@aragon-agent/cli 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -1,577 +1,670 @@
-# Changelog
-
-All notable changes to `@aragon-agent/cli` are documented here. Entries at
-`0.4.x` and earlier refer to the package by its former name, `@argon-agent/cli`
-— those releases really were published under that name, so they are left as they
-were written.
-
-## Unreleased
-
-### Added
-
-- **Output token limits that cannot themselves fail a run.** Every model and
-  every provider now defaults to 64000 output tokens, and that number is
-  configurable from the TUI, from a flag, from `ARAGON_MAX_TOKENS`, and by hand
-  in `~/.aragon-agent/config.json`. Leave it alone and it stays 64000.
-
-  What is new is that the number is an *ambition*. `gpt-4o` caps at 16384 and
-  `gemini-1.5-pro` at 8192; sending 64000 to either is an HTTP 400 that ends the
-  turn with a raw provider string in the transcript. The cap is now clamped down
-  to whatever the target model actually accepts, from a per-model table plus
-  whatever the provider's own model list reports. For a model nothing knows — a
-  proxy, a `--base-url` endpoint, something that shipped last week — the request
-  goes out at 64000, and if the provider objects, `aragon` reads the real ceiling
-  out of the error text, repairs the request, sends it exactly once more, and
-  remembers the answer for the rest of the session. One warning line; the run
-  continues.
-
-  Two combinations that were a guaranteed 400 on every request are fixed with
-  it: `--thinking xhigh` asks for a 65536-token budget while Anthropic requires
-  `max_tokens` to be strictly greater than it, and OpenAI's reasoning family
-  (`o1`, `o3`, `gpt-5`) rejects the `max_tokens` parameter name outright in
-  favour of `max_completion_tokens`.
-
-  New surfaces: `/max-tokens [<n>|auto|default]`, which with no argument reports
-  the setting *and* the effective cap for the live model; an `Effective:` line
-  under the settings screen's `Max tokens` field, so a value the model will not
-  honour is visible before you save it; `--max-tokens auto`; and
-  `aragon config set maxTokens <n|auto|default>`, which echoes the value that was
-  actually stored rather than the one you typed.
-
-- **Team subagents.** The agent can now hand independent parts of a job to up to
-  five short-lived subagents that run in parallel, then read one combined report
-  of what each of them found. It decides for itself whether to delegate, so a
-  session that never calls the new `task` tool is byte-for-byte the session that
-  existed before. On by default; `--no-team` or `team.enabled: false` turns it
-  off, and `aragon config set team.maxSubagents <n>` sets the width (1-10; the
-  10 is a hard ceiling no config file can raise).
-
-  A subagent is a full agent with the same tools and working directory but no
-  memory of your conversation, so its brief has to be self-contained. It cannot
-  delegate further and it cannot ask you anything. Plan mode and a skill's
-  `allowed-tools` ceiling both reach one level down, so delegating is never a
-  way around either; `--confirm` queues subagent confirmations one at a time and
-  labels each with the subagent that is asking.
-
-  Subagents can message each other with `team_send` / `team_wait`, delivered by
-  attaching the message to the recipient's next tool result rather than
-  interrupting it. The limits are deliberate — 6 messages each, one every 15
-  seconds, 24 per dispatch — and every refusal is a plain result naming the
-  limit rather than an error, because an error invites the retry the limits
-  exist to prevent.
-
-  While a dispatch runs, a roster sits between the transcript and the composer
-  and the status bar carries `agents 3/5`; both disappear when it finishes and
-  the transcript keeps a card you can expand with `Ctrl+O`. `Esc` aborts every
-  subagent and returns the partial report. Under `-p` the transitions go to
-  stderr and the subagents' tokens are folded into the `[usage]` footer, so the
-  cost readout cannot under-report what the team spent.
-
-  Full documentation, including the limits table and how team mode interacts
-  with plan mode, skills and `--confirm`, is in the README.
-
-- **The subagent roster now shows what each subagent is doing, and shows the
-  ones that are working.** Where every row used to say `thinking` for minutes at
-  a time, it now says `bash: npm test -w cli`, `read: src/api/routes.ts`,
-  `waiting for a2`, or the tail of the sentence the subagent is currently
-  writing. On a narrow terminal the same row falls back to a file name and a
-  program name rather than wrapping, and the elapsed clock keeps its place at
-  every width.
