Aonyx Agent v0.10.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

[0.10.0] — 2026-06-04 — in-app document RAG (local embeddings + hybrid search)

A self-contained, offline-capable RAG in the memory palace: local embeddings, a
vector store, and RRF fusion with the existing BM25 — plus an ingest CLI and a
built-in rag_search tool. Backend and embeddings are chosen at setup (local
OSS vs provider). Clean-room (ADR-008/009).

Added

• Local embeddings — Embedder trait + fastembed-rs (rag feature): ONNX,
  multilingual, downloaded on first use; provider embeddings (OpenAI/Ollama)
  opt-in. (ADR-005, ADR-009)
• Vector store + hybrid search — chunk_vectors table, cosine top-k, and
  RRF (k=60) fusion of BM25 + vectors in Palace::hybrid_search.
• rag_search built-in tool — palace-backed retrieval returning
  {project, source, content, score}; auto_retrieve now works fully local and
  zero-server, with the same contract as the external MCP. (ADR-008)
• aonyx ingest <path> — chunk + embed + index documents into the palace.
• Setup — [rag] backend (local | external) + embeddings (local | provider)
  prompts and config fields.

Notes

• The desktop app (desktop/, unpublished) was rebuilt on a React + Vite +
  Tailwind shell (movable nav rail, chat, settings, memory, knowledge graph,
  FR/EN i18n, aonyx-account auth) — ships on its own cadence via the Desktop
  workflow.

[0.9.2] — 2026-06-04 — auto_retrieve (retrieve-then-generate)

Pre-loads memory-palace context so weak/local models benefit from the RAG even
when they don't call rag_search themselves. auto_retrieve is covered by 5
unit tests; workspace suite green.

Added

• auto_retrieve — retrieve-then-generate before the agent loop. On the
  aonyx serve surfaces, the runner can pre-fetch RAG context for the user's
  message and inject it as a source-attributed system block before the loop,
  instead of relying on the model to call rag_search (weak models — e.g. a
  local 8B — skip it on interrogative messages, leaving the palace unused). The
  agent stays free to call read_document / find_related to dig deeper
  (pre-load, not replace).
  • Config: auto_retrieve (off by default), auto_retrieve_top_k (5, clamped
    1..=10), auto_retrieve_min_len (12).
  • Applies to Telegram / Discord / OpenAI / API; the interactive TUI is a
    fast-follow.
  • Finds the rag_search MCP tool dynamically (<server>__rag_search),
    handles both structured {results:[…]} and the MCP JSON-as-string payload,
    and is best-effort (no tool / error / empty ⇒ no-op).

[0.9.1] — 2026-06-04 — Telegram streaming + desktop provider wizard

Added

• Telegram live token streaming. The Telegram bot renders replies token by
  token (via editMessageText) instead of one block, bridging the agent loop's
  existing run_streaming / TurnEvent to the adapter. New
  StreamEvent {Status, Delta, Final} in aonyx-adapters with a default
  AgentHandler::handle_stream (so Discord / the OpenAI server are unchanged).
  Edits are throttled (≈900 ms, edit-only-when-changed to dodge 429 / "not
  modified"), the live view is capped at 4096 chars, and tool calls surface as
  a transient status line (never raw tool JSON).
• Desktop — first-run provider wizard (desktop/ 0.9.1). Configures the
  provider on first launch (Anthropic / OpenAI / OpenRouter / Ollama / LM Studio
  / Claude Code, with key / base URL / model), writes ~/.aonyx/config.toml
  format-preserving (toml_edit), and restarts the embedded local agent.
  Auto-opens when the local agent can't be reached.

Notes

• Versioning: the desktop app (desktop/) is a standalone workspace and
  versions independently from the agent workspace — desktop 0.9.1 (the
  wizard) is a different artifact from workspace 0.9.1 (Telegram streaming).
  Agent crates + binaries follow the workspace version; the desktop installer
  follows desktop/src-tauri's version.

[0.9.0] — 2026-06-03 — Vague 4 complete: the desktop app

Ships Aonyx Desktop (Tauri 2), closing Vague 4 (automation API + desktop
app). The agent crates are unchanged since 0.8.1; the workspace version is
aligned to 0.9.0 to mark the milestone.

Added

• Desktop app (desktop/, Tauri 2) — a native GUI over aonyx serve api,
  reusing the site's design:
  • Streaming markdown chat with live tool activity (called: …).
  • Sessions sidebar (switch to load a transcript, New to start one).
  • Memory-palace search (hybrid hits with scores).
  • Embedded local agent — the app launches aonyx serve api itself on a
    free loopback port (no separate server to start), and falls back to a
    configurable remote URL + bearer token. The frontend talks to the API
    through Rust-side commands, so there is no CORS and no bundled npm.
  • Windows installer (.msi + NSIS .exe) built by
    .github/workflows/desktop.yml.

