Lemon 2026.10.14 (preview)

Security

• Upgrade locked Mint from 1.10.1 to 1.10.2 to fix HTTP/1 response smuggling
  (EEF-CVE-2026-94194), HTTP/2 decoded-header memory exhaustion
  (CVE-2026-91043 / GHSA-9x8p-qrf4-jq7g), and oversized HTTP/2 frame buffering
  (EEF-CVE-2026-92103), without changing dependency constraints or other locks.

Changed

• Setup finishes with a first coding prompt, a success check, optional Telegram
  and Web UI commands, and an offer to open Lemon immediately after verification.

• Add short, availability-gated system prompt guidance for questions, conversation
  and filesystem checkpoints, structural code rewrites, language servers, debugging
  and external agent delegation, with stable ordering for prompt caching.

• Rotate to healthy alternate credentials or fallback candidates immediately on
  rate limits; bench quota-exhausted credentials for 15 minutes to one hour.

• Native task and swarm subagent spend now counts toward parent run/session token
  and dollar caps without duplicating per-session usage reports; exhausted parents
  cannot spawn further children.

Added

• Publish a generated TUI command and global-key reference, expose overlooked tool guides in site navigation, and guard against orphaned pages and command-reference drift.

• Show Telegram and Discord typing indicators for chat-originated runs, with
  topic/thread-scoped refreshes and bounded cleanup on completion or cancellation.

• Interactive setup audits an existing Hermes home and offers a confirmed,
  backed-up import without secrets or overwriting conflicts.

• Add offline lemon usage date ranges and day/provider/model/session reports,
  plus TUI /cost --by breakdowns with explicit completeness and session omissions.

• Add read-only lemon runs, lemon runs active, lemon cron runs, and
  lemon logs for headless operators, with bounded redacted offline launcher
  logs and interruptible two-second follow polling.

• Expose ask in Telegram and Discord native runs with origin-user-bound option
  buttons, consumed free-text replies, and finite no-answer deadlines.

• Surface-aware Telegram and Discord command help, including model, resume,
  file, checkpoint, and goal controls, plus automatic registration of Telegram's
  public / command menu without blocking transport startup on API failures.

• Notify when a TUI ask question is waiting, with shared [tui] notifications
  modes and a terminal-bell fallback for questions, approvals, and turn completion.

• Add /copy, /copy code [n] (first block by default), /copy prompt, and
  Alt+Shift+C, sharing OSC 52 plus local native clipboard fallbacks with message
  Copy buttons; SSH never invokes host clipboard tools.

• Cron schedules accept relative one-shots such as in 30m and timezone-aware
  local ISO timestamps, rejecting past times and retiring after execution.

• Successful prompt jobs can reply with exactly [SILENT] to retain history
  without delivering a notification or session summary.

• Cron lifecycle actions accept case-insensitive exact job names and refuse
  ambiguous names with a list of candidates.

• Show per-run tokens, recorded cost, model and provider in recent run history
  and the TUI /runs output when usage records are available.

• Dollar-capped sessions warn when the active model has no known catalog pricing.

• Forward Telegram photos and image documents and Discord CDN image attachments
  to vision-capable models, with bounded downloads and text fallback on failure.

• Share one initialized language-server process per server/workspace/config
  across sessions, with reference-counted owners, configurable idle shutdown,
  central document versions, diagnostic fan-out and next-use crash recovery.

• Add default-on [runtime.tools.bash] git_guard checks for destructive Git
  commands before all shell launch modes, with a verified task-isolation worktree
  exemption and actionable refusal messages.

• Opt in to a dedicated managed Chrome user-data directory and profile with
  LEMON_BROWSER_USER_DATA_DIR / LEMON_BROWSER_PROFILE_DIRECTORY, with
  default-directory and profile-lock safety checks and fail-closed identity binding.

• Add opt-in [runtime.tools.bash.interceptor] dedicated-tool routing with
  configurable rules, session-tool availability checks and piped-stdin exemptions,
  applied before foreground, background and named-service launches.

• Layer language-server defaults with global/project
  [runtime.tools.lsp.servers.<id>] overrides, custom servers, disabling,
  initialization options and environment settings across catalog consumers.

• Native task subagents now have a configurable soft assistant-request budget
  (default 200, per-item override, 0 disables), one optional wrap-up steer, and
  a graceful hard stop at 1.5x that auto-delivers partial findings. Revived runs
  receive fresh budgets, including structured-output correction requests.

