Skip to content

Release v0.10.0-nightly.260719.c2a2768a9

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jul 06:59
v0.10.0-nightly.260719.c2a2768a9
c2a2768

Release v0.10.0-nightly.260719.c2a2768a9

Installation

Install or upgrade LLxprt Code using npm:

npm install -g @vybestack/llxprt-code

Or use directly with npx:

npx @vybestack/llxprt-code

What's New

  • Bun runtime migration: The CLI now runs directly on TypeScript source via Bun, removing the esbuild bundling step for faster startup and simpler development workflows.

  • New model support: Added GPT-5.6 Sol, Terra, and Luna; Claude Sonnet 5; Claude Fable 5 with user-visible refusal notices; Claude Opus 4.8 as the new Anthropic default; and expanded GLM catalog with a 200K token limit.

  • New providers: Added LiteLLM provider and Ollama Cloud/Makora aliases.

  • Provider authentication changes: Removed discontinued Qwen OAuth (now API-key-only) and deprecated Gemini Code Assist OAuth login; Gemini auth now routes through API key or Vertex. Require explicit provider selection at startup to prevent accidental usage.

  • Configuration on XDG paths: Migrated configuration and storage to platform-standard XDG directories.

  • Skills system: Introduced comprehensive agent skills with /skills reload, CLI management commands, extension support, status bar integration, and autonomous activation.

  • Hooks system: Added tool input modification, STOP_EXECUTION/block control in model hooks, mcp_context for BeforeTool/AfterTool events, and enable-all/disable-all commands.

  • Policy engine: Added granular shell allowlisting with legacy deprecation and unified shell security.

  • Extensions: Added install/uninstall commands, update notifications, and settings info.

  • MCP improvements: Made MCP server discovery non-blocking at startup and non-fatal; fixed MCP discovery dropping input during startup.

  • Tool changes: Removed google_web_search and google_web_fetch tools. Made search_file_content respect gitignore and llxprtignore configuration.

  • UI improvements: Profile-qualified model identity now appears in status bar, diagnostics, and response headers. Accumulated subagent streaming text instead of replacing per-token. Added security warnings for project-level hooks. Optimized text buffer for large inputs.

  • Keyboard and terminal: Added OSC-52 clipboard support for Windows Terminal, fixed home/end keybinding conflict, unified shell confirmation dialogs, added Esc-Esc to clear prompt, and restored checkmark indicators.

  • New commands: Added /introspect slash command, /chat debug command for nightly builds, and export chat history via /bug with GitHub issue prefill.

  • Removed experimental UI: Deprecated and removed OpenTUI experimental UI.

  • Chat and streaming fixes: Fixed --continue rendering one token per line. Fixed subagent streaming text display. Fixed whitespace-only stream deltas. Fixed stream idle timeout races, deadlocks, and Kimi tool call ID collisions. Removed Kimi K2 special buffering that caused Fireworks hangs. Stopped invalid stream fallthrough retries. Fixed Anthropic stopReason-only delta preservation.

  • Windows support: Fixed shell guidance for quoted paths, CJK input preservation, Windows ripgrep results, PTY crash on terminal exit, storage EINVAL errors, and /dev/tty access crashes.

  • Subagent fixes: Fixed parallel tool call cancellation causing hangs. Fixed ESC and error-on-cancel not cancelling subagents. Fixed Ctrl-C hard abort in non-interactive mode. Fixed subagent wizard invocation crash. Raised unconfigured subagent turn fallback to 1000.

  • Compression fixes: Fixed masked empty-summary errors aborting turns. Fixed compression preflight guard attempting compression before bailing. Fixed extraction safety instead of throwing. Fixed hard-limit compression fallback with diagnostics. Added 0.5% context-limit fudge factor. Preserved last user prompt during middle-out compression.

  • Context and history: Fixed context overflow preflight after model switch. Fixed load-balancer context accounting. Fixed context-limit not applied on first profile load. Fixed stale context limit after profile load. Fixed carried history loss across rebuilds. Fixed restored history folding into reused HistoryService.

  • Provider fixes: Fixed OpenAI tool format overrides. Fixed provider-aware rate limit messages. Fixed reasoning IDs and field name support for classic OpenAI provider. Fixed currentProfile preservation across provider switches. Fixed OAuth eligibility gating by base URL for third-party gateways. Restored OAuth system prompt in Anthropic provider. Fixed token cache invalidation on 401/403 revocation. Enabled bucket failover during compression 401 errors. Fixed auth cache invalidation for unbucketed profiles. Preserved Linux auth fallback paths.

  • Load balancer fixes: Fixed exhausted failover rotation reset. Fixed 429 aggregate retry preventing fatal drops to prompt. Fixed profile auth isolation. Fixed cross-provider ephemeral leak in mixed load balancers. Fixed shared-reference token fallback accounting. Fixed active provider restoration after fromConfig(). Fixed LB model identity.

  • Hooks and settings: Fixed ANSI escape code leakage in skill consent prompts. Fixed deep merge of hooksConfig/hooks settings across scopes. Fixed OAuth dialog showing prompts for wrong provider. Fixed initial prompt gating on startup guards. Fixed empty allowedFunctionNames in BeforeToolSelectionHook. Fixed systemMessage threading through hook stop/block events with action-required indicator.

  • Tool fixes: Fixed MCP tool lookup in tool registry. Fixed disabled tools filtering instead of throwing runtime error. Fixed sanitized tool descriptions for failures. Enforced BeforeToolSelection hook tool restrictions at runtime.

  • Security fixes: Enforced GenAI enclave boundary. Hardened subagent review follow-ups. Hardened sibling encrypted file stores with machine-secret KDF. Preserved fail-open-on-fault contract in envelope decrypt. Added disk-read on lock timeout to prevent cross-process token replay. Hardened secure-store fallback encryption. Removed flash fallback message from quota error responses.

  • Other fixes: Fixed todopause not actually pausing todo reminders. Fixed prompt-interactive scheduler readiness. Fixed profile switch stalls after failed turns. Added retry for Anthropic internal server errors instead of breaking. Disabled google_web_search by default. Fixed cross-model thinking block signature errors on model switch. Surface Claude Fable 5 classifier refusals as notices. Preserved keyfile profile auth in interactive startup. Preserved provider quota errors across retry timeouts. Fixed git-commit info loading on fresh checkout. Converted media blocks to text placeholders during compression. Fixed URL-backed PDF handling. Fixed apply_patch directory-qualified header validation. Fixed home path redaction in assignment-style tokens. Fixed JSON truncation and tab handling in export.

