v0.6.0-beta.1

Keep-going mode now starts approved work itself, Crook keeps a log of every verdict that
you can query, a new upkeep pass (Muster) tidies what has gone stale, lanes can set
approved check files aside, and merge rules can run in shadow mode. Follow-through can
defer to an external owner and escalates to Claude when a round does not close. Nothing is
removed and no existing use breaks; the new config keys, routes, commands and tools are
additive. The longer form is in docs/releases/0.6.0-beta.1.md.

Added

• Keep-going mode starts approved work itself. The daemon continues approved items whose
  lane never ran or whose last run a crash interrupted, then starts approved items with no
  lane, in rank order, until the run slots are full. A new lane takes the scope named by
  its item's plan document; an item whose plan names no scope, or that has neither a plan
  nor an acceptance line, is held and the feed says so. Every start passes the same gate as
  the desk's, and shepherd keep-going status ends with a summary of what the mode did.
  The drive never answers a decision, approves, merges, pushes for a person, tags,
  releases or deploys. See docs/keep-going.md.
• Crook keeps a verdict log. Every verdict a call site acts on is stored with the rule that
  decided, its stage, the actor and a redacted reason. shepherd crook why <id>,
  crook why run <id>, crook why lane <name>, crook log and crook rules read it, and
  all take --json. Crook also loads rule files and layers. See
  docs/crook-why.md.
• Merge rules in shadow mode. A repo can have a merge rule in .shepherd/rules/<id>.md;
  in shadow mode Shepherd works out what the rule would have done for each open lane merge
  request and records it, and the person still merges. shepherd crook shadow and the
  crook_shadow tool read the record, and crook rules counts shadow rows apart. Shadow
  mode never merges, approves, retries a job or posts. The daemon's forge watcher runs the
  pass for each open lane merge request, apart from the poll, and records an outcome row
  when the person merges; a failed pass records nothing. Going live is not built. See
  docs/merge-rules.md.
• Checks first. A lane can set approved check files apart: the person approves them with
  checks.approve, they are left out of a build lane's scope, and checks.release frees
  them. Opening, rescoping, pushing and shipping respect the set, and lane ship refuses a
  branch that changes approved check files. Lane views list the excluded files, and
  approving or releasing checks appears in the feed.
• Muster, an upkeep pass on the watcher's tick. It looks over artifacts, lanes, runs,
  next-up items, questions and decisions for what has gone stale, tidies what is safe and
  can be undone, and raises a finding for the rest. Each finding and fix is a row in the
  muster log, and an applied fix can be undone for a number of days. Its routes, CLI and
  web screens are not built yet. See docs/muster.md.
• Follow-through by an external owner. A repo can name another service as the owner of a
  merge request's failed pipelines and review threads. Shepherd stands back, and takes the
  work over if the owner stays silent past patience or says Unfixed:.
• Follow-through escalates to Claude. When a follow-up round on a merge request, run by a
  cheaper model or another agent, does not close the open items, the next round runs on
  Claude Code, resuming the lane's Claude session when there is one. The first round is
  never escalated. If Claude Code is not installed, the round stays with the usual agent,
  and a skipped escalation says why. Set watch.escalate: false to keep every round on
  the same agent. See docs/follow-through.md.
• shepherd next list filters by repo, topic, state and text. --topic matches a
  conversation topic and refuses an ambiguous title, and --state fetches dropped and
  done items.
• The desk's run_stop tool takes for_restart, which hurries a drain. A run stopped that
  way is continued after the restart; the CLI says when --for-restart is used with no
  drain under way and falls back to a plain stop.
• Web UI: one error, loading and empty state across the views, with a working Retry on the
  reads that can reload and a back link on the error state.
• Web UI: the side panel has panes for a routing request and a next-up item, and the
  Forge watcher card on the daemon status page names the forges the watcher can read and
  how often it polls, or says polling is off.
• Agents are told in every brief never to skip git hooks. Claude Code runs
  deny --no-verify, commit -n and core.hooksPath overrides by pattern, and Copilot
  runs deny them where they follow the subcommand (Copilot matches command prefixes, so
  a flag placed last gets through); the pre-push
  hook no longer suggests git push --no-verify to an agent's run, and a run seen
  skipping hooks is flagged once in the feed. These stay cooperative guards, not a
  boundary.

Changed

• Approving and releasing checks, and lane rescoping, fail closed on lookup and git errors,
  and the feed text for check approvals and releases is redacted.
• The forge reader looks for the renamed AI review job when it retries an approval.
• Documentation: merging follows each repo's merge rule.
• make check runs the web checks as well as the Go checks, skipping them where npm is
  missing or CI runs them apart.