-
-  The five visible rows are now the five that matter: whatever is running comes
-  first, then whatever is queued, then the most recent results. Above five
-  subagents the old panel showed the five that had finished first and hid
-  everything still working behind `+3 more`, which is the opposite of what the
-  roster is for. `+3 more` now says how many of the hidden ones are still going.
-
-- **A subagent no longer waits two minutes for a message nobody can send.**
-  `team_wait` now checks whether anyone could actually answer before it blocks:
-  if the teammate it named has already finished, does not exist, or is itself
-  waiting in a way that cannot be released in time, it returns straight away and
-  says which. Nothing is refused that could still have been answered — including
-  by a third teammate further down the chain — and the subagent is told what to
-  do instead rather than handed an error.
-
-- **A subagent whose very first request dies on a rate limit is retried once.**
-  Only a genuine cold start qualifies: no turn completed and no tool ran, so
-  there is nothing to undo. It restarts after two seconds, the roster says
-  `starting (retry)`, and the report notes `retried 1x`. Pressing `Esc`, a
-  timeout, or any subagent that had already begun work is never retried.
-
-### Changed
-
-- **`"maxTokens": null` in `config.json` now means AUTO** — use each model's own
-  ceiling, never above 64000. It previously resolved to 64000 by accident (the
-  layered resolver skipped `null`), and there was no way to express AUTO through
-  any supported write path. If you have a `null` there today, the only difference
-  is a downward clamp on models whose real ceiling is below 64000 — the direction
-  that prevents failures rather than causing them. Absent still means 64000, and
-  an explicit number still means that number.
-
-- **`config.json` holds settings again.** The prompts you type are no longer
-  stored in it. They move to `~/.aragon-agent/prompt-history.jsonl` — one JSON
-  object per line, `0600` on POSIX — and the submit counter and the "notice
-  already shown" flag move to `~/.aragon-agent/state.json`. `↑` and `↓` behave
-  exactly as before.
-
-  Two things get better. Opening `config.json` to change your model no longer
-  means scrolling past a transcript of your own typing, and copying it to
-  another machine no longer carries your prompts along. And submitting a message
-  no longer rewrites the file that holds your API keys: `config.json` is written
-  when you change a setting, and at no other time.
-
-  **Your history and counters are migrated automatically, once, at the next
-  launch.** Nothing is printed, because nothing changes for you. The dead
-  `recentModels` key — which nothing has ever written — is dropped.
-
-  If you go back to 0.5.x after upgrading, that version does not know about the
-  new file and `↑` will look empty. Nothing has been lost: the entries are still
-  in `prompt-history.jsonl`, and upgrading again brings them back.
-
-### Added
-
-- **`aragon history`** — `path`, `list` (`-n`, `--json`) and `clear --yes` for
-  the prompt history, alongside the existing `aragon logs` commands. Entries are
-  stored verbatim, so `clear` is how you erase them; `aragon config set
-  historyEnabled false` stops new ones being recorded without deleting or hiding
-  what is already there.
-
-- **The mouse wheel scrolls what is under the pointer.** In full-screen mode the
-  wheel now scrolls the transcript three rows per notch (a page with `Shift`),
-  scrolls an open overlay when the pointer is over one, and steps prompt history
-  one entry per notch when the pointer is over the input box — the same code
-  path `↑` / `↓` use, so it inherits the rule that an in-progress draft is never
-  overwritten. A slim rail on the viewport's right edge shows where you are in
-  the conversation.
-
-  **This fixes a destructive bug.** Previously the wheel recalled prompt history
-  no matter where the pointer was, because the alternate screen makes terminals
-  translate each notch into arrow keys. Wheeling while composing a message
-  silently replaced the draft with an old prompt, and nothing scrolled.
-
-  **Selecting text with the mouse now requires `Shift`+drag** in most terminals.
-  That is the standard convention for "an application is tracking the mouse" and
-  it applies to everyone, including people who never scroll with the wheel — so
-  the first session says so once, in the transcript, and never again. Turn the
-  whole feature off with `--no-mouse`, `ARAGON_MOUSE=0`, or
-  `aragon config set mouse false`; the wheel then does nothing rather than
-  reverting to the old behaviour. Inline mode (`--no-fullscreen`) is untouched:
-  your terminal's own scrollback already does the right thing there.
