v0.2.0

Worth a minute before you upgrade. A few things change behaviour rather than just
adding to it:

• Settings that Waibee used to read but never act on now take effect. If you tuned
  background.max_jobs or the network.* timeouts, your values start applying — on
  one real config that moved max_jobs from an effective 10 to the configured 16.
• In "Don't ask" mode, high-risk commands (sudo, curl, wget, nc) now pause for
  approval instead of running silently, and a handful of catastrophic ones are refused
  outright in every mode.
• The workspace sandbox profile is now workspace-write; the old name still loads.
• The UserPromptExpansion hook is gone — use UserPromptSubmit.
• --mode belongs before the command; waibee run … --mode … is rejected rather than
  silently ignored, which is what it was doing.
  Settings that never had any effect were deleted. Existing config files still load
  unchanged.
• Setup works on the first try. The API key you enter when you first start Waibee takes effect immediately — no restart. Text pasted while a dialog is open now goes to that dialog rather than into the message box behind it, so a key pasted a moment early is not lost.
• A flag before a subcommand no longer starts the agent by mistake. waibee -m haiku version, waibee --cwd . sessions and friends ran a real (billed) agent turn on the prompt "version" or "sessions" instead of the subcommand — exit code 0 and a plausible-looking answer, so it was easy to miss. A mistyped command is caught too: waibee versoin now answers "did you mean waibee version?" instead of quietly asking the model about it. To prompt a single word that happens to be a subcommand name, use waibee -- doctor.
• --cwd, --model and --no-audit work on either side of the command. waibee run "…" --model haiku used to be an error; only waibee --model haiku run "…" was accepted.
• waibee - takes the prompt from stdin. echo "fix the failing test" | waibee -, or pipe in a file. It used to ask the model about a hyphen.
• Status messages stay up long enough to read — they sit at the far right of the bottom bar and used to vanish after two seconds.
• Quitting no longer leaves your terminal in a strange state. If Waibee was stopped by a signal — kill, a closed tmux pane, a supervisor — it skipped its own cleanup and left mouse tracking on, so the shell started printing bursts of characters at you. It now restores the terminal on the way out.
• Editor integration: switching the permission mode works again. Waibee read a field name the protocol doesn't use, so the mode picker showed up in your editor but every switch came back as an error. Fixed, along with the rest of that sweep: your model choice no longer resets when you change mode, forking a session keeps the directory and MCP servers you asked for, the session list can be filtered by project and pages correctly, and your editor is now told about the session actions Waibee already supported (delete, resume, sign out).
• / finds plugin skills by their short name. /mocki now matches some-plugin:mocking — no need to remember the prefix. The grey preview follows the row you highlighted, so arrowing the list no longer shows one command while Tab inserts another.
• Long /changelog and /help text scrolls all the way now — the last lines used to be unreachable.
• Catastrophic commands are refused outright. Wiping the root or your home directory, mkfs, shred, dd if=…, fork bombs, and piping a download straight into a shell are turned down in every permission mode — including Bypass — and no allow-rule approves them. Deleting a specific folder still just asks, as before. The check no longer depends on how the command is spelled: quoting the target (rm -rf '/'), splitting the flags (rm -r -f /), hiding it behind another verb (bash -c, eval, timeout, find / | xargs rm -rf) or letting the shell fill it in (rm -rf $D) all reach the same verdict as the plain spelling. Writing to a file that runs code later has to ask — shell start-up files including ~/.zshenv, git hooks, and Waibee's own .claude/settings.json; the last two matter because they sit inside your project, where the sandbox permits writes. Reading any of them is untouched. In "Don't ask" mode Waibee now pauses for high-risk commands (sudo, curl, wget, nc) instead of running them silently; everything ordinary runs untouched.
• Secrets are hidden from the agent by default. .env files, *.pem, SSH keys, .netrc and .aws/credentials no longer show up through Read, Grep or Glob — including when the agent searches those folders directly — so an instruction hidden in a file or a web page cannot quietly harvest them through the agent's file tools. .env.example stays visible, and a ! line in .waibeeignore re-opens anything you do want read (e.g. !.env). This covers the file tools, not the shell: a command like cat .env still reads the file, so the sandbox and the approval prompt are what stand between a suspicious command and your secrets.