Fixed

• An answer to a decision whose asking run has been superseded continues the lane's
  latest run's session instead of reviving the old conversation.
• A thread reply to a desk question closes it, in order with skips and answers.
• Crook writes verdicts in the background, logs an identical hold or refusal at most once a
  minute, and ends a path at its stage. Rule loading refuses class matchers where classes
  are unknown, folds case in the rules-folder floor, and skips symlinked rule files and
  folders.
• Keep-going: a lane whose item link failed is taken up, a start counts only after the run
  starts, drive lanes are scoped by plan, and a refused start closes its lane.
• Artifacts: declared screenshots over 10 MiB survive a lane closing, and the no-copy feed
  line is written only after a close succeeds and is worded neutrally.
• Muster asks about a running run with no pid, keeps a decision whose run cannot be read,
  clears findings only for checks that finished, and leaves artifacts alone when the
  worktree is missing. Scope offers need a widening verb and safe paths.
• Rescope works for a repo whose directory is gone, and returns the error when the repo's
  files cannot be listed.
• Shadow reads say when they hit the row cap and count merged_after for any verdict, and
  a shadow row whose write failed is retried, with one feed line per head.
• Follow-through: an owner's Unfixed: thread is taken at once on first sight, and the
  authors clear when a repo returns to shepherd.

Interface changes

• Config: a muster: section with stale_days (3, 0 turns the check off), batch_days
  (3), digest_days (3), skip_days (7) and undo_days (7); negative values are refused.
  Under defaults: or a repo's watch:, follow_through: with owner (shepherd or
  external), name, patience (30m) and author (required with owner: external).
• Rule files: .shepherd/rules/<id>.md with kind: merge, mode: shadow and require:
  conditions.
• HTTP API: new routes /v1/checks, /v1/crook/verdicts and /v1/crook/rules.
• CLI: shepherd crook why, crook log, crook rules and crook shadow; shepherd next list filters; run stop --for-restart falls back to a plain stop with no drain.
• MCP tools: new crook_why and crook_shadow; run_stop gains for_restart.
• Feed: new kinds checks_approved and checks_released.
• Config: watch.escalate (default on) keeps follow-through rounds on one agent when set
  to false.
• Status detail (HTTP API and web): the forge watcher reports poll_seconds, forges and
  off.
• Store: three appended migrations add the Crook verdict log, the Muster log and the
  approved check files. An older binary refuses a store migrated by a newer one, so going
  back a version can mean a fresh store.

v0.5.0-beta.2

A fix release for 0.5.0-beta.1. The web UI no longer shows a blank page when a merged
lane is held open by files waiting on a decision, and the counts in the window title,
favicon, Board and Next up now agree with Waiting on you. It also adds auto-widen (off
unless a repo turns it on) and project grouping in the shepherd chat dock.

Fixed

• Web UI: a waiting item of kind artifact (a merged lane held open by undecided files),
  or any kind the page does not know, no longer blanks every page. Such items list in the
  Inbox under To tidy, and unknown kinds show a neutral mark in the status counts.
• Web UI: the window title, favicon, and the Board and Next up Needs counts follow the
  Waiting on you count.

Added

• Auto-widen: a repo can let Shepherd widen a lane's scope by rule, for a small request
  that names exact files near the lane's work, instead of asking the person. It is off
  unless the repo sets widen: auto; protected paths (gate files, secrets and any listed
  globs) are never widened by rule. Each auto-widen is a feed item and is listed in the
  merge request description. See docs/config.md.
• shepherd chat: the dock names a lane's project (shop/feat-login) when more than one
  project has items. /dock opens the whole dock, and /group or p there groups it by
  project with a summary line each; the choice and the folded projects are remembered.
  A project at 80% of its budget cap, or at a hard cap that holds runs, gets a dock row.

Interface changes

• Config: new keys widen (human by default, or auto), widen_max_files
  (3), widen_cap (3) and widen_protected, under defaults or a repo.
• Settings: the daemon accepts two new keys, dock.group and dock.collapsed.

v0.5.0-beta.1

A beta of uBixShepherd with a redesigned web UI built from one design system, a
keep-going mode that lets the front desk carry on with what is already approved, files
that agents produce kept as artifacts, restarts that drain running agents and continue
them, runs that stop without finishing continued once, a Waiting on you list that also
shows blocked lanes and unapplied scope widenings, tracked questions from the desk to the
person, review threads handed back to a lane's agent, GitLab links in reports, and a
daemon upgrade from the update notice. Nothing is removed or changed incompatibly. See
Known limits at the end of this section for what is not built yet.