All Changes

  • Consolidate release guard regression coverage (Fixes #2597) (c2a2768)
  • Preserve whitespace-only subagent stream deltas (Fixes #2555) (#2591) (a1dd642)
  • Use Bun-native development launcher (Fixes #2342) (#2594) (e3004a8)
  • Keep guard tests responsive during release checks (Fixes #2584) (#2593) (2b418c1)
  • Honor manual versions for nightly releases (Fixes #2589) (#2592) (cf296c4)
  • Require explicit provider selection at startup (Fixes #2481) (#2583) (0d82e78)
  • Harden subagent review follow-ups (Fixes #2472) (#2582) (8390626)
  • Add Bun/Vitest compatibility shim for bun test runner (Fixes #2475) (#2484) (91e7462)
  • Enforce the GenAI enclave boundary (Fixes #2352) (#2546) (2496e89)
  • Preserve provider quota errors across retry timeouts (Fixes #2559) (#2568) (11328eb)
  • Finish provider-neutral Gemini cleanup (#2573) (#2574) (30de44a)
  • Merge pull request #2570 from vybestack/issue2537 (2056a55)
  • Remove inherited Gemini names from neutral APIs (#2537) (f10865f)
  • Raise unconfigured subagent turn fallback to 1000 (Fixes #2541) (#2566) (c0c27e8)
  • Lower DEFAULT_TOKEN_LIMIT to 200K, add GLM catalog, consolidate resolution (Fixes #2527) (#2565) (62a89dc)
  • good memory (c7b1b78)
  • test: isolate all package tests from real user storage (fixes #2528) (#2545) (d7e6cb0)
  • Keep Codex provider identity coherent during startup (Fixes #2544) (#2561) (bf4beab)
  • Fix restored chat rendering one token per line with --continue (Fixes #2549) (#2558) (6a34605)
  • Merge pull request #2543 from vybestack/issue5228 (a521510)
  • Merge remote-tracking branch 'origin/main' into issue5228 (ac29484)
  • Keep PowerShell parameter checks field-specific (7f38bc7)
  • Make PowerShell schema tests wording-independent (d165445)
  • Fix Windows shell guidance for quoted paths (#2538) (d3eefc8)
  • fix: preserve CJK input and Windows ripgrep results (#2539) (0820185)
  • Fix Windows shell guidance for quoted paths (fdd9502)
  • Remove GenAI SDK coupling from leaf packages (Fixes #2351) (#2520) (646bac9)
  • Make MCP discovery non-fatal and stop dropping input during startup (Fixes #2516) (#2521) (4cfe82b)
  • Thin the CLI entry chain: runtime assembly behind createAgent, kill deep imports, shrink core import surface (Fixes #2378) (#2493) (c3ec9d3)
  • refactor(providers): unify OpenAI schema converter and preserve dropped JSON-schema keywords (Fixes #2508) (#2514) (b475247)
  • Make startup migration and profile loading resilient (Fixes #2476, Fixes #2477) (#2504) (07c96ca)
  • Merge pull request #2515 from vybestack/issue2509 (e1a8c29)
  • Merge pull request #2513 from vybestack/issue2505 (21cb698)
  • Normalize core memory test paths (#2509) (049f779)
  • Merge pull request #2440 from vybestack/issue2349 (d4d8837)
  • Fix cross-platform test expectations (#2509) (b3576c8)
  • fix: preserve valid Responses reasoning IDs (#2349) (056a7ae)
  • fix(providers): trim reasoning field name and make resolveReasoningValue return undefined when unusable (f7a1043)
  • Fix Windows test portability (#2509) (5b0a3ea)
  • test(providers): use fixed timestamp in streaming test chunks (5cd89e2)
  • fix(providers): add reasoning.fieldName support to classic openai provider (Fixes #2505) (6c68c98)
  • Merge remote-tracking branch 'origin/main' into issue2349 (d74b84f)
  • Merge remote-tracking branch 'origin/main' into issue2349 (1a2e0c1)
  • Merge pull request #2507 from vybestack/issue2501 (e47e14a)
  • Merge pull request #2503 from vybestack/issue2500 (f70c49d)
  • test: align retry assertions with neutral content (#2349) (38a0028)
  • fix: preserve neutral retry and AFC history semantics (#2349) (e000e61)
  • test(agents): assert exact restored turn in ChatSessionFactory #2500 fold test (5e7ff49)
  • fix(providers): preserve currentProfile across provider switches (Fixes #2501) (b8192a7)
  • fix(core): preserve carried history across rebuilds when client not yet initialized (#2500) (dc1adcf)
  • fix(agents): fold restored history into reused empty HistoryService (Fixes #2500) (b36150d)
  • fix(ui): show effective model in profile-qualified response header (Fixes #2501) (de9f5f0)
  • Merge remote-tracking branch 'origin/main' into issue2349 (27cbc7b)
  • fix: harden neutral message boundaries after review (#2349) (d3d63da)
  • Reset exhausted load-balancer failover rotations (Fixes #2492) (#2495) (0c99622)
  • Add GPT-5.6 Sol, Terra, and Luna support (Fixes #2483) (#2497) (63b8855)
  • feat(providers): support configurable reasoning field name for Ollama streaming (Fixes #2488) (#2491) (ddff241)
  • fix(ui): accumulate subagent streaming text instead of replacing each token (Fixes #2008) (#2486) (ec14820)
  • Eliminate inverted core→tools dependency and barrel over-import chain (Fixes #2417) (#2473) (a4e7175)
  • feat(test): add Bun-backed root test orchestration entry point (Fixes #2463) (#2470) (ae7633d)
  • fix(launcher): add self-exit guards to prevent orphaned shim processes on terminal/PTY death (Fixes #2468) (#2474) (4fca1a4)
  • Fail loudly on unavailable profile provider; never save LB runtime as a standard profile (Fixes #2479, Fixes #2478) (#2480) (2d97afd)
  • fix: exclude prototype keys from executor template property test (#2349) (f1f5eab)
  • fix: expose placeholder model through core root (#2349) (2fbd53a)
  • Isolate tmux harness from nested sessions (#2471) (87e133d)
  • merge main into issue2349 and resolve neutral conflicts (cdf3c33)
  • fix(agents): activate subagent providers via isolated runtime, restore LB failover, guard Null message (Fixes #2410) (#2415) (e0a0ee8)
  • fix: keep empty merged content as human speaker (#2349) (12eb3ab)
  • fix: preserve hook telemetry metadata (#2349) (4ca3fcf)
  • fix: harden stream telemetry and validation paths (#2349) (a9deb44)
  • fix: address additional OCR migration findings (#2349) (3bd1558)
  • fix: address CodeRabbit migration comments (#2349) (6395d50)
  • fix: address neutral migration review findings (#2349) (1322381)
  • fix(agents): convert legacy Part-shaped arrays in toPartListUnion (#2349) (ec3e3ee)
  • fix: remove unnecessary type assertion in boundaryRecovery test (#2349) (913de60)
  • fix: remove @google/genai import from issue2410 test (#2349) (32cef38)
  • fix: normalize additionalContext injection to ContentBlock[] (#2349) (facc294)
  • fix(hooks): convert hook-modified contents back to IContent via toIContents (38ea315)
  • fix(format): prettier fix on auto-fixed test file (894ac54)
  • fix(post-rebase): resolve type errors from main merge (ba7a7d5)
  • fix(lockfiles): remove @google/genai from agents workspace in lockfiles (cc9f7a4)
  • fix(core): update tests for neutral IContent/ContentBlock shapes (49b2a3e)
  • fix(tests): update assertions for neutral ContentBlock shapes (22157f0)
  • fix(cli): extract isIContentLike to reduce expression complexity (67c504f)
  • fix(cli): null-check req in loopTestHelpers for strict tsc (5c6d238)
  • fix(cli): merge duplicate imports to fix lint:ci --max-warnings 0 (4ad1022)
  • fix(cli): extract loopTestHelpers to fix max-lines lint (e704101)
  • fix(cli): accept unknown in addPartToResult for AgentRequestInput (19f9097)
  • fix(agents): fix formatting + extract modelInfoHelpers for max-lines (4ad131b)
  • fix(agents): address OCR findings + CI lint failures (7ad898b)
  • fix(agents): correct ToolGroupArray typing for ChatSessionConfig.tools (03e0edc)
  • fix(cli): use public root import for CheckpointContent (fixes CI lint boundary) (d4f7c23)
  • fix(agents): P33 fix tool group wrapping for provider compatibility (bd3f10f)
  • feat(agents): P32 remove @google/genai dependency from agents package.json (d343631)
  • feat(agents): P29-P31 enforcement gate — anti-#2424 CI wiring + test gate (fe79d9e)
  • feat(agents): P28 test migration — zero @google/genai imports in agents tests (5875e95)
  • feat(agents): P27 remaining group retype — ZERO prod @google/genai imports (9507c47)
  • feat(agents): P26 remaining group characterization TDD (ff0a0fa)
  • feat(agents): P25 executor retype + DELETE streamChunkWrapper.ts/providerStopReason.ts (0737ab9)
  • feat(agents): P24 executor slice characterization TDD — 14 tests pinning observable executor behavior (4a9bcec)
  • feat(agents): P23 subagent retypes — all @google/genai imports removed from subagent*.ts (1439a8c)
  • feat(agents): P22 subagent slice characterization TDD (30e161f)
  • feat(agents): P21 cross-package clientContract flip to neutral IContent[] (23d723a)
  • feat(agents): P20 clientContract characterization tests (9df0f55)
  • feat(agents): P18-P19 usage-metadata boundary mapper + telemetry neutralization (f43536c)
  • feat(agents): P16-P17 runtime enum replacements + googlePartHelpers neutralization (6569ef9)
  • feat(agents): P14-P15 structural-access migration — ContentBlock[] reimpl, isValidResponse deleted (3aee3d9)
  • fix: address CodeRabbit findings — uncaught exceptions, String(message) fallback, malformed JSDoc (6b885f5)
  • fix: resolve lint errors in agentMessageInput, characterization tests (9fa57a5)
  • fix: use barrel export for llm-types to fix import-boundary guard + Node consumer smoke (de01e8a)
  • fix: address OCR review findings — forward reasoningTokens, consolidate imports, use getResponseTextFromBlocks, fix test names (b4ea353)
  • fix: prettier formatting for P13 files (e17131d)
  • feat(agents): P13 DirectMessageProcessor neutralization — sendMessage→ModelOutput, delete synthetic fabricators (Fixes #2349) (b1c1eb0)
  • feat(agents): P12 direct-message characterization tests (5ed2c12)
  • feat(agents): neutralize hookToolRestrictions and add legacy compat bridge (P10-P11) (aed9b68)
  • fix(agents): use Mock type in characterization helpers (P09 lint fix) (78f6d07)
  • fix(agents): lint fixes — extract validation helpers, fix unnecessary conditions (P09) (6f2e789)
  • feat(agents): neutralize MessageConverter survivors + callers to IContent (P09) (674467b)
  • feat(agents): neutralize turn.ts and TurnProcessor streaming path (P07-P08) (205b0e5)
  • feat(agents): add neutral gap types, AST gate skeleton, and mutation tooling for #2349 migration (f62366e)
  • fix(providers): make LB failover aggregate retryable so all-429 doesn't fatally drop to prompt (Fixes #2450) (#2460) (13e7a49)
  • Add memory: do not merge PRs without explicit user confirmation (e0877b6)
  • Make MCP server discovery non-blocking at startup (Fixes #2325) (#2451) (aa0404c)
  • refactor(tools): permanently remove google_web_search and google_web_fetch tools (Fixes #2443) (#2447) (52ed3f4)
  • Cancel obsolete PR workflow runs (Fixes #2445) (#2448) (7eb9800)
  • fix(agents): forward subagent systemInstruction to all providers, gate cache_control for z.ai, harden empty content blocks (#2439) (8933611)
  • ci(ocr-review): preflight LLM connectivity diagnostics (Fixes #2442) (#2444) (5da645c)
  • fix(providers): use a Windows named pipe for the credential proxy transport (Fixes #2403) (#2441) (4e3cf6b)
  • ci(ocr-review): make OCR infrastructure failures non-blocking (#2438) (4936450)
  • fix(cli): load git-commit info resiliently so a fresh checkout can't crash startup (Fixes #2435) (#2437) (2faa01c)
  • Make ast-grep native init lazy; cut barrel coupling (Fixes #2399) (#2407) (fa7d9eb)
  • Revise .llxprt/LLXPRT.md with new instructions (a738410)
  • fix(anthropic): gate OAuth eligibility by base URL so third-party gateways never trigger Anthropic OAuth (Fixes #2411) (#2430) (73fdff9)
  • remove mistakenly included agent train of thoughts (be25d6b)
  • Minimal Node launcher: exec Bun directly, keychain-direct in non-sandbox, proxy only in sandbox (Fixes #2419) (#2426) (b9424e3)
  • Add test review helper script (5fcd1f0)
  • ci(ocr-review): exclude deleted test files from the scope guard (#2427) (29ccdb2)
  • Migrate core ContentConverters off Google genai types (Fixes #2397) (#2416) (5b7c566)
  • Add standalone ocr-review.yml workflow (Fixes #2413) (#2420) (099a5d0)
  • fix(ci): pin Node 24 in smoke-test workflow to match lockfile npm version (Fixes #2418) (#2421) (2cdad39)
  • Remove deprecated Gemini Code Assist OAuth login; route Gemini auth through API key + Vertex (Fixes #2398) (#2409) (c93031b)
  • fix(compression): preflight guard attempts compression before bailing (Fixes #2402) (#2405) (38fffc9)
  • Migrate CLI off @google/genai to neutral contract types (Fixes #2350) (#2401) (bb17c81)
  • chore(github): stop creating/applying phantom bug and triage labels in CI and templates (#2404) (113b2d5)
  • chore(coderabbit): disable automatic issue labeling (#2400) (8833ddc)
  • Clean up project memories: remove transient/outdated entries, update to bun (a87f5ee)
  • Migrate core off direct Google genai imports (Fixes #2348) (#2391) (ef0de98)
  • Drive provider activation and auth through agent config, not CLI orchestration (Fixes #2374) (#2390) (0d32733)
  • Cap incremental reviews at 3 per PR instead of disabling them (#2396) (6acf50f)
  • Expose tool listing/discovery via the Agent API; remove UI access to ToolRegistry/scheduler internals (Fixes #2376) (#2388) (da25522)
  • fix(release): make build:packages generate its own prerequisites (Fixes #2392) (#2395) (c98c77e)
  • Feat/add litellm provider (#2394) (124a100)
  • Remove Config migration bridge from CLI UI, introduce focused CliUiRuntime boundaries (Fixes #2373) (#2384) (78541eb)
  • Proxy credentials for no-compile Bun launcher (Fixes #2369) (#2380) (6bb3aaa)
  • Port Zed integration onto Agent API; delete hand-rolled chat loop (Fixes #2375) (#2385) (8ec4911)
  • Bound first model response and fix load-balancer model identity (Fixes #2379) (#2383) (ce7095a)
  • Interactive CLI consumes agent.stream() instead of assembling the agentic loop (Fixes #2372) (#2382) (eb53ed1)
  • Foundation: neutral LLM type layer anchored on IContent (Fixes #2347) (#2381) (274e9e9)
  • Replace fs.watch with fs.watchFile for branch name polling (Fixes #2370) (#2377) (cde58fa)
  • Remove stale Bun startup build check (#2371) (b29b83a)
  • Rename CLI geminiStream hook tree, Gemini-named UI components, and zed GeminiAgent (Fixes #2345) (#2353) (8eb1892)
  • Add CodeRabbit configuration to reduce review rate-limit hits (#2363) (f78597d)
  • Rename Gemini-named stream/event/request types in core to provider-agnostic names (Fixes #2344) (#2354) (33b9320)
  • Fix nightly release preflight: build before lint:ci for type-aware ESLint (Fixes #2339) (#2367) (6af56f8)
  • docs: Update documentation for Bun runtime migration (Fixes #2245) (#2311) (fe78389)
  • Rename GeminiCLIExtension and sweep residual Gemini-named config/infra constants (Fixes #2346) (#2355) (8e3e3ac)
  • Surface Claude Fable 5 classifier refusals as a user-visible notice (Fixes #2329) (#2341) (a2ee3e1)
