v0.4.3

What's Changed

• feat: let web search widen past the focused session's workspace by @saucam in #312
• fix: resolve the qwen model catalog from the gateway, not qwen-code by @saucam in #313
• fix: recover a qwen session whose backing chat does not exist by @saucam in #314
• fix: unstick the model alias from a superseded Opus, bump the agent SDK by @saucam in #315
• fix: share one model resolver between the daemon and the web client by @saucam in #316
• docs: federation design — one hub view over N machines by @saucam in #317
• chore(web): declare the Node floor the test environment actually needs by @saucam in #321
• fix(test): stop the gemini-cli live smoke flaking on the default timeout by @saucam in #318
• fix(dispatch): scope task claim and reclaim to the owning daemon by @saucam in #319
• feat(web): make the conductor and its workers legible in the session list by @saucam in #320
• feat(web): live fleet board state over fleet.subscribe by @saucam in #324
• fix(web-ui): serve /ui on Windows by comparing against the platform separator by @saucam in #322
• feat(web): render conductor fleet calls as action cards by @saucam in #323
• feat(web): dock the state-grouped fleet beside the conductor's chat by @saucam in #325
• fix(claude): re-send a prompt the backend consumed without running it by @saucam in #327
• fix(conductor): let the fleet read surface run without prompting by @saucam in #328
• feat(web): Conductor ⇄ Sessions toggle by @saucam in #329
• feat: sign in to a backend from codeoid, instead of pasting an API key by @saucam in #331

Full Changelog: v0.4.2...v0.4.3

v0.4.2

What's Changed

• devops: point the README badges at @highflame/codeoid by @saucam in #293
• feat: the fleet board contract — clients can finally see the conductor (P5.0) by @saucam in #294
• fix: stop asserting fleet tool registration through MCP SDK internals by @saucam in #296
• fix: typing while a tool runs re-armed the stall watchdog and reset the turn by @saucam in #298
• feat: order the session list by attention, not by when you created it by @saucam in #300
• feat: repeat-tool guard — break the loop before the budget runs out by @saucam in #295
• feat: Qwen Code backend (Alibaba) via @qwen-code/sdk by @saucam in #301
• fix: size the 1M context window for the bracket alias form (opus[1m]) by @saucam in #302
• fix: derive the login scope set from ALL_SCOPES instead of hand-listing it by @saucam in #303
• fix: auto-rotation never fired when memory was enabled by @saucam in #304
• fix: reconcile stale session statuses on boot; name the tool blocking a send by @saucam in #305
• feat: return readable Claude reasoning, and render absent reasoning honestly by @saucam in #308
• fix: one name for the memory MCP server; drop "Claude" from a shared notice by @saucam in #307
• fix: preserve session createdAt/lastActivityAt across a daemon restart by @saucam in #306
• feat: reach cross-workspace session search from the TUI by @saucam in #309
• fix: a sandboxed agent presents its own identity, and its children die with the sandbox by @saucam in #310
• feat: reach cross-workspace session search from Telegram by @saucam in #311

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• PR from npm-release to main for commit 9db4823 by @highflame-github-bot[bot] in #288
• PR from npm-release-patch to main for commit 439cacf by @highflame-github-bot[bot] in #289
• PR from release-patch to main for commit ae739ba by @highflame-github-bot[bot] in #290
• PR from release-patch to main for commit 1e24192 by @highflame-github-bot[bot] in #291
• PR from release-patch-1 to main for commit ab31ca4 by @highflame-github-bot[bot] in #292