Interface changes

• Keep-going mode: new routes GET /v1/keep-going?workspace_id=N and POST /v1/keep-going,
  the command shepherd keep-going on [--cap USD] [--runs N] [--idle HOURS], off and
  status, the MCP tool keep_going (on, off, status) and /keep-going on|off in
  shepherd chat. A new keep_going section in config.yaml takes cap (default 5
  dollars), max_runs (2), idle_hours (4), day_end (local midnight, HH:MM) and
  lane_starts (3 a lane a day). A person-started turn, the CLI and the web UI are not
  limited by it; an event-turn desk that opens a lane, starts or continues a run or takes
  a fix is refused with a 403 and its reason when the mode is off or a limit is reached.
  An appended store migration adds the mode's row and per-lane start counts.
• GET /v1/waiting gains kinds blocked (an open lane whose last run reported blocked,
  with no run going) and scope (an answered scope-widening decision the lane's scope
  does not yet cover), both with action open. An approved Next-up item whose lane closed
  without a merge is listed too.
• New routes GET|POST /v1/questions, POST /v1/questions/{id}/answer and /skip, with
  MCP tools question_open, question_answer and question_list and the command
  shepherd question. POST /v1/desk/turn takes reply_to. GET /v1/waiting gains kind
  question and counts.questions.
• New route POST /v1/update/upgrade, an upgrade object in GET /v1/update, the
  commands shepherd update upgrade [--now] and /update upgrade [now], and config key
  update.auto (default false).
• next_add from the front desk now stores source chat, and takes propose (with
  shepherd next add --propose, desk only) to put an item up for approval as before.
• New config keys watch.fix_tries (default 2, 0 off) and watch.review_threads
  (default on), under defaults or a repo. The fix budget is now shared by failed
  pipelines and review threads.
• New command shepherd links and MCP tool links_thread, which turn a discussion id
  into its note URL.
• New route GET /v1/lanes/{id}/files?path=&ref=, a read-only listing of a directory or
  one file (up to 1 MiB inline, larger and binary files are listed without data) of the
  lane's worktree, or of a ref in its repo.
• Artifacts: new routes GET /v1/artifacts, GET /v1/artifacts/{id},
  GET /v1/lanes/{id}/artifacts, POST /v1/runs/{id}/artifacts (the run's own token
  only), a snapshot content route, and routes to move an artifact to keep, discard, pin
  and edit its intent (the web and the operator only). New command shepherd worker artifact PATH, shepherd artifact gc, the MCP tool artifact, the desk tools
  artifact_list and artifact_read, --artifact on ask-human, and the feed kind
  artifact. New config keys artifacts.keep_days (30) and artifacts.cap_mb (500).
• POST /v1/desk/turn takes a structured about (what the person's message is about),
  which the web's context composer sends.
• shepherd daemon restart --drain [--timeout 10m]; make install uses it, and
  DRAIN_TIMEOUT sets how long it waits. Runs gain a reason column and a new
  held_starts table keeps starts held during a drain.
• New config keys: max_runs under defaults or a repo (a cap on agents running in one
  repo; daemon.max_runs stays the machine's cap), next.expire_days (days a proposed
  Next-up item may wait), and autonomy.tag: agent with autonomy.push: shepherd, under
  which Shepherd pushes a release tag the lane's agent reserved. New command shepherd workspace rename and MCP tool workspace_rename.
• Next-up items gain done_when and depends_on, and suggestions appear in Waiting on you.
• Appended store migrations add lane_forge.threads_seen, the artifact tables, the
  held_starts table and the run reason column, and relabel planned desk items as
  chat. They apply when the daemon starts, and a binary refuses a store
  migrated by a newer one.