  • Preserve keyfile profile auth in interactive startup (Fixes #2364) (#2365) (532047c)
  • Migrate active scripts to Bun TypeScript (Fixes #2242) (#2336) (c9227ac)
  • security: resolve open Dependabot alerts (uuid, js-yaml) and dismiss CodeQL clear-text-logging false positives (Fixes #2340) (#2338) (65df749)
  • Make runtime identity explicit and deterministic (Fixes #2300) (#2313) (aad9bd7)
  • Drop cross-model thinking blocks to fix 400 'Invalid signature in thinking block' on model switch (Fixes #2335) (#2337) (80939f3)
  • No-compile npm runtime: checked-in launcher runs Bun on TS source (Fixes #2243) (#2305) (6efdd87)
  • fix(compression): stop masked empty-summary errors from aborting turns (Fixes #2333) (#2334) (51622a4)
  • Fix release preflight API surface setup (Fixes #2323) (#2330) (9741379)
  • Add claude-fable-5 to the Anthropic OAuth (Claude Code) model list (Fixes #2328) (#2331) (88ea7d4)
  • Eliminate extraction heuristics for hook-modified contents: differential boundary recovery + hook API extension (Fixes #2306) (#2332) (bbd3511)
  • remove broken ocderabbit button (4c173e0)
  • Retire bundle/llxprt.js from CI, release, and test harness (Fixes #2314) (#2315) (cf57a66)
  • Upgrade CI workflows and runtime baseline to Node 24 (Fixes #2316) (#2318) (1164737)
  • Adds agents API-surface depollution, CLI import-boundary guard, runtime factory single-source migration, and CLI session module split (Fixes #2285) (#2317) (f4f2d08)
  • Merge pull request #2319 from vybestack/issue2312 (5ff574d)
  • Thread MessageBus through TaskTool subagents (d3d43ea)
  • Merge pull request #2309 from vybestack/issue2286 (921ff67)
  • Merge pull request #2303 from vybestack/issue2244 (099a452)
  • Merge pull request #2310 from vybestack/issue2304 (a81ff1c)
  • Polish independent ignore filtering coverage (7b6ce1f)
  • fix(cli): use writeToStderr not console.error for telemetry shutdown warning (Part of #2244) (5d14a7f)
  • refactor: remove dead code — buildRequestContents wrapper and buildProviderContentEnvelope helper (533d016)
  • Merge remote-tracking branch 'origin/main' into issue2244 (6e6d295)
  • Bun migration S4: Stop run-path compilation & retire esbuild, keep tsc --noEmit (Fixes #2241) (2c37965)
  • Merge origin/main into issue2241 (resolves conflicts) (3c3682d)
  • fix(cli): harden telemetry cleanup + launcher signal forwarding (Part of #2244) (6df064e)
  • Merge remote-tracking branch 'origin/main' into issue2241 (fa35674)
  • ci(release): thread release version/tag through env, not inline expansion (Part of #2244) (9d13c3a)
  • ci(release): attach CLI source tarball instead of bundle/llxprt.js to GitHub Release (Part of #2244) (04ef96b)
  • fix(compression): use reference equality for hook detection, not blanket hook-enabled check (a1ea083)
  • Merge issue2243 (S6: CI Bun smoke job, Node consumer smoke) into issue2244 (S7) (f60f997)
  • Merge issue2241 (S4: retire esbuild, run CLI from TS via Bun) into issue2244 (S7) (29eef0b)
  • Exclude test helpers from tools build (11f0eb9)
  • Merge pull request #2290 from vybestack/issue2240 (be0c0e5)
  • refactor(compression): thread pending-content boundary via ProviderContentEnvelope (Fixes #2304) (979d8d3)
  • Address CodeRabbit: make a2a-server build failure fatal; resolve WASM via require.resolve (Fixes #2241) (7e4064c)
  • ci: add Node consumer smoke job, document Bun CI blockers (S6, part of #2243) (32a1755)
  • Fix independent llxprtignore filtering (Fixes #2286) (8015fb6)
  • Fix package-lock.json: regenerate with npm 10.x to match CI (Fixes #2241) (6c12e06)
  • Retire esbuild bundling; run CLI from TS via Bun (Fixes #2241) (5d723e9)
  • fix(docker): scope pipefail to Bun install, restore default SHELL after (Part of #2244) (33bef63)
  • Merge remote-tracking branch 'origin/issue2240' into issue2244 (c063bab)
  • Merge remote-tracking branch 'origin/issue2240' into issue2241 (91e82fa)
  • Merge pull request #2302 from vybestack/issue2299 (236a6a2)
  • Address CLI output review feedback (Fixes #2240) (913f8fd)
  • fix(docker): add pipefail SHELL + trim .bun-version under Bun install (a9cf145)
  • ci(release): pin Bun via .bun-version across release + sandbox image (Part of #2244) (c2ef94e)
  • Merge pull request #2292 from vybestack/issue2289 (e50ab47)
  • Merge pull request #2295 from vybestack/issue2239 (35f4bd9)
  • Merge pull request #2298 from vybestack/issue2287 (1a1b91a)
  • Fix mocked app event fallback (Fixes #2240) (8663bb6)
  • Fix Bun JSON output startup path (Fixes #2240) (7940dfd)
  • refactor(core): extract wireExitHandler to satisfy max-lines-per-function (5d1ac1f)
  • refactor(core): backend-aware PTY kill, debug logging, dead code removal (e215095)
  • fix(compression): attempt compression when extraction is unsafe instead of throwing (Fixes #2299) (f7c36e8)
  • Merge pull request #2284 from vybestack/issue2282 (a9ccb60)
  • Add deprecated getLatestClaude4Model alias, update plan doc + CHANGELOG (#2289) (14b091f)
  • Merge pull request #2293 from vybestack/issue2291 (15f81ef)
  • Fix claude-sonnet-5-latest and dated-snapshot token limits, route token fns through isSonnet5 (#2289) (e09ef0c)
  • Fix todo_pause continuation break (Fixes #2287) (0f66188)
  • fix: address CodeRabbit findings in decomposed guard modules (#2282) (d34bbc4)
  • refactor(core): remove silent-hang watchdog, fix inactivity resolution gap (d3d0897)
  • test(oauth): assert post-refresh ON state in toggle test (6cb295d)
  • fix(oauth): refresh auth status after toggle, fix error interpolation, eliminate dead I/O (b9399bf)
  • Set Anthropic default model to Claude Opus 4.8 (Fixes #2289) (8296bce)
  • Merge pull request #2257 from vybestack/issue2184 (b3dc06b)
  • Classify Bun install script trust (Fixes #2240) (70580a7)
  • fix: address CodeRabbit findings in telemetry/version scripts (#2282) (1554244)
  • Fix E2E bundle freshness (Fixes #2240) (e6af408)
  • Fail closed on ambiguous canonical registry matches (501460e)
  • feat(core): add Bun.Terminal PTY adapter, runtime detection, and shell hardening for Bun POSIX (Fixes #2239) (882a946)
  • Merge remote-tracking branch 'origin/main' into issue2240 (76d9c31)
  • Fix alias asymmetry, governance tests, and OCR findings (Fixes #2184) (85c6ad2)
  • Decompose check-eslint-guard.js to eliminate structural carve-out (#2282) (ad83866)
  • fix(oauth): register providers on all OAuthManager creation paths and normalize case (Fixes #2291) (d69eced)
  • Fix Node 20 E2E bundle parse (Fixes #2240) (09a9a16)
  • refactor: simplify isSonnet5 to drop redundant latest-alias check (Fixes #2289) (ab0615b)
  • Stabilize approval UI smoke wait (Fixes #2240) (b507485)
  • Remove out-of-scope profile test change (2e31bc4)
  • fix: prettier formatting in AnthropicModelData Sonnet 5 test (Fixes #2289) (698973b)
  • Fix Bun install smoke prepare script (Fixes #2240) (3bd4bb5)
  • Add Claude Sonnet 5 (claude-sonnet-5) to the model menu (Fixes #2289) (78c48c1)
  • Centralize subagent excluded tool governance (888b86e)
  • Address launcher review feedback (Fixes #2240) (5e596aa)
  • Sync Bun install metadata for CI (Fixes #2240) (edbacad)
  • Add Bun relaunch support for CLI runtime (Fixes #2240) (bb4360a)
  • Address CodeRabbit: fix guard empty-result fallback; strengthen test (#2282) (7cf5ef5)
  • Tighten qualified tool governance follow-up (d225a2f)
  • Fix lint violations in cli-import-boundary (merged from #2265) (#2282) (5e8d046)
  • Merge remote-tracking branch 'origin/main' into issue2282 (8a0a4be)
  • Fix coverage test timeout on slow CI runners (#2282) (9667cdd)
  • Merge pull request #2265 from vybestack/issue2204 (e49a940)
  • Make eslint-guard respect gitignored dirs; harden review findings (#2282) (5d37a29)
  • Merge pull request #2281 from vybestack/issue2275 (8a2fe78)
  • Merge pull request #2277 from vybestack/issue2273 (b2f727c)
  • Merge pull request #2283 from vybestack/issue2271 (57bdbd4)
  • Apply strict code-quality lint rules to scripts tree (Fixes #2282) (f7715ca)
  • Merge remote-tracking branch 'origin/main' into issue2184 (cb63a32)
  • Tighten qualified subagent tool governance (0c4f8da)
  • refactor(auth): remove stale Qwen OAuth test scaffolding (d4d79f2)
  • Update Codex model lists (Fixes #2271) (b1b3af4)
  • Enforce CLI runtime public API boundary (#2204) (f9f5acf)
  • Merge pull request #2260 from vybestack/issue2238 (dee17b7)
  • fix(test): stabilize flaky DebugLogger zero-overhead perf test on CI (Fixes #2275) (4bd0513)
  • Strip comments before scanning for relative deps in tarball walker (Fixes #2238) (766baf4)
  • test(providers,docs): strengthen Qwen-removal assertions per review (0c7146f)
  • Merge pull request #2276 from vybestack/issue2272 (ff04cca)
  • test(providers): cover qwen DashScope base-url resolution on provider switch (cf87785)
  • Harden Bun S1 CI/test surface per review (Fixes #2238) (2d80c84)
  • feat: remove discontinued Qwen OAuth provider; Qwen now API-key-only (Fixes #2273) (f41b763)
  • Tighten Codex model fallback tests (Fixes #2272) (fdef999)
  • test(bun): harden S1 verifier and lifecycle tests per code review (b0c707f)
  • Use Codex alias config as model source (Fixes #2272) (4e754ef)
  • Link local workspace source and guard dual-lockfile parity and trust (130afea)
  • Add Bun workspace-install smoke job with a reusable link verifier (171a725)
  • Extract shared detectInstaller helper used by lifecycle scripts (1d4e8d4)
  • Merge pull request #2268 from vybestack/issue2250 (9de8432)
  • Merge pull request #2269 from vybestack/issue2267 (ee734e8)
  • Expose context limit resolver through agent API (ec9d09f)
  • docs: correct latest model versions and retire dead model ids (Fixes #2267) (0515c70)
  • Merge remote-tracking branch 'origin/main' into issue2204 (c08e2e3)
  • Stabilize token mutation property test (cb2b624)
  • Tighten TaskTool public surface tests (Fixes #2250) (7a036d8)
  • Merge pull request #2262 from vybestack/issue2251 (fd9bf22)
  • docs: refresh model/provider/capability docs for 0.10.0 (Fixes #2267) (c7bed89)
  • Merge origin/main into issue2204 (c79ebd5)
  • Address TaskTool public surface review feedback (b02eb83)
  • Merge remote-tracking branch 'origin/main' into issue2250 (6eca710)
  • test(compression): drop redundant LB handler test and redundant assertion (fda3ccb)
  • refactor(context-limit): deduplicate cli/agents resolver; harden LB tests (ad07fa8)
  • Merge pull request #2266 from vybestack/issue2263 (8683285)
  • Address PR review feedback for issue 2204 (8a3a1bd)
  • Merge pull request #2264 from vybestack/issue2259 (e6abdcc)
  • Remove duplicate TaskTool implementation (Fixes #2250) (49f7347)
  • fix(compression): consult provider context limit in preflight guard; add CompressionHandler-level regression test (1bbf90a)
  • fix: guard all shared-state mutations in superseded turns (issue #2259) (2f44c33)
  • feat(ui): extend profile-qualified model identity to response prefix and status fallback (9361634)
  • Merge pull request #2258 from vybestack/issue2246 (1a88e9f)
  • Enforce CLI public Agent boundary (d6505b9)
  • Pin .bun-version test to the exact validated Bun version (d75c3ee)
  • Address CodeRabbit review on PR #2260 (fb0d682)
  • Make root lifecycle scripts Bun-aware and add behavioral coverage (4b53b9a)
  • Test extracted test-utils helpers (6ae90ea)
  • fix: prevent stale turn from clobbering newer turn's isResponding state (Fixes #2259) (809c5ad)
  • fix(lint): keep LoggingProviderWrapper under max-lines after getContextLimit (51bbdad)
  • Preserve fake responses across repeated TestRig setup (99538b7)
  • refactor: drop out-of-scope resolveLoggingConfig change from issue2251 PR (b5441b3)
  • Merge pull request #2223 from vybestack/issue2193 (6e14dea)
  • fix(compression): use load-balancer backend context limit for compaction (Fixes #2251) (050ffbc)
  • Adopt Bun as package and workspace manager (Fixes #2238) (0aaa972)
  • Bring test-utils under lint coverage (0a8e31c)
  • Merge pull request #2247 from vybestack/issue2237 (59026b0)
  • Harden qualified tool whitelist parsing (5e360d6)
  • refactor: address open-code-review findings for LB identity (#2193) (693c06a)
  • Fix qualified subagent tool whitelists (Fixes #2184) (fbdf16b)
  • test: align LB getStats mocks with ExtendedLoadBalancerStats contract (ffdb0af)
  • fix(config): address CodeRabbit review on migration robustness (#2247) (9e2e6cf)
  • Fix post-merge lint: dedup diagnostics import, extract LB config validation (f2b3411)
  • Merge remote-tracking branch 'origin/main' into issue2193 (38e6abe)
  • fix(config): make legacy path migration marker-based so it can't be silently skipped (Fixes #2237) (7cc99c5)
  • Merge pull request #2228 from vybestack/issue2207 (247d6df)
  • Address CodeRabbit: emit LB selection on failover backend attempt (9cbe162)
  • Allow failover after compression callback failure (dd2b48c)
  • Address review: dedicated LB selection event + diagnostics disambiguation (121959a)
  • fix(settings): stop streamIdleTimeoutMs leaking into provider request body (5fcdbb4)
  • Preserve compression threshold after density optimization (49ea393)
  • Clamp provider compression threshold (6e61577)
  • Honor compression threshold for provider payloads (f016052)
  • Merge pull request #2219 from vybestack/issue2199 (a78cffb)
  • Merge pull request #2222 from vybestack/issue2203 (b31d75a)
  • Merge pull request #2230 from vybestack/issue2227 (e4acd88)
  • Align cleanup-scope guard tests with final policy (450d562)
  • Address PR review guardrail findings (2654a19)
  • Enforce repository escape-hatch cleanup policy (Fixes #2227) (9d92b7e)
  • Tighten load-balancer profile guard (da6ca01)
  • Address review feedback for context accounting (a5774ea)
  • Fix ArrayBuffer view cloning for CI (1e588de)
  • Address issue 2207 post-merge review findings (7155638)
  • Address post-merge review findings (2efe2a7)
  • Extract context window enforcement helper (d5abc57)
  • Merge remote-tracking branch 'origin/main' into issue2207 (fa53657)
  • Make footer load-balancer identity reactive to sub-profile selection (Fixes #2193) (3fd44aa)
  • Fix shared-reference token fallback accounting (d5d24d2)
  • test: add getProvider/getModel to FakeAgent interface for type safety (a0a3e01)
  • test: update cliAgentBootstrap tests for provider restoration (32e4803)
  • Address load-balancer accounting review feedback (790b4da)
  • fix: restore active provider after fromConfig() resets it (813de6c)
  • Fix load-balancer context accounting (Fixes #2207) (71808e4)
  • Address CodeRabbit follow-up boundary fixes (7a3886c)
  • fix: address OCR findings — provider validation, compress fallback, hook cleanup (074360d)
