Tera Pilot 2.4.0 — agent profiles, fleets & convenient keys

Tera Pilot 2.4.0 — agent profiles, fleets & convenient keys

The v2.4.0 release is the “pick your agent for today” release:

1. Agent profiles — every agent has a named profile with its own system
   prompt (persona) and security level. /agent opens a picker, /agent <id> activates a profile (persisted across restarts), and you create or
   tune profiles with /agent new, /agent edit and /agent delete.
   Built-in presets: code (default), video (video production),
   reviewer (read-only) and apex (top-tier general assistant persona).
   Security levels (controlled / balanced / free) map onto autonomy +
   Guardian and are applied to the live runtime, including the
   system-prompt fragment, which previously was stored but never injected.
2. Fleet mode — tera-pilot fleet start --agent code:~/code --agent video:~/videos runs several profiles at once as headless workers, each
   in its own workspace; tera-pilot fleet task <agent> "<prompt>" queues
   work, and tera-pilot fleet watch is the “main terminal” that shows a
   live summary of every agent. fleet stop (or Ctrl+C) shuts the workers
   down after their current task. In a fleet, controlled agents fail
   closed on side-effecting tools (effectively read-only), balanced
   auto-approves headless, and free runs un-gated.
3. Convenient API-key setup — tera-pilot key (interactive picker +
   hidden input, list / set / remove, masked output) and /key in the
   TUI (pick a provider, paste the key on the input line). Keys are stored
   atomically in ~/.tera_pilot/config.json and never echoed.
4. Remote task mode is now reachable from the CLI — tera-pilot-daemon serve --inbound telegram reads ~/.tera_pilot/inbound.json (Telegram bot token
   • mandatory allow-list of chat IDs) and wires the inbound messenger
     listener to the task queue: any allowed message becomes a task, the task
     runs on the daemon, and the result is reported back to the same chat
     (pair with --notify telegram for completion notifications). Replying
     STOP cancels the running task. Previously the listener existed only as
     a library module with no way to start it — “set a task and walk away”
     was not actually possible.
5. Rust acceleration is one command — make native builds and installs
   tera_pilot_native (sandbox checks, circuit breaker, compaction,
   interjection buffer, cancel tokens) and verifies it loaded. The wheel
   build was already reproducible and the extension is picked up
   automatically by tera_pilot.agent.native; this just removes the manual
   two-step dance from the docs.
6. TUI approval modals got a visual refresh — the Approve/Deny and
   Guardian (Approve/Use Fix/Reject) dialogs now have clearer titles with
   icons, the proposed action sits in its own bordered mono block, buttons
   carry explicit borders and focus states, and both dark and light themes
   were updated in lockstep.
7. TUI slash commands, grouped — the command palette and /help now
   organize every slash command into six categories (Security & Control,
   Agent & Persona, Provider & Model, Session & Workspace, Info & Stats,
   Actions & UI) with group headers and counts, /help <group> filters a
   category, and picking a palette command runs its no-arg form instead of
   erroring with "needs a parameter".
8. TUI header refresh & fleet polish — the top header is now
   theme-aware (brand, version, active provider/model and workspace render
   as chips that switch palettes with the theme instead of hard-coded dark
   colors), the status line animates a braille spinner while a turn runs,
   the composer border breathes with a working/pulse state, and the
   welcome screen was refreshed with the key shortcuts. fleet start
   accepts --provider / --model / --api-base overrides applied to
   every worker (the stored API key is preserved), and fleet watch marks
   stale/dead workers and exits on its own once every agent has finished.

Tera Pilot 2.3.9

Tera Pilot 2.3.9 — repository-hygiene & docs release

Changes

• Internal documents dropped from version control. Dated eval/security reports, product strategy & readiness plans and market-research notes were removed from the repo (they stay on disk as working documents) so the public repository only carries docs that reflect the current product state. Measured eval and security results remain in the README.
• Public docs updated to reference the current sections instead of the removed files: CONTRIBUTING.md, DEVELOPING.md, THREAT_MODEL.md, eval/README.md, README.md.
• No runtime code changed. Version 2.3.9 is in sync everywhere: npm, pip, Web UI, TUI, auto-updater, tests.