Notes

• The embedded mode needs aonyx (built with --features api) on the PATH;
  otherwise point the app at any running aonyx serve api in Settings.

[0.8.1] — 2026-06-03 — tool-calling reach + safety

Makes v0.8.0's tool calling actually usable for served deployments
(Telegram / Discord / OpenAI / API) and adds a tool whitelist/denylist.
clippy --all-features -D warnings clean; workspace suite green.

Fixed

• MCP tools now reach aonyx serve …. The serve path
  (build_serve_registry) never connected the configured MCP servers, so a
  bot/API deployment saw tools: [built-ins, 0 MCP] and could not call them
  (e.g. a RAG server hallucinated instead of invoking list_projects). It
  now connects them just like the interactive/TUI path (shared
  connect_configured_mcp).

Added

• Tool whitelist / denylist (tools_allow / tools_deny in
  config.toml). Restrict the catalogue the model sees: * is a prefix
  wildcard, so tools_allow = ["aonyx-rag__*"] exposes only that MCP
  server's tools (MCP tools are named <server>__<tool>), and
  tools_deny = ["bash", "fs_write", "fs_edit"] strips dangerous built-ins
  from an exposed bot. Disabled tools vanish from both the model's schema and
  the dispatch path; GET /v1/tools shows the effective set.
• Native Ollama tool calling (/api/chat) — the built-in ollama
  provider now advertises tools, replays assistant tool calls + tool-role
  results, and parses message.tool_calls from the JSON-lines stream. Tool
  calling now works on every provider except claude-code (which runs
  its own tool loop inside the claude binary).

Notes

• A native desktop app (Tauri 2 — streaming chat, sessions, memory search
  over aonyx serve api) landed in-repo under desktop/; it ships
  separately as v0.9.0.

[0.8.0] — 2026-06-03 — real end-to-end tool calling

Fixes a blocker. The agent can now actually call tools — built-in, MCP,
and plugin — on every supported provider. Previously the providers deferred
tool calling: openai_compat never sent the tools field, and neither it
nor anthropic parsed tool calls back from the response, so the agent could
only emit text and would hallucinate instead of querying its tools/RAG.
clippy --all-features -D warnings clean; full workspace suite green.

Fixed / Added

• Core — Message now carries structured tool data: tool_calls (on an
  assistant turn that requested tools) and tool_call_id (on a tool result),
  so multi-turn tool exchanges replay correctly. Backward-compatible
  (#[serde(default)] — older persisted sessions decode unchanged).
• Runner — records the assistant's tool-call turn (text and the
  calls) and links each result back by id; tool schemas now carry their
  description so the model knows what each tool does.
• OpenAI-compatible providers (OpenAI, OpenRouter, LM Studio, llama.cpp's
  llama-server, and Ollama via its /v1 endpoint) — send tools in OpenAI
  {type:"function", …} shape, replay assistant tool_calls + tool
  results with tool_call_id, and accumulate streamed delta.tool_calls[]
  fragments into complete calls.
• Anthropic — serialize assistant tool calls as tool_use blocks and
  results as tool_result blocks; parse streamed tool_use
  (content_block_start → input_json_delta → content_block_stop).

Known follow-ups

• The native Ollama provider (/api/chat) and the claude-code
  provider still route tool use through their own paths; Ollama users wanting
  tools today should point an OpenAI-compatible provider at
  http://localhost:11434/v1.

Notes

• The Tauri desktop app (originally slated for v0.8.0) shifts to v0.9.0.

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — `GET /v...

Aonyx Agent v0.9.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.9.0] — 2026-06-03 — Vague 4 complete: the desktop app

Ships Aonyx Desktop (Tauri 2), closing Vague 4 (automation API + desktop
app). The agent crates are unchanged since 0.8.1; the workspace version is
aligned to 0.9.0 to mark the milestone.

Added

• Desktop app (desktop/, Tauri 2) — a native GUI over aonyx serve api,
  reusing the site's design:
  • Streaming markdown chat with live tool activity (called: …).
  • Sessions sidebar (switch to load a transcript, New to start one).
  • Memory-palace search (hybrid hits with scores).
  • Embedded local agent — the app launches aonyx serve api itself on a
    free loopback port (no separate server to start), and falls back to a
    configurable remote URL + bearer token. The frontend talks to the API
    through Rust-side commands, so there is no CORS and no bundled npm.
  • Windows installer (.msi + NSIS .exe) built by
    .github/workflows/desktop.yml.

Notes

• The embedded mode needs aonyx (built with --features api) on the PATH;
  otherwise point the app at any running aonyx serve api in Settings.

[0.8.1] — 2026-06-03 — tool-calling reach + safety

Makes v0.8.0's tool calling actually usable for served deployments
(Telegram / Discord / OpenAI / API) and adds a tool whitelist/denylist.
clippy --all-features -D warnings clean; workspace suite green.