New Contributors

• @highflame-github-bot[bot] made their first contribution in #288

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• chore: retarget repo URLs to highflame-ai + add DCO terms by @saucam in #239
• devops: drop self-hosted Gemini review workflow; pin CI runners by @saucam in #241
• fix: make from-scratch onboarding reliable — README + start hint by @saucam in #242
• feat: self-reliant embed session refresh via rotating refresh token by @saucam in #243
• docs: design proposal for collaborative multi-model sessions by @saucam in #244
• build(deps): bump @anthropic-ai/claude-agent-sdk to 0.3.220 for Claude Opus 5 by @saucam in #246
• feat: per-child provider/model on dispatched workers (collab sessions P0) by @saucam in #247
• feat: collaboration config on session.create (collab sessions P1a) by @saucam in #248
• feat: content-blind push notifications — daemon backbone (P2 push, slice 1) by @saucam in #249
• docs: add Superset to COMPARISON.md and record the backend-fidelity stance by @saucam in #254
• feat: local mode (--local) — run codeoid with no ZeroID, no account, no login by @saucam in #255
• fix: persist session renames and enforce the conductor-name guard on rename by @saucam in #258
• feat: bring up collaboration role-children (collab sessions P1b) by @saucam in #256
• fix: main does not typecheck — stale recordDestruction call from #256 by @saucam in #259
• feat: goal blackboard — typed artifact store + role scoping (blackboard 1/3) by @saucam in #260
• feat: render collaboration fleets and their goal blackboard in the web UI by @saucam in #262
• fix: a collaboration did not survive a daemon restart — the fence came back missing by @saucam in #263
• feat: native APNs/FCM push transport + shared push-core (P2 push, slice 3a) by @saucam in #261
• Update description of AI coding agents by @rsharath in #264
• feat: bound collaboration fan-out, wire the orchestrator's dispatch path, and surface goal cost at approve-time (P3 guards) by @saucam in #267
• feat: the dispatch barrier — N members, one joined result (P3 panel) by @saucam in #268
• fix: make multi-writer artifacts readable, and stop destroying codex error causes by @saucam in #270
• feat: show the fan-out while it runs — collaboration.panels + panel state in the sidebar by @saucam in #271
• fix: audit findings — index the polled panel query, stabilise its trigger, unify the terminal rule, report every live fan-out by @saucam in #272
• fix: stop losing turn-lifecycle events (dangling sub-agents, stuck 'thinking') by @saucam in #273
• fix: collaboration never started, role editor stole focus, auto-approved tools ran invisibly by @saucam in #274
• feat: reframe the conductor as an assistant whose fleet is one capability by @saucam in #275
• feat: see background tasks and wake the session when they settle — on every backend by @saucam in #284
• feat: pipeline is a mode you can pick, and an ambient pack is a thing you can see by @saucam in #285
• Design: per-role model binding for pipeline runs by @saucam in #286
• feat: per-role model binding — tiers, operator maps, --role overrides, pack-adopted collaborations by @saucam in #287
• devops: publish from the Highflame org as @highflame/codeoid, 0.4.0 by @saucam in #269

New Contributors

• @rsharath made their first contribution in #264

Full Changelog: v0.3.4...v0.4.0

v0.3.4

What's Changed

• fix: never auto-approve AskUserQuestion — elicitation is a hard block in every mode by @saucam in #226
• feat(pipeline): deterministic, backend-agnostic phase detection (design + implementation) by @saucam in #227
• fix(pipeline): re-baseline history after send (phase reuse + spurious nudge) + hide halt card while deciding by @saucam in #228
• fix(pipeline): detect phase turns by last-turn role, not a history watermark (kills the pre-work nudge + phase-N-reuse) by @saucam in #229
• fix(session): don't commit a content-free turn — the phantom-turn root cause (all backends) by @saucam in #230
• fix(session): freeze the memory index in the system prompt — the systemPromptAppend-oscillation root cause by @saucam in #231
• fix: surface and recover skill-command permission failures (#232, #233) by @saucam in #235
• fix: pipeline-created session appears immediately, not after a reconnect by @saucam in #237
• chore: release 0.3.4 by @saucam in #238