• Ask read image questions with ?q= (including SVG :img?q=), using a
  configured vision model role or the active image-capable model and returning
  bounded, untrusted answer text instead of pixels.

• Extension tool-call, tool-result and session-start hooks can return bounded,
  ordered additional_context for the model, including blocked tool calls,
  without changing result trust, error status or mutation receipts.

• Keep finished native task children addressable: wake idle sessions or revive
  parked sessions with prior context through write agent://, with configurable
  idle TTL, explicit delivery receipts and coalesced concurrent revival.

• Read SVG/SVGZ markup as text and render explicit :img views as bounded PNG
  previews with librsvg; decoded SVGZ sources enforce the rich-read size limit.

• Expose anchored-edit seen-line enforcement through the validated
  [runtime.tools.edit] enforce_seen_lines config key (default false), carried
  through session settings into registered edit tools.

• Add default-on optional i tool intent in provider schemas, preserving original
  transcripts while keeping intent out of execution arguments and telemetry;
  show it in approval rationales and existing ACP tool-call titles.

• Add opt-in enforce_seen_lines coding-tool options for snapshot-anchored edits:
  remember displayed lines across read windows and refuse unseen targets or
  insertion anchors with actionable range-read hints, including during recovery.

• Add ls tree: true: depth-limited newest-first trees with file sizes,
  12 children per directory and explicit omitted-sibling counts.

• Emit content-free tool-call start/stop/exception telemetry with native-unit
  duration, tool name, error outcome and timeout flag, including failed workers.

• Add report_issue for short tool-misbehavior notes in a private, bounded
  session-local JSONL log, with timestamp and optional tool name. It requires
  no approval by default and makes no network requests.

Fixed

• Start core credential storage before cold CLI setup-readiness checks, so
  configured source installs are recognized without starting the agent runtime;
  surface readiness failures instead of silently rerunning setup.

• Preserve observed input, output and cache-token breakdowns in cancelled and
  failed native runs when budget accounting arrives before terminal completion.

• Hermes provider-config import now reports conflicts instead of replacing
  existing values unless --overwrite is explicitly requested.

• Stop replaying ambiguous Telegram sends and outbox failures; preserve unknown
  enqueue outcomes and deduplicate Discord transport retries with stable nonces.

• Fail closed for Telegram's unimplemented local_transcript voice provider
  instead of submitting synthetic transcript text to the model.

• Classify aborted and crashed run history truthfully, include bounded redacted
  error labels, filter before limiting, and report unavailable history instead of
  an empty list when storage fails.

• Cron restarts catch up one missed slot within a bounded grace window and retire
  expired one-shot reminders instead of moving them to next year.

• Cron run history is pruned hourly to 100 terminal runs per job by default,
  preserving active attempts and pending retries.

• Escape angle-bracket placeholders in generated configuration registry prose so
  VitePress treats paths such as <root>/agent-tools/node/bin/node as text, not
  unclosed HTML tags, while preserving existing inline code and alias line breaks.

• Restore the LSP Dialyzer gate by explicitly discarding idle timer cancellation
  results and removing an unreachable nil working-directory branch.

• Re-enter setup for incomplete saved configurations on interactive launch, and
  recognize keyless local providers and environment-only credentials in readiness,
  doctor, and setup verification.

• Make injected SVG rasterizer fixtures portable across BSD and GNU base64, and
  explicitly exclude only the named real-rasterizer test when librsvg is absent.

• Synchronize task-surface regression fixtures with the owning run's delta
  admission before flushing a reused conversation coalescer.

• Keep missing local provider API keys out of shared circuit-breaker health, so
  they cannot block other sessions that have valid credentials.

• Isolate intentional provider outages in ownership probes so their circuit and
  rate-limit state cannot contaminate later cases or repeated runs.

• Gate manual product releases on the source commit before bumping versions or
  pushing tags, build artifacts from the prepared cut, and skip existing CalVer
  tags without deleting unpublished orphan tags.

• Bind TUI fake control-plane listeners to their advertised IPv4 loopback address,
  preventing random test ports from reaching unrelated IPv4 services and timing
  out during command-harness setup.

• Make coordinator active-session lifecycle tests deterministic with per-test
  admission and explicit completion, timeout, cancellation and process-down fences
  instead of racing short deadlines against shared session startup.

• Preserve file-operation details from native assistant tool calls during
  compaction, including patch additions, updates, deletions, and rename paths,
  so subsequent summaries retain the affected files.

---