Fixed

• MCP tools now reach aonyx serve …. The serve path
  (build_serve_registry) never connected the configured MCP servers, so a
  bot/API deployment saw tools: [built-ins, 0 MCP] and could not call them
  (e.g. a RAG server hallucinated instead of invoking list_projects). It
  now connects them just like the interactive/TUI path (shared
  connect_configured_mcp).

Added

• Tool whitelist / denylist (tools_allow / tools_deny in
  config.toml). Restrict the catalogue the model sees: * is a prefix
  wildcard, so tools_allow = ["aonyx-rag__*"] exposes only that MCP
  server's tools (MCP tools are named <server>__<tool>), and
  tools_deny = ["bash", "fs_write", "fs_edit"] strips dangerous built-ins
  from an exposed bot. Disabled tools vanish from both the model's schema and
  the dispatch path; GET /v1/tools shows the effective set.
• Native Ollama tool calling (/api/chat) — the built-in ollama
  provider now advertises tools, replays assistant tool calls + tool-role
  results, and parses message.tool_calls from the JSON-lines stream. Tool
  calling now works on every provider except claude-code (which runs
  its own tool loop inside the claude binary).

Notes

• A native desktop app (Tauri 2 — streaming chat, sessions, memory search
  over aonyx serve api) landed in-repo under desktop/; it ships
  separately as v0.9.0.

[0.8.0] — 2026-06-03 — real end-to-end tool calling

Fixes a blocker. The agent can now actually call tools — built-in, MCP,
and plugin — on every supported provider. Previously the providers deferred
tool calling: openai_compat never sent the tools field, and neither it
nor anthropic parsed tool calls back from the response, so the agent could
only emit text and would hallucinate instead of querying its tools/RAG.
clippy --all-features -D warnings clean; full workspace suite green.

Fixed / Added

• Core — Message now carries structured tool data: tool_calls (on an
  assistant turn that requested tools) and tool_call_id (on a tool result),
  so multi-turn tool exchanges replay correctly. Backward-compatible
  (#[serde(default)] — older persisted sessions decode unchanged).
• Runner — records the assistant's tool-call turn (text and the
  calls) and links each result back by id; tool schemas now carry their
  description so the model knows what each tool does.
• OpenAI-compatible providers (OpenAI, OpenRouter, LM Studio, llama.cpp's
  llama-server, and Ollama via its /v1 endpoint) — send tools in OpenAI
  {type:"function", …} shape, replay assistant tool_calls + tool
  results with tool_call_id, and accumulate streamed delta.tool_calls[]
  fragments into complete calls.
• Anthropic — serialize assistant tool calls as tool_use blocks and
  results as tool_result blocks; parse streamed tool_use
  (content_block_start → input_json_delta → content_block_stop).

Known follow-ups

• The native Ollama provider (/api/chat) and the claude-code
  provider still route tool use through their own paths; Ollama users wanting
  tools today should point an OpenAI-compatible provider at
  http://localhost:11434/v1.

Notes

• The Tauri desktop app (originally slated for v0.8.0) shifts to v0.9.0.

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — GET /v1/tools, /v1/skills, /v1/config
    (secrets are never exposed), /v1/info, /v1/health.
  • OpenAI-compatible — POST /v1/chat/completions + GET /v1/models
    co-mounted on the same port, so any OpenAI SDK is a drop-in client.
  • OpenAPI — GET /v1/openapi.json (open, for discovery).
  • Security — bearer token (flag / keyring api_token / AONYX_API_TOKEN);
    binds 127.0.0.1 by default; a non-loopback bind refuses to start
    without a token; destructive tools stay denied at the loop level.

Notes

• New crate aonyx-api (10 crates total). The API never depends on
  aonyx-agent — the agent loop is injected through an ApiAgent trait,
  exactly like the channel adapters — so the binary pulls it in behind the
  api feature with no dependency cycle.
• First half of Vague 4. The Windows desktop app (Tauri 2, hybrid
  local/remote) lands in v0.8.0.

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live...

Aonyx Agent v0.8.1

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.8.1] — 2026-06-03 — tool-calling reach + safety

Makes v0.8.0's tool calling actually usable for served deployments
(Telegram / Discord / OpenAI / API) and adds a tool whitelist/denylist.
clippy --all-features -D warnings clean; workspace suite green.

Fixed

• MCP tools now reach aonyx serve …. The serve path
  (build_serve_registry) never connected the configured MCP servers, so a
  bot/API deployment saw tools: [built-ins, 0 MCP] and could not call them
  (e.g. a RAG server hallucinated instead of invoking list_projects). It
  now connects them just like the interactive/TUI path (shared
  connect_configured_mcp).