Full Changelog: v0.3.3...v0.3.4

What's Changed

• fix: never auto-approve AskUserQuestion — elicitation is a hard block in every mode by @saucam in #226
• feat(pipeline): deterministic, backend-agnostic phase detection (design + implementation) by @saucam in #227
• fix(pipeline): re-baseline history after send (phase reuse + spurious nudge) + hide halt card while deciding by @saucam in #228
• fix(pipeline): detect phase turns by last-turn role, not a history watermark (kills the pre-work nudge + phase-N-reuse) by @saucam in #229
• fix(session): don't commit a content-free turn — the phantom-turn root cause (all backends) by @saucam in #230
• fix(session): freeze the memory index in the system prompt — the systemPromptAppend-oscillation root cause by @saucam in #231
• fix: surface and recover skill-command permission failures (#232, #233) by @saucam in #235
• fix: pipeline-created session appears immediately, not after a reconnect by @saucam in #237
• chore: release 0.3.4 by @saucam in #238

Full Changelog: v0.3.3...v0.3.4

v0.3.3

What's Changed

• docs: backfill the 0.3.1 CHANGELOG section by @saucam in #213
• feat(pipeline): dynamic pack loading — registries, CLI, and web Pack Browser by @saucam in #214
• fix(web): request pipeline scopes so the Pack Browser works by @saucam in #215
• feat(pack): ambient pack activation — session.create --pack + role gate + web selector by @saucam in #216
• feat(pipeline): governed run cockpit — /pipeline trigger, auto-advance, Approve/Revise/Reject by @saucam in #217
• fix: attribute agent identities to the human owner and type them as code agents by @saucam in #218
• fix: delegate sub-agent tokens from the parent's scoped subject token by @saucam in #220
• feat(pipeline): conductor-over-live-session — S1+S2+S3 (visible runs, universal halt, cross-backend, web cockpit) by @saucam in #219
• fix(pipeline): a phase execution error fails the run instead of showing "passed" by @saucam in #221
• fix: load pack skills so /spec-style skill invocations resolve by @saucam in #222
• fix(pipeline): complete a phase on an explicit marker, and let it ask the user for input mid-run by @saucam in #224
• fix(pipeline): carry the missing nudge fix + keep scoped phases in-scope + a reopenable cockpit by @saucam in #225
• chore: release 0.3.3 by @saucam in #223

Full Changelog: v0.3.2...v0.3.3

What's Changed

• docs: backfill the 0.3.1 CHANGELOG section by @saucam in #213
• feat(pipeline): dynamic pack loading — registries, CLI, and web Pack Browser by @saucam in #214
• fix(web): request pipeline scopes so the Pack Browser works by @saucam in #215
• feat(pack): ambient pack activation — session.create --pack + role gate + web selector by @saucam in #216
• feat(pipeline): governed run cockpit — /pipeline trigger, auto-advance, Approve/Revise/Reject by @saucam in #217
• fix: attribute agent identities to the human owner and type them as code agents by @saucam in #218
• fix: delegate sub-agent tokens from the parent's scoped subject token by @saucam in #220
• feat(pipeline): conductor-over-live-session — S1+S2+S3 (visible runs, universal halt, cross-backend, web cockpit) by @saucam in #219
• fix(pipeline): a phase execution error fails the run instead of showing "passed" by @saucam in #221
• fix: load pack skills so /spec-style skill invocations resolve by @saucam in #222
• fix(pipeline): complete a phase on an explicit marker, and let it ask the user for input mid-run by @saucam in #224
• fix(pipeline): carry the missing nudge fix + keep scoped phases in-scope + a reopenable cockpit by @saucam in #225
• chore: release 0.3.3 by @saucam in #223

Full Changelog: v0.3.2...v0.3.3

v0.3.2

What's Changed

• feat(mcp): /settings surface — list mounted MCP servers + health by @saucam in #203
• feat(pipeline): SDLC pipeline primitive — engine, store, registries (dark) by @saucam in #204
• feat(pipeline): real backend runner + control-plane protocol + hardening by @saucam in #207
• feat(pipeline): declarative pack loader + create-from-pack by @saucam in #208
• feat(pipeline): load packs from config + create-from-pack over the wire by @saucam in #209
• feat: consume embedded-handoff ZeroID token from URL hash (skip sign-in when framed) by @saucam in #210
• fix: address audit findings across pipeline, protocol, store, session by @saucam in #211
• chore: release 0.3.2 by @saucam in #212

