v0.6.6

Assistant execution

• Enter executes an approved proposal through the execution gate. Nested evaluation remains subject to its separate policy.
• Provider startup completes the bootstrap handshake before sending a real request. Cancellation invalidates the current turn and stops an obsolete pending provider session. End-of-stream cleanup stops the corresponding provider without stopping a replacement session.
• Destructive-command classification covers option clusters, quoted environment assignments, and wrapper commands. Safety labels are not a sandbox.
• Context redaction preserves valid numeric runtime settings without exempting arbitrary environment values. Audit records distinguish JSON null from an empty collection.

Processes and verification

Foreground pipelines no longer mistake a cached initial stop for a new job-control stop after resuming. Regression tests cover a second stop, process termination, and failed resume signals without replacing status hooks.

Process waits avoid an SBCL wake-pipe race on repeated stop/continue notifications while continuing to serve stream-copy events. Terminal waits drain remaining output, including non-file-descriptor streams, and error cleanup uses the same wait path.

Synchronous external-command timeouts now cover output draining even when the command exits and a descendant keeps a pipe open. Non-file-descriptor stderr uses the same deadline. Merged stdout/stderr has a single reader, and timeout callbacks run after copier cleanup. Deadline expiration is tracked separately from callback identity, so using one callback for both outcomes does not trigger another wait after timeout. The shell closes its own pipes without signaling an already-exited leader's process group.

The asynchronous cleanup test now distinguishes an aborted worker from a join timeout using SBCL's second return value. Its deadline, liveness checks, and provider-state assertions remain unchanged. The v0.6.5 tag was retained after its release gate exposed that test defect; this release contains the correction.

The release workflow runs Linux flake checks, the full non-sandboxed integration suite, pinned dependency suites, native spawn regressions, and private history storage checks. Dependency gates reject empty discovery, mismatched execution counts, skipped cases, and zero-assertion runs of three selected history properties.

The extracted release archive is checked for dependency closure, license files, runtime smoke behavior, and real-PTY editing, signals, history restart, job control, and terminal restoration.

A separate macOS arm64 probe with Claude Code 2.1.295 checked approval-before-execution, cancellation, a subsequent request, and provider-process cleanup. Other providers were not exercised live. This remains a v0.6 development preview, not a POSIX/fish-compatible interpreter or an exhaustive platform and provider compatibility claim.

Install

With Nix, run nix run github:nerima-lisp/nshell/v0.6.6.

Without Nix, download the x86_64-linux archive and its SHA-256 file. Verify the checksum before extraction and keep the extracted directory intact.