Tera Pilot 2.3.8

Tera Pilot 2.3.8 — correctness & integration release

Fixes

• ACP server prompt/send no longer crashes. The streaming path iterated the runtime's sync run_stream() generator with async for → TypeError on every turn. Text chunks now stream as session/update events and end with turn_end.
• tera-pilot-acp --no-confirm no longer raises NameError (the env var was set before import os).
• ToolEngine OfficeWorker forward reference is now a TYPE_CHECKING-only import (no import cost, clean mypy).
• File-backup integrity in the diff engine: backups use a monotonic-nanosecond timestamp (two writes in the same second used to overwrite each other's backup) and the prune cap now holds exactly max_backups files instead of max_backups + 1.

Tests

• 66 new tests: ACP protocol surface (11), diff utilities (22), signed audit trail incl. tamper/reorder/deletion detection (16), MCP client env sandboxing + argument validation + result handling (17).
• Full suite: 774 collected, 754 passing (+20 environment-dependent skips), of which 269 are security/sandbox/licensing tests.

Eval

• Latest live batches are fully successful: 5/5 coding tasks solved on OpenRouter stealth/ox-alpha (2026-08-22) and 4/5 on a fully-local 2.6B LM Studio model (2026-08-21); a live SSRF attack against the cloud-metadata endpoint was correctly refused.

Version is in sync everywhere: npm, pip, Web UI, TUI, auto-updater, tests.

Tera Pilot v2.3.6

v2.3.6 — Offline license issuance, landing redesign, reporting fixes

Seller-side offline licensing

• New tera-pilot license gen-keypair --out <dir> + tera-pilot license issue --private-key <key.pem> --customer <id> [--tier pro] [--expires ISO] [--features a,b,c] — issue Ed25519-signed Pro license keys entirely offline: the private key never leaves the seller's machine, no network call, zero telemetry. Customers verify with tera-pilot license activate <key> against the embedded public key — no license server, no phone-home.
• licensing.issue_license() / load_private_key() helpers with early validation (rejects past expires_at, empty keys) — see LICENSING.md.

Landing page

• index.html refreshed for the current feature set: 17 providers (incl. the keyless local OpenAI-compatible endpoint), OS-level sandbox, SSRF-hardened web_fetch, offline licensing, security metrics (210 security/sandbox tests, 58 eval tasks, 5 fixed offensive findings).
• New visual system: glassmorphism cards with orbiting gradient borders + hover shine, film grain, floating particles and mouse parallax background, nav scrollspy with animated underlines, terminal 3D tilt, staggered hero entrances — everything disabled under prefers-reduced-motion.

Reporting & API fixes

• The agent SSE done event now reports the real provider/model and runtime-accumulated token usage even when auto-routing is disabled — the eval harness no longer records None/0.
• save_settings drops unknown provider ids (a stray providers.undefined from the UI can no longer corrupt the persisted config or warn on every startup).
• Chat-mode done event reports an honest cancel state — a stopped generation no longer looks like a normal completion.

Web UI / TUI reliability

• Web UI works when served over LAN (--host 0.0.0.0): the frontend now uses the page's own origin as the API base instead of its own loopback, so remote browsers in demo mode survive.
• Notifier status() no longer self-deadlocks (RLock instead of Lock) — the TUI /notify command can't freeze the UI anymore.
• TUI: provider switch now also configures the model; QuickSettings "Advanced…" hands off to the full model palette; duplicate agent-error rendering suppressed.

Tests

• New coverage: seller-side license issuance (CLI + licensing), extended API endpoints, TUI integration/widgets, npm version marker.
• Full suite: 664 passed, 20 skipped (684 total).

Version 2.3.6 is in sync everywhere (npm, pip, Web UI, TUI, auto-updater, tests).

Tera Pilot v2.3.5

v2.3.5 — OS sandbox, SSRF hardening, fail-closed autonomy, LM Studio native tool calls

Security hardening

• OS-level sandbox (P1.10) for execute_command / run_code / auto-detected test-lint commands: macOS sandbox-exec (Seatbelt) and Linux bubblewrap backends — network denied, writes restricted to the workspace + OS temp, sensitive paths (~/.ssh, ~/.aws, ~/.gnupg, cloud SDK configs) unreadable. Configurable via agent_os_sandbox (auto default / on fail-closed / off).
• web_fetch SSRF defense (P0.2): loopback, private, link-local and cloud-metadata targets rejected (IPv4 + IPv6 incl. ::ffff:-mapped); the hostname is DNS-resolved and every resolved address checked (DNS-rebinding defense); every redirect hop is re-validated.
• Local API token (P0.3): no longer returned by the public GET /api/status — delivered only through the same-origin HTML page the server itself serves (no CORS header on the token-bearing page).
• Headless fail-closed (P0.4): daemon/ACP side-effecting actions are blocked when no confirmation UI is wired; explicit opt-in via --no-confirm / TERA_PILOT_ACP_NO_CONFIRM=1. Guardian now fails closed on provider errors / unparseable verdicts instead of silently approving.