Full Changelog: v0.3.1...v0.3.2

What's Changed

• feat(mcp): /settings surface — list mounted MCP servers + health by @saucam in #203
• feat(pipeline): SDLC pipeline primitive — engine, store, registries (dark) by @saucam in #204
• feat(pipeline): real backend runner + control-plane protocol + hardening by @saucam in #207
• feat(pipeline): declarative pack loader + create-from-pack by @saucam in #208
• feat(pipeline): load packs from config + create-from-pack over the wire by @saucam in #209
• feat: consume embedded-handoff ZeroID token from URL hash (skip sign-in when framed) by @saucam in #210
• fix: address audit findings across pipeline, protocol, store, session by @saucam in #211
• chore: release 0.3.2 by @saucam in #212

Full Changelog: v0.3.1...v0.3.2

v0.3.1

What's Changed

• feat(memory): context-strategy seam + shared recall registry (#178 Phase 0) by @saucam in #179
• feat(memory): VWS on Claude — seedText transport + get_episode + resume-beyond-budget eval (#178 Phase 1) by @saucam in #180
• fix(codex): drive codex's native approval policy from the session mode by @saucam in #181
• feat(memory): VWS on gemini-cli + codex via a shared in-daemon MCP endpoint (#178 Phases 2–3) by @saucam in #182
• feat(memory): VWS memory tools on pi, openai + gemini (#178 Phases 4–5) by @saucam in #183
• feat(telegram): render provider dialogs (session.ui_request) uniformly by @saucam in #184
• feat(memory): ask_user tool for openai + gemini (so every backend can ask the user) by @saucam in #185
• feat(settings): config-file-driven settings manifest + daemon RPC by @saucam in #186
• feat(web): tabbed settings drawer rendering the daemon manifest by @saucam in #187
• feat: /settings command (web + telegram) + settings follow-ups by @saucam in #188
• docs: per-backend setup + ZeroID quickstart in the README by @saucam in #189
• docs: Gemini backends are API-key/Vertex only (no consumer subscription) by @saucam in #192
• docs: plugin-based SDLC pipeline design proposal by @saucam in #191
• docs: conductor front-doors (web + terminal UX) design spec by @saucam in #193
• fix: forks inherit the parent's execution mode by @saucam in #194
• feat: URL-hash token handoff for embed SSO in the web UI by @saucam in #195
• fix(codex): approve MCP tool calls via mcpServer/elicitation/request by @saucam in #196
• feat(mcp): registry-driven cross-backend MCP mounter — design + foundation (S1+S2) by @saucam in #197
• feat(mcp): mount registry MCP servers on backends (claude, openai, gemini) — S3+S4 by @saucam in #198
• feat(mcp): mount registry servers on codex + gemini-cli (Model-A natives) by @saucam in #199
• feat(mcp): pi backend + import ~/.claude.json servers (S5) + observability (S6) by @saucam in #201
• feat: authenticate ZeroID registration with an injected per-sandbox key by @saucam in #200
• chore: release 0.3.1 by @saucam in #202

