v0.14.1

Added

• ahi tools list now shows the working directory's ahi.tools.yaml painted by outcome, followed by the summary ahi doctor prints, or says the file is absent. ahi tools examples list (the default for bare ahi tools examples) names the shipped policies with what each lets the model do, which list printed in 0.14.0; ahi tools examples show prints every one painted and ahi tools examples show <name> prints one.
• ahi tools init, list, and examples paint each rule in a terminal with the chat's colors for its outcome: approve green, ask gray, deny red, the same backgrounds the transcript uses for added and removed diff lines, with a legend. --color never prints plain text, auto honours NO_COLOR, and the written file is always plain. This is the first command to use --color, which was validated and ignored before.

Changed

• ahi tools --help, ahi tools init --help, and the ahi tools examples list state the boundary: every builtin tool works inside the working directory, rule paths are relative to it, absolute paths, .., and symbolic links are refused, and run_command starts only inside it; and that this is not a sandbox, since an approved program runs on the host with the operator's access and can follow links, read above the working directory, and run other programs. Example summaries say "the whole working directory" instead of "anywhere".

v0.14.0

Added

• ahi tools init [--example <name>] [--write] [--force] writes a shipped tool policy from examples/tools into the working directory as ahi.tools.yaml, following ahi migrate: it prints the policy and writes only with --write, replacing an existing file only with --write --force. The default is read-all. ahi tools list names the shipped policies with what each lets the model do. The examples are embedded in the binary, so cargo install has them; a test keeps the list and the directory in step.
• ahi doctor reports the working directory's ahi.tools.yaml: absent, invalid, or present with approve/ask/deny rule counts and the tools it advertises.

Changed

• The chat startup header's "tools off" line now says that ahi tools init writes a policy.
• The repository's own ahi.tools.yaml now begins with the read-all example rule for rule (a test keeps them equal) and adds run_command rules for the repository workflow: cargo check, cargo test, cargo doc, git status, git diff, and git log run without a prompt; cargo clippy, cargo fmt, other cargo subcommands, and just ask; cargo publish, cargo install, and git push are denied.
• Example policies: commands.yaml gains the root .env deny the other reading policies have; ask-every-read.yaml asks for find_files and search_files too; sources-only.yaml approves find and search under src and docs. Comments and the examples README now say that path: .env names the root file only, since rules match a path prefix, and that the sh rule in commands.yaml covers any sh command run from scripts.

v0.13.2

Added

• scripts/check-published-members.sh compares each in-repo member crate (ahi-win32, ahi-widgets) with its published copy on crates.io and fails when the same version has different contents, naming the files and the fix. It runs in CI, just check, the release script before tagging, and the publish script before a member is skipped, so the 0.13.0 failure (a Dependabot bump inside ahi-widgets with no version bump) cannot reach a release again. ahi-win32 is 0.1.1: its published 0.1.0 predates a test-only change in the tree.

v0.13.1

Fixed

• ahi-widgets is 0.1.1, re-published with its ratatui-core =0.1.2 pin. The 0.13.0 crate never reached crates.io: the registry's ahi-widgets 0.1.0 still pinned ratatui-core =0.1.0, which conflicted with ahi's lockfile after a dependency bump changed the widgets crate without bumping its version. The 0.13.0 GitHub release and its binaries are intact; cargo install ahi gets 0.13.1 with the same features.

Added (from 0.13.0, whose crate was never published)

• Chat transcript formatting (#52). Assistant text renders a markdown subset (headings, emphasis, inline and fenced code with a copy affordance, lists, quotes, rules, links, tables) with in-repo per-line syntax highlighting for eleven languages; /plain shows text as written. Tool results open with one header grammar, tool target · summary · duration: edit_file/write_file show a unified diff with red/green backgrounds and word-level emphasis, run_command shows the approved argv with stdout/stderr blocks, and search_files rows are clickable path:line references. URLs and workspace file references are underlined; a click (or Enter in keyboard selection) opens a URL in the browser or a file in the editor chosen by /editor (code, cursor, zed, subl, idea, or an argv template), with $AHI_EDITOR, $VISUAL, $EDITOR, then code on PATH as defaults. The activity line counts the turn's elapsed time, each tool header carries its call's duration, and a completed turn ends with a right-aligned footer done in 1m 12s · 14:02 in local time from a TZif reader (/clock utc for UTC). Selections copy rendered text by default; Y or /copy raw copies the model's markdown source. A fresh transcript opens with a text wordmark header showing the version, model, thinking level, and workspace. Preferences persist in <state>/preferences. No new dependencies: the markdown parser, lexers, Myers diff, link scanner, and TZif reader are in-repo modules with tests.

v0.13.0

Added

• Chat transcript formatting (#52). Assistant text renders a markdown subset (headings, emphasis, inline and fenced code with a copy affordance, lists, quotes, rules, links, tables) with in-repo per-line syntax highlighting for eleven languages; /plain shows text as written. Tool results open with one header grammar, tool target · summary · duration: edit_file/write_file show a unified diff with red/green backgrounds and word-level emphasis, run_command shows the approved argv with stdout/stderr blocks, and search_files rows are clickable path:line references. URLs and workspace file references are underlined; a click (or Enter in keyboard selection) opens a URL in the browser or a file in the editor chosen by /editor (code, cursor, zed, subl, idea, or an argv template), with $AHI_EDITOR, $VISUAL, $EDITOR, then code on PATH as defaults. The activity line counts the turn's elapsed time, each tool header carries its call's duration, and a completed turn ends with a right-aligned footer done in 1m 12s · 14:02 in local time from a TZif reader (/clock utc for UTC). Selections copy rendered text by default; Y or /copy raw copies the model's markdown source. A fresh transcript opens with a text wordmark header showing the version, model, thinking level, and workspace. Preferences persist in <state>/preferences. No new dependencies: the markdown parser, lexers, Myers diff, link scanner, and TZif reader are in-repo modules with tests.

v0.12.0

A dependency and supply-chain release. No chat or hook features change; one YAML strictness change is noted under Behavior.