-
-  Under `tmux` with `mouse on`, tmux keeps the wheel for itself and the app
-  never sees it. `set -g mouse off` hands it back.
-
-### Changed
-
-- **Your files moved to `~/.aragon-agent/`.** Config, sessions, installed skills
-  and the usage counters now live in one directory in your home — on Windows
-  `C:\Users\<you>\.aragon-agent\`, and the same path on macOS and Linux. They
-  used to be split across `%APPDATA%\aragon-agent-nodejs\Config` and
-  `%LOCALAPPDATA%\aragon-agent-nodejs\Data` (or the XDG equivalents), which are
-  correct locations and terrible answers to "where do I change the model?".
-
-  **The move happens once, automatically, on first launch, and prints a line on
-  stderr when it does.** Nothing is deleted: `config.json` is COPIED rather than
-  moved, and the old directories are left where they are, so reinstalling 0.5.0
-  remains lossless. `aragon config home` prints the new location and names the
-  old ones. Once you are satisfied, you can delete them yourself.
-
-  `ARAGON_HOME` relocates the whole tree. It has to be a real environment
-  variable — the path is resolved before any `.env` is read, so putting it in a
-  `.env` will not work. `aragon config home` always prints what is actually in
-  use.
-
-### Added
-
-- **Logging.** Records go to `~/.aragon-agent/logs/aragon-<date>.log` as JSON
-  Lines: startup and exit, config writes, turn boundaries with token counts,
-  tool names with durations, skill loads, and every uncaught error. Files rotate
-  by day and by size (`log.maxFileBytes`, default 5 MiB) and the oldest beyond
-  `log.maxFiles` (default 10) are deleted.
-
-  **`info`, the default, records no conversation content**, so attaching a log
-  to a bug report is safe. `--log-level debug` (or `--verbose`) adds prompts,
-  replies and tool arguments truncated to `log.previewChars`; `trace` adds them
-  in full. Those two write what you typed — check before sharing one.
-
-  API keys are removed at every level by two independent passes: fields whose
-  name looks like a credential are blanked whatever they hold, and every string
-  is scanned both for known key formats and for the literal keys this process is
-  holding — which is what covers a custom endpoint whose key looks like nothing
-  in particular. `log.redactSecrets false` turns both off and warns you on
-  stdout when you set it.
-
-  Nothing is ever uploaded. There is no network path out of this subsystem.
-
-  New commands: `aragon logs path | list | tail [-n N] [--follow] [--level lv]
-  [--json] | clear --yes | open`, and `/logs` inside the TUI. New flags:
-  `--log-level`, `--verbose`, `--log-file` / `--no-log-file`, `--log-dir`. New
-  environment variables: `ARAGON_LOG_LEVEL`, `ARAGON_LOG_FILE`, `ARAGON_LOG_DIR`
-  — these three, unlike `ARAGON_HOME`, can come from a `.env`.
-
-- **`aragon config get <key>` / `list [--json]` / `edit` / `home`.** `get` and
-  `list` mask every secret, `--json` included. `edit` opens `config.json` in
-  `$VISUAL` / `$EDITOR` (`notepad` on Windows), takes a `config.json.bak` first,
-  and re-parses on exit — an invalid edit is reported immediately, and the
-  backup is named in the message.
-
-- **`/reload`** re-reads `config.json` into the running session, for when you
-  have edited it in another window. Refused while a run is in progress: swapping
-  the model mid-turn would let the second half of an answer come from different
-  settings than the first, with nothing afterwards able to explain the result.
-
-- **Log level in the settings screen**, alongside provider / model / thinking.
-  The rest of the log settings — and `redactSecrets` above all — stay
-  command-line-only, so the one switch that can put credentials on disk cannot
-  be flipped with an arrow key.
-
-### Fixed
-
-- **A malformed `config.json` no longer resets everything in silence.** A stray
-  comma used to send the model, theme, timeouts, skills and (as far as you could
-  tell) your API key back to defaults, with nothing anywhere explaining it. The
-  fallback is unchanged — a bad config still never stops the CLI from starting —
-  but it now says so, and records why.
-
-- **Ctrl+C now flushes pending log records in every mode.** The signal handlers
-  only existed in the full-screen branch, so `-p`, the inline renderer and every
-  subcommand took Node's default termination, which does not run exit handlers.