Added

• Tool whitelist / denylist (tools_allow / tools_deny in
  config.toml). Restrict the catalogue the model sees: * is a prefix
  wildcard, so tools_allow = ["aonyx-rag__*"] exposes only that MCP
  server's tools (MCP tools are named <server>__<tool>), and
  tools_deny = ["bash", "fs_write", "fs_edit"] strips dangerous built-ins
  from an exposed bot. Disabled tools vanish from both the model's schema and
  the dispatch path; GET /v1/tools shows the effective set.
• Native Ollama tool calling (/api/chat) — the built-in ollama
  provider now advertises tools, replays assistant tool calls + tool-role
  results, and parses message.tool_calls from the JSON-lines stream. Tool
  calling now works on every provider except claude-code (which runs
  its own tool loop inside the claude binary).

Notes

• A native desktop app (Tauri 2 — streaming chat, sessions, memory search
  over aonyx serve api) landed in-repo under desktop/; it ships
  separately as v0.9.0.

[0.8.0] — 2026-06-03 — real end-to-end tool calling

Fixes a blocker. The agent can now actually call tools — built-in, MCP,
and plugin — on every supported provider. Previously the providers deferred
tool calling: openai_compat never sent the tools field, and neither it
nor anthropic parsed tool calls back from the response, so the agent could
only emit text and would hallucinate instead of querying its tools/RAG.
clippy --all-features -D warnings clean; full workspace suite green.

Fixed / Added

• Core — Message now carries structured tool data: tool_calls (on an
  assistant turn that requested tools) and tool_call_id (on a tool result),
  so multi-turn tool exchanges replay correctly. Backward-compatible
  (#[serde(default)] — older persisted sessions decode unchanged).
• Runner — records the assistant's tool-call turn (text and the
  calls) and links each result back by id; tool schemas now carry their
  description so the model knows what each tool does.
• OpenAI-compatible providers (OpenAI, OpenRouter, LM Studio, llama.cpp's
  llama-server, and Ollama via its /v1 endpoint) — send tools in OpenAI
  {type:"function", …} shape, replay assistant tool_calls + tool
  results with tool_call_id, and accumulate streamed delta.tool_calls[]
  fragments into complete calls.
• Anthropic — serialize assistant tool calls as tool_use blocks and
  results as tool_result blocks; parse streamed tool_use
  (content_block_start → input_json_delta → content_block_stop).

Known follow-ups

• The native Ollama provider (/api/chat) and the claude-code
  provider still route tool use through their own paths; Ollama users wanting
  tools today should point an OpenAI-compatible provider at
  http://localhost:11434/v1.

Notes

• The Tauri desktop app (originally slated for v0.8.0) shifts to v0.9.0.

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — GET /v1/tools, /v1/skills, /v1/config
    (secrets are never exposed), /v1/info, /v1/health.
  • OpenAI-compatible — POST /v1/chat/completions + GET /v1/models
    co-mounted on the same port, so any OpenAI SDK is a drop-in client.
  • OpenAPI — GET /v1/openapi.json (open, for discovery).
  • Security — bearer token (flag / keyring api_token / AONYX_API_TOKEN);
    binds 127.0.0.1 by default; a non-loopback bind refuses to start
    without a token; destructive tools stay denied at the loop level.

Notes

• New crate aonyx-api (10 crates total). The API never depends on
  aonyx-agent — the agent loop is injected through an ApiAgent trait,
  exactly like the channel adapters — so the binary pulls it in behind the
  api feature with no dependency cycle.
• First half of Vague 4. The Windows desktop app (Tauri 2, hybrid
  local/remote) lands in v0.8.0.

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, P...

Aonyx Agent v0.8.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.8.0] — 2026-06-03 — real end-to-end tool calling

Fixes a blocker. The agent can now actually call tools — built-in, MCP,
and plugin — on every supported provider. Previously the providers deferred
tool calling: openai_compat never sent the tools field, and neither it
nor anthropic parsed tool calls back from the response, so the agent could
only emit text and would hallucinate instead of querying its tools/RAG.
clippy --all-features -D warnings clean; full workspace suite green.

Fixed / Added

• Core — Message now carries structured tool data: tool_calls (on an
  assistant turn that requested tools) and tool_call_id (on a tool result),
  so multi-turn tool exchanges replay correctly. Backward-compatible
  (#[serde(default)] — older persisted sessions decode unchanged).
• Runner — records the assistant's tool-call turn (text and the
  calls) and links each result back by id; tool schemas now carry their
  description so the model knows what each tool does.
• OpenAI-compatible providers (OpenAI, OpenRouter, LM Studio, llama.cpp's
  llama-server, and Ollama via its /v1 endpoint) — send tools in OpenAI
  {type:"function", …} shape, replay assistant tool_calls + tool
  results with tool_call_id, and accumulate streamed delta.tool_calls[]
  fragments into complete calls.
• Anthropic — serialize assistant tool calls as tool_use blocks and
  results as tool_result blocks; parse streamed tool_use
  (content_block_start → input_json_delta → content_block_stop).