LM Studio / local-model integration

• LM Studio's engine rejects generated native tool calls whose content contains quotes (400 Invalid diff). The runtime now stops advertising the tools schema to LM Studio and parses the model's native <|tool_call_start|>[name(arg='...')] text format instead (agent_runtime/parser.py) — enabling fully-local agent runs.

Evaluation harness

• New direct driver — the same task prompt sent straight to an OpenAI-compatible endpoint with no agent loop, for head-to-head with/without Tera Pilot comparisons; --repeat for N fresh-workspace runs.
• security category with security_expectation; per-run evidence (the actual diff, provider/tool error counters, self_verify); 10 adversarial sec-* tasks (prompt injection, git-hook escapes, npm backdoors, SSRF, exfiltration, MCP write-outside).
• Local-model smoke batch: 4 of 5 coding tasks solved via Tera Pilot (eval/REPORT_2026-08-21.md).

Reliability & polish

• Timezone-aware UTC datetimes (datetime.utcnow removed) in swarm manager and plugins; request-queue stream serialization fixes; quota breakdown + token-optimization tips API; GUI/TUI polish.

Full test suite: 627 tests passing (20 skipped).

Tera Pilot v2.3.4

v2.3.4 — Security hardening, data-integrity fixes, offline licensing, GUI polish

Security hardening (offensive-testing driven)

Five real vulnerabilities were found and fixed this cycle (details in SECURITY_TEST_REPORT.md):

• git sandbox: !-aliases and exec-capable config keys (core.fsmonitor, core.editor, diff.*.textconv, filter.*.clean/.smudge, …) could execute arbitrary shell — including when a malicious repo ships them in its own .git/config/.git/hooks. Neutralized at runtime for every agent git call.
• CORS: localhost.evil.com used to be echoed as an allowed origin (string-prefix check), exposing api_token — now matches exact loopback hosts only.
• Encrypted prompts: fail closed without cryptography; insecure XOR fallback removed.
• npm scripts: npm run aliases (test, exec, start, …) execute arbitrary package.json scripts — all blocked; auto-detected test/lint commands require approval.
• web_fetch: loopback targets refused (local API token can't be exfiltrated).
• Constant-time token comparison (API + daemon), request body size caps, /api/context/pin|unpin → POST, daemon closes SSE streams for finished tasks.

Covered by 96 security tests + 36 sandbox/command tests (full suite: 448 tests).

Data integrity & reliability

• Command pipes drained while child runs — large test/lint output no longer hits a spurious 60 s timeout with zero captured output.
• GUI Undo actually works (shared checkpoint manager); rewind restores the latest backup at-or-before the target checkpoint.
• Learning-loop entries get unique LEARN-YYYYMMDD-NNN ids after dismissal.
• SSE streams close right after done — no more "success reported as timeout" (eval runs dropped from ~300 s hangs to ~25 s).
• repetition_guard (repetition-dominated response detection) and think_scrubber (streaming reasoning-block scrubber) ported from hermes-agent (MIT).

Offline licensing (zero-telemetry Pro gating)

• Ed25519-signed license keys verified entirely offline — no network calls during checks (test-enforced). tera-pilot license activate|status|deactivate. See LICENSING.md.

M1/M2/M3 completion

• Second Opinion / Cost Router / Spend Dashboard gating enforced identically across TUI / Web UI / HTTP daemon / CLI; fixed wiring bugs that made /api/second_opinion/run and /api/cost/* always error; 10 integration tests.

GUI & TUI

• Smart auto-scroll with "Jump to latest" pill; Settings always opens the full modal; About shows the real backend version.
• Open project end-to-end: macOS directory picker no longer crashes the backend, picker failures fall back to manual entry with a working Browse button, project context index built lazily (50k files / 5 s), file tree refreshes after switch, Cmd+O binding, /cd ~ in the TUI.