-
-### Added
-
-- **Plan mode.** `Shift+Tab` toggles between `BUILD` (everything as before) and
-  `PLAN`, a read-only research-and-design posture. `/plan [on|off|status]` is a
-  first-class equivalent for terminals that swallow `CSI Z`, and `--plan` /
-  `--no-plan` / `ARAGON_PLAN=1` / `planModeDefault` cover the startup case.
-
-  In `PLAN`, `write_file`, `edit_file`, `bash`, `skill_install` and
-  `skill_create` are refused **at the tool boundary**, so read-only is a
-  property of the wiring rather than a promise in a prompt. `bash` is refused in
-  full, `git status` included: a shell string cannot be classified reliably, and
-  a gate that is right most of the time is worse than one that is always right,
-  because you stop trusting the badge. The refusal names `read_file` / `glob` /
-  `grep` as the alternatives.
-
-  Two tools exist only while a human is attached. `ask_user` renders a
-  keyboard-driven wizard - 1-5 questions, 2-4 options each, exactly one marked
-  `RECOMMENDED`, plus an `Other...` free-text option - where pressing `Enter`
-  through the wizard accepts every recommendation. `submit_plan` renders the
-  plan as a scrollable card: `a` approves, `r` sends written feedback (`<-`
-  returns to the card), `Esc` dismisses. **Approving flips the session to
-  `BUILD` immediately and the same run continues into implementation.**
-
-  Dismissing a plan asks for a better one rather than stopping - the agent is
-  told to refine and resubmit - so the way out of a run is `Esc` twice: the
-  first closes the card, the second aborts the run.
-
-  Toggling mid-run is asymmetric on purpose: `build -> plan` applies at once,
-  `plan -> build` is deferred to the end of the run (the status bar shows
-  `PLAN -> BUILD` meanwhile) so a run launched under a read-only guarantee
-  cannot start writing files because of one stray keypress.
-
-  `aragon -p --plan "..."` registers no question or plan tool - there is nobody
-  to ask - but the read-only gate still applies, so it means "tell me how you
-  would do this, and do not touch my repository".
-
-- Three flat config keys: `planModeDefault` (default `false`),
-  `planModeMaxAskRounds` (default `4`, clamped `[1, 10]`) and
-  `planModeHumanTimeoutMs` (default `1800000`, clamped `[60000, 7200000]`). All
-  three are settable with `aragon config set`. Additive, as always: a config
-  file written by an earlier version loads unchanged.
-
-### Fixed
-
-- A `--confirm` prompt no longer races the idle watchdog. Taking longer than
-  `idleTimeoutMs` over `Proceed? (y/N)` used to abort the run with no
-  explanation; every human wait now suspends the watchdog and restarts it in a
-  `finally`.
-
-- Honor an explicit `NODE_TLS_REJECT_UNAUTHORIZED=0` setting in the CLI and the
-  official npm release workflow while hiding only Node's standard insecure-TLS
-  warning. Other process warnings remain visible.
-
-## 0.5.0
-
-### Breaking
-
-- **The package is renamed `@argon-agent/cli` → `@aragon-agent/cli`.** The brand
-  was always meant to be *Aragon*, matching AragonMesh; the missing `a` was a
-  typo that reached the registry. Install with:
-
-  ```
-  npm uninstall -g @argon-agent/cli
-  npm install -g @aragon-agent/cli
-  ```
-
-  `@argon-agent/cli` is deprecated and receives no further releases. **The
-  executable is still `aragon`** — the command you type does not change.
-
-- **Environment variables are `ARAGON_*`, not `ARGON_*`.** There is no
-  compatibility fallback: `ARGON_MODEL`, `ARGON_PROVIDER`, `ARGON_BASE_URL`,
-  `ARGON_THINKING`, `ARGON_MAX_TOKENS`, `ARGON_THEME`, `ARGON_FULLSCREEN`,
-  `ARGON_SKILLS`, `ARGON_SKILLS_DISABLED`, `ARGON_SKILLS_PATH` and
-  `ARGON_REDUCED_MOTION` are all ignored from this release on. Rename them in
-  your shell profile and CI. Provider keys (`ANTHROPIC_API_KEY`,
-  `OPENAI_API_KEY`, `GOOGLE_API_KEY`, `GEMINI_API_KEY`) are untouched.