  • Address review feedback on API boundary hardening (ec8c3e9)
  • Merge origin/main into issue2203 (b09f216)
  • Merge pull request #2224 from vybestack/issue2202 (9e9054e)
  • Merge pull request #2221 from vybestack/issue2200 (b753487)
  • fix: address CodeRabbit review feedback for #2203 (4230e51)
  • Merge pull request #2226 from vybestack/issue2201 (40882e1)
  • Merge pull request #2220 from vybestack/issue2182 (8fe1456)
  • style: prettier-format commandAgentSurface test config cast line (1425871)
  • fix: TypeScript build error in commandAgentSurface test type assertion (cf4c769)
  • fix: address OCR review findings — contract mismatches, test quality, DRY (b5bd307)
  • Merge pull request #2225 from vybestack/issue2067 (8384c19)
  • fix: consume full Agent stream without returning on per-turn done (Fixes #2202) (e62b9d2)
  • Forward Agent confirmation payloads (d031692)
  • Harden hard-limit compression fallback (Fixes #2067) (da07329)
  • Tighten test coverage and MCP gate diagnostics (Fixes #2202) (aa891fc)
  • refactor: compact COMMAND_API_MAP entries via helper functions (8608bbc)
  • Propagate errorType in raw ToolCallResponseInfo branch (Fixes #2202) (5de965e)
  • Address open code review: remove unsafe casts and dedupe stats types (ec76a92)
  • test(cli): extract shared mock Agent helper and drop redundant disposal test (8ae8074)
  • Harden Agent dispose + dedup max-turns message (Fixes #2202) (111d339)
  • style: apply prettier formatting to renderOptions test and tasksCommand (0374ae5)
  • fix: use generic type param in toPolicyRuleDisplay so argsPattern is accessible (bf1d040)
  • Profile-qualified model identity in status bar and diagnostics (Fixes #2193) (d97f819)
  • Address non-interactive migration review findings (Fixes #2202) (f84b95e)
  • Migrate CLI command surfaces to Agent APIs (Fixes #2203) (468615b)
  • test(cli): strengthen foreground-agent lifecycle coverage (826b31d)
  • feat(cli): introduce Agent at the interactive composition root (fixes #2200) (5bd0ed8)
  • Route non-interactive prompt mode through Agent stream (Fixes #2202) (bb61cec)
  • Use braced variable references in lb-profiles-tmux.sh for shellcheck SC2250 (cf262b2)
  • Fix cross-provider ephemeral leak in mixed load balancers (Fixes #2182) (5e5f118)
  • Stabilize LSP control unavailable-server test (ba8a51c)
  • Merge pull request #2218 from vybestack/issue2189 (f1bb9a2)
  • Align a2a workspace dependency resolution (731fd56)
  • Address API boundary review feedback (8859a89)
  • Fix post-merge workspace resolution (97e92d8)
  • Merge remote-tracking branch 'origin/main' into issue2199 (e498fde)
  • Harden agent runtime API boundary (Fixes #2199) (d5a10da)
  • Harden ESLint policy guard (Fixes #2189) (9137afe)
  • Merge pull request #2217 from vybestack/issue2208 (b765ad8)
  • Merge pull request #2192 from vybestack/issue1465 (6d08d52)
  • Merge pull request #2214 from vybestack/issue2210 (7889fd8)
  • Merge pull request #2215 from vybestack/issue2209 (22174c3)
  • Merge pull request #2216 from vybestack/issue2211 (f18066b)
  • Merge pull request #2213 from vybestack/issue2212 (e18862e)
  • fix: remove duplicated branch causing sonarjs/no-duplicated-branches lint error (fb1b90f)
  • Tighten issue2208 repro validation (d2c4669)
  • fix: address CodeRabbit and OCR review findings (732f848)
  • Preserve streaming newlines in assistant output (Fixes #2208) (03c75db)
  • fix: correct platform-specific test assertions for Linux XDG paths (e71c58e)
  • test: address open-code-review findings on issue2210 (556be23)
  • fix(oauth): route runtime message bus through the setter in constructor (34033a1)
  • test(providers): strengthen behavioral assertions from open-code-review (2034477)
  • refactor(providers): type provider runtime and OAuth manager seams (Fixes #2211) (ba02075)
  • fix: remove leftover settings dependency from tools package (68d26a7)
  • fix: avoid adding settings dependency to tools package (8dfaa04)
  • fix: update package-lock.json for tools→settings dependency (a92975f)
  • Address LSP review findings (fab4265)
  • fix: address OCR review findings for multi-bucket migration (300d6fe)
  • refactor: migrate to XDG-aligned multi-bucket directory structure (b750b02)
  • refactor(providers): remove residual as-unknown-as casts from review (789122f)
  • fix(tools): re-export capability guards from package root barrel (576f373)
  • fix(lint): resolve eslint errors in new test files (ffefa35)
  • Fix LSP unknown bridge boundaries (995d454)
  • fix(modularization): replace internal adapter unknown casts with typed contracts (2b0303c)
  • test(vercel): tighten buildVercelTools assertion to verify tool shape (6b8f504)
  • refactor(providers): eliminate all 27 as-unknown-as type-escape casts (Fixes #2212) (95b247e)
  • fix: address second OCR review pass findings (e68995a)
  • fix: address OCR review findings for path migration (ace4987)
  • Merge pull request #2180 from vybestack/issue1900 (73eed51)
  • Merge origin/main into issue1465 (94fcf3c)
  • Merge pull request #2188 from vybestack/issue2187 (1edcfc9)
  • Merge remote-tracking branch 'origin/main' into issue2187 (bb7c30f)
  • Merge pull request #2206 from vybestack/issue1050 (94e6588)
  • Merge remote-tracking branch 'origin/main' into issue1900 (82fe3bf)
  • Merge pull request #2205 from vybestack/issue2170 (a1f6483)
  • test(settings): strengthen stream idle coverage (Fixes #1900) (71de566)
  • build: make format script honor .prettierignore (Fixes #1050) (bf5735f)
  • fix: address CodeRabbit findings (migration error fallback, path-boundary checks, env restore) (ee46680)
  • test(mcp): guard POSIX-only chmod-failure tests on Windows (73576b5)
  • build: make format script honor .prettierignore (50acaba)
  • test(cli): cover /set timeout settings autocomplete (Fixes #1050) (04347e1)
  • Fix .prettierignore for experimental CLI — add .llxprt/** pattern (5d37299)
  • Clean shared CLI type-escape seams — eliminate as-unknown-as casts (Fixes #2170) (4309266)
  • Merge remote-tracking branch 'origin/main' into issue2187 (e4730cd)
  • fix: address open-code-review findings (empty-string env handling, type-mismatch, test isolation) (ccf9518)
  • fix(security): address open-code-review follow-up on sibling-store hardening (937c045)
  • Add open code review (ocr) gate to issue workflow before push (b436025)
  • Merge pull request #2186 from vybestack/issue1989 (718c8ce)
  • Merge pull request #2190 from vybestack/issue1990 (b2a746c)
  • Merge pull request #2153 from vybestack/issue2114 (3c2356b)
  • Merge pull request #2176 from vybestack/issue1987 (679869d)
  • Merge pull request #2183 from vybestack/issue1988 (74d54e7)
  • Merge pull request #2191 from vybestack/issue2110 (5645d61)
  • fix: remove _lockDir memoization to respect LLXPRT_CONFIG_HOME changes (d4ee183)
  • fix: eliminate all package.json/lock changes to pass CI formatter check (f93ac9d)
  • fix: remove env-paths dep from auth to prevent lock file CI failure (de5a9ae)
  • fix: remove storage workspace dep from tools to avoid lock file CI failure (dddee7f)
  • fix: use npm-generated lock file to resolve CI format mismatch (PR #2192) (1a400eb)
  • fix: address OCR review findings and fix lock file format (PR #2192) (b251a03)
  • fix: address CodeRabbit comments on PR #2192 (a8ee531)
  • fix: reorder workspaces so storage builds before tools (b5c32c3)
  • fix: add new deps to lock file without introducing peer flags (c4f6abc)
  • fix: regenerate package-lock.json to preserve all existing entries (7bc900b)
  • feat: migrate configuration to platform-standard paths (Fixes #1465) (63453ac)
  • fix(security): allow empty legacy ciphertext in tool-key-storage backward-compat read (27cf502)
  • docs(settings): clarify window title status prefixes (Fixes #1900) (b16a2f7)
  • Merge remote-tracking branch 'origin/main' into issue1900 (6f62b61)
  • fix(security): preserve fail-open-on-fault contract in envelope decrypt (0dcd647)
  • test(storage): assert public behavior instead of private getFilePathHash (Fixes #1990) (d9d95f9)
  • fix(tools): make search_file_content respect gitignore/llxprtignore via config (Fixes #2110) (53e6a00)
  • fix(security): address open-code-review on sibling-store hardening (45a149e)
  • fix(settings): gate stream idle profile settings (Fixes #1900) (db87b2f)
  • test(storage): cover visible symlink filter paths (40d9ddd)
  • fix(storage): prevent write-chain poisoning when logger throws (557fe42)
  • wip(#2114): address small PR review cleanups (b0d40d9)
  • Merge pull request #2177 from vybestack/issue2139 (c2bbb11)
  • Merge remote-tracking branch 'origin/main' into issue2114 (9504d3b)
  • Merge remote-tracking branch 'origin/main' into issue1987 (f45de16)
  • Merge pull request #2179 from vybestack/issue2165 (c145588)
  • test(e2e): stabilize file tool scenarios (8ed21a3)
  • Merge pull request #2181 from vybestack/issue1922 (a25118a)
  • fix(security): address CodeRabbit review on sibling-store hardening (f0d4d7d)
  • fix(security): harden sibling encrypted file stores with machine-secret KDF (Fixes #2187) (3abc2c2)
  • Merge remote-tracking branch 'origin/main' into issue1922 (3adaf9b)
  • test: stabilize BOM encoding e2e (61142ac)
  • docs: tighten llama.cpp validation examples (7152f99)
  • Merge pull request #2178 from vybestack/issue1986 (d71c47e)
  • fix(storage): normalize filter fast-path paths (5f36569)
  • wip(#2114): preserve secure masking with leading whitespace (c2fbbe6)
  • fix(settings): address stream idle review feedback (Fixes #1900) (fef2acd)
  • fix(agents): address CodeRabbit review on MCP OAuth quad-state (#2165) (fe8c37a)
  • test: strengthen provider-switch property runs (fd8f631)
  • fix(storage): serialize concurrent ConversationFileWriter writes (f0409a7)
  • test: cover profile and prompt review regressions (3923cf4)
  • test: cover review follow-up cases (84a97cb)
  • Address context preflight review findings (3addc6c)
  • fix(storage): convert ConversationFileWriter to async I/O to unblock event loop (Fixes #1988) (f067a77)
  • docs(settings): update generated configuration docs (Fixes #1900) (b23ee64)
  • Merge pull request #2175 from vybestack/issue2131 (c33b827)
  • Address secure-store hardening review feedback (06a814a)
  • test(agents): stabilize mutation coverage properties (21f9c14)
  • docs: add llama.cpp Gemma local model setup (7d544b5)
  • fix(settings): validate compression thresholds (Fixes #1900) (5c13173)
  • fix(auth): log resolved effective bucket in forceRefreshToken and drop duplicate test (#2131) (45f87c3)
  • wip(#2114): ratchet CLI type escapes (372b80f)
  • docs(agents): P09 final plan-quality evaluation for #2165 (0455525)
  • Harden secure-store fallback encryption (Fixes #1986) (5e708e4)
  • test(agents): P08 quality gates for MCP OAuth quad-state (#2165) (d25ad5e)
  • fix(storage): trim system settings override (fcce36a)
  • Fix context overflow preflight after model switch (5fd8cfd)
  • fix(storage): harden system settings path override (0a96d0b)
  • fix(auth): align vi.mock importOriginal type with mocked module (#2175) (1bf579e)
  • Merge pull request #2168 from vybestack/20260624security (a6ec607)
  • fix(auth): resolve active session bucket during 401 force-refresh (Fixes #2131) (fc3a9fa)
  • fix(telemetry): set explicit metric-reader export timeout to stop JSON stdout corruption (124a903)
  • security: remediate all open Dependabot + CodeQL alerts (Fixes #2167) (69266bb)
  • test(agents): P07 non-breaking guards + docs for MCP OAuth quad-state (#2165) (078360d)
  • Merge pull request #2164 from vybestack/issue2161 (1f08bdb)
  • wip(#2114): merge latest main after harness cleanup (cbbeddc)
  • feat(agents): project real MCP OAuth quad-state through Agent surface (#2165) (66d25fd)
  • test(agents): P05 behavioral RED for MCP OAuth projection (#2165) (859ed35)
  • Merge pull request #2149 from vybestack/issue2120 (8e2de31)
  • refactor(retry): remove dead retryFetchErrors plumbing (c3e4e7d)
  • issue2165 P04a: engine-helper gate PASS (architect blind + 100% mutation) (52fc85d)
  • Add canonical MCP OAuth-status engine helper (issue2165 Phase 1) (80284b4)
  • wip(#2114): share useGeminiStream test harness (b9c3e88)
  • Relax broad parity timeout (Fixes #2120) (afa03af)
  • fix(core): resolve tool-name and async-guidance prompt token leaks (Fixes #2109) (#2163) (b606663)
  • Add issue2165 MCP OAuth-truth TDD plan + foundation gates (PLAN-20260622-MCPOAUTHTRUTH) (7f8eae2)
  • Relax parity property timeout (Fixes #2120) (be4cdb3)
  • fix(tools): add 'fetch failed' to transient phrases for consistency (Fixes #2161) (43f4165)
  • Add #2136 regression coverage; gate prepareQueryForGemini on own signal (#2160) (811ab00)
  • Merge latest main for settings cleanup (Fixes #2120) (160960b)
  • Merge pull request #2162 from vybestack/issue2150 (b5fcbd0)
  • Constrain agent settings property keys (Fixes #2120) (9739b0c)
  • wip(#2114): format merged guard test (1098b8c)
  • wip(#2114): merge latest main after review fixes (6e28122)
  • fix(providers): retry connection-phase fetch failures (Fixes #2161) (f0f70ab)
  • Merge pull request #2155 from vybestack/issue2122 (7f09994)
  • wip(#2114): address renderer and redactor review (1fb90aa)
  • Close Agent API engine-capability gaps before CLI refactor (Fixes #2143) (#2156) (c2d1ab7)
  • Address settings validation review (Fixes #2120) (fca0333)
  • Retry transient mid-stream connection errors instead of breaking the loop (Fixes #2150) (434e6c0)
  • Fix policy guard comment handling (9ec0240)
  • siwthc to ollamakimi not synthetic (2a5ca9a)
  • Detect actual image format from magic bytes for Anthropic (Fixes #2130) (#2158) (165d8e8)
  • Merge latest main for settings cleanup (Fixes #2120) (ecada00)
  • Harden settings parse boundaries (Fixes #2120) (f2f6ea0)
  • Merge origin/main into issue2122 (3a8468d)
  • fix(core): re-estimate tokens, fix cache double-counting on provider switch (Fixes #1567) (#2145) (1ab6181)
  • Merge pull request #2154 from vybestack/issue2123 (26dae8c)
  • wip(#2114): remove stale provider regex suppression (1b3c8f0)
  • Merge origin/main into issue2122 (ebbe250)
  • Merge pull request #2157 from vybestack/issue2152 (6ea8bbe)
  • Merge main into issue2123 (adbb220)
  • wip(#2114): merge latest main storage cleanup (298a845)
  • wip(#2114): merge main and preserve CLI lint cleanup (c4fa567)
  • Replace deprecated Vitest timeout option syntax in auth tests (Fixes #2152) (375cf9d)
  • Remove policy ESLint directive suppressions (Fixes #2122) (deddfa9)
  • Remove a2a-server ESLint directive suppressions (Fixes #2123) (a0490be)
  • Eliminate storage ESLint directives (Fixes #2119) (cf8360c)