Known follow-ups

• The native Ollama provider (/api/chat) and the claude-code
  provider still route tool use through their own paths; Ollama users wanting
  tools today should point an OpenAI-compatible provider at
  http://localhost:11434/v1.

Notes

• The Tauri desktop app (originally slated for v0.8.0) shifts to v0.9.0.

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — GET /v1/tools, /v1/skills, /v1/config
    (secrets are never exposed), /v1/info, /v1/health.
  • OpenAI-compatible — POST /v1/chat/completions + GET /v1/models
    co-mounted on the same port, so any OpenAI SDK is a drop-in client.
  • OpenAPI — GET /v1/openapi.json (open, for discovery).
  • Security — bearer token (flag / keyring api_token / AONYX_API_TOKEN);
    binds 127.0.0.1 by default; a non-loopback bind refuses to start
    without a token; destructive tools stay denied at the loop level.

Notes

• New crate aonyx-api (10 crates total). The API never depends on
  aonyx-agent — the agent loop is injected through an ApiAgent trait,
  exactly like the channel adapters — so the binary pulls it in behind the
  api feature with no dependency cycle.
• First half of Vague 4. The Windows desktop app (Tauri 2, hybrid
  local/remote) lands in v0.8.0.

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) ...

Aonyx Agent v0.7.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — GET /v1/tools, /v1/skills, /v1/config
    (secrets are never exposed), /v1/info, /v1/health.
  • OpenAI-compatible — POST /v1/chat/completions + GET /v1/models
    co-mounted on the same port, so any OpenAI SDK is a drop-in client.
  • OpenAPI — GET /v1/openapi.json (open, for discovery).
  • Security — bearer token (flag / keyring api_token / AONYX_API_TOKEN);
    binds 127.0.0.1 by default; a non-loopback bind refuses to start
    without a token; destructive tools stay denied at the loop level.

Notes

• New crate aonyx-api (10 crates total). The API never depends on
  aonyx-agent — the agent loop is injected through an ApiAgent trait,
  exactly like the channel adapters — so the binary pulls it in behind the
  api feature with no dependency cycle.
• First half of Vague 4. The Windows desktop app (Tauri 2, hybrid
  local/remote) lands in v0.8.0.

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / ne...

Aonyx Agent v0.6.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / network errors with exponential backoff (RR).
• Anthropic prompt-caching: the system prompt is sent as a cached
  block, cutting input-token cost across a session's turns (RR).
• /cost prints a detailed per-session token + USD breakdown (RR).

TUI

• /mcp panel lists connected MCP servers and toggles all of a server's
  tools at once (RR). /rename retitles the current session (RR).
  @glob refs (@src/**/*.rs) load every matching file (RR).

Skills & theming

• Custom skills loaded from ~/.aonyx/skills/ (DD); live theme editor
  /theme-edit (KK).

[0.2.0] — 2026-05-29 — the full-screen TUI

A 25-phase arc (B → Z) turning the line-based REPL into a full-screen
ratatui terminal UI with multimodal input, multi-session branching, a
memory-palace inspector, and live capability toggles. 185 workspace tests,
clippy --workspace -D warnings clean.

Launch with aonyx --tui. The legacy line REPL remains the default.

Added

Terminal UI (ratatui)

• Full-screen layout: scrollable conversation viewport, multi-line composer,
  status bar. Auto-scroll, animated braille spinner, 💭 thinking…
  placeholder.
• Markdown rendering in the viewport via tui-markdown, with a
  ratatui_core → ratatui colour converter. Rendered live during
  streaming — headings / bold / code light up as the model types.
• @path file references load files into the next turn's context;
  !cmd runs a local shell and feeds the output back.
• Fuzzy autocomplete popup (nucleo-matcher) for @ files, / commands,
  and /cmd <arg> argument completion (/themes, /load, /ingest,
  /undo).
• Inline composer syntax highlight: /cmd magenta, !bash yellow, chat
  default — recoloured on every keystroke.
• Ctrl+P fuzzy command palette over every slash command + theme.
• Mouse support: scroll wheel, single-click palette accept. /mouse
  toggles capture so the host...

Aonyx Agent v0.5.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / network errors with exponential backoff (RR).
• Anthropic prompt-caching: the system prompt is sent as a cached
  block, cutting input-token cost across a session's turns (RR).
• /cost prints a detailed per-session token + USD breakdown (RR).

TUI

• /mcp panel lists connected MCP servers and toggles all of a server's
  tools at once (RR). /rename retitles the current session (RR).
  @glob refs (@src/**/*.rs) load every matching file (RR).