-
-- **The project-level skills directory is `.aragon/skills`, not
-  `.argon/skills`.** This one lives in your repository, so rename it yourself:
-
-  ```
-  git mv .argon .aragon
-  ```
-
-  A config file that already persisted the old default keeps working — an
-  explicitly saved `skills.projectDirs` still wins over the default — but the
-  shipped default is now `['.aragon/skills', '.claude/skills']`. Update it with
-  `aragon config set` if you want the new default.
-
-### Added
-
-- **Automatic migration of your user-level state.** On first run, 0.5.0 moves
-  the `env-paths` config and data directories from `argon-agent` to
-  `aragon-agent` — your API key, sessions and installed skills come with it, and
-  each installed skill's `.argon-skill.json` manifest is renamed to
-  `.aragon-skill.json` so `skills update` and `skills uninstall` still recognise
-  it. The migration prints one line to **stderr**, runs once, and is skipped
-  entirely if the new directory already exists. If it fails for any reason the
-  CLI still starts; the old directory is never deleted when a cross-volume copy
-  was needed.
-
-- The opening wordmark now reads `ARAGON` and is 52 columns wide (was 44).
-  Terminals between 52 and 55 columns show the single-line banner rather than a
-  clipped wordmark.
-
-- **Skills.** A skill is a directory holding a `SKILL.md` (YAML frontmatter +
-  Markdown body) plus optional `reference/`, `scripts/` and `assets/`. Skills
-  reach the model through three levels of progressive disclosure: a name +
-  one-line "when to use" catalog in the system prompt (≤ 6 000 bytes total),
-  the full body only when the model calls the `skill` tool, and bundled files
-  only when it reads them with `read_file` / `bash`. A skill therefore costs a
-  line of context rather than its whole body. How many fit in Level 1 depends on
-  description length and language — roughly 30 with terse English descriptions,
-  roughly 10 with Chinese ones at the character cap; past that the catalog
-  truncates and `skill_find` covers the remainder.
-- Four model-facing tools: `skill` (load), `skill_find` (search installed
-  skills), `skill_install` (install from a local directory, git repo, or https
-  `SKILL.md` / `.zip`) and `skill_create` (author a new one from a procedure the
-  agent just worked out).
-- **`aragon skills update <name> | --all`**, with `--dry-run`, `--force` and
-  `--check`. Re-fetches from the source recorded in the install manifest,
-  preserving `installedAt` and recording `updatedAt` / `previousVersion`. Refuses
-  before downloading anything when the installed copy has local edits, and
-  re-validates the source against the *current* `skills.allowedHosts` rather than
-  the one in force at install time. Not exposed to the model.
-- **Catalog ranking.** Level 1 entries are ordered by scope, then by how recently
-  and often each skill was used, so truncation drops what you do not use rather
-  than what sorts last alphabetically. With no usage data the order is unchanged.
-- **`skill_find`**, advertised in the prompt only when the catalog actually
-  truncated. Searches installed skills by name, description and keyword; never
-  reaches the network, never returns `activation: manual` skills, and tells the
-  model to ask for a source rather than invent one when nothing matches.
-- **Cross-process install lock.** Install / create / remove / update take a
-  per-directory advisory lock, closing a race in which two concurrent installs
-  could interleave their atomic-replace steps and delete a skill with no error.
-  Self-expires after 60 s; waits at most 5 s; only ever released by its owner.
-- **Load-time integrity.** Discovery re-checks `SKILL.md` against the sha256
-  recorded at install, at no extra I/O. `skills.integrity` selects
-  `off` / `warn` (default) / `strict`.
-- **Local usage counters** at `<data>/skill-usage.json` — skill name, count and
-  timestamp only, never transmitted, disabled with `skills.usageTracking=false`.
-  Automatically injected `activation: always` skills are not counted.
-- Config keys `skills.integrity` and `skills.usageTracking`; `aragon skills list
-  --sort=recent` and `/skills list --sort=recent`.
-- Every usable skill also becomes a slash command: `/<skill-name> [args]`, with
-  `$ARGUMENTS` / `$1..$9` substitution. On a name clash the built-in command
-  always wins and the skill is reachable as `/skill:<name>`.