  • Resolve settings cleanup conflicts (Fixes #2120) (9e86bad)
  • Merge origin/main into issue2119 (a2ebe90)
  • wip(#2114): remove CLI sonarjs regex suppressions (320044d)
  • Address settings ESLint review feedback (Fixes #2120) (8a2fb26)
  • Remove auth ESLint directive suppressions (Fixes #2121) (#2151) (0f133e5)
  • Merge origin/main into issue2119 (e7b62b9)
  • Remove core ESLint bypasses (Fixes #2115) (#2146) (da4e4f1)
  • wip(#2114): remove final CLI eslint suppressions (is-in-ci, jsx-no-bind) (feb79b3)
  • Merge remote-tracking branch 'origin/main' into issue2119 (2cb33d9)
  • Eliminate settings ESLint directives (Fixes #2120) (c664010)
  • Harden storage path tests for Windows (7319df9)
  • Eliminate storage ESLint directives (Fixes #2119) (d593b46)
  • Merge pull request #2140 from vybestack/issue2116 (65b2e83)
  • Resolve origin/main conflicts for issue2116 (53f3a31)
  • Merge pull request #2144 from vybestack/issue2117 (b5a0518)
  • wip(#2114): split useGeminiStream.test.tsx under max-lines (730fda5)
  • wip(#2114): split InputPrompt.test.tsx under max-lines (1ed4cb0)
  • wip(#2114): split App.test.tsx under max-lines (d790743)
  • wip(#2114): split SettingsDialog and SessionBrowserDialog tests under max-lines (a8b46bd)
  • wip(#2114): split KeypressContext test under max-lines (fc962bf)
  • wip(#2114): split oversized executable hook tests under max-lines (4a43f1d)
  • Resolve origin/main conflicts for issue2116 (2547169)
  • wip(#2114): split InputPrompt.tsx into cohesive modules (85ece01)
  • Merge pull request #2142 from vybestack/issue2118 (5ec0e2b)
  • wip(#2114): resolve react-hooks/exhaustive-deps without suppressions (90537f3)
  • wip(#2114): split SettingsDialog.tsx into cohesive modules (d12674d)
  • Remove provider ESLint suppressions (Fixes #2116) (9d709b7)
  • Address agents directive review feedback (98a0617)
  • wip(#2114): split history-navigation handler and prompt-prefix ternary in InputPrompt (341d697)
  • wip(#2114): extract setting-type predicates and color helpers in SettingsDialog (c88daf8)
  • Normalize MCP OAuth token responses (Fixes #2118) (01330e0)
  • wip(#2114): extract diff-line parsing helpers in DiffRenderer (d33ca87)
  • wip(#2114): reduce break/continue and nested control flow in keypress/scroll (ca9607c)
  • wip(#2114): flatten nested control flow in config and ui utils (c170c6e)
  • Merge pull request #2138 from vybestack/issue2133 (c15e9b7)
  • wip(#2114): flatten nested conditionals and complex expressions (1465b3e)
  • Remove agents ESLint directive backlog (70af3cc)
  • wip(#2114): fix mechanical lint violations in cli package (5c3e4dd)
  • wip(#2114): split cli.tsx to clear file max-lines (af26e40)
  • Address CodeRabbit review feedback on apply_patch (#2138) (eb60771)
  • Merge pull request #2108 from vybestack/issue1594 (0505d86)
  • wip(#2114): refactor nested ternaries and complex expressions in dialogs/layout (8e7a927)
  • wip(#2114): remove vitest conditionals from Footer/InputPrompt/SettingsDialog tests (3d2fc0b)
  • wip(#2114): satisfy vitest rules in subagentCommand.test (0a30102)
  • wip(#2114): satisfy vitest rules in keyCommand.subcommands.test (26f7d6e)
  • Address CodeRabbit: preserve null-safety with type casts (9ded8d7)
  • wip(#2114): remove vitest conditionals from integrationWiring/formatSessionSection (2f5ccd1)
  • wip(#2114): remove vitest conditionals from oauth-dismiss/oauth-buckets (fc25413)
  • wip(#2114): remove vitest conditionals (adapter/install/profile-keyfile) + nullish (d7e43ce)
  • wip(#2114): satisfy vitest top-level/nested-describe rules (13a8615)
  • wip(#2114): remove vitest conditionals from theme/keypress/radio tests (085ad4d)
  • Eliminate all inline ESLint disables in packages/mcp (Fixes #2118) (34e2d29)
  • wip(#2114): remove vitest conditionals from clipboard/windowTitle/skill/session/phrase tests (3137e85)
  • wip(#2114): convert prefer-nullish-coalescing in cli to ?? / firstNonEmptyString (a0d21bb)
  • Merge pull request #2141 from vybestack/issue2137 (eed67e0)
  • wip(#2114): fix typecheck regressions from directive removal in cli (4fd2de9)
  • feat(agents): complete public Core Agent API surface for CLI integration (Fixes #1594) (11ebb6c)
  • Merge pull request #2126 from vybestack/issue2113 (23a565b)
  • wip(#2114): remove inline eslint directives + fix regex/control-char rules in cli (7ffe1bd)
  • Use consistent Responses error prefixes (8146051)
  • Apply PR follow-up remediation for issue #{issue_number} (6cae060)
  • Harden Codex Responses request validation (0f376a0)
  • Fix apply_patch directory-qualified header validation (91fd1ec)
  • Redact home paths in assignment-style tokens (d51ba1d)
  • Confirm arguments key before truncating partial JSON; handle tab in export (bd93f87)
  • Fix #2133: apply_patch fails (6a1ee54)
  • Merge origin/main into issue2113 (4ad9c68)
  • Merge pull request #2134 from vybestack/issue2132 (04afdbb)
  • Tighten parser guard and redaction edge cases (24bc9d0)
  • Address load balancer review feedback (dd26320)
  • Fix profile auth isolation for load balancers (158f9e4)
  • Address remaining CodeRabbit feedback (97a7132)
  • Merge pull request #2129 from vybestack/issue2092 (b9b9979)
  • Address CodeRabbit regex review feedback (d0a210f)
  • Remove targeted regex lint overrides (f314d2e)
  • Remove fileSearch lint exception (ca44cba)
  • Merge pull request #2125 from vybestack/issue2099 (69fb4e3)
  • Fix Linux secure store path test (0e7447a)
  • Stabilize LSP navigation registration test (7bc3dca)
  • Avoid disabling skill regex checks (76a87d5)
  • Address CodeRabbit feedback for issue 2092 (d23ef37)
  • Fix CodeRabbit review: guard signal.aborted before launching tool batch (a0b0319)
  • Keep targeted regex lint rules enabled (e66739c)
  • Fix #2099: Cancelling a tool call from a subagent during parallel tool calls can cause a hang (ebe20c6)
  • Remove test ESLint suppressions (Fixes #2092) (f006f0d)
  • Replace broad regex lint policy (93a004c)
  • Merge pull request #2112 from vybestack/issue1054 (8e8f21c)
  • Clarify compression preserve invariant (2494657)
  • Merge pull request #2111 from vybestack/issue2091 (19509fb)
  • Make compression config assertion order-independent (602b3df)
  • Merge main into issue2091 (3e085f6)
  • Remove provider ESLint suppressions (Fixes #2084) (#2106) (9f978a3)
  • Address review feedback for issue 1054 (d9c13d6)
  • Fix CLI profile integration assertions (8423687)
  • Improve quality guards for compression and prompts (6161f5f)
  • Remove CLI ESLint suppressions (Fixes #2087) (#2105) (8c7a0db)
  • Remove CLI test ESLint suppressions (Fixes #2091) (1473b74)
  • Remove CLI ESLint suppressions (Fixes #2086) (#2104) (7624bc4)
  • Merge remote-tracking branch 'origin/main' into issue1594 (8de81b8)
  • Remove ESLint suppressions from packages/agents source (Fixes #2085) (#2103) (487a5b1)
  • Merge remote-tracking branch 'origin/main' into issue1594 (5c45d33)
  • Remove agents test ESLint suppressions (Fixes #2090) (#2107) (1e893f8)
  • Address CodeRabbit review findings on Agent API surface (Fixes #1594) (1cbcf4e)
  • Fix Lint (Javascript) CI: guard ENOBUFS + remove inline eslint-disables (Fixes #1594) (99c8652)
  • Strip unsupported peer flags from package-lock.json (6ceb827)
  • Merge origin/main into issue1594 (90b2839)
  • Add public Core Agent API surface to @vybestack/llxprt-code-agents (Fixes #1594) (fbd20c1)
  • Remove ESLint suppressions for packages/tools (Fixes #2088) (#2101) (fafdfb2)
  • Remove provider core ESLint suppressions (Fixes #2083) (#2102) (8746f6c)
  • Remove package ESLint suppressions (Fixes #2089) (#2100) (d7897dc)
  • fix(cli): resolve Windows storage 'EINVAL' and '/dev/tty' crashes, improve early debug logging (#2052) (dccf1f2)
  • Remove core ESLint suppressions (Fixes #2081, Fixes #2082) (#2098) (59645cc)
  • Fix error-on-cancel and ESC not cancelling subagents (Fixes #2076, Fixes #2074) (#2097) (39cb278)
  • Enforce ESLint guardrails (Fixes #2079, Fixes #2080) (#2096) (f729b6d)
  • Clarify tool display-state flag after engine-owned continuation (Fixes #2054) (#2095) (2ff50a3)
  • Inherit parent max turns for subagents (Fixes #2048) (#2094) (89847c1)
  • Allow 0.5% context-limit fudge factor before hard-limit truncation (Fixes #2067) (#2077) (85f8d85)
  • Add presubmit npm script and streamline contributing guide (Fixes #2075) (#2093) (b74174d)
  • Fix load balancer profile handling (Fixes #2057) (#2070) (020f354)
  • Fix dumpcontext invocation propagation (Fixes #2066) (#2071) (903861b)
  • Preserve subagent tool defaults (Fixes #2069) (#2073) (3e09608)
  • Fix subagent wizard invocation crash (Fixes #2068) (#2072) (4cca1b2)
  • Add Ollama Cloud and Makora provider aliases (Fixes #2056) (#2065) (b99ceaf)
  • Avoid profile switch stalls after failed turns (Fixes #2049) (#2064) (bedb023)
  • Retry Anthropic api_error (Internal Server Error) instead of breaking the loop (Fixes #2053) (#2063) (8a8ee67)
  • Skip tests for doc-only workflow changes (Fixes #1565) (#2055) (33467ef)
  • Consolidate agentic turn loop into engine (Fixes #2034) (#2050) (e0a12bd)
  • Fix stale context limit after profile load (Fixes #2040) (#2043) (0173274)
  • Up model versions for built-in providers (Fixes #2037) (#2046) (1662607)
  • Retry compression on provider overload/rate-limit errors (Fixes #2045) (#2047) (f7ca2c3)
  • Fix Anthropic OAuth 401 retry loop on empty failed token (Fixes #2035) (#2044) (4fb97cc)
  • Relocate provider & profile composition out of CLI into engine packages (Fixes #2033) (#2039) (d3f2ca4)
  • Disable google_web_search by default (Fixes #2036) (#2042) (4e5d0ed)
  • Fix #1801: Sanitize ANSI escape codes in skill consent prompts (#2031) (679c7bd)
  • Fix event-driven model profile display (Fixes #1770) (#2032) (e741337)
  • Re-derive aggregatedText after AfterModel hook modification (Fixes #1749) (#2028) (d26aa49)
  • Eagerly authenticate remaining buckets after Pass 3 reauth (Fixes #1658) (#2030) (01fe05b)
  • Validate ast_edit preview replacements (#2029) (e88afa5)
  • Fix #1802: Deep merge hooksConfig/hooks settings across scopes (#2027) (f7dbcba)
  • Fix dumpcontext request and response dumps (Fixes #1700) (#2012) (fad5266)
  • Add migration support for ui.disableLoadingPhrases (Fixes #1809) (#2013) (aa85445)
  • Fix prompt-interactive scheduler readiness (Fixes #2001) (#2006) (0f8d981)
  • Add tmux interactive UI CI lane (Fixes #1179) (#2011) (d3e18a5)
  • Add configurable max heap setting (Fixes #1624) (#2009) (1adad3b)
  • Consolidate auth key settings (Fixes #1560) (#2007) (bda4680)
  • Fix #1877: Subagent armTimeout fires against defunct instance if initScheduler rejects (#2010) (cfb9164)
  • Fix #2002: todopause still doesn't pause the system from telling the model it has todos and to keep going (#2005) (cc359de)
  • Merge pull request #1998 from vybestack/issue1541 (3ad720e)
  • Make emoji filter mode set readonly (01816fd)
  • Merge pull request #2004 from vybestack/issue1804 (d18312f)
  • Centralize emoji filter mode validation (2700418)
  • Preserve sanitized tool descriptions for failures (7f77315)
  • Fix post-merge build: relocate canonicalizeToolName to tools package (d0b8245)
  • Merge remote-tracking branch 'origin/main' into issue1804 (cfa37e7)
  • Merge main and filter todo pause emojis (f9455f7)
  • Enforce BeforeToolSelection hook tool restrictions at runtime (Fixes #1804) (583cf8e)
  • Restore interactive todo updates (e78db93)
  • Merge pull request #1996 from vybestack/issue1547 (5631397)
  • Merge pull request #1997 from vybestack/issue1894 (2fd82b2)
  • Merge pull request #1999 from vybestack/issue1592 (ca2bd77)
  • Merge pull request #1994 from vybestack/issue1470 (9cc87cc)
  • test: include agents in release package order (fc21326)
  • test: update agents confirmation coordinator type import (b155c00)
  • fix: address issue1592 review feedback (7c2411c)
  • merge: incorporate main into issue1592 agents extraction (f7b572a)
  • test: fix scheduler test import duplication (30fd228)
  • test: approve issue1592 final semantic review (85f6b9a)
  • test: complete issue1592 final hardening (ef35fa9)
  • test: verify issue1592 consumer migration (88a8c78)
  • test: harden issue1592 consumer boundaries (37a5c4b)
  • test: verify issue1592 agent runtime move (183753c)
  • refactor: move agent runtime into agents package for issue1592 (a404d5d)
  • Stabilize noninteractive E2E fixtures (a1c310e)
  • Filter emojis in todo writes (Fixes #1541) (dfe0bc7)
  • Address CodeRabbit review: document 15s timeout, remove duplicate test (ce19a26)
  • Fix PTY focus routing for live shells (9a38173)
  • Address noninteractive Ctrl-C review feedback (c8eb62c)
  • Harden shell security parsing: fix backtick detection bug in regex fallback (Fixes #1547) (2c54326)
  • test: verify issue1592 agents scaffold (6a2f769)
  • build: scaffold agents package for issue1592 (9c448f4)
  • Fix noninteractive Ctrl-C hard abort (Fixes #1470) (f208e36)
  • test: verify issue1592 construction seams (dd325d4)
  • Merge pull request #1991 from vybestack/issue1593 (02e5d53)
  • refactor: inject agent runtime construction seams for issue1592 (acb4a26)
  • Merge origin/main into issue1593 (62756a6)
  • Merge pull request #1992 from vybestack/issue1972 (a410f99)
  • Merge pull request #1984 from vybestack/issue1585 (2a0a11b)
  • plan: complete issue1592 preflight verification (11e9713)
  • chore: remove stray reviewer test file (cdbfa26)
  • plan: issue1592 packages/agents extraction plan (12 review rounds, approved) (8c0fb3a)
  • Fix release-process canonical publish order test for storage+policy (Fixes #1585) (873d441)
  • Merge origin/main into issue1585 (Fixes #1585) (20ca427)
  • Merge remote-tracking branch 'origin/main' into issue1593 (1f1340b)
  • test: assert ide-integration ordering in release/build configs (276c07f)
  • fix(subagent): run subagents non-interactively in -p mode and fix dispose crash (Fixes #1585) (4a1bbee)
  • Address CodeRabbit review on compression load-balancer (Fixes #1972) (4ff9e14)
  • Merge pull request #1983 from vybestack/issue1591 (b2cd754)
  • Fix list_subagents tool failing with 'not available synchronously' (Fixes #1585) (f7001fd)
  • Merge remote-tracking branch 'origin/main' into issue1591 (6ff8236)
  • Extract packages/storage leaf package from core (Fixes #1590) (#1982) (d2effd4)
  • Merge remote-tracking branch 'origin/main' into issue1972 (27d0c94)
  • Regenerate package-lock.json for workspace reorder (Fixes #1593) (a9779df)
  • Fix workspace build order: ide-integration before mcp (Fixes #1593) (ad9b93d)
  • Fix subagent/profile compression provider auth resolution (Fixes #1972) (555592f)