Skills & theming

• Custom skills loaded from ~/.aonyx/skills/ (DD); live theme editor
  /theme-edit (KK).

[0.2.0] — 2026-05-29 — the full-screen TUI

A 25-phase arc (B → Z) turning the line-based REPL into a full-screen
ratatui terminal UI with multimodal input, multi-session branching, a
memory-palace inspector, and live capability toggles. 185 workspace tests,
clippy --workspace -D warnings clean.

Launch with aonyx --tui. The legacy line REPL remains the default.

Added

Terminal UI (ratatui)

• Full-screen layout: scrollable conversation viewport, multi-line composer,
  status bar. Auto-scroll, animated braille spinner, 💭 thinking…
  placeholder.
• Markdown rendering in the viewport via tui-markdown, with a
  ratatui_core → ratatui colour converter. Rendered live during
  streaming — headings / bold / code light up as the model types.
• @path file references load files into the next turn's context;
  !cmd runs a local shell and feeds the output back.
• Fuzzy autocomplete popup (nucleo-matcher) for @ files, / commands,
  and /cmd <arg> argument completion (/themes, /load, /ingest,
  /undo).
• Inline composer syntax highlight: /cmd magenta, !bash yellow, chat
  default — recoloured on every keystroke.
• Ctrl+P fuzzy command palette over every slash command + theme.
• Mouse support: scroll wheel, single-click palette accept. /mouse
  toggles capture so the host terminal can do native drag-to-select + copy.
• Vim modal editing (/vim): Insert / Normal, j/k/g/G navigation.
• 4 bundled themes (/themes): default, catppuccin, dracula, gruvbox.
• Desktop notifications (notify-rust) on long-turn completion + errors.
• Token + USD cost estimator in the status bar (per-provider pricing table).

Multi-session

• SqliteSessionStore cross-run persistence at ~/.aonyx/sessions.db,
  auto-restore on startup.
• /sessions list, /new rotate, /find <query> full-text search across
  every session, /load <id-prefix> switch, /fork branch the current
  session into a child (parent_id tracked).

Floating panels

• /kg — memory-palace visualization: entities grouped by type, relations
  as src ──predicate──▶ dst.
• /tools — enable / disable registered tools live (shared ToolRegistry
  disabled-set).
• /skills — enable / disable loaded skills live (shared runner toggle set).
• /inspect — pretty-printed JSON of the last LLM request (base64 images
  elided).

Safety + memory

• Inline approval overlay: destructive fs_edit / fs_write / bash calls
  pause the runner for a [Y/n] decision (async AsyncApprover bridge).
• /undo [N|list] — revert the last N filesystem changes via a JSONL
  snapshot journal at <cwd>/.aonyx/undo.jsonl.
• /ingest <path> — chunk a local file (paragraph-aligned) into the project
  palace; searchable by the agent.

Multimodal

• `@image.png...

Aonyx Agent v0.4.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / network errors with exponential backoff (RR).
• Anthropic prompt-caching: the system prompt is sent as a cached
  block, cutting input-token cost across a session's turns (RR).
• /cost prints a detailed per-session token + USD breakdown (RR).

TUI

• /mcp panel lists connected MCP servers and toggles all of a server's
  tools at once (RR). /rename retitles the current session (RR).
  @glob refs (@src/**/*.rs) load every matching file (RR).

Skills & theming

• Custom skills loaded from ~/.aonyx/skills/ (DD); live theme editor
  /theme-edit (KK).

[0.2.0] — 2026-05-29 — the full-screen TUI

A 25-phase arc (B → Z) turning the line-based REPL into a full-screen
ratatui terminal UI with multimodal input, multi-session branching, a
memory-palace inspector, and live capability toggles. 185 workspace tests,
clippy --workspace -D warnings clean.

Launch with aonyx --tui. The legacy line REPL remains the default.

Added

Terminal UI (ratatui)

• Full-screen layout: scrollable conversation viewport, multi-line composer,
  status bar. Auto-scroll, animated braille spinner, 💭 thinking…
  placeholder.
• Markdown rendering in the viewport via tui-markdown, with a
  ratatui_core → ratatui colour converter. Rendered live during
  streaming — headings / bold / code light up as the model types.
• @path file references load files into the next turn's context;
  !cmd runs a local shell and feeds the output back.
• Fuzzy autocomplete popup (nucleo-matcher) for @ files, / commands,
  and /cmd <arg> argument completion (/themes, /load, /ingest,
  /undo).
• Inline composer syntax highlight: /cmd magenta, !bash yellow, chat
  default — recoloured on every keystroke.
• Ctrl+P fuzzy command palette over every slash command + theme.
• Mouse support: scroll wheel, single-click palette accept. /mouse
  toggles capture so the host terminal can do native drag-to-select + copy.
• Vim modal editing (/vim): Insert / Normal, j/k/g/G navigation.
• 4 bundled themes (/themes): default, catppuccin, dracula, gruvbox.
• Desktop notifications (notify-rust) on long-turn completion + errors.
• Token + USD cost estimator in the status bar (per-provider pricing table).