-- `/skills` management: `list`, `info`, `install`, `remove`, `enable`,
-  `disable`, `reload`, `create`, `trust`, `untrust`.
-- `aragon skills …` non-interactive equivalents plus `path` and `doctor`.
-  Exit codes follow `config set`: `0` ok, `1` run-time failure, `2` usage.
-- Four discovery scopes in ascending precedence: bundled (`<pkg>/skills`), user
-  (`<data>/skills`), project (`<cwd>/.aragon/skills` and, read-only,
-  `<cwd>/.claude/skills` for Claude Code interop), and `ARAGON_SKILLS_PATH`.
-- New flags `--no-skills`, `--skill <name>` (repeatable) and `--skills-yes`;
-  env `ARAGON_SKILLS`, `ARAGON_SKILLS_PATH`, `ARAGON_SKILLS_DISABLED`; config keys
-  `skills.enabled`, `skills.requireApproval`, `skills.catalogMaxBytes`,
-  `skills.bodyMaxBytes`.
-- One bundled skill, `skill-creator`, documenting how to write a good one.
-- New runtime dependency: `fflate` (~30 KB, MIT, zero transitive deps) for zip
-  extraction. `@aragon-agent/core` gains no dependency.
-- **Release tooling for the scope change.** `npm run verify:brand` scans every
-  file that `npm pack` would put in the tarball — README and `dist/` included —
-  and blocks the release on any surviving `argon` reference, with only the four
-  documented exceptions (the two CHANGELOGs and the legacy-state migration
-  module, which hold the old names by definition). `packages/cli` also gains a
-  `prepublishOnly: npm run build`, so a publish that bypasses
-  `publish-latest.ps1` can no longer ship a `dist/` that is out of step with the
-  sources. `deprecate-legacy.ps1` retires `@argon-agent/*` on the registry, and
-  refuses to do so until the replacements are actually published.
-
-### Changed
-
-- The globally installed executable is now `aragon`. The previous `argon` and
-  `argon-agent` aliases are no longer installed.
-- `config/store.ts` now deep-merges the `skills` section on both read and write,
-  the same treatment `apiKeys` already received. Without it a partial patch such
-  as the one `/skills disable` sends would replace the whole section and
-  silently discard `trustedProjectDirs`, `allowedHosts` and `requireApproval`.
-- `slashSuggestions` accepts `-` and `:`, so kebab-case and `skill:`-namespaced
-  commands autocomplete. Previously `/my-sk` produced no popup at all.
-- `AgentController` now has a single `agent.setSystemPrompt()` call site, so a
-  `/cwd` change can no longer drop the skill catalog out of the prompt.
-- With skills off or none installed, the system prompt and the 7-tool array are
-  byte-identical to the previous release.
-- Added a repository-level PowerShell release workflow that automatically
-  updates CLI and Core versions, synchronizes their dependency and lockfile,
-  verifies both tarballs, and publishes them in dependency order.
-
-### Security
-
-- Installing a skill requires an explicit human approval that **probes for a
-  human first and refuses when there is none**. Under `-p` there is no TUI and
-  therefore no approver, so `skill_install` is refused with an actionable
-  message rather than writing a third-party directory unattended. Use
-  `--skills-yes` (or `skills.requireApproval=false`) to opt out deliberately.
-- Project skill directories require a one-time trust confirmation before they
-  are loaded — cloning an unfamiliar repository does not grant it the ability
-  to inject instructions into your session.
-- Git is invoked only via `execFile` with an argv array and `shell: false`, and
-  owner / repo / ref / subdirectory fragments are whitelisted and refused if
-  they begin with `-`. A leading dash matters even with a pure argv array:
-  `--upload-pack=<program>` makes git execute that program.
-- Zip extraction is streamed and gated on **actually written** bytes, per-entry
-  size, compression ratio and entry count, all of which can abort mid-archive.
-  The size a zip *declares* is written by whoever built it and is never trusted.
-  Path traversal, absolute entries, symlinks and Windows device names are
-  refused, and a rejected archive is removed rather than left half-extracted.
-- Network fetches are `https:` only, restricted to `skills.allowedHosts`,
-  re-checked on every redirect (max 3), size-capped, and refuse IP literals and
-  loopback.
-- Nothing a skill ships is executed at install time, and the executable bit is
-  not preserved. Scripts run only when the model invokes `bash` explicitly.