Added

• Keep-going mode lets the front desk carry on with what is already approved. Until
  now every [Shepherd] event turn told the desk not to start work it had not been asked
  for, so it reported and waited even when the next step was obvious. With the mode on,
  the desk may start the next approved Next-up item, continue an approved next step and
  follow up a failed pipeline, within limits the daemon enforces and not the prompt: a
  spend cap, concurrent runs, idle time, end of day and starts per lane per day. It
  turns itself off when a limit is reached and records why. It never answers a decision,
  approves, merges, tags or deploys, and only the person turns it on. The mode is per
  workspace, lives in the store and survives a restart. The desk's "do not start new
  work" sentence now comes from one function that reads the flag. The web has a switch and the
  feed has a keep_going kind, and an alert is posted once when a stall leaves approved
  items unstarted. Known limits below says what the mode does not do yet. See docs/keep-going.md.
• Waiting on you lists blocked lanes and unapplied scope widenings. A lane whose last
  run reported blocked, an answered scope-widening decision the lane's scope does not
  cover, and an approved Next-up item whose lane closed without a merge now wait on the
  person. A merge request the forge merged never lists, whatever its pipeline status. See
  docs/waiting-on-you.md.
• Clickable GitLab links in reports: agents' briefs and the desk's instruction require links for merge requests, pipelines, jobs and review threads (a thread links to its first note), Shepherd's own watcher messages emit them, and shepherd links (MCP tool links_thread) turns a discussion id into its note URL. See docs/links.md.
• Shepherd sends unresolved review threads back to the lane's agent, and the fix budget
  is configurable. The watcher reads an open lane merge request's unresolved threads
  and continues the agent with each thread's id, file and line and text, once per thread
  (remembered across restarts). It shares one per-request budget with failed pipelines,
  now watch.fix_tries (default 2, 0 off) under defaults or a repo, with
  watch.review_threads: false to stop thread handoff. A failure of the require-approval
  job alone is never handed to an agent: it waits for a human reviewer. A migration adds
  lane_forge.threads_seen. See the README's "Watching the forge".
• Work the desk registers from chat is marked as coming from chat and does not wait on
  you. next_add from the front desk now stores source chat: the item shows as planned
  with a "chat" badge in Next up and is left out of "Waiting on you". The new propose
  option on next_add (and shepherd next add --propose, desk only) puts an item up for
  approval as before. A migration relabels planned desk items already on the list as
  chat. See docs/backlog-next.md.
• The front desk's questions to you are tracked and cannot be missed. The desk marks a
  question with the new question_open tool when a reply asks you something; it then waits
  in the "Waiting on you" list as kind question, in the header, the dock and the desk's
  [Waiting on you (N)] line. The header counter has up and down arrows that step through
  everything waiting and scroll to and highlight it in the thread. A question's message
  shows "Reply here" (an inline reply linked to the question) and "Skip". The desk marks
  one answered with question_answer when a main-chat reply plainly covers it. See
  docs/desk-questions.md. Interface changes: new routes
  GET|POST /v1/questions, POST /v1/questions/{id}/answer and /skip, reply_to on
  POST /v1/desk/turn, kind question and counts.questions in GET /v1/waiting, MCP
  tools question_open, question_answer and question_list, and shepherd question.
• Fenced code blocks in the web chat have a copy button. Each block in a desk or agent
  message gets an icon button in its top-right corner that copies the block's text exactly,
  over plain http too, and shows a check for a moment. Inline code is unchanged.
• The update notice can upgrade the daemon in one click, and the daemon can do it by
  itself. The notice in the web UI gains an Upgrade button, shepherd update upgrade [--now] and /update upgrade [now] in shepherd chat do the same. The daemon downloads
  the release archive for its platform, checks it against the release's SHA256SUMS,
  proves the new binary runs, keeps the old one as shepherd.previous, swaps it in, and
  restarts onto it at the first moment no agent is running (or at once with --now,
  "Restart now", which interrupts them). A new binary that does not stay up is replaced
  by the previous one on the next start. Homebrew, go install and source installs are
  not replaced: the notice says what to run. New opt-in setting update.auto (default
  false) installs a newer release without a click. Interface changes: new route
  POST /v1/update/upgrade, an upgrade object in GET /v1/update, config key
  update.auto. See [docs/update-check.md](docs/update-check....

v0.4.0-beta.1

A beta of uBixShepherd that shows each lane's gate result in the web UI, files the
person's turns under topics, and lets the front desk widen a lane's scope once the person
has approved it. No interface is removed or changed incompatibly.