Full Changelog: v0.3.0...v0.3.1

What's Changed

• feat(memory): context-strategy seam + shared recall registry (#178 Phase 0) by @saucam in #179
• feat(memory): VWS on Claude — seedText transport + get_episode + resume-beyond-budget eval (#178 Phase 1) by @saucam in #180
• fix(codex): drive codex's native approval policy from the session mode by @saucam in #181
• feat(memory): VWS on gemini-cli + codex via a shared in-daemon MCP endpoint (#178 Phases 2–3) by @saucam in #182
• feat(memory): VWS memory tools on pi, openai + gemini (#178 Phases 4–5) by @saucam in #183
• feat(telegram): render provider dialogs (session.ui_request) uniformly by @saucam in #184
• feat(memory): ask_user tool for openai + gemini (so every backend can ask the user) by @saucam in #185
• feat(settings): config-file-driven settings manifest + daemon RPC by @saucam in #186
• feat(web): tabbed settings drawer rendering the daemon manifest by @saucam in #187
• feat: /settings command (web + telegram) + settings follow-ups by @saucam in #188
• docs: per-backend setup + ZeroID quickstart in the README by @saucam in #189
• docs: Gemini backends are API-key/Vertex only (no consumer subscription) by @saucam in #192
• docs: plugin-based SDLC pipeline design proposal by @saucam in #191
• docs: conductor front-doors (web + terminal UX) design spec by @saucam in #193
• fix: forks inherit the parent's execution mode by @saucam in #194
• feat: URL-hash token handoff for embed SSO in the web UI by @saucam in #195
• fix(codex): approve MCP tool calls via mcpServer/elicitation/request by @saucam in #196
• feat(mcp): registry-driven cross-backend MCP mounter — design + foundation (S1+S2) by @saucam in #197
• feat(mcp): mount registry MCP servers on backends (claude, openai, gemini) — S3+S4 by @saucam in #198
• feat(mcp): mount registry servers on codex + gemini-cli (Model-A natives) by @saucam in #199
• feat(mcp): pi backend + import ~/.claude.json servers (S5) + observability (S6) by @saucam in #201
• feat: authenticate ZeroID registration with an injected per-sandbox key by @saucam in #200
• chore: release 0.3.1 by @saucam in #202

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• feat: conductor foundations — session resolution (P0–P1) + durable owner-delegated identity (P2) by @saucam in #51
• fix: re-check token expiry on every Telegram command and callback by @saucam in #121
• fix: correlate tool calls by the SDK's toolUseID and keep subagent text out of canonical history by @saucam in #118
• fix: re-attach sessions after TUI reconnect; treat transient token failures as retryable by @saucam in #119
• fix: harden the pinned-file export, workdir, and provider-env read paths by @saucam in #120
• fix: sanitize untrusted output in the legacy readline terminal client by @saucam in #122
• feat: conductor session + read-only fleet tools (P3) by @saucam in #124
• fix: stop the busy indicator looping forever after a mid-turn model switch by @saucam in #125
• fix(web): functional/interaction bug batch (Esc-interrupt, IME, mergeSession, memo, approvals, dropdowns) by @saucam in #126
• perf(web): stop large streaming code blocks and Write previews from melting the renderer by @saucam in #127
• fix(web): state leaks + storage hardening by @saucam in #128
• fix(web): OAuth reconnect fallback + all-session notifications + reconnect ordering/proto guards by @saucam in #129
• feat: dispatch + routing — the conductor directs the fleet (P4) by @saucam in #130
• feat: provider extension surface — dialogs, dynamic commands, rich parts, provider registry by @saucam in #131
• feat: pi (pi.dev) as an officially supported session backend by @saucam in #132
• feat: mid-session provider switching with provider-owned history seeding by @saucam in #133
• feat(web): visual backend switcher + provider chips by @saucam in #134
• fix: allowlist the pi subprocess environment (GHSA-38vh parity) by @saucam in #135
• devops: replace CodeRabbit with the Gemini review bot by @saucam in #136
• feat: daemon-native hook bus — uniform tool/turn/lifecycle hooks for every backend by @saucam in #137
• feat: Phase-2 canonical history — native tool_use/functionCall replay across backends by @saucam in #138
• devops: stop stray PR comments from cancelling an in-flight Gemini review by @saucam in #139
• fix: close post-merge test gaps in hooks + Phase-2 history by @saucam in #140
• feat: bundle pi so the backend works with zero install by @saucam in #141
• feat: OpenAI Codex as a codeoid backend (app-server JSON-RPC, first slice) by @saucam in #142
• feat: gemini-cli as a codeoid backend over ACP (bundled, Google-subscription auth) by @saucam in #143
• fix: ACP authenticate fallback when session/new requires an auth selection by @saucam in #144
• fix: codex real token usage + resolve codex outside the daemon PATH by @saucam in #145
• feat: session.fork — branch a conversation, optionally onto another backend by @saucam in #146
• feat: surface backend-switch + fork on telegram and web by @saucam in #147
• fix: /fork slash misroute + session-scoped attachments + Esc/search correctness by @saucam in #148
• fix: web feedback for destroy/mode/model/approve, guarded-mode fallback, live clocks, thinking throttle by @saucam in #149
• fix: send during pending approval no longer auto-denies + daemon correctness batch by @saucam in #150
• fix: telegram robustness — approval races, swallowed errors, MarkdownV2 code spans, tool-line coalescing by @saucam in #151
• fix: LRU-bound the embedding-matrix cache by @saucam in #156
• fix: rebuild the warm query loop when systemPromptAppend changes by @saucam in #155
• feat: tail-first attach + on-demand scrollback paging by @saucam in #157
• feat: web tail-first attach — loading states + scroll-up history backfill (#152) by @saucam in #158
• fix: model catalog follows the session's backend (web) by @saucam in #160
• feat: make the attach tail window configurable (session.attachTailBytes) by @saucam in #159
• fix: don't advertise openai/gemini backends without their API key by @saucam in #161
• feat: fork lineage — record + surface where a session was forked from by @saucam in #162
• fix: codex executes approved actions — disable its redundant sandbox by @saucam in #163
• fix: send codex sandboxPolicy in its real internally-tagged wire shape by @saucam in #164
• feat: real cross-backend integration tests (fresh + resume) + pi harness by @saucam in #165
• test: guard fork-while-mid-turn in the web UI by @saucam in #166
• fix: de-flake hook-bus observe-hook test (JSON EOF race) by @saucam in #168
• feat: size the cross-backend history seed to the target model's context window by @saucam in #169
• feat: isolate forks in their own git worktree (carry the parent's live state) by @saucam in #170
• feat: fork setup command, base-branch forks, and a fresh-worktree note by @saucam in #171
• feat(web): session search UX — sidebar name filter + cross-session Ctrl+K by @saucam in #172
• feat(web): "Fork from current state" toggle + base-branch input by @saucam in #173
• fix(web): show forked session in sidebar immediately by @saucam in #174
• chore(release): add release-smoke pre-release gate + fix stale CLI --version by @saucam in #175
• docs: restructure README — screenshots, slim comparison by @saucam in #176
• chore: release v0.3.0 by @saucam in #177