-  There is no sandbox: approval blocks *silent* installation, it does not make
-  a skill you approved safe.
-
-## 0.3.0
-
-A full-screen TUI release. `@argon-agent/core` is untouched, no new runtime
-dependency is added, and the headless/print contract, exit codes, and
-slash-command semantics are unchanged. The 0.2.0 inline renderer remains
-available in full via `--no-fullscreen`.
-
-### Added
-
-- **Full-screen mode (default).** `aragon` now takes over the terminal's
-  alternate screen buffer — the same mechanism `vim` / `htop` / `lazygit` use.
-  Your shell history is covered, not erased, and comes back untouched on exit.
-  The frame is a fixed `rows - 1` tall, so **the composer and the status bar sit
-  at the physical bottom of the screen from the very first frame**: empty
-  session, long session, mid-scroll, or overlay open.
-- **Brand region.** A six-row gradient ASCII wordmark on a roomy empty session,
-  degrading to a banner, then a single-line bar, then a bare wordmark as space
-  runs out. Row 1 always begins with the brand glyph.
-- **Self-drawn scrolling.** `PgUp` / `PgDn` by the page, `Shift+↑` / `Shift+↓` by
-  the line. The viewport auto-follows new output while pinned to the bottom;
-  scrolling away shows `↑N` in the status bar plus a "N new lines" hint, and
-  submitting a message always re-pins.
-- **Exit replay.** After leaving the alternate screen the session is replayed
-  into the normal buffer as plain, colorless text, so the conversation does not
-  evaporate with the screen. Turn it off with `--no-exit-transcript`.
-- **New flags** `--fullscreen` / `--no-fullscreen` / `--no-exit-transcript`, the
-  env var `ARGON_FULLSCREEN=0|1`, and the config keys `fullscreen`,
-  `exitTranscript`, and `transcriptWindow`.
-- **Automatic downgrade.** A non-TTY stdout, `TERM=dumb`, CI, and terminals under
-  12 rows / 40 columns fall back to the inline renderer. Only the non-TTY gate is
-  un-overridable — `--fullscreen` beats the rest.
-
-### Changed
-
-- The status bar lost its round border and is now exactly one row; it had been
-  spending an eighth of a 24-row terminal framing a single line of text.
-- The toast strip holds a fixed row in full-screen mode, so the transcript no
-  longer jumps as toasts appear and expire.
-- The composer is a rounded frame whose border color reports state (idle, has a
-  draft, running, blurred by an overlay), with the completion popup above it.
-- `Ctrl+L` repaints the frame instead of writing a clear sequence. Ink dedupes
-  identical output at two separate gates, so under a fixed frame the old
-  approach erased the screen and then declined to redraw it.
-- `Shift+↑` / `Shift+↓` no longer recall prompt history — they scroll.
-- Full-screen mode routes `console.*` into the transcript as notices rather than
-  letting Ink write them straight to stdout, which corrupts the frame's line
-  accounting.
-
-### Known trade-offs
-
-- The terminal's native scrollback and mouse wheel do not scroll the transcript
-  in full-screen mode; use `PgUp` / `PgDn`, or run with `--no-fullscreen`.
-- Mouse tracking is deliberately left off: enabling it costs text selection and
-  copy in most terminals.
-- Should a crash ever strand your terminal on the alternate screen, `reset`
-  restores it. Four independent restore paths exist to prevent that: normal
-  exit, `process.exit`, `SIGINT` / `SIGTERM` / `SIGHUP`, and Ink's own signal
-  handling.
-
-## 0.2.0
-
-A design-elevation & HCI-hardening release. No breaking changes: `@argon-agent/core`
-is untouched, no new runtime dependency is added, and the headless/print contract,
-exit codes, config keys, and slash-command semantics from 0.1.0 are unchanged.
-
-### Added
-
-- **Real theming engine.** Distinct `dark` / `light` palettes with an `auto`
-  resolution (`auto → dark`), color degradation across terminal depth
-  (truecolor → 256 → 16 → monochrome), and an ASCII glyph fallback for terminals
-  without Unicode. Honors `NO_COLOR`, `FORCE_COLOR`, `--no-color`, and
-  `TERM=dumb`. Switch live with `/theme <auto|dark|light>` (persisted).
-- **Elegant chrome.** A gradient