Multi-session

• SqliteSessionStore cross-run persistence at ~/.aonyx/sessions.db,
  auto-restore on startup.
• /sessions list, /new rotate, /find <query> full-text search across
  every session, /load <id-prefix> switch, /fork branch the current
  session into a child (parent_id tracked).

Floating panels

• /kg — memory-palace visualization: entities grouped by type, relations
  as src ──predicate──▶ dst.
• /tools — enable / disable registered tools live (shared ToolRegistry
  disabled-set).
• /skills — enable / disable loaded skills live (shared runner toggle set).
• /inspect — pretty-printed JSON of the last LLM request (base64 images
  elided).

Safety + memory

• Inline approval overlay: destructive fs_edit / fs_write / bash calls
  pause the runner for a [Y/n] decision (async AsyncApprover bridge).
• /undo [N|list] — revert the last N filesystem changes via a JSONL
  snapshot journal at <cwd>/.aonyx/undo.jsonl.
• /ingest <path> — chunk a local file (paragraph-aligned) into the project
  palace; searchable by the agent.

Multimodal

• @image.png rendered inline as a half-block Unicode thumbnail (works in
  any truecolor terminal, no Kitty / iTerm / Sixel dependency).
• Vision passthrough: images forwarded to Anthropic (image / source
  blocks) and OpenAI-compatible providers (image_url data URLs).
• Attachment::Image on Message, #[serde(default)] for backwards
  compatibility with existing persisted rows.

Changed

• ApprovalPolicy::allow is now async to support the interactive TUI
  approver.
• AgentRunner exposes shared handles: skill_toggle_handle(),
  last_request_handle().
• SessionStore gains search, find_by_id_prefix, and fork.
• ToolRegistry gains a shared disabled-set with disable / enable /
  toggle / is_disabled.

[0.1.0] — 2026-05-28 — pre-alpha foundations

This is the first release. Aonyx Agent runs end-to-end against Anthropic / OpenAI /
OpenRouter / Ollama / LM Studio with a working memory palace (Knowledge Graph,
diary, BM25 full-text search) and four ...

Aonyx Agent v0.3.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / network errors with exponential backoff (RR).
• Anthropic prompt-caching: the system prompt is sent as a cached
  block, cutting input-token cost across a session's turns (RR).
• /cost prints a detailed per-session token + USD breakdown (RR).

TUI

• /mcp panel lists connected MCP servers and toggles all of a server's
  tools at once (RR). /rename retitles the current session (RR).
  @glob refs (@src/**/*.rs) load every matching file (RR).

Skills & theming

• Custom skills loaded from ~/.aonyx/skills/ (DD); live theme editor
  /theme-edit (KK).

[0.2.0] — 2026-05-29 — the full-screen TUI

A 25-phase arc (B → Z) turning the line-based REPL into a full-screen
ratatui terminal UI with multimodal input, multi-session branching, a
memory-palace inspector, and live capability toggles. 185 workspace tests,
clippy --workspace -D warnings clean.

Launch with aonyx --tui. The legacy line REPL remains the default.

Added

Terminal UI (ratatui)

• Full-screen layout: scrollable conversation viewport, multi-line composer,
  status bar. Auto-scroll, animated braille spinner, 💭 thinking…
  placeholder.
• Markdown rendering in the viewport via tui-markdown, with a
  ratatui_core → ratatui colour converter. Rendered live during
  streaming — headings / bold / code light up as the model types.
• @path file references load files into the next turn's context;
  !cmd runs a local shell and feeds the output back.
• Fuzzy autocomplete popup (nucleo-matcher) for @ files, / commands,
  and /cmd <arg> argument completion (/themes, /load, /ingest,
  /undo).
• Inline composer syntax highlight: /cmd magenta, !bash yellow, chat
  default — recoloured on every keystroke.
• Ctrl+P fuzzy command palette over every slash command + theme.
• Mouse support: scroll wheel, single-click palette accept. /mouse
  toggles capture so the host terminal can do native drag-to-select + copy.
• Vim modal editing (/vim): Insert / Normal, j/k/g/G navigation.
• 4 bundled themes (/themes): default, catppuccin, dracula, gruvbox.
• Desktop notifications (notify-rust) on long-turn completion + errors.
• Token + USD cost estimator in the status bar (per-provider pricing table).

Multi-session

• SqliteSessionStore cross-run persistence at ~/.aonyx/sessions.db,
  auto-restore on startup.
• /sessions list, /new rotate, /find <query> full-text search across
  every session, /load <id-prefix> switch, /fork branch the current
  session into a child (parent_id tracked).