Eval harness

• Retries "another agent request is already running" collisions with backoff.
• A run whose tests passed (agent actually ran) is no longer masked by a terminal driver error.
• First analyzed batch (2026-08-19): eval/REPORT_2026-08-19.md — 12/27 meaningful runs verified, 8/9 tasks solved at least once. Raw run logs are not versioned.

Docs

• README.md and TERA_PILOT_PRODUCT_READINESS.md updated for the release; GROQ_EVAL_REPORT.md added.

Version: 2.3.4 in package.json, pyproject.toml, tera_pilot/__init__.py, agent/__init__.py, auto_updater.py, web APP_VERSION.

v2.3.3

Tera Pilot v2.3.3

Reliability, usability, and evaluation-harness improvements.

Highlights

• Rate-limit errors now surface actionable messages — instead of raw JSON, quota/429 errors show a short message with concrete next steps (wait / switch model / switch provider), keeping the original error as context for logs.
• Longer retry budget for quota errors — saturated free-tier pools get up to 8 attempts (vs 5) with provider-honoured delays, so short-lived 429 windows no longer kill a run.
• Health probe no longer cripples subsequent LLM calls — the provider-config swap during /api/providers/health is restored in a finally block, fixing the bug where every later agent/chat call was capped at 100 output tokens (the root cause of "agent reports success but did nothing").
• "Open Project" updates the file tree immediately — project_root is validated, persisted to config, and re-pointed in the shared agent runtime so the Web UI reflects the new workspace right away.
• Live model lists — new /api/providers/models endpoint fetches models from the provider's /models endpoint (OpenAI-compatible and Anthropic), with a clean fallback to built-in lists.
• LLM-generated chat titles — a short model round-trip names chats; falls back to cleaned truncation when unavailable.
• Command output keeps the tail — long stdout/stderr is truncated from the head, preserving the failure summary at the end of test/build output.
• Eval harness — HTTP/SSE read timeout is decoupled from the agent's task timeout (task timeout + 120 s grace) and iteration counting no longer inflates from non-iteration SSE steps.
• Quota messages in the TUI/GUI chat are now human-readable instead of raw JSON.

Housekeeping

• Version bumped to 2.3.3 everywhere (npm, pip, Web UI, TUI, auto-updater, tests).
• Removed throwaway files: TESTING_NOTES.md, e2e_agent_test.py, gui_task_discount/.
• README updated with the v2.3.3 changelog.
• Full test suite green: 286 passed.

Install

npm install -g tera-pilot        # or
pip install -U tera-pilot

v2.3.2 — Reliability & version-consistency release

v2.3.2 — Reliability & version-consistency release

Version sync

• Package version is now 2.3.2 everywhere: npm (package.json), pip (pyproject.toml), Web UI, TUI and the auto-updater (previously pip lagged at 2.2.4 and the auto-updater at 2.2.0).

Bug fixes

• Daemon crash: every daemon task (HTTP + tera-pilot-daemon task) crashed with TypeError because AgentRuntime was constructed without its required registry. The daemon now builds a config-backed provider registry from ~/.tera_pilot/config.json.
• Provider model= override: generate() / stream() on every provider now accept a per-call model kwarg (G20b routing). Previously the consensus engine, Guardian review, second-opinion check and task-decomposition router crashed with TypeError: unexpected keyword argument 'model' and silently degraded to APPROVE.
• Quota / 429 handling: providers' retry-delay hints ("Please retry in 41s") are now honoured with a cooldown between agent-loop calls — free-tier quota hits (e.g. Gemini 5 req/min) no longer kill runs with premature retries.
• AgentRuntime.get_token_stats() added: the daemon and e2e harness called a method that never existed; they now report real token/cost usage.
• local provider registered: the keyless OpenAI-compatible local provider id was anticipated by the code but never registered — config.json entries for local endpoints no longer log Unknown provider: local at startup.
• pytest collection fixed: the eval/ fixture repos (workspace-local test_*.py files) broke pytest from the repo root; collection is now scoped to tests/.

Evaluation

• The evaluation harness (eval/) ships 43 baseline-verified repository tasks (bug fixes, test repair, refactoring, features, code review, documentation).
• The api driver auto-accepts diff reviews so headless runs don't stall on the 300 s review timeout.
• First live run of fix-missing-return produced a working fix (task tests pass, verification passed); the api driver still records the run as error when the 300 s SSE timeout expires — a known harness limitation tracked for the next release.