The lockfile goes from 285 entries to 182. Advisory ignores in deny.toml go from two to one (lru, tracked in #51). Direct dependencies drop from 23 to 17.

Dependencies

• ratatui: ahi depends on ratatui-core and ratatui-crossterm directly. The six widgets it draws with are forked into the new in-repo ahi-widgets crate from ratatui-widgets 0.3.0 under MIT, with the upstream copyright, per-file provenance headers, and a FORK.md; scripts/sync-ahi-widgets.py refreshes the fork from a new upstream version. Rendering is unchanged. (#44, #48)
• ureq 3.5 replaces 2.12: one TLS root store, http types, explicit connect, send, and receive timeouts. (#44)
• serde_yaml and unsafe-libyaml removed (RUSTSEC-2024-0449). Every config is parsed by yaml-rust2, which already ran the hardening pass, and bridged to serde so field errors read the same. (#47)
• base64, libc, and time insourced as small tested modules: RFC 4648 encoding, the O_NOFOLLOW constant per platform, and RFC 3339 on the proleptic Gregorian algorithms. (#46)
• thiserror removed as unused; base64 and the remaining pins aligned so every duplicate version left lives inside ratatui's tree. (#44)

Supply chain

• deny.toml fails on unsound and unmaintained advisories unless ignored with a reason and a review date. CI and publish build with --locked. (#44)
• A weekly dependency audit workflow runs cargo-deny and cargo-audit against main and opens or updates one issue on failure. Dependabot updates Cargo pins and GitHub Actions weekly in grouped PRs; merges stay manual. (#45)

Behavior

• YAML scalars are no longer coerced into strings. An unquoted true, null, or number where a string is expected (an entry: true hook, an argv: [true] token) is an error whose message says to quote the value. Upstream pre-commit applies the same rule. (#47)
• Catalog timestamps are written at second precision; stamps with fractions or offsets still parse. (#46)

Crates

This release publishes ahi-widgets 0.1.0 to crates.io alongside ahi.

v0.11.0

Chat tools grow from two read-only builtins to seven, all compiled into ahi and governed by ahi.tools.yaml. See Tool catalog for the survey behind the design and Chat screen for the contract.

Added

• find_files and search_files (action: tool_call): glob over names or paths, and regex or literal search returning path:line:text. In process with no rg, fd, or git subprocess; .gitignore honored; symbolic links never followed; sorted, capped output. The walk is a parallel structure-of-arrays arena; search uses three syscalls per file. (#41)
• read_file paging: offset and limit; at the 64 KiB cap the tail names the offset to continue from and no partial line is emitted. Whole files come back verbatim. (#41)
• edit_file and write_file (action: file_write): replace text that occurs exactly once (or every occurrence with replace_all), and create a file (or replace one with overwrite). A rule names edit_file, write_file, or neither for both, so creating and editing are approved separately. Atomic writes, confined to the working directory, never through a symlink; ahi.tools.yaml, ahi.hooks.yaml, ahi.dev.yaml, .pre-commit-config.yaml, .gitignore, and .git are never writable. The prompt shows line counts, never text. Hash-only audit line per attempt. (#42)
• run_command (action: command): argv list, no shell, matched by match.argv as a token-by-token prefix with optional match.path for the working directory and toolchain_env as in ahi.hooks.yaml. Scrubbed environment plus AHI_TOOL=run_command, timeout (default 120 s, max 600), stdout and stderr capped at 32 KiB each. The prompt shows the command line; a session grant is the asking rule's argv prefix. Output-free audit line per attempt. Host execution in this alpha; ahi dev run -- ahi tui is the container boundary until ahi sandbox run. (#43)
• ahi dev and ahi dev run set the container hostname to the image's short name. (#38)
• docs/TOOL_CATALOG.md: built-in tools, output bounds, permission grammars, and confinement across pi, Claude Code, Codex CLI, OpenCode, Gemini CLI, Aider, Goose, Amp, Cline, and Roo Code. (#40)

Examples

examples/tools/edit-sources.yaml and examples/tools/commands.yaml show the new rule kinds. The repository's own ahi.tools.yaml approves the four read tools.

v0.10.1

What's Changed

• feat(dev): container hostname is the image short name; AHI_DEV_PROJECT names the mount by @iancleary in #38

Full Changelog: v0.10.0...v0.10.1

v0.10.0

Added

• ahi dev --tag <tag> and tag in ahi.dev.yaml choose the image tag (latest, edge, a dated tag) separately from the image name. The flag outranks the file, which outranks the default latest. A reference that already names a tag or digest is never rewritten: --tag against it is an error, and a repository tag yields to a tagged --image or AHI_DEV_IMAGE. ahi dev status reports where the tag came from. (#36)

Changed

• --help pages: the global flags sit under "Global options" at the end of every page, ahi run groups its flags into file selection, output, and behavior, every command has a one-line summary with caveats moved to --help, and --format and --color list their accepted values. (#37)
• ahi migrate prints counted sections with aligned columns, one rules: block for the local hooks to add to ahi.hooks.yaml, the config path relative to the working directory, and the "left unchanged" or "wrote" line on stdout. (#37)

v0.9.0

What's Changed

• feat(dev): default shell is zsh, the login shell of the ahi-dev images by @iancleary in #35

Full Changelog: v0.8.0...v0.9.0