Floating panels

• /kg — memory-palace visualization: entities grouped by type, relations
  as src ──predicate──▶ dst.
• /tools — enable / disable registered tools live (shared ToolRegistry
  disabled-set).
• /skills — enable / disable loaded skills live (shared runner toggle set).
• /inspect — pretty-printed JSON of the last LLM request (base64 images
  elided).

Safety + memory

• Inline approval overlay: destructive fs_edit / fs_write / bash calls
  pause the runner for a [Y/n] decision (async AsyncApprover bridge).
• /undo [N|list] — revert the last N filesystem changes via a JSONL
  snapshot journal at <cwd>/.aonyx/undo.jsonl.
• /ingest <path> — chunk a local file (paragraph-aligned) into the project
  palace; searchable by the agent.

Multimodal

• @image.png rendered inline as a half-block Unicode thumbnail (works in
  any truecolor terminal, no Kitty / iTerm / Sixel dependency).
• Vision passthrough: images forwarded to Anthropic (image / source
  blocks) and OpenAI-compatible providers (image_url data URLs).
• Attachment::Image on Message, #[serde(default)] for backwards
  compatibility with existing persisted rows.

Changed

• ApprovalPolicy::allow is now async to support the interactive TUI
  approver.
• AgentRunner exposes shared handles: skill_toggle_handle(),
  last_request_handle().
• SessionStore gains search, find_by_id_prefix, and fork.
• ToolRegistry gains a shared disabled-set with disable / enable /
  toggle / is_disabled.

[0.1.0] — 2026-05-28 — pre-alpha foundations

This is the first release. Aonyx Agent runs end-to-end against Anthropic / OpenAI /
OpenRouter / Ollama / LM Studio with a working memory palace (Knowledge Graph,
diary, BM25 full-text search) and four built-in skills.

Added

Agent core

• aonyx-agent::AgentRunner — multi-turn loop with streaming, tool dispatch,
  ApprovalPolicy gate, per-turn iteration cap, skill activation, project context.
• ApprovalPolicy with AutoAllow, DenyDestructive (default), Custom(Arc<Fn>).
• ChatRequest / ChatChunk / ChatStream = BoxStream<'static, Result<ChatChunk>>
  shared types in aonyx-core.

Memory palace

• aonyx-memory::SqliteKgStore — Knowledge Graph with entity / relation
  temporal validity windows, idempotent migrations, indexes, 5 tests.
• aonyx-memory::SqliteDiaryStore — append-only narrative log per project.
• aonyx-memory::SqliteChunksStore — SQLite FTS5 BM25 search with
  unicode61 remove_diacritics 2 tokenizer.
• aonyx-memory::Palace — unified facade composing the three stores; open(dir)
  creates {kg.db, diary.db, chunks.db} layout under ./.aonyx/.
• MemoryStore::hybrid_search delegates to BM25 (FTS5). Vector layer
  (fastembed-rs + HNSW + RRF k=60) intentionally deferred to V1.1.

LLM providers

• aonyx-llm::anthropic::AnthropicProvider — native Messages API,
  streaming SSE, content_block_delta + message_stop events,
  system-message extraction.
• aonyx-llm::openai_compat::OpenAiCompatProvider — shared backend for every
  "speaks-OpenAI" endpoint. Optional Bearer auth, optional extra headers.
• aonyx-llm::openai::provider — OpenAI public API factory.
• aonyx-llm::openrouter::provider + provider_with_attribution —
  OpenRouter aggregator with optional HTTP-Referer / X-Title.
• aonyx-llm::lm_studio::provider — LM Studio with empty Bearer (no auth header).
• aonyx-llm::OllamaProvider — JSON-lines streaming from /api/chat.
• aonyx-llm::Router — fallback chain across providers with tracing::warn on each failure.

Tools (10 built-in handlers, registered by ToolRegistry::default_set())

• fs_read, fs_glob, fs_grep — Safe.
• fs_write, fs_edit — Destructive (must clear ApprovalPolicy).
• bash — Destructive; cmd /C on Windows, sh -c elsewhere; timeout via
  tokio::time::timeout; kill_on_drop.
• git_status, git_diff, git_log, git_show — Safe.

Skills

• aonyx-skills::SkillLoader — parses YAML frontmatter + markdown body from
  any SKILL.md / *.skill.md. Handles \n and \r\n line endings.
• aonyx-skills::SkillEngine — activates skills via case-insensitive keywords,
  query regex, project regex, always_on, or manual. Invalid regexes are
  silently skipped.
• aonyx-skills::builtin_skills() returns the four V1 built-ins embedded
  in the binary at compile time:
  code-review, doc-writer, data-analyst, incident-response.

CLI

• aonyx — opens an interactive REPL in the current dir.
• `aonyx...