Changed

• The daemon files each of the person's turns under a topic before the front desk sees
  it. In order: the topic the person wrote from in the web thread (the web sends it as
  topic_id on POST /v1/desk/turn); else the one open topic of a lane, run, decision,
  request or merge request the message names (run 12, decision 4, !158, a lane's
  name), and none when the things named are in different topics; else the topic of the
  person's last turn. Cleared topics are never chosen. The turn's header tells the desk
  which, and not to file it again. The desk can still re-file the turn with topic_set
  when the person clearly changes the subject.
• A hosted OpenCode run's cost is shown as an estimate. OpenCode prices a step from its
  own table, and OpenRouter's billed usage.cost never reaches its events, so the figure
  can be several times low. Runs and usage records gain cost_estimated (an appended
  migration, which also marks earlier hosted OpenCode runs), the run history and usage
  totals say how much of their dollars is an estimate (estimated_usd), and the web shows
  ~$0.05 with a tooltip, "cost unknown" for a hosted run that reported none and "local, no
  cost" for a local model. The figure itself is unchanged.
• The front desk files its turns under topics without being told their ids. topic_set
  with only an id, or a new title, files the turn in progress: the daemon knows the turn
  the desk's token was minted for. The desk may file only its own turn. A turn Shepherd
  starts for a run, decision or request already in a topic is filed under that topic, and
  the desk is told which; a lane with no link takes the topic of its next-up item or of a
  run tied to it. topic_set takes a lane by name (with repo) as well as by id, and lane open and lane list show the lane id. No schema change.

Added

• lane_widen and shepherd lane widen: the desk widens a lane's scope once the person
  has approved it in a decision. The tool adds globs to an open lane on the strength of an
  answered decision raised by one of the lane's runs, only in a turn the person started (the
  rule decision_answer follows). A glob another open lane holds is refused, naming that
  lane, as for lane_open. Each change is logged and put in the feed. This adds the route
  POST /v1/lanes/{id}/widen and the MCP tool lane_widen; lane scope is unchanged.
• Settings: the Web section with editor_url. web.editor_url now appears in the
  Settings form as "Editor link", a URL template where {path} is the file's absolute path
  and {line} is optional. The default is vscode://file/{path}. Validated at load,
  following the same scheme rules the page already enforces.
• A gate badge in the web UI, and a run-narrowed Changes section. The lane page, the
  board and a project's open lanes show the lane's gate record (passed, failed, stale or
  not run), with its commit, time and command on hover. The run page gains a Changes
  section narrowed to the run with run=<id>; it shows the worktree's uncommitted work
  only for the lane's latest run and marks files on the run's outside list. This is the
  web step of docs/lane-diff.md; the daemon already served the badge.
• The Help dialog lists g t, the key for the timeline page.

Fixed

• A lane with a running run is never judged finished. The review looked only at git state,
  so a clean lane with nothing unlanded read as finished while an agent run, such as a
  continuation of a stopped run, was still running in it. Such a lane is now judged live.
• OpenCode agents can run a repo's web tests and build: npm * is allowed. The repo's
  gate is allowed as written, with no wildcard, so make check build no longer matches
  make check.

Interface changes

• New MCP tool lane_widen and command shepherd lane widen, on the new route
  POST /v1/lanes/{id}/widen. It is not open to an agent's worker token.
• POST /v1/desk/turn takes an optional topic_id. topic_set takes a lane by name (with
  repo) as well as by id, and files the turn in progress when given only an id or a
  new title. lane open and lane list show the lane id.
• Runs and usage records gain cost_estimated, and run history and usage totals gain
  estimated_usd. One appended store migration, which applies when the daemon starts; a
  binary refuses a store migrated by a newer one.
• web.editor_url is unchanged; it is now editable in the Settings form.

v0.3.0-beta.1

A beta of uBixShepherd that adds a Next up list for planned work, lane diff and a
Changes tab on the lane page, a timeline page in the web UI, and shepherd repo add/remove/list/scan. No interface is removed or changed incompatibly.

