v0.7.9 — Session Restore & SQL Display Fix

Fixed

• Default startup_mode set to "last" — new installs restore previous session
• SQL in tool output wrapped in code blocks at source — prevents *, |, _ from breaking Markdown rendering
• Analysis table metadata rebuilt on startup (v0.7.8)

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.8 — Session Restore Fix

Fixed

• Analysis table metadata rebuilt on startup: DuckDB persists tables to disk, but the in-memory metadata map was lost on restart. Restoring a session with loaded data now correctly exposes analysis tools instead of showing 0 tools.

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.7 — Synchronous Analysis & Dynamic Tool Filtering

Key Changes

Synchronous Analysis — analyze-bg replaced with analyze-data

• Analysis runs in-process instead of as a detached background process
• On local LLM environments, background analysis competes for the same GPU/CPU as chat — synchronous is simpler and avoids resource contention
• Results returned directly as tool output; LLM can immediately summarize
• CLI shell-agent analyze subcommand retained for explicit detached use

Dynamic Tool Filtering

• Analysis tools only exposed when data is loaded (9 tools without data, 15 with)
• Prevents local LLMs from being overwhelmed by too many tool definitions

Processing Guard

• Warns before quit or session switch during active analysis/tool execution
• Prevents accidental loss of in-progress results

Cleanup

• Removed: JobMonitor, job cards, completion dialog, analysis-status/result tools (-729 lines)
• Version shown in startup log for remote diagnostics

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.6 — Job Monitor, Sample Tools & Stability

New Features

Background Job Monitor

• Job cards in chat area with live progress updates (running/done/error)
• MITL-style completion dialog: "Review Now" triggers LLM to read and summarize the analysis report; "Later" defers review to a clickable card
• No more false promises from LLM about notifications

Sample Tool Scripts

• 4 sample tools auto-installed on first launch: list-files, write-note, weather (JMA), get-location
• Additional examples for gem-search and gem-image in tools/examples/

Structured Logging

• internal/logger package: component-tagged, severity-leveled, dual output (stderr + app.log with 10MB rotation)
• All fmt.Printf removed — diagnostics available in ~/Library/Application Support/shell-agent/logs/app.log

Stability Fixes

• RWMutex deadlock on startup (restartGuardians + GetTools)
• Guardian Start() 15-second timeout (unresponsive MCP)
• HTTP 10-second connection timeout
• Comprehensive session concurrency (all access sites protected)

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.5 — Concurrency Audit & Deadlock Fixes

Critical Fixes

• RWMutex deadlock: restartGuardians() held write lock and called GetTools() which tried RLock — deadlocked on every startup, causing complete app unresponsiveness
• Guardian Start() hang: 15-second timeout prevents indefinite block when MCP server doesn't respond
• HTTP connection timeout: 10-second dial timeout surfaces unreachable API servers quickly

Comprehensive Session Concurrency

Full audit of all session.Records access sites. sessionMu now protects:

• buildMessages (snapshot-copy pattern)
• generateTitleIfNeeded / compactMemoryIfNeeded / extractPinnedMemories (read→unlock→LLM→lock→write)
• listImagesTool / createReportTool / autoSave / GetLLMStatus

Structured Logging

New internal/logger package: component-tagged, severity-leveled, dual output (stderr + app.log with 10MB rotation). All fmt.Printf removed.

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.4 — Concurrency & Info Exposure Fixes

Security (Medium)

Addresses remaining Medium-severity findings from code review:

• session.Records data race: sessionMu guards append (agent loop goroutine) and range (Wails bindings like GetLLMStatus)
• guardians map rebuild race: guardiansMu (RWMutex) protects all read paths (GetTools, buildToolDefs, handleToolCall MCP dispatch) during restartGuardians rebuild
• HTTP error body exposure: Truncated to 512 bytes via io.LimitReader — prevents internal server details from leaking into LLM context or logs
• osascript path injection: %q quoting for temp file path — prevents injection via poisoned TMPDIR

All tests pass with -race flag.

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.3 — Security Hardening (Review Follow-up)

Security (Critical)

• Arbitrary file read via tool result JSON: extractImageFromResult now delegates to fileToDataURL allowlist
• Path traversal via analysis-status/analysis-result job_id: validated against job-<digits> pattern
• API key no longer exposed in ps output: passed via SHELL_AGENT_API_KEY env var

Security (High)

• IsReadOnlySQL rewritten: regex word boundaries, comment/string-literal stripping, multi-statement rejection, DuckDB extension denylists (LOAD/INSTALL/PRAGMA/EXECUTE/VACUUM)
• MCP Guardian Stop(): mutex-guarded, idempotent, call() refuses after stop
• Token-stat data race: statsMu + accessor functions

All tests pass with -race flag.

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.2 — Directory Traversal Fix

Security Fix

Fixes directory traversal bypass reported in code review follow-up.

• Root cause: filepath.IsAbs() check allowed relative paths like ../../../etc/passwd to skip allowlist validation
• Fix: All candidate paths resolved to absolute via filepath.Abs() before allowlist check, with separator-aware prefix matching to prevent partial directory name collisions

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.1 — Security Hardening

Security Fixes

Addresses code review findings:

• Directory traversal prevention: fileToDataURL now normalizes paths with filepath.Clean() and validates against an allowlist of permitted base directories
• SQL read-only enforcement: New IsReadOnlySQL() check at application layer blocks write operations (INSERT/UPDATE/DELETE/DROP/ALTER/CREATE/TRUNCATE) in query-sql, query-preview, and quick-summary tools
• Tool script security guidelines: README documents stdin JSON argument passing and warns against eval / unquoted shell expansion in custom tool scripts

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

v0.7.0 — Data Analysis with Embedded DuckDB

What's New

Two-layer data analysis architecture with embedded DuckDB.

Interactive Layer (in-process)

• Load CSV/JSON/JSONL files into DuckDB tables
• Natural language → SQL generation via LLM
• Direct SQL execution, schema inspection, description annotation
• LLM-powered analysis suggestions and quick summaries

Background Layer (detached process)

• Sliding window summarization for large datasets
• Survives app shutdown (Setsid session leader)
• Status tracking via status.json, findings + markdown report output

Key Design

• Single binary: shell-agent analyze subcommand — no separate build or deploy
• 10 analysis tools: load-data, describe-data, query-preview, query-sql, suggest-analysis, quick-summary, analyze-bg, analysis-status, analysis-result, reset-analysis
• DB copy for background jobs: avoids DuckDB file-level locking conflicts
• nlk/guard: prompt injection defense in SQL generation and window analysis

Architecture Documentation

Comprehensive architecture docs added (EN/JA):

• System Architecture
• Memory Architecture
• Agent & Tool Architecture
• Analysis Architecture

Dependencies

• Added github.com/marcboeker/go-duckdb v1.8.5 (CGO, embedded)
• Build tag: no_duckdb_arrow (Arrow interface unused)

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md