. "...all of that looks right. Draft it.") transitions discovery to extraction even when the prior turn carried other content, while hedge signals (but, actually, add, change, one more, etc.) continue to block premature completion.
• System prompt guidance directs Aegis to ask for a clean final confirmation when the user introduces final changes alongside an affirmation, so the policy is drafted against the final intended scope.

Changed

• Discovery completion gate split into two functions: short standalone confirmations still go through isSimpleAffirmative; longer messages use the new isDiscoveryCompletionAffirmation with its own end-of-message regex and late-change blocker list.

Fixed

• Inline comments document why isDiscoveryCompletionAffirmation diverges intentionally from isSimpleAffirmative's blocker list, and why the streaming live tail is capped at six lines.

v0.4.5

Added

• Last-resort discovery completion salvage. When the model omits the literal [DISCOVERY_COMPLETE] marker after an unambiguous user affirmation, the engine auto-injects the marker provided four structural gates pass (no existing marker, prior user turn affirmed, response contains no trailing question, response shows positive completion intent). Auto-injection emits a stderr breadcrumb so the path is observable from outside.
• System prompt strengthened with an explicit example of the exact final acknowledgement-plus-marker shape.

Changed

• Streaming response render is bounded to a terminal-height-aware live tail. Long Aegis turns no longer scroll early content into permanent scrollback before the static-history commit fires.
• isSimpleAffirmative recognizes additional draft-style affirmations: draft it, draft those, draft them, write it, write those, write them.

v0.4.4

Fixed

• Terminal render regressions in the Ink-based UI, including word wrap and line-tagging seams around the wrapConversationTurn helper.
• Extraction animation now loops continuously for the full lifetime of an extraction call. The previous behavior of holding the final shield frame after one pass read as "stuck" when extraction ran longer than the animation length.

v0.4.3

Added

• Schema-drift surfacing in policy migration. Schema-invalid but parseable policy files now load into existingPolicyContents rather than being skipped silently. Validation failures become structured PolicyMigrationFinding[] entries with source: "registry" | "schema_validation" and per-field error details, which the discovery LLM raises conversationally with the human. Known drift categories detected: module_map[].owner: null, tech_stack.key_libraries[] as string array, ledger legacy field names (agent_role, description, timestamp, affected_paths, action).
• Ghost-text slash-command autocomplete in the input prompt. Typing /m shows a dimmed odel - switch models during this discovery session completion inline; the ghost updates on every keystroke and uses a post-completion command set (/d hints /done) after extraction.

Changed

• The aegis init splash banner always renders in full on every invocation. The previous quiet-mode return-visit variant has been removed.

Fixed

• Banner-render-order regression where validation errors could print to stderr before the Ink banner mounted.

v0.4.2

Added

• Auto-discovery of local model servers on the Custom (OpenAI-compatible) path. Ollama, LM Studio, llama.cpp, and vLLM running on conventional ports are detected and offered as model options during setup.
• Validation timeouts on provider auth checks: 15 seconds for Anthropic, OpenAI, DeepSeek, and Custom providers, preventing indefinite hangs on slow networks or unreachable endpoints.
• .github/secret_scanning.yml configuration for repo-level secret scanning policy.

Changed

• Hidden-input paste hardening for API key entry: pasted keys no longer leak partial echoes during the masked-input phase.
• Slash-command submit-time prefix matching: typing /m and pressing Enter resolves to /model rather than rejecting the partial command.

Removed

• Mistral provider option removed entirely.
• Anthropic Haiku 4.5 removed from the model menu (low confidence in Haiku-tier sessions for Aegis discovery work).
• Model menu reduced from 11 options to 9.

v0.4.1

Fixed

• Google OAuth scope corrected to generative-language.retriever, unblocking the native Google OAuth path introduced in 0.4.0.

v0.4.0

Added

• Native Google Desktop OAuth flow for Gemini authentication. The CLI now performs a full OAuth dance with Google's Desktop App OAuth client and stores refresh tokens at ~/.aegis/oauth/google/credentials.json. No more dependency on gcloud Application Default Credentials.
• Improved Google sign-in messaging through the OAuth handoff.

Removed

• ADC (gcloud auth application-default login) path for Google authentication. The native OAuth flow replaces it entirely.

v0.3.9

Added

• Google gcloud auth path and validation timeout for the Gemini provider (interim solution before native OAuth landed in 0.4.0).