  • Add PR body doc for #1593 (38e00fa)
  • Fix duplicate @lvce-editor/ripgrep dependency breaking sandbox Docker build (Fixes #1585) (a2dd049)
  • Extract ide-integration package (Fixes #1593) (cfecc19)
  • Address CodeRabbit review on tools-adapters (Fixes #1585) (686bca6)
  • Fix stale canonical publish-order assertion in release-process test (Fixes #1585) (d1efc3c)
  • Fix CodeQL alerts: harden ReDoS regexes and remove no-op replace (Fixes #1585) (86c5735)
  • Fix integration test import after tools extraction (Fixes #1585) (d7daff1)
  • Merge origin/main (auth package extraction #1980) into issue1585 (Fixes #1585) (04f065b)
  • Merge origin/main into issue1585 (Fixes #1585) (f8e85bc)
  • Merge remote-tracking branch 'origin/main' into issue1591 (6780f7c)
  • Extract auth package (Fixes #1586) (#1980) (85da6b3)
  • Wire policy package into sandbox and release pipeline (Fixes #1591) (2fb3cff)
  • Extract tools into standalone @vybestack/llxprt-code-tools package (Fixes #1585) (6fddd10)
  • Address CodeRabbit review on policy extraction (Fixes #1591) (6539d94)
  • Sync package-lock workspaces order with policy-before-mcp (Fixes #1591) (6626d72)
  • Build policy package before mcp in workspaces order (Fixes #1591) (6b2d150)
  • Merge remote-tracking branch 'origin/main' into issue1591 (1866d4d)
  • Add PR body documentation for policy package extraction (Fixes #1591) (216b6fb)
  • Extract policy engine and confirmation bus into dedicated package (Fixes #1591) (4f24372)
  • Extract settings package (Fixes #1588) (#1979) (065db2d)
  • Extract telemetry package (Fixes #1589) (#1976) (985798b)
  • Fix load balancer subagent runtime profiles (Fixes #1970) (#1974) (fef3cbb)
  • Rename provider-agnostic Gemini surfaces (Fixes #1423) (#1975) (1fbcac7)
  • Extract MCP package (Fixes #1587) (#1973) (4fbf4f4)
  • Bound LSP requests with timeouts (Fixes #1416) (#1971) (a391c4f)
  • Replace compress tests with behavioral captures (Fixes #1217) (#1969) (409577a)
  • Add subagent recovery turns (Fixes #1133) (#1959) (885041d)
  • Remove duplicate subagent factory propagation (Fixes #1962) (#1968) (4b5953f)
  • Update README.md (b7df729)
  • Revise model listings in README (021901f)
  • Apply test best practices from upstream (Fixes #1075) (#1958) (a9c7427)
  • Improve autocomplete resilience for large trees (Fixes #1732) (#1961) (603cf22)
  • Fix #1956: hydrate runtime content generator factory (#1960) (bbfed46)
  • Fix providers release publishing (Fixes #1955) (#1957) (f5ba94e)
  • Support V2 settings format (Fixes #1613) (#1952) (b686a05)
  • Fix #1889: cover compression media sanitization (#1951) (aaf27c9)
  • Fix #1782: Bound OAuth reauth and relogin flow (#1947) (8aa3b25)
  • Extract providers package boundary (Fixes #1584) (#1953) (e3e41b4)
  • Fix OpenAI tool format overrides (Fixes #1943) (#1949) (047cfb1)
  • Fix provider-aware rate limit messages (Fixes #1398) (#1950) (baf16f5)
  • Fix subagent PromptConfig initialMessages contract (Fixes #1788) (#1948) (31e5634)
  • Fix #1730: Add semantic response outcome metadata (Fixes #1730) (#1945) (a5f04b2)
  • Fix #276: Replace direct sk-ant-oat checks with BaseProvider.classifyOAuthToken hook (#1946) (fa92406)
  • Fix edit line guard for multiline replacements (Fixes #1912) (#1944) (34eb0bb)
  • Fix #1776: Gate initial prompt on startup guards (#1942) (6824071)
  • Fix #1878: Guard OAuth dialog against wrong-provider auth prompts (Fixes #1878) (#1941) (57b8fb5)
  • Fix #1915: Validate promoted lint rules (#1940) (0151000)
  • Fix #1803: Reset geminiMessageBuffer on contextCleared event during streaming (#1913) (108a236)
  • Fix #1748: BeforeToolSelectionHook: empty allowedFunctionNames array treated as no restriction (#1910) (4d903c1)
  • fix: update lockfile for LSP package metadata (92bf45f)
  • fix: add repository metadata for LSP package (a914fb9)
  • ci: use trusted publishing for npm releases (bd87255)
  • fix: enforce complexity cap 25 (Fixes #1914) (#1921) (2a7ec00)
  • refactor(lint): finish #1569 lint hardening (Fixes #1569) (#1907) (794c53a)
  • Fix #1808: Document actual default scope behavior for /skills enable and disable (#1909) (acbc1e1)
  • Enforce vitest strict equality in tests (Fixes #1569) (#1901) (636d547)
  • fix(stream): disable idle timeout watchdog by default (Fixes #1905) (#1906) (214fe89)
  • fix(mcp): support tool schemas declaring JSON Schema draft 2020-12 (Fixes #1902) (#1903) (40a733b)
  • fix(stream): make idle timeout configurable and raise default to 10 min (Fixes #1898) (#1899) (74ef2d7)
  • fix(oauth): preserve Linux auth fallback paths (Fixes #1895) (#1897) (a497ee2)
  • fix(auth): enable auth cache invalidation for unbucketed profiles (Fixes #1739) (#1896) (851e956)
  • fix(core): convert media blocks to text placeholders during compression (Fixes #1875) (#1892) (0a9d5ed)
  • Clean up old dev-docs (Fixes #1745) (#1893) (5422c41)
  • fix(streaming): remove Kimi K2 special buffering that caused Fireworks hangs (Fixes #1890) (#1891) (344ba95)
  • fix(stream): prevent sendPromise deadlock on idle timeout abort (Fixes #1887) (#1888) (b4e83ea)
  • fix(stream): prevent Kimi tool call ID collisions and silent scheduler drops (Fixes #1872) (#1886) (b0757ce)
  • fix(version): cache CLI version to show running version not installed version (Fixes #1883) (#1885) (b9e1193)
  • fix(stream): increase idle timeouts and fix AbortError suppression (Fixes #1881) (#1884) (e09c980)
  • fix(stream): close iterator on abort to prevent sendPromise hang (Fixes #1881) (#1882) (77a3e9e)
  • fix(subagent): filter disabled tools instead of throwing runtime error (Fixes #1747) (#1880) (1c1e1a1)
  • Handle Anthropic rate_limit_error in JSON body like a 429 (Fixes #1871) (#1879) (fb63c14)
  • Fix stream idle timeout races with a shared helper (Fixes #1872) (#1876) (86d44b2)
  • fix(stream): ensure first chunk consumption happens inside retry boundary (Fixes #1750) (#1869) (32acec4)
  • fix(auth): invalidate token caches and force-refresh on 401/403 revocation (Fixes #1861) (#1874) (a5c0a39)
  • Fix: Project-level memories not loaded when workspace is subdirectory (Fixes #1855) (#1864) (78dee81)
  • Merge pull request #1867 from vybestack/issue1859 (a9d7cd8)
  • Merge pull request #1866 from vybestack/issue1862 (b47a93b)
  • fix: Enable bucket failover during compression 401 errors (fixes #1859) (dcb16eb)
  • fix(lsp): use fileURLToPath for Windows path compatibility in test fixtures (Fixes #1865) (abf161c)
  • Merge pull request #1863 from vybestack/diagnosis-stream-fragmentation (015db30)
  • fix: stop invalid stream fallthrough retries (2f96438)
  • style: format merged stream orchestrator (fdf3aef)
  • Merge origin/main into diagnosis-stream-fragmentation (1ff2e28)
  • fix(debug): flush shutdown logs and expand stream diagnostics (5ddaf28)
  • Merge pull request #1797 from vybestack/gmerge/0.26.0 (a508376)
  • fix: address remaining review feedback on docs and fake fixtures (f3e7ad8)
  • fix: keep settings docs generation stable and clarify hooks toggle precedence (96fa476)
  • fix: harden hook/e2e stability and align config docs on #1797 (979d7d5)
  • fix: pre-seed welcome config for interactive integration rig (77dc904)
  • fix(streaming): preserve Anthropic stopReason-only deltas and add terminal diagnostics (Fixes #1856) (#1860) (a4ef0f1)
  • fix: stabilize hooks telemetry flow and align tool-display behavior (24e766a)
  • fix(ci): update GitHub Actions to valid commit SHAs in evals-nightly.yml (Fixes #1857) (#1858) (a753fc1)
  • fix(core): preserve provider terminal metadata and tool schemas (Fixes #1844) (#1854) (3942aaf)
  • fix: address CodeRabbit review findings on PR #1797 (3cdcc66)
  • merge: sync with latest main (7e9552f) preserving gmerge fixes (430764e)
  • fix: restore gmerge features lost in config refactor merge (edb7385)
  • merge: integrate latest main into gmerge/0.26.0 and restore lost features (4fe82e2)
  • fix(openai): set stopReason in metadata so turns finish for Fireworks/Kimi providers (Fixes #1837) (#1853) (7e9552f)
  • fix(integration-tests): add stdin prompt to prevent CI failures (Fixes #1848) (#1852) (708d039)
  • fix(cli): --version flag prints version to stdout instead of debug log (Fixes #1849) (#1850) (eb58dbd)
  • fix(ui): context-limit not applied on first profile load (Fixes #1842) (#1851) (a87644a)
  • fix(providers): empty tool schemas for subagents and streaming pipeline hangs (Fixes #1845, Fixes #1846) (#1847) (8b6ec27)
  • fix(client): handle 413 errors with retry and tool name guidance (Fixes #1707) (#1843) (d4d2752)
  • test(auth): formal behavioral test coverage for all OAuth bucket failover scenarios (Fixes #1783) (#1841) (b075b0a)
  • fix(subagent): prevent crashes and hangs during subagent launch (Fixes #1838) (#1840) (e48f826)
  • fix(set-command): remove model_param alias, keep only modelparam (Fixes #1821) (#1839) (3cf7b20)
  • fix(stats): detect API-key providers with kebab-case base-url config (Fixes #1828) (#1836) (65d8e53)
  • fix(compress): distinguish no-op, recent, and failed outcomes (Fixes #1792) (#1827) (dcd2437)
  • Remove stale UI version bump from release versioning (Fixes #1834) (#1835) (840acd2)
  • Bootstrap release workflow dependencies in both paths (Fixes #1831) (#1832) (b47300a)
  • Fix token performance telemetry and stats reporting (Fixes #1805) (#1817) (1e6c98f)
  • fix(ci): resolve ESLint OOM and invalid gh flag in release workflow (Fixes #1825) (#1826) (428fd93)
  • fix(anthropic): use getAuthTokenForPrompt in buildProviderClient for OAuth support (#1823) (73bb12f)
  • fix(oauth): add disk-read on lock timeout to prevent cross-process token replay (Fixes #1781) (#1822) (923cd36)
  • fix(core): enforce hard-limit compression fallback + diagnostics (Fixes #1791) (#1818) (a791910)
  • fix(lsp): use Buffer-based accumulation for Content-Length framing (Fixes #1415) (#1824) (6da4225)
  • fix: remediate post-merge gaps for gmerge/0.26.0 high-risk batches (d3bdb03)
  • fix(set-command): clear ephemeral shadow and accept model_param alias (Fixes #1814) (#1819) (7154ed2)
  • Fix settings search focus and typing flow (Fixes #1744) (#1820) (e58af5c)
  • Remove flash fallback message from quota error responses (Fixes #1772) (#1816) (b0089b4)
  • test: Audit and clean up 77 skipped tests, 172 -> 95 (Fixes #1811) (#1810) (73e8152)
  • refactor(core): remove dead upstream agent architecture files (Fixes #1765) (#1815) (01c27f1)
  • refactor(cli-config): Break up cli config.ts into focused modules (Fixes #1582) (#1785) (b1529d7)
  • refactor(core): centralize path validation into PathValidator service (Fixes #1612) (#1812) (9751e18)
  • merge: integrate upstream v0.26.0 sync and preserve gmerge plan adaptations (96ca183)
  • Respect maxOutputTokens setting in Anthropic OAuth provider switch (Fixes #1769) (#1807) (3cce1e8)
  • fix(core): correct off-by-one line count in read tools to match wc -l (Fixes #1753) (#1806) (100dd93)
  • fix: address latest CodeRabbit follow-up threads in PR #1797 (27fc346)
  • fix: address follow-up CodeRabbit findings in PR #1797 (cbf0734)
  • fix: address selected CodeRabbit findings in PR #1797 (9a7018f)
  • Wire LSP package lint into CI workflow (Fixes #1798) (#1800) (4c83470)
  • fix: TPM not calculated for pure stream calls (fixes #1764) (#1793) (4b37687)
  • fix(core): rationalize duplicate getOrCreateScheduler wrappers in subagent scheduler setup (Fixes #1787) (#1795) (b3d18e4)
  • Deprecate and remove OpenTUI experimental UI (Fixes #1774) (#1796) (2f82915)
  • fix: remediate audit findings from gmerge/0.26.0 review (7aa2f7e)
  • fix: preserve last user prompt during middle-out compression (fixes #1650) (#1790) (3ac3048)
  • fix(oauth): use filtered bucket list for prompt progress display (Fixes #1620) (#1789) (040c72b)
  • Merge pull request #1784 from vybestack/issue1777 (7dfb77e)
  • fix: route downstream Codex device-flow messages through bridge when UI is live (9b00325)
  • style: remove trailing blank line in displayDeviceCodeToUser (0ea9cdf)
  • Merge pull request #1786 from vybestack/issue1773 (9fdedce)
  • fix: eliminate deprecated getAddItem() usage and fix Codex device-code fallback (a3398fe)
  • Merge pull request #1779 from vybestack/issue1581 (7b3bdc8)
  • fix: restore checkmark symbol ✓ in CLI UI indicators (fixes #1773) (9c1e2bc)
  • Merge pull request #1780 from vybestack/issue1583 (095c43e)
  • chore: final progress/notes/audit updates for gmerge/0.26.0 (e1d07ae)
  • reimplement: package.ts debugLogger.error in catch (upstream d8e9db3) (829ff6a)
  • refactor: address CodeRabbit review - remove dead tool lookup, add scheduler adapter comment (387c2ae)
  • chore: update progress/audit for batch R41 (dcdfeb6)
  • reimplement: package.ts try/catch readPackageUp (upstream 43846f4) (7772261)
  • chore: update progress/audit for batch R40 (2f77c95)
  • reimplement: add clearContext to AfterAgent hooks (upstream 2a3c879) (2b98926)
  • chore: update progress/audit for batch R39 (99e6e68)
  • reimplement: MCP status hook refactor (upstream cebe386) (54ea7b6)
  • chore: update progress/audit for batch R38 (ba1ab36)
  • reimplement: fast return buffer keypress flags (upstream ee87c98) (cd3a71b)
  • chore: update progress/audit for batch R37 (8b23133)
  • reimplement: auth failure sandbox handling (upstream 0fa9a54) (3ae52cb)
  • refactor: clean up subagent module coupling and 80-line compliance (572e661)
  • chore: update progress/audit for batch R36 (3933792)
  • reimplement: fix System scopes migration (upstream 93ae777) (1d60766)
  • chore: update progress/audit for batch R35 (27be289)
  • reimplement: Esc-Esc to clear prompt (upstream e1fd5be) (ca2b2ea)
  • chore: update progress/audit for batch R34 (4c9fe91)
  • reimplement: fix newline support (upstream aceb06a) (0ab20d7)
  • chore: update progress/audit for batch R33 (db1f2ca)
  • reimplement: hooks properties are event names (upstream 211d2c5) (d160f64)
  • refactor: add proper cleanup and typed mock for executeTokenRefresh tests (a3b8c24)
  • fix: clear buffered tool calls on error events in processGeminiStreamEvents (8c0ce15)
  • style: replace dynamic imports with static imports in cross-process test (3331e56)
  • chore: update progress/audit for batch R32 (8097fdd)
  • reimplement: send llxprt-code version as MCP client version (upstream b288f12) (bc456e0)
  • fix: address CodeRabbit review findings (dd2124d)
  • chore: update progress/audit for batch R31 (7c8b1f5)
  • reimplement: resolve Ctrl+Enter/Ctrl+J newline (upstream 645e2ec) (e62e450)
  • chore: update progress/audit for batch R30 (4ab0214)
  • reimplement: migrate BeforeModel/AfterModel hooks (upstream e92f60b) (44c3d48)