Full Changelog: v0.2.0...v0.3.0

What's Changed

• feat: conductor foundations — session resolution (P0–P1) + durable owner-delegated identity (P2) by @saucam in #51
• fix: re-check token expiry on every Telegram command and callback by @saucam in #121
• fix: correlate tool calls by the SDK's toolUseID and keep subagent text out of canonical history by @saucam in #118
• fix: re-attach sessions after TUI reconnect; treat transient token failures as retryable by @saucam in #119
• fix: harden the pinned-file export, workdir, and provider-env read paths by @saucam in #120
• fix: sanitize untrusted output in the legacy readline terminal client by @saucam in #122
• feat: conductor session + read-only fleet tools (P3) by @saucam in #124
• fix: stop the busy indicator looping forever after a mid-turn model switch by @saucam in #125
• fix(web): functional/interaction bug batch (Esc-interrupt, IME, mergeSession, memo, approvals, dropdowns) by @saucam in #126
• perf(web): stop large streaming code blocks and Write previews from melting the renderer by @saucam in #127
• fix(web): state leaks + storage hardening by @saucam in #128
• fix(web): OAuth reconnect fallback + all-session notifications + reconnect ordering/proto guards by @saucam in #129
• feat: dispatch + routing — the conductor directs the fleet (P4) by @saucam in #130
• feat: provider extension surface — dialogs, dynamic commands, rich parts, provider registry by @saucam in #131
• feat: pi (pi.dev) as an officially supported session backend by @saucam in #132
• feat: mid-session provider switching with provider-owned history seeding by @saucam in #133
• feat(web): visual backend switcher + provider chips by @saucam in #134
• fix: allowlist the pi subprocess environment (GHSA-38vh parity) by @saucam in #135
• devops: replace CodeRabbit with the Gemini review bot by @saucam in #136
• feat: daem...

v0.2.0

codeoid v0.2.0 — the package family release

codeoid is no longer one npm package: the wire protocol and the client core now ship standalone — @codeoid/protocol and @codeoid/core — one source of truth shared by the daemon, the web UI, and the mobile client that's next. On top of that: a hardened wire protocol, two security fixes, and a substantial performance pass.