Tests

• 274 tests pass. Retry tests updated for _RETRY_MAX_ATTEMPTS = 5.

v2.3.1 — Browser GUI fully wired, streaming fix, brand-neutral themes

v2.3.1 — Browser GUI fully wired, streaming fix, brand-neutral themes

🐛 Fixed

• TUI streaming duplication — every streamed token chunk wrote a new log line (RichLog._children doesn't exist in Textual 8.x); a stream of N chunks produced N duplicate entries and the final answer was never rendered as Markdown. Streaming now updates one live entry in place and renders the final Markdown answer.
• Browser GUI dead endpoints — ~30 controls called HTTP routes that had no backend handler and silently failed with {"error": "not found"}: the /context, /clear, /compact, /pin, /unpin, /reload-context slash commands, the Collective Memory (memory file) editor, Apply/Copy file buttons, the file tree panel, Settings save, Stop generation, diff-review responses, snippets, pricing, and more are now implemented and reach the shared agent runtime.
• Stop could kill the server — the chat stream shared the server-shutdown event; pressing Stop in the GUI previously set the shutdown flag. Chat streaming now has its own cancel event.
• Checkpoint path escape — rewind() now validates manifest paths against the workspace before restoring/deleting files (defense-in-depth against hand-edited manifests with absolute paths or ..).
• Version label sync — all surfaces now report v2.3.1.

✨ Improved

• Brand-neutral themes — SpaceX/Cursor/Apple styling renamed to Noir and Flat; saved themes migrate automatically; third-party brand wording removed from the UI.
• Minimal motion — TUI modals fade in with a gentle rise, chat scrolls smoothly, the input glows while the agent works; the GUI got press feedback, step glide-in, message hover lift, and a generating glow on the status dot (all respecting prefers-reduced-motion).
• README and architecture docs updated.

🧪 Tests

246 passing (added regression suites for streaming, checkpoint path escape, and the extended API endpoints).

v2.2.4 — Tera Pilot (renamed from Clew): TUI-first local coding agent

v2.2.4 — Tera Pilot (renamed from Clew)

Full product rename (clew → tera_pilot, clew_tui → tera_pilot_tui) plus the
P0 work since v2.1.1.

⚠️ This release replaces the Clew-era codebase on main. See
P0_IMPLEMENTATION.md for the full journal.

Rename & packaging

• clew* → tera_pilot* (packages, classes, env vars TERA_PILOT_*, ~/.tera_pilot, TERA_PILOT.md)
• One-command install: npm install -g tera-pilot (postinstall bootstraps a Python venv at ~/.tera_pilot/venv)
• npm bin now exposes tera-pilot, tera-pilot-tui, tera-pilot-daemon, tera-pilot-acp, tera-pilot doctor, tera-pilot audit

P0 onboarding & evidence

• Environment Doctor — tera-pilot doctor (human + --json output)
• Signed audit export/verification — tera-pilot audit (Ed25519 + SHA-256 hash chain)
• Public threat model — THREAT_MODEL.md
• Machine-readable backend report contract (schema v1, tool args redacted, secrets-safe)

Rust native acceleration (tera-pilot-native)

• sandbox, circuit breaker, interjection, compaction, actor — PyO3 extension mirroring pure-Python fallbacks
• Benchmarks: circuit breaker ~43x, sandbox path checks ~3.3x, interjection ~1.8x
• Sandbox security fixes: ..-escape and symlink+.. parity with Python Path.resolve()

Evaluation harness (eval/)

• 43 tasks in 6 categories (bug_fix / test_repair / refactor / feature / code_review / documentation)
• eval.runner CLI: run / check / smoke / report, result schema v1, baseline recording

Reliability & security

• TUI integration tests (19) driving the real runtime through the real bridge with a fake provider
• ToolEngine/Guardian security fixes: git --git-dir / --work-tree sandbox bypass, git_diff pathspec validation, Guardian dead-code policy check
• Cancel-hang (TOCTOU) fix in the TUI bridge
• Test suite: 216 tests passing; eval check 43/43, eval smoke 10/10

Docs

• All product docs translated to English (TERA_PILOT_PRODUCT_STRATEGY.md, TERA_PILOT_PRODUCT_READINESS.md, THREAT_MODEL.md, eval/README.md)
• Market-research article moved to docs/market-research/