Added

• A next-up list: shepherd next and the next_list, next_add and next_update
  tools. Work that is planned but not being acted on now lives in the daemon's store
  (next_items, an appended migration), in the person's order: approved, then planned,
  then deferred. shepherd next lists, adds, shows, approves, defers, drops, finishes,
  moves and links items, and shepherd next seed adds the items docs/backlog-next.md
  lists. lane open --item N (and the item argument of lane_open) links an item to the
  lane it opens, or a lane named as the item's hint links it when exactly one matches;
  the item reads as started while the lane is open and done when its merge request
  merges. Approving, deferring, dropping, finishing and reordering are the person's: the
  daemon refuses them from the front desk outside a turn the person started, and an agent's
  token has no route. The API is GET/POST /v1/next and GET/PATCH /v1/next/{id}. The
  work-matrix read-through is a later merge request.
• A Next up page and rail view in the web UI. #/next (nav entry Next up, key
  g n) lists the items in order: approved, planned and deferred, with done and dropped
  behind a toggle. Each row shows its state, plan doc, repo, lane and merge request, and
  the first approved item with no lane carries the next marker. The person approves,
  defers, drops, restores, moves up or down, links to an open lane and adds items from
  the page; a refusal from the daemon shows as it came. Start puts "open a lane for
  item N" in the chat draft and starts nothing. The chat page's backlog rail gains a
  Now / Next up toggle, remembered in the browser: Now is the rail as it was, and
  Next up shows the top five approved items with Start and a link to the page.
• shepherd lane diff and the lane_diff tool. One read of what a lane holds against
  its base: the commits, the committed changes, uncommitted changes in the worktree and
  untracked files, each file marked inside or outside the lane's scope. --stat is the
  default, --files adds hunk headers, --file <path> reads one patch, --json prints the
  answer the daemon serves at GET /v1/lanes/{id}/diff. It is bounded (30 commits, 200
  files, 64 KiB per file, 256 KiB in all), redacted before it is cut, and open to the
  desk and browser sessions but not to an agent's worker token. The web Changes tab, the
  gate badge and the run view are later steps of docs/lane-diff.md.
• A timeline in the web UI. #/timeline (key g t, and a Timeline entry in the nav)
  shows the day's work at once: a track per lane grouped by repo, a bar per run coloured
  by its agent, running bars that grow with the clock and end in a pulsing cap, a lantern
  on every decision or request waiting on you, a tick for each merge, a notch on each
  failure, and a spend band against the daily budget. It has Today, Last 24 hours and Last
  7 days, an agent filter in the legend, hover and keyboard-focus details, click-through to
  the run, lane or decision, and a table view of the same runs. It is built from the live
  snapshot and the existing history endpoints, with no daemon change; the agent colours
  were checked with the dataviz validator, and the page follows the dark theme, reduced
  motion, forced colors and the narrow layout. The design is docs/swarm-timeline.md.
• shepherd repo add, remove, list and scan, and init --prune. Managing a repo
  no longer needs init. A removed repo is marked, not deleted, so its lanes, runs and
  history stay readable, and adding it again restores the same row. init --only now says
  it only adds and lists what it left managed; --prune unmanages the unlisted repos,
  refusing while a lane is open. The daemon serves them at GET/POST /v1/repos and
  POST /v1/repos/{id}/unmanage, with no restart.
• A Changes tab on the web lane page. It reads GET /v1/lanes/{id}/diff and opens
  each file's patch on demand. web.editor_url (default vscode://file/{path}) turns each
  file into an editor link; an empty value hides the links.
• Gate results per commit. Each Shepherd gate run (the end-of-run push and lane ship)
  is recorded with its commit, command, outcome and time (gate_results, an appended
  migration), and a run over uncommitted changes is skipped. Lane views and the lane diff
  carry a gate badge: passed, failed, stale or not run. The diff read takes a run, for
  that run's own start-to-end range (lane diff --run, run diff <id>, the run
  argument of lane_diff).
• Web actions reach the front desk. Answering a decision, stopping, continuing or
  starting a run, closing a lane, routing or closing a request, and taking or dismissing
  a fix from the web page append an action event. It shows in the thread, the history and
  other tabs, starts no turn, is redacted, and heads the desk's next turn.
• The web stub for screenshots (web/shots) serves BUSY=1, a heavy day, answers its
  history endpoints with its runs, and takes SHOTS_PAGES to choose pages. Shots now
  emulate reduced motion.

Interface changes

• New commands: shepherd next (list, add, show, approve, defer, drop, finish, move,
  link, seed), shepherd lane diff (--stat, --files, --file, --run, --json),
  shepherd run diff <id>, shepherd repo add, remove, list and scan, and
  lane open --item N. init --only only adds; --prune unmanages the unlisted repos.
• New MCP tools: next_list, next_add, next_update and lane_diff; lane_open
  takes an item argument. lane_diff is not open to an agent's worker token.
• New endpoints: GET/POST /v1/next, GET/PATCH /v1/next/{id},
  GET /v1/lanes/{id}/diff, GET/POST /v1/repos and POST /v1/repos/{id}/unmanage.
  Lane views gain a gate badge; the feed has action events.
• New config key web.editor_url, validated when the config loads.
• Two appended store migrations (next_items, gate_results); they apply when the
  daemon starts, and a binary refuses a store migrated by a newer one.

Fixed

• OpenCode's hosted-model cost is labelled as OpenCode's own estimate, and a hosted model
  no longer gets the local endpoint's context window.
• Chat messages in the web UI use the thread column's width, and the backlog rail takes
  about 35% of the width, 18 to 30rem.