  • fix: return correct StreamProcessingStatus from processGeminiStreamEvents (4a28363)
  • fix(auth): stabilize OAuth bridge lifecycle and cross-process refresh safety (Fixes #1777) (3f256f6)
  • chore: update progress/audit for batch R29 (c2d21c5)
  • fix: add turnCancelledRef to processGeminiStreamEvents dependency array (4c671fd)
  • reimplement: enhanced compression concepts (upstream 1182168) (5393ce6)
  • fix: clear buffered tool calls on cancel/loop-detect (8d8942f)
  • chore: update progress/audit for batch R28 (341e183)
  • reimplement: shell redirection transparency and security (upstream ec74134) (c1d5aec)
  • chore: update progress/audit for batch R27 (NO_OP) (85683f7)
  • fix: address third CodeRabbit review round (a41b977)
  • chore: update progress/audit for batch R26 (21546e6)
  • reimplement: centralize tool mapping (upstream 1b6b6d4) (895be1e)
  • fix: address second CodeRabbit review round (81274a4)
  • chore: update progress/audit for batch R25 (43c6070)
  • reimplement: fix Homebrew detection for llxprt-code (upstream 4cfbe4c) (76bc501)
  • chore: update progress/audit for batch R24 (3380d44)
  • reimplement: keyboard shortcuts URL to vybestack.dev (upstream 6900253) (234a225)
  • chore: update progress/audit for batch R23 (2508b08)
  • reimplement: enable agent skills by default (upstream 272570c) (de72ae2)
  • refactor: eliminate backward-compat shim from subagent.ts decomposition (02a65d1)
  • chore: update progress/audit for batch R22 (df34eaf)
  • reimplement: unify shell confirmation dialogs (upstream 1681ae1) (2dd155b)
  • fix: address remaining CodeRabbit feedback (checkpoint dedup, non-shell overlap, callId type) (3374249)
  • chore: update progress/audit for batch R21 (4324410)
  • reimplement: rename disable* to enable* settings (upstream 608da23) (5bf2581)
  • chore: update progress/audit for batch R20 (acde16d)
  • reimplement: hook event name validation (upstream 9722ec9) (4180f7b)
  • chore: update progress/audit for batches R18-R19 (0f6f2be)
  • reimplement: organize key bindings (upstream ce35d84) (7f5c404)
  • chore: update progress/audit for batch R18 (NO_OP — already present) (ccc796c)
  • refactor: remove compatibility shim and update all imports to geminiStream/ (cd9f995)
  • chore: update progress/audit for batch R17 (93b55be)
  • reimplement: MCP discovery state tracking (upstream 1e8f87f) (8f68d3b)
  • chore: update progress/audit for batch R16 (68cbac7)
  • reimplement: safely handle /dev/tty on macOS (upstream 8a627d6) (62f3ce3)
  • chore: update progress/audit for batch R15 (a1e1ff7)
  • reimplement: OOM prevention in file search (upstream e77d7b2) (9b29e53)
  • chore: update progress/notes/audit for batch R14 (51489a7)
  • reimplement: non-nullable merged settings (upstream f7f38e2) (5e0fe92)
  • Merge pull request #1778 from vybestack/issue1578 (c214222)
  • reimplement: policy source tracking (upstream f909c9e) (ab08dd4)
  • reimplement: skill conflict detection and warnings (upstream 222b739) (fbdad47)
  • reimplement: security consent for skill installation (upstream a81500a) (b40cfc3)
  • chore: update progress/audit for R6-R10 (de727fc)
  • fix: lint errors from R6/R4 — remove unnecessary type assertions, fix import type, remove stale dep (790a281)
  • fix(auth): guard lock-timeout disk probe against token-store failures (24e7c58)
  • reimplement: add timeout to tree-sitter parsing (upstream ae19802) (a009d8b)
  • reimplement: improve keybindings MOVE_UP/MOVE_DOWN (upstream 42c26d1) (3206967)
  • fix: address third-round CodeRabbit review (test accuracy) (4930b73)
  • reimplement: undeprecate --prompt flag (upstream a2dab14) (55feec8)
  • reimplement: remove sequence binding (upstream fb76408) (9a5ce9e)
  • reimplement: scheduler event types (upstream 6021e4c) (fd040a1)
  • fix(auth): address CodeRabbit round 4 — docblock accuracy + proactive renewal on lock-timeout path (a906398)
  • fix: address second-round CodeRabbit nitpicks (test hygiene) (b83bf04)
  • style: format after R3/R4 batches (f0ffd70)
  • fix: update scrollHome/scrollEnd test data for home/end keybinding change (P4) (bf1e2e4)
  • reimplement: simplify paste handling (upstream 94d5ae5) (893307f)
  • fix: address CodeRabbit review comments (2bf31d6)
  • chore: trim token-access-coordinator to 789 lines, remove plan artifacts (04c3f89)
  • fix: unused logger param and floating promise in instantiateChat (8cef932)
  • reimplement: remove unnecessary \x7f key bindings (upstream 09a7301) (756587f)
  • chore: update progress/audit for R1-R2 (ac8b64c)
  • reimplement: rootCommands array for policy parsing (upstream a3234fb) (038ec66)
  • style: format subagentExecution.test.ts with prettier (b7d2850)
  • reimplement: extension config setting (upstream 3b55581) (b56a039)
  • fix: shellcheck warnings in compare-coverage.sh (f57a142)
  • fix: address CodeRabbit review feedback (da06848)
  • chore: update progress/notes/audit for batch P5 — all PICK batches complete (eab85d8)
  • Fix mcp tool lookup in tool registry (#17054) (c9f6255)
  • fix bad fallback logic external editor logic (#17166) (5e5308b)
  • Phase 5: final cleanup — format, lint fixes, prepareRun extraction (559a3d0)
  • chore: update progress/notes/audit for batch P4 (4056415)
  • fix: LLxprt adaptations for P4 cherry-picks — DebugProfiler, disable test, MCP list test, format (4a6e652)
  • Phase 4: extract subagentExecution.ts — execution loop helpers (e48fd93)
  • fix: resolve lint errors in test files (eslint-disable for any types, fix array-type, arrow-body-style, require import, UserTierId value) (bf5106c)
  • fix(auth): remove dead stdin methods after unreachable code removal (59060a0)
  • refactor: Phase 3 — extract subagentToolProcessing.ts from subagent.ts (#1581) (6be2168)
  • fix(auth): address 7 pre-existing bugs found during CodeRabbit review (6c9d604)
  • refactor: decompose useGeminiStream.ts into focused modules (fixes #1583) (16c6af2)
  • refactor: Phase 2 — extract subagentRuntimeSetup.ts from subagent.ts (#1581) (613d4c8)
  • fix(cli): display 'http' type on mcp list (#16915) (a522dcf)
  • fix(cli): resolve home/end keybinding conflict (#17124) (37b4c79)
  • Avoid spurious warnings about unexpected renders triggered by appEvents and coreEvents. (#17160) (d1998fe)
  • Fixes Windows crash: "Cannot resize a pty that has already exited" (#15757) (98e0ca4)
  • Revert "Revert "Update extension examples"" (#16445) (0f05bca)
  • chore: update progress/notes/audit for batch P3 (3bb3daf)
  • fix: LLxprt adaptations for P3 cherry-picks — introspect branding, refreshMcpContext (2b52444)
  • refactor: Phase 1 — extract subagentTypes.ts from subagent.ts (#1581) (1cf6f77)
  • Test coverage for hook exit code cases (#17041) (aa87fd2)
  • Fix mcp instructions (#16439) (cc6b6be)
  • docs(themes): remove unsupported DiffModified color key (#17073) (a8a282f)
  • feat: add /introspect slash command (#17048) (e45cfdb)
  • chore: update progress/notes/audit for batch P2 (73f7ee2)
  • chore: Phase 0 — test infrastructure for subagent.ts decomposition (#1581) (95a4964)
  • fix: LLxprt adaptations for P2 cherry-picks — LruCache.size, static OAuth methods, type annotations (b72c08d)
  • fix: remove redundant api.qwen.com from qwenDomains array (3f8f396)
  • fix(cli): use OSC-52 clipboard copy in Windows Terminal (#16920) (4478acc)
  • fix(core): resolve PKCE length issue and stabilize OAuth redirect port (#16815) (d1ff2eb)
  • perf(ui): optimize text buffer and highlighting for large inputs (#16782) (9983634)
  • chore: update progress/notes/audit for batch P1 (8fc967b)
  • fix: address CodeRabbit review feedback (daff403)
  • fix(auth): resolve lint errors in extracted auth modules (afa1a6d)
  • refactor(core): harden skill frontmatter parsing (#16705) (89a27bb)
  • fix: Handle colons in skill description frontmatter (#16345) (68384cf)
  • refactor(skills): replace 'project' with 'workspace' scope (#16380) (93697af)
  • docs: clarify F12 to open debug console (#16570) (8ef4487)
  • refactor(auth): decompose oauth-manager.ts into cohesive modules (Fixes #1578) (685ca41)
  • chore: add gmerge/0.26.0 cherry-pick plan and playbooks (3306a68)
  • Merge pull request #1775 from vybestack/issue1580 (cc95c80)
  • Merge pull request #1771 from vybestack/issue1579 (1426900)
  • style: fix prettier formatting in confirmation-coordinator.test.ts (24e0bb8)
  • fix: address CodeRabbit test review feedback (df2eab9)
  • fix: resolve remaining lint errors missed in previous commit (6cb2d73)
  • fix: resolve lint errors in extracted scheduler modules (3443f1c)
  • style: apply prettier formatting to extracted scheduler modules (b1556fe)
  • refactor(core): decompose coreToolScheduler into focused modules (Fixes #1580) (137ce0d)
  • fix(core): address second round of CodeRabbit feedback (676d8ac)
  • fix(core): remove unnecessary type assertions and update test names (365df37)
  • fix(core): address CodeRabbit review feedback on client decomposition (3ac20a1)
  • Merge pull request #1768 from vybestack/issue1576 (64de2f2)
  • fix: restore selection copying while preserving copy-mode shortcut gating (4d5e6b1)
  • fix: tighten AppContainer hook wiring and async safety (e66f7a8)
  • fix: address second-round CodeRabbit findings (9ce5923)
  • refactor(core): decompose client.ts into focused sibling modules (fixes #1579) (b8036c6)
  • fix: address CodeRabbit review findings in AppContainer decomposition (8ca0b11)
  • fix: copyright header typo in useOAuthOrchestration.ts (5d48e26)
  • refactor: decompose AppContainer.tsx into focused hooks and builders (Fixes #1576) (0f12e7f)
  • Merge pull request #1741 from vybestack/issue1573 (9fbd981)
  • Merge pull request #1767 from vybestack/issue1577 (1c226ef)
  • Merge pull request #1766 from vybestack/issue1575 (5091a95)
  • refactor: split applyConfigParams into sub-functions to satisfy 80-line function limit (28a92df)
  • fix: correct VISUAL/EDITOR fallback precedence and tighten transformation test fixtures (9db8a55)
  • fix: preserve all telemetry settings fields via spread in constructor hydration (9d3074d)
  • refactor: replace export * with explicit exports, extract useTextBuffer helpers (0516af2)
  • format: apply prettier to config.ts and configConstructor.ts post-merge (6c231d6)
  • Merge origin/main: integrate enableHooksUI, adminSkills, subagent extensions, dispose (f44a92d)
  • Pre-merge: integrate enableHooksUI, adminSkills, subagent extensions, dispose into decomposed modules (4afdf63)
  • style: fix formatting in runtimeAccessors.spec.ts (5fe0bda)
  • fix: exclude text-buffer.test.ts specifically instead of broad glob (7dd1ee7)
  • test: tighten runtimeAccessors.spec.ts assertions per CodeRabbit review (cabae46)
  • Address review findings: type-safe constructor target, disabledHooks fix (56a38d5)
  • fix: remove stale bootstrap comment from runtimeAccessors.spec.ts (9ca1077)
  • fix: address CodeRabbit review feedback (019bf62)
  • refactor: decompose text-buffer.ts into focused modules (Fixes #1577) (08f24a9)
  • fix: adopt main eslint.config.js with sonarjs rule optimizations (8ae3d6b)
  • Decompose oversized config.ts into focused modules under 800 lines (Fixes #1573) (ef51437)
  • Merge remote-tracking branch 'origin/main' into issue1575 (660c667)
  • refactor(runtime): split runtimeSettings into focused modules and stabilize tests (Fixes #1575) (e111e13)
  • Merge pull request #1752 from vybestack/gmerge/0.25.2 (04c2dfa)
  • fix: use non-backtracking regex in TestRig tool call parser (CodeQL CWE-1333) (5112559)
  • fix: thread systemMessage through hook stop/block events and refine action-required indicator (016ee1e)
  • docs: regenerate settings schema and configuration docs (0fe6151)
  • test: align hook-caller static assertions with stream processor (73b566a)
  • Merge main into gmerge/0.25.2 (df51874)
  • fix: add ESM-compatible __dirname in skillManager.ts (3dbb629)
  • fix: resolve TypeScript errors from remediation work (64215cd)
  • fix: B46-B48 subagent encapsulation (06745a3)
  • fix: B3 TestRig enhancements with CommandRun (68dc549)
  • fix: B39 built-in skills loader with recursive discovery (b897c3d)
  • fix: B9 docs branding and B20 bracketed paste state management (f6b466d)
  • fix: additional B26 branding fix - skillsCommand pending item (f8d3501)
  • fix: update copyright headers on new files (B30/COPYRIGHT) (ef3860d)
  • fix: B26 Agent Skills branding and B30 copyright fix (46472c6)
  • Merge pull request #1763 from vybestack/issue1762 (8d05543)
  • Increase CI lint heap to avoid JavaScript OOM on PR checks (a269fd0)
  • Disable irrelevant SonarJS rules to cut lint overhead (Fixes #1762) (970c0da)
  • Merge pull request #1742 from vybestack/issue1574 (429723f)
  • fix: regenerate docs and schema for cherry-picked changes (8e2d75c)
  • Merge pull request #1743 from vybestack/issue1571 (57bb126)
  • Detect MISSING tokens via zero-width node walk, fix mock ENOENT code (88a0ae1)
  • fix: remove unused syntheticResponse variable in hook-control test (a313bfb)
  • Harden freshness check: treat null mtime as conflict, propagate non-ENOENT errors (03850fc)
  • Merge pull request #1740 from vybestack/issue1572 (b0821be)
  • fix: resolve TS2339 in userStartupWarnings.test.ts os mock (39e9ef9)
  • fix: update tests for cherry-picked API changes (v0.24.5→v0.25.2) (8e7f9b7)
  • style: format DefaultAppLayout.tsx and types.test.ts (57d3e5f)
  • fix: resolve lint errors from cherry-pick batches (589ba22)
  • fix: convert json-output E2E response files to FakeProvider JSONL format (8e0aa90)
  • fix: remove orphan conflict marker in client.test.ts and regenerate settings.schema.json (57224f5)
  • docs: update gmerge-0.25.2 tracking artifacts (PROGRESS, NOTES, AUDIT) (9eb367f)
  • style: format after final batch (3f797b7)
  • cherry-pick: upstream 217f2775805 batch 55 (787da22)
  • cherry-pick: upstream bb6c5741443..f6a5fa0e03a batch 53 (1118595)
  • reimplement: Aggregate test results (upstream 66e7b479ae4) (62b7b10)
  • reimplement: Behavioral evals framework (upstream 8030404b08b) (108324f)
  • fix: remove dead code and consolidate duplicate type (38fc3c9)
  • Fix validateASTSyntax to detect syntax errors via tree-sitter ERROR nodes (439535e)
  • cherry-pick: upstream eda47f587cf batch 50 (59657e9)
  • fix(core): cache-adjust streaming token counts, hoist matcher, remove dead code (c3e68b4)
  • fix: remove dead try/catch and fix bucket evaluation order in rate limit handler (6f62ce9)
  • cherry-pick: upstream e8be252b755..8dbaa2bceaf batch 49 (b5e030d)
  • reimplement: feat(core, cli): Add support for agents in settings.json (upstream 92e31e3c4ae) (8dbec57)
  • cherry-pick: upstream 91fcca3b1c7..e931ebe581b batch 47 (87de133)
