Kaya v0.25.1

• Kaya now lives under the kayahq organization. The code, releases and
  update checks moved to github.com/kayahq/kaya, and the Go module path,
  docs and links follow. Updates keep working without a manual step because
  GitHub redirects the old addresses to the new ones.
• Nothing about your Pod changes. Same services, same data, same signed
  releases; this update only changes where Kaya looks for them.

Kaya v0.25.0

• Ghost is now Kaya. The name is changed everywhere: the app, the web
  console, the command you type (kaya), the services that run it, the paths
  it keeps and the module it is built from. Your memory, files, logins and
  settings are untouched — only the names around them changed.
• Upgrading from Ghost takes one manual step. The old ghost command
  cannot install this release by itself, because the binary, asset and path
  names all changed. Install the kaya binary from this release once — run
  make install from the repository, or use the prebuilt kaya_linux_*
  asset — then run kaya update. Every update after that is kaya update.
• The phone app is Kaya too. The app is named Kaya and its URL scheme is
  kaya://. Install the new build before pairing a phone again; an older
  build will not open Kaya links.

Ghost v0.24.211

• Connecting an app now names the one step only you can do. Ghost no longer
  says it will open a screen it cannot open. When an app needs a sign-in or a
  key, Ghost points at the Apps screen, says plainly what is yours, and handles
  everything around it.

Ghost v0.24.210

• Vault is in Settings, where you look for it. It sits between Data sources
  and Phone, and About stays last. The Vault now says plainly what Ghost can and
  cannot see: it never sees a saved card's number or security code, but it can
  see logins and contact details so it can type them in for you.
• Ghost does the work instead of handing you a command. Most people are not
  technical, so Ghost no longer tells you to run a command, edit a config or
  use a terminal. It uses the Vault and its tools itself. Your part is only what
  only you can do: enter a secret in a private form, finish a sign-in, grant an
  approval, or answer a question only you can answer.
• Actions run to completion. A browser or computer step can take up to ten
  minutes without Ghost stopping it, and Ghost is told to finish the steps a
  request needs rather than report progress and ask whether to continue. If it
  cannot finish, it says what remains and the one real blocker. A sign-in or
  purchase no longer gets the six-call budget meant for a quick glance.
• Helpers are used for the right reasons. Ghost delegates only when work is
  genuinely independent, would flood the conversation with context, or needs a
  conflicting tool set — not as a sequential handoff. A helper now starts with
  the least authority it needs and must be granted anything more.

Ghost v0.24.209

• A Vault for what Ghost uses on your behalf. Logins, payment cards,
  contacts and API keys now live in one place under Settings → Vault, sealed on
  your Pod. Ghost sees a login's site and username, a card's brand and last
  four digits, contact details and key names — never a password, a card number,
  a security code or a key's value. It can fill a sign-in, type your details
  into a form, or use a key in a command only when that command names the
  variable and you allowed it.
• Ghost can ask for a sign-in privately. When a site needs a login Ghost
  does not have, it puts a form in the conversation: you type the username and
  password, choose whether to save it, and submit. The answer goes from your
  phone to the Vault; it never passes through the model or the chat. A saved
  login is used only on its own site.
• Icons without leaking your site list. The Pod fetches a login's favicon
  itself and keeps it, and cards show the brand mark that matches the number
  you typed.
• Connected Apps is now just apps. Website logins moved into the Vault, and
  the approval card above the conversation is opaque so the thread no longer
  shows through it.

Ghost v0.24.208

• An approved action now runs exactly what you approved. While waiting for
  your approval Ghost kept only short text arguments. Everything else was
  dropped, so "delete this project and everything in it" ran as "delete this
  folder" and did nothing, and an approved long build lost its time limit. A
  dry run you approved could have become the real thing. Every argument is now
  kept with its type. One that cannot be kept (a password or key, which Ghost
  never stores) makes the approval refuse to run and tell you why, instead of
  running a smaller action.
• A search word is no longer treated as a secret. Anything with "key" in its
  name, such as keyword, was dropped like a password.
• Ghost no longer invents the cause of a change it finds, or throws it away.
  It said a modified file came from "your docparse work", told you to re-apply
  it, and reverted it, when the change was its own earlier build. It is told to
  say it does not know, and to commit only its own files.