Changed

• The docs explain the front desk and its Claude Code requirement.

v0.2.0-beta.1

A beta of uBixShepherd with a web UI served by the daemon, projects, standards packs,
usage stats, run diagnoses, an OpenCode agent and a front desk the daemon runs. This is
the first release published to GitHub. The 0.1.0-beta.1 section below was prepared but
never tagged, so everything it lists is part of this release too.

Added

• Projects. projects: in config.yaml groups repos (a repo is in at most one
  project) with a daily or monthly budget marked soft or hard, local build caches
  and intake rules. Shepherd rolls spend up per project, holds or warns at the caps,
  and layers a project's approved brief and its caches into the text agents are given.
  A project's brief is drafted and then approved by the person. The daemon serves them
  at /v1/projects. A repo may be named in a project without its own repos: entry.
  See docs/projects.md.
• The web UI grows pages. The chat page follows the front desk with a composer,
  typed rows and decisions answered inline, and keeps a half-typed message across page
  changes. Beside it, a backlog rail lists what waits on the person or has gone quiet,
  most urgent first: needs you, broken, idle, working and to review, with today's spend
  against the budget, the forge poll's health and any quota hold in its header. Rows
  carry their age and MR and pipeline badge, dated from the lane's last activity and the
  forge's own times, and an "in thread" jump. The other pages are a Projects view (and
  a Board grouped by project, with a Work section from docs/WORK.md), Runs and
  history, a Usage page, a lane's whole Conversation, a Settings tab and a daemon status
  popover on the connection dot. See docs/web-chat.md, docs/web-projects.md,
  docs/web-settings.md and docs/web-daemon-status.md.
• Settings in the web UI. The Settings tab reads and edits config.yaml in place:
  per-repo overrides against the defaults, projects (add, edit, delete), a diff before
  every save, validation beside the field, a config.yaml.bak.<time> backup (the last
  10) and a reload of the daemon on save. It refuses to save over a file that changed
  on disk, and risky changes ask to be confirmed. A browser session may save only when
  shepherd web --allow-settings signed it in; otherwise the tab is read-only. See
  docs/web-settings.md.
• Standards packs. A pack is a folder of markdown rules, each with a level
  (must or should), an optional check command, applies_to globs and when tags.
  The rules that apply to a lane go into the one brief every agent gets, plan_first
  is part of it, and a must rule's check runs before a push. A repo's own standards
  win. Repo profiles gain standards, standards_docs, standards_pack_dir and
  standards_when; shepherd standards list, show and init inspect them, and an
  example house pack is written on first start. See docs/standards-packs.md.
• Usage stats. Each run and each front desk turn records its tokens, its largest
  context and how often the CLI compacted. shepherd stats (--days, --from, --to,
  --json), GET /v1/usage, the usage_stats tool, the web Usage page and a usage
  line in shepherd run show answer whether a larger context window is worth it.
  Claude Code and OpenCode report them; Copilot and Cursor record cost only. See
  docs/usage-stats.md.
• Run diagnoses and suggested fixes. A run that ends badly, or whose work cannot be
  pushed (gate, standards or commit rules failed, out of scope, push or merge refused,
  out of quota, hung, no change), gets a deterministic one-line diagnosis with its
  evidence and suggested fixes, shown in the feed, the CLI and the web UI. A fix runs
  an existing operation; the ones that widen what an agent may do are left to the
  person. The web UI and chat show what a running run is doing now. See
  docs/run-failures.md.
• Dismiss a failed run. shepherd run dismiss and run undismiss (and the
  run_dismiss and run_undismiss tools) take a failed or stopped run off the board
  without hiding it from history.
• The OpenCode agent. shepherd lane run --agent opencode runs OpenCode headless
  for small mechanical edits on a local model. opencode.bin, opencode.endpoint,
  opencode.idle_timeout, opencode.context and opencode.output configure it; a run
  that changes nothing or hangs fails with a diagnosis. Not for tests in a typed
  codebase. See docs/opencode.md.
• Front desk session rotation. The daemon's front desk ends its session past
  desk.rotate_tokens (default 150000) or desk.rotate_cost, and starts the next
  seeded with a summary Shepherd builds from its own records (desk.summary_model,
  desk.summary_chars, desk.summary_turns). What each tool returns to the desk is
  capped at desk.tool_output_chars (default 4000). A desk_rotated item appears in the
  feed. See docs/desk.md.