• Fetched pages and search results are treated as data, not orders. Web content comes back clearly marked as untrusted, and Waibee won't act on instructions hidden inside it — it tells you what the page tried instead.
• Gentler on your machine. Up to 8 shell commands run at once and the rest queue, instead of a dozen processes starting together.
• Sandbox: the write allowance is much tighter. workspace-write used to hand over whole trees that are not inert — ~/.cargo and ~/.rustup (which hold cargo's config.toml, bin/ and your toolchains), and all of ~/.cache and ~/Library/Caches (where pre-commit keeps hooks that run on every git commit, and app updaters stage executables). Any of those let a command arrange for something of yours to run later, outside the sandbox. Now only the individual build caches are writable — cargo's registry and package lock, ~/.npm/_cacache, ~/.gradle/caches, ~/.m2/repository, ~/go/pkg/mod, and the per-tool caches under ~/.cache for pip, uv, yarn, pnpm, ccache and friends. Builds are unaffected. Anything else gets a denial naming the path; add it to sandbox.allow_write if you need it — though the toolchain directories themselves stay refused there too, since granting one whole is the hole this closed.
• New: an optional OS sandbox. /sandbox shows the choices with what each one allows, and workspace-write limits where the commands the agent runs may write: your project, Waibee's own folder, temp folders and package caches. It is not a container — everything still runs on your machine, with your real files and git, and reading files and network access are unchanged. While it is on the bottom bar shows 🔒 write: project. Applies straight away, no restart. Also available as waibee --sandbox workspace-write or under /settings → Security. macOS and Linux enforce it in the kernel; Windows has no such mechanism, so run under WSL2 there — /doctor shows what your machine supports. Off unless you ask for it.
• opus, sonnet and haiku now point at the newest model in each family, and the /effort levels show up for all of them.
• Settings that were quietly ignored now work. Your proxy, connect and request timeouts, audit and cache retention, the tool-output budget and the background-job limits are all read properly — and the proxy now covers everything Waibee does, not just model requests. If you had set background.max_jobs or network.connect_timeout_secs, your values take effect where they previously didn't, so it's worth a quick look. Settings that never had any effect were removed; your existing config still loads unchanged.
• Fewer stalls. A wedged MCP server can no longer hang the agent (per-server timeout_ms, 5 minutes by default). A long command that hits its timeout keeps running in the background instead of being killed. Connections recover from HTTP/2 hiccups and back off sensibly when rate-limited.
• Ctrl+B backgrounds a sub-agent too, not just a shell command — the task keeps going while you carry on, and reports back on your next turn. Todos can be marked blocked, so the agent stops chasing work that's waiting on someone else.
• Hooks got real control. Hooks from .claude/settings.json block by default ("async": true opts out), run inside sub-agents, and tell you when a hook script is broken. A Stop hook now also fires when the agent gives up early — empty reply, repetition, turn limit — and can send it back to work, so "don't stop until the tests pass" setups behave. PostToolUse can rewrite a tool's output before the model sees it. New SubagentStart pairs with SubagentStop. UserPromptExpansion is gone — use UserPromptSubmit.
• Safer editing. Two edits to the same file in one step can't overwrite each other, edits still match when your file uses smart quotes or dashes, and notebook edits honour .waibeeignore and refuse to clobber a file that changed on disk. Commands the agent runs no longer receive your API keys.
• Long sessions keep more. Facts worth remembering are saved before the history gets summarised, and a summary that comes back empty is retried instead of replacing your conversation.
• Scripting. waibee run exits 130 on Ctrl-C and 143 on SIGTERM, and reports per-model token use with --output-format json. Sub-agents take a capability_mode — read-only, read-write or execute.
• /doctor now runs inside the app, /update installs a pending update and otherwise tells you which version you are on, ←/→ cycle a dropdown in /settings, and your /effort choice survives a restart.