Ghost v0.24.207

• Ghost can edit a project's files, not just run commands in it. Reading,
  listing, searching, editing and writing now understand projects/<name>/....
  Before, the file tools said a project file "does not exist", and a project
  with a folder called skills or state had its own edits refused as if they
  were Ghost's. Ghost's own files are protected exactly as before, and a link
  inside a project cannot lead out of it.
• Reading code can no longer change what Ghost is allowed to do. Ghost read
  a library whose examples say Name: "greet", took that for a skill called
  greet, and then held every command for approval under it. A skill is now
  committed to only by reading its own SKILL.md.
• Git works. In the sandbox git refused any repo you own ("dubious
  ownership"), refused the first commit ("Author identity unknown") and would
  wait for a username nobody could type. Commits are now made as Ghost, git
  trusts the project it is in, and a push without credentials fails at once with
  a clear message so Ghost tells you instead of waiting.
• Removing a project works. delete_file can remove projects/<name> (with
  your approval, as before), never the projects folder itself, and it is told to
  check for uncommitted or unpushed work first and tell you what would be lost.

Ghost v0.24.206

• Ghost can now run a real build or test suite. Asked to build a Go
  project, it hit a fixed one-minute limit twice, then lost minutes trying to
  run the build in the background (which cannot work) and being refused for
  harmless commands. A command can now be given up to 30 minutes with
  timeout_seconds, a timeout says how to recover, and the tool's description
  says plainly that nothing keeps running once a command returns.
• Fewer false refusals. A command was refused as "would destroy a Ghost
  primary file" whenever it had a redirect and a word like state, memory
  or workspace anywhere, so go test ./pkg/memory/... 2>&1 and a log in the
  scratch area were blocked. Harmless redirects (2>&1, >/dev/null) and the
  writable scratch areas no longer count, and inside a project only absolute
  paths into Ghost's own files are protected. Real writes to them are still
  refused.
• A cancelled request is no longer reported as a timeout. A command stopped
  because you disconnected said it had "timed out after 5m0s".

Ghost v0.24.205

• Showing you what Ghost knows no longer files a second copy of it. The
  note that summaries stop recording judgments about you did not hold: asked to
  audit what it holds, Ghost still wrote its own readings of you into the daily
  notes. A turn that only reads back Ghost's records of you is now not noted at
  all, whatever the model would have written.
• Cleaning up a probe's memories can no longer take a true fact with it.
  ghost state purge-foreign now leaves any memory your own conversation also
  established, and takes --keep=word to spare others you name.

Ghost v0.24.204

• Only your own conversation teaches Ghost about you. Test clients and
  scripted probes talk to the same gateway under names of their own, and what
  they said was filed as facts about you (a girlfriend, a dog, a death in the
  family) and written into your daily notes. Facts and notes now come only from
  your conversation, or from a context with its own scope. Ghost's own scheduled
  work is still noted. ghost state purge-foreign lists, and with --apply
  forgets, anything already filed that way.
• Forgetting now erases. A forgotten memory left a "rejected" line beside
  the original, which still held the words you asked Ghost to forget, and the
  sentence it was read from. Both are now removed from the file. Ghost keeps
  only scrambled fingerprints of the identifying words, enough to keep the
  subject out of its notes without keeping the content. Memories forgotten
  earlier are cleaned the first time Ghost starts.
• Ghost no longer scores your mood. It kept running totals of the tone of
  your messages, from a word list that only understood English, and told the
  model every turn that it was "distant" from you; probe traffic had pushed it
  to the floor. Nothing records, shows or gates on it now, and the old file is
  deleted at startup. /affect says so.
• Ghost can say what it keeps about you. Asked what it knows or infers, it
  denied having any profiling at all. Its instructions now list what exists.
• Summaries no longer record judgments about you. Ghost's own reading of
  your character, produced in answer to a question, could be saved in the daily
  notes and later read back as something remembered.
• Things Ghost creates in your workspace are yours. The service runs as
  root, so project folders and rewritten memory files came out root-owned.
  They now keep your ownership.