  • reimplement: Implement support for subagents as extensions (upstream aa524625503) (419b7ae)
  • reimplement: Refactor beforeAgent and afterAgent hookEvents to follow desired output (upstream a6dca02344b) (95f2204)
  • reimplement: fix(cli): refine Action Required indicator and focus hints (upstream 304caa4e43a) (ef06be7)
  • cherry-pick: upstream 6adae9f7756 batch 43 (1a988e6)
  • cherry-pick: upstream 2fc61685a32 batch 42 (864d382)
  • reimplement: feat(cli): cleanup activity logs alongside session files (upstream c572b9e9ac6) (5769066)
  • cherry-pick: upstream 8d3e93cdb0d batch 40 (f2f4824)
  • cherry-pick: upstream e9c9dd1d672 batch 39 (cdbe30f)
  • cherry-pick: upstream ca6786a28bd batch 38 (7e2666f)
  • cherry-pick: upstream 2e8c6cfdbb8 batch 37 (831bde6)
  • cherry-pick: upstream 95d9a339966 batch 36 (3af99a9)
  • cherry-pick: upstream 3b678a4da0f..e049d5e4e8f batch 35 (b7703e6)
  • cherry-pick: upstream 64cde8d4395 batch 34 (ef85f6f)
  • cherry-pick: upstream 15891721ad0 batch 33 (fa7dc3f)
  • reimplement: Add other hook wrapper methods to hooksystem (upstream 8a2e0fac0d8) (1bed4ab)
  • reimplement: Attempt to resolve OOM w/ useMemo on history items (upstream 950244f6b00) (320eed1)
  • cherry-pick: upstream 64c75cb767c batch 30 (9a7c9eb)
  • reimplement: feat(cli): Hooks enable-all/disable-all feature with dynamic status (upstream 9703fe73cf9) (9209b02)
  • reimplement: feat(cli): add /chat debug command for nightly builds (upstream 0e955da1710) (48098fc)
  • reimplement: Support for Built-in Agent Skills (upstream 461c277bf2d) (7431b1f)
  • reimplement: Update system prompt to prefer non-interactive commands (upstream b08b0d715b5) (82da1fe)
  • cherry-pick: upstream ea7393f7fd5..1fb55dcb2e0 batch 24 (21f8c93)
  • reimplement: fix: properly use systemMessage for hooks in UI (upstream c7d17dda49d) (ebd8e7a)
  • cherry-pick: upstream 8bc3cfe29a6..14f0cb45389 batch 22 (fb79ec9)
  • reimplement: Show settings source in extensions lists (upstream 77e226c55fe) (2c1b33b)
  • cherry-pick: upstream 88f1ec8d0ae batch 20 (80ff528)
  • reimplement: Refine Gemini 3 system instructions to reduce model verbosity (upstream 41e627a7ee4) (f45f9f6)
  • reimplement: feat(hooks): Support explicit stop and block execution control in model hooks (upstream e1e3efc9d04) (482b507)
  • reimplement: Support @ suggestions for subagents (upstream 18dd399cb57) (229ece8)
  • cherry-pick: upstream f8138262fa7..4ab1b9895ad batch 16 (ff9313d)
  • reimplement: feat(hooks): add mcp_context to BeforeTool and AfterTool hook inputs (upstream eb3f3cfdb8a) (e882743)
  • reimplement: bug(core): Fix spewie getter in hookTranslator.ts (upstream 660368f2490) (6b06249)
  • reimplement: Reapply feat(admin): implement extensions disabled (#16082) (upstream 97ad3d97cba) (deed540)
  • reimplement: feat(cli): export chat history in /bug and prefill GitHub issue (upstream 030847a80a4) (7b271af)
  • cherry-pick: upstream 1bd4f9d8b6f..722c4933dc3 batch 10 (71a1989)
  • reimplement: docs: add docs for hooks + extensions (upstream 17b3eb730a9) (0f80e36)
  • reimplement: feat(core): Decouple enabling hooks UI from subsystem. (upstream 4c961df3136) (a4b6dfa)
  • reimplement: feat(hooks): simplify hook firing with HookSystem wrapper methods (upstream c64b5ec4a3a) (8a58abd)
  • cherry-pick: upstream 57012ae5b33 batch 06 (b46303b)
  • Strengthen context-collector test assertions per CodeRabbit review (9f66b4e)
  • reimplement: Simplify extension settings command (upstream 97b31c4eefa) (768253c)
  • cherry-pick: upstream 8f9bb6bccc6 batch 04 (6c7d9f5)
  • fix: remove duplicate thinking block completion log (4cbb2e3)
  • reimplement: Enhance TestRig with process management and timeouts (upstream 416d243027d) (e1c147a)
  • reimplement: policy: extract legacy policy from core tool scheduler to policy engine (upstream 5fe5d1da467) (75b9d97)
  • refactor: decompose all functions to ≤80 lines, DRY CacheableContentBlock type, add redacted_thinking streaming (b785350)
  • Fix context-collector test: variables excluded by zero-signal filter (01b9805)
  • cherry-pick: upstream da85e3f8f23..2d683bb6f8a batch 01 (038c71b)
  • fix(core): revert config merge in TurnProcessor to fix build (88d8948)
  • fix(core): address CodeRabbit review feedback on decomposition (870e85a)
  • plan: add gmerge-0.25.2 planning artifacts and dev-docs updates (f087f2e)
  • fix: remove unused params from handleContentBlockStart, strip raw thinking from remaining log (666d11b)
  • Address second CodeRabbit review: fix ellipsis logic, zero-signal filter, explicit-extension imports (a7f8159)
  • fix: address CodeRabbit round-3 review comments (8113304)
  • fix: make normalizeToAnthropicToolId deterministic for empty IDs (adc8e9d)
  • fix: prevent stream retry after content has been yielded to consumer (e5aa504)
  • fix: handle URL-backed PDFs, preserve all human message blocks, support document blocks in cache control (759202e)
  • Address CodeRabbit review: harden edge cases, improve tests, fix TOCTOU (b069b2e)
  • fix(core): fix two decomposition regressions in stream validation and token sync (bac2e41)
  • refactor(core): decompose geminiChat.ts into focused modules (Fixes #1571) (94f7c2e)
  • fix(anthropic): restore OAuth system prompt in buildSystemContext (3af9c29)
  • Fix remaining lint errors: remove unused collector var, type catch clause (0b9f614)
  • Fix lint errors: replace 'as any' with typed double-cast patterns (9ef8f8d)
  • fix(anthropic): address CodeRabbit review and fix test pollution (a848bf2)
  • Fix test mocks and regex for CodeRabbit review issues (6e95478)
  • Decompose ast-edit.ts monolith into 15 focused modules (Fixes #1574) (7acf6c4)
  • refactor(anthropic): decompose AnthropicProvider into focused modules (fixes #1572) (d2f2c0b)
  • Merge pull request #1736 from vybestack/issue1570 (71e63cb)
  • Add symmetric httpsAgent assertion and env isolation for CI (d81e68d)
  • Fix ClientFactory test: isolate from OPENAI_BASE_URL env var (67f6d3a)
  • Fix lint errors: remove unused vars, replace 'as any' casts (ed24803)
  • Extract streaming/non-streaming logic from generateChatCompletionImpl into focused modules (c145da1)
  • Extract client infrastructure from OpenAIProvider into ClientFactory (de63728)
  • Extract pure helpers from OpenAIProvider into RequestBuilder and ResponseParser (e8da800)
  • Clean up stale legacy references in comments and test names (61fd5f7)
  • Remove legacy tool call processing path from OpenAIProvider (Fixes #1570) (9c4222e)
  • Merge pull request #1733 from vybestack/issue1569a (4c13489)
  • Merge pull request #1717 from vybestack/gmerge/0.24.5 (1da0ce9)
  • fix: display .LLXPRT_SYSTEM files separately from context files in status (bc340ff)
  • fix: stabilize verification and harden sandbox settings (95f5053)
  • fix: trim coverage reporters to prevent OOM during report generation (d7749ea)
  • fix: resolve CodeQL polynomial regex and test OOM via forks pool (ed8a5ff)
  • fix: resolve test OOM, CodeQL alerts, and extension test spy mismatch (b154112)
  • fix: remove messageBus removal-gate test that requires ripgrep (1ead413)
  • fix: revert console→debugLogger in all extension CLI commands (2f8aad3)
  • style: format install.test.ts (7d2c358)
  • fix(lint): add no-console override for extension CLI commands (02856f3)
  • fix: resolve CI failures from upstream v0.24.5 sync (277d3e4)
  • fix: remove --max-warnings 0 from CI and pre-commit hook (f5121bd)
  • chore: update NOTICES.txt for semver version bump (4c8a7ce)
  • fix: regenerate lockfile without peer flags (0b8397d)
  • Merge remote-tracking branch 'origin/main' into issue1569a (a29107c)
  • fix(ui): add messageBus to useToolScheduler useEffect dependency array (0827523)
  • merge: integrate main into gmerge/0.24.5 (12aa1af)
  • fix: resolve MissingProviderRuntimeError from provider-scoped UUID runtimeIds (b554f28)
  • debug: add diagnostic console.error to getCliRuntimeContext for MissingProviderRuntimeError (a9d8a95)
  • fix: use consistent runtimeId in CLI bootstrap to prevent MissingProviderRuntimeError (7de6e2d)
  • fix: resolve all test failures from gmerge-0.24.5 DI migrations (8f18daf)
  • feat(skills): load skills from extension skills/ subdirectory (073540e)
  • fix: resolve CLI bootstrap crash from MessageBus DI migration (3d416df)
  • merge: integrate main into gmerge/0.24.5 (257a1ff)
  • feat: complete gmerge-0.24.5 sync — MessageBus DI, hooks, policy, extensions, settings, tests (e6e8f1b)
  • feat: enable strict lint and complexity rules as warnings on core/cli (1d73d43)
  • fix: resolve build errors from upstream v0.24.5 sync (edbbc31)
  • fix: add missing debugLogger imports and fix console migration issues (1e92130)
  • style: fix formatting after console migration (6f137d7)
  • chore: remove stale gmerge-0.24.4 plans and deferred migration doc (81c694f)
  • refactor: migrate console.* to debugLogger across all packages (eff4e88)
  • refactor: remove dead LoggingContentGenerator, extract getToolSuggestion (2120741)
  • feat(ui): terse image path transformations in text buffer (3352a5e)
  • chore: limit MCP resources display to 10 by default (99b10c8)
  • feat(ui): add security warning to HooksList for project-level hooks (5cd9fa8)
  • fix: paste/keyboard improvements — ModifyOtherKeys, BracketedPaste, exit cleanup (5acf597)
  • docs: defer console→debugLogger migration to separate PR (a7c8180)
  • docs: add security documentation for hooks (2077ff6)
  • feat: settings — descriptions for /settings dialog, remote admin settings (5c5c1dd)
  • feat: extensions — install/uninstall commands, settings info, update notifications (0029c76)
  • feat: policy engine — granular shell allowlisting, legacy deprecation, unified shell security (1733b58)
  • feat: hooks UI — context injection, visual indicators, enabled setting, security warnings (59dfed2)
  • feat: hooks core — tool input modification, STOP_EXECUTION, granular agent behavior (09970d2)
  • feat: hooks infrastructure improvements — folder trust, warnings, deduplication (393ea0d)
  • feat: add environment variable sanitization service (87952e5)
  • fix: default folder trust to untrusted + resolve circular dependency via tsconfig paths (0331e90)
  • refactor: add optional MessageBus constructor params (Phase C MB-B1) (d67aa88)
  • fix: resolve typecheck errors in tool-executor.ts (import casing + type-as-value) (29074e0)
  • refactor: extract response formatting to generateContentResponseUtilities (Phase B TS-B5) (1973338)
  • fix: clarify misleading comment in tool-executor.ts (2e03818)
  • docs: add Phase 04 completion marker (16843c7)
  • refactor: extract ToolExecutor from CoreToolScheduler (Phase 04 TS-B4) (46a54fb)
  • chore: update PROGRESS.md — TS-B1/B2/B3 are DONE, not TODO (9feaa20)
  • fix: remove unused ConfirmHandler import from coreToolScheduler (c0f914f)
  • test: characterize tool execution behavior (Phase B TS-B3) (9fe2744)
  • refactor: add re-exports for ToolScheduler types (Phase B TS-B2) (3276995)
  • refactor: extract ToolScheduler types to scheduler/types.ts (Phase B TS-B1) (bd634d1)
  • chore: update PROGRESS.md and NOTES.md for B5-B8 (477d0e7)
  • fix: lint errors from B7+B8 cherry-picks (e57777d)
  • fix(ui): ensure rationale renders before tool calls (#17043) (df03603)
  • Fix race condition by awaiting scheduleToolCalls (#16759) (9a22e0a)
  • fix: writeTodo construction (#16014) (c3d0791)
  • fix: prevent /copy crash on Windows by skipping /dev/tty (#15657) (27f70ed)
  • fix: consent.test.ts duplicate removal + mockReaddir integration (52ee3ff)
  • fix(cli): mock fs.readdir in consent tests for Windows compatibility (#15904) (6e30c5b)
  • fix: branding in skills docs + add allow_redirection to yolo.toml (e4d5526)
  • Agent Skills: Initial Documentation & Tutorial (#15869) (5925aa7)
  • fix: hide broken skills object from settings dialog (#15766) (9987f48)
  • docs: update PROGRESS.md and NOTES.md for PICK-B3 and PICK-B4 (e37911b)
  • fix: add debugLogger compat shim + SettingsChanged overloads + format (65621d3)
  • Agent Skills: Add skill directory to WorkspaceContext upon activation (#15870) (3dcc987)
  • Agent Skills: Implement /skills reload (#15865) (a04ab3e)
  • Agent Skills: Add gemini skills CLI management command (#15837) (464c9db)
  • Agent Skills: Extension Support & Security Disclosure (#15834) (bfc4670)
  • fix: Skills branding leaks + lint fixes from type assertion ripple (1e6c23f)
  • fix: branding and conflict resolution for Skills cherry-picks (d94355b)
  • Agent Skills: Unify Representation & Centralize Loading (#15833) (fe31e61)
  • Agent Skills: Status Bar Integration for Skill Counts (#15741) (6015c7e)
  • Agent Skills: Implement Agent Integration and System Prompt Awareness (#15728) (aa7c0b4)
  • Agent Skills: Implement Autonomous Activation Tool & Context Injection (#15725) (50b5e9c)
  • Agent Skills: Implement Core Skill Infrastructure & Tiered Discovery (#15698) (4989cde)
  • chore: update tracking docs for PICK-B1 and PICK-B2 results (ea214f0)
  • fix(core): handle checkIsRepo failure in GitService.initialize (#15574) (11abb49)
  • Resolve unhandled promise rejection in ide-client.ts (#15587) (7687471)
  • chore(core): fix comment typo (#15558) (31d67db)
  • fix: suppress unused _onErrorHandler in readStdin test (df76e90)
  • fix: add missing type field to MCPServerConfig (#15465) (1edf8b9)
  • fix #15369, prevent crash on unhandled EIO error in readStdin cleanup (#15410) (77d400c)
  • chore: add PLAN.md execution plan + tracking artifacts (5c72743)
  • fix: round 2 playbook remediation — remove vague/conditional language (51d0ab0)
  • fix: remediate 20 sha-plan playbooks from deepthinker review round 1 (07ad2ed)
  • chore: add 25 sha-plan playbooks for REIMPLEMENT commits (bc67b95)
  • chore: descope A2A remote agents from gmerge-0.24.5 (ba75508)
  • fix: round 3 plan remediation (a1bf7f0)
  • fix: round 2 plan remediation — template compliance, substantive fixes, ToolScheduler phase count (1a2fa4c)
  • fix: reconcile CHERRIES.md tables — all 121 commits now in tables (88de432)
  • chore: add MessageBus DI plan, resolve deferred items, fix async gap (82cf9f2)
  • chore: add implementation plans for A2A and ToolScheduler (b8d6c65)
  • chore: promote ADC auth, TOML config, dialect adapter to MVP scope (b5a1db4)
  • chore: move TOML remote agent config into MVP scope (2c6d69f)
  • chore: gmerge-0.24.5 design review round 3 — fix contradictions and staleness (c5ff186)
  • chore: gmerge-0.24.5 design specs — A2A remote agents, tool scheduler refactor (7435032)
  • chore: gmerge-0.24.5 audit — branch, CHERRIES.md, SUMMARY.md (16f6a93)

Full Changelog: v0.9.3...v0.10.0-nightly.260719.c2a2768a9

Assets 3
Loading