Highlights

• @codeoid/protocol — typed client↔daemon contract (messages, scopes, published input limits) with optional runtime-validation schemas (@codeoid/protocol/schemas) (#101, #102, #105)
• @codeoid/core — framework-agnostic client core: reconnecting WebSocket transport, transcript store semantics, resume cursors, display helpers — build a codeoid frontend without re-implementing the hard parts (#115)
• Long tasks no longer get killed — the 300s stall watchdog paused during tool execution and pending approvals, so multi-minute research/exploration runs survive (#104)
• Cheap reconnects — incremental resume replays only what changed since your cursor, not the whole scrollback (#103)
• One prompt, one bill — send idempotency dedupes ambiguous-delivery retries (#103)

Security

• Untrusted model/tool output sanitized before dangerous sinks (terminal output, markdown link/image URLs) (#91)
• Cross-tenant memory disclosure fixed — workspace ids are now tenant-scoped (#93)

Protocol & reliability

• Typed auth handshake with bidirectional capability negotiation (#102)
• All inbound frames schema-validated; oversized prompts rejected as a token-bill safety net (#102)
• Large-session scrollback replays chunked + drain-paced — no more backpressure lockouts on attach (#84, #100)
• Client core hardening: auth-handshake deadline, connect-join semantics, duplicate-request-id guard, subscriber-fault isolation (#115)

Performance

• Daemon event loop unblocked on status flips, workspace probes, and fs.list (#95) · transcripts bounded with rotation + tail-load (#96)
• Memory recall: vector cache appended not cleared (#94); clustering single-flight with yielding k-means (#97)
• Web streaming: no full markdown re-parse per delta (#98); O(1) reducer lookups (#99)

Models

• Live model catalog persisted across restarts, provider-agnostic — no more stale hardcoded picker (#78, #79)

Full changelog: v0.1.3...v0.2.0 · Detailed entries in CHANGELOG.md

What's Changed

• fix: refresh stale fallback model catalog to current Claude models by @saucam in #78
• feat: persist the live model catalog so restarts serve current models by @saucam in #79
• fix: sanitize untrusted terminal output and markdown link/image URLs by @saucam in #91
• fix: tenant-scope memory workspace ids so co-located accounts can't cross-read by @saucam in #93
• fix: append to the vector cache on embed instead of clearing it by @saucam in #94
• fix: stop blocking the daemon event loop on status flips, workspace-id probes, and fs.list by @saucam in #95
• fix: bound transcript growth and resume cost — rotation, streaming tail load, output cap by @saucam in #96
• fix: share clustering per workspace — single-flight, lean hydration, yielding k-means by @saucam in #97
• fix: stop re-parsing the whole markdown message on every streaming delta by @saucam in #98
• fix: O(1) positional lookup in the web streaming reducers by @saucam in #99
• fix: chunk large scrollback replays to avoid WS backpressure lockout (#84) by @saucam in #100
• feat: extract @codeoid/protocol workspace package (P0) by @saucam in #101
• feat: typed auth handshake, capability negotiation, inbound validation (protocol P0, 1/2) by @saucam in #102
• fix: stall watchdog no longer kills long-running tools by @saucam in #104
• feat: seq-based incremental resume + send idempotency (protocol P0, 2/2) by @saucam in #103
• feat: web consumes @codeoid/protocol — retire the hand-maintained mirror by @saucam in #105
• feat: extract @codeoid/core — framework-agnostic client core (P0, final) by @saucam in #115
• chore: release v0.2.0 by @saucam in #116
• fix: complete the 0.2.0 changelog — security, performance, model catalog by @saucam in #117

Full Changelog: v0.1.3...v0.2.0