• A daemon on another machine. A named host in ~/.shepherd/hosts.yaml is reached
  over an SSH tunnel with --host NAME (or SHEPHERD_HOST), with --workspace and
  --repo to choose what to act on; shepherd host list and host check list and
  test the hosts. The daemon stays loopback-only.
• Chat conveniences. Links in shepherd chat are clickable OSC 8 hyperlinks
  (chat.hyperlinks, also in Settings), and !command runs a shell command in the chat
  client, never by the front desk.
• A minimum git. The daemon refuses to start on git older than 2.31 and says so, and
  CI runs the tests on Ubuntu 22.04 (git 2.34).
• OpenCode provider timeouts. opencode.request_timeout (default 60 minutes, at
  least 1 minute, or off) and opencode.chunk_timeout (default 10 minutes, at least
  10 seconds) set the per-request and stream-chunk limits Shepherd writes when
  opencode.endpoint is set. These defaults raise the previous hard-coded 15 minute
  request limit and 2 minute chunk limit. off disables the request limit. The chunk
  limit cannot be turned off. See docs/opencode.md.
• Scoped tokens. Besides the operator token in daemon.json, the daemon mints a
  worker token for each agent run, passed to the agent as SHEPHERD_TOKEN with the API
  address in SHEPHERD_URL, and revoked when the run ends or the daemon restarts. A
  worker token may only report, ask the person, ask another lane, reserve and release
  its own lane's tags, read its own run and run the pre-push check. A desk role, for a
  front desk the daemon runs, gets the operator tools but may answer a decision only in
  a turn the person started. See docs/design.md §3.17.
• The front desk in the daemon. The daemon runs a front desk of its own, one
  conversation per workspace kept in the store, that clients follow instead of starting
  their own: POST /v1/desk/turn, GET /v1/desk/stream (server-sent events, resumable
  by sequence number), GET /v1/desk/history, GET /v1/desk/status,
  POST /v1/desk/interrupt and POST /v1/desk/new. Swarm events wake it on its own
  as the new desk.wake setting says (attached, the default, always or never),
  as one digest when nobody was attached. A turn it takes on its own cannot answer a
  decision. Each turn's own cost is recorded as desk spend. shepherd chat keeps its
  own desk for now. See docs/design.md §3.18.
• A feed stream. GET /v1/feed/stream sends the feed as server-sent events, each
  item with its event kind, resumable by id or Last-Event-ID, with a heartbeat every
  15 seconds and a limit on subscribers. GET /v1/feed is unchanged.
• The web UI, served by the daemon. The binary embeds the build of web/ and the
  daemon serves it at its own address; make build builds it first when Node is
  installed, and a binary built without it serves a page saying how to. shepherd web
  signs a browser in: it asks the daemon for a link that works once, for a minute, and
  opens it (--print prints it instead; --sign-out-all ends every browser session).
  Opening the link sets a session cookie (HttpOnly, SameSite=Strict, for /v1 only,
  12 hours, kept in the store so a daemon restart does not sign you out), so the
  browser never sees the operator token.
  A browser session has a new web role: the front desk's routes, the front desk
  conversation and answering decisions, but not the daemon's setup or minting links.
  Remote use is an SSH tunnel to the daemon's loopback port. See web/README.md.
• A Work section on the project page. Each repo may keep docs/WORK.md: a ## Work
  heading and one table with the columns ID | Area | Item | Status | Lane | PR | Notes.
  The daemon reads it from the repo's base branch as of the last fetch (origin/<base>,
  not the working tree), caches it by blob hash, and serves it at
  GET /v1/projects/{name}/work (and GET /v1/unassigned/work). The web UI groups the
  rows by status, links each to its lane and PR or MR, and flags drift: an open lane no
  row names, a doing row whose lane is closed or unknown, and a repo with no file.
  Rows the parser cannot read are reported as warnings. See docs/work-matrix.md.
• A model policy in config.yaml (per-agent catalogue with use-for notes, default
  model and effort, project and repo deny and allow rules, shown by shepherd models and
  the models_list tool) and a per-run effort for lane run, run continue, lane_run
  and run_continue; the front desk chooses model and effort from the permitted list.
• An install script (bin/install.sh), docs/INSTALL.md with per-OS steps, and a
  release workflow that pins Node 22 and refuses to publish without the embedded web UI
  or any of the six archives.

Interface changes

• New endpoints for projects (GET /v1/projects, GET /v1/projects/{name}, GET /v1/unassigned, a brief's draft and approve routes), config (GET/PUT /v1/config
  and POST /v1/config/preview), history (GET /v1/history/lanes and
  /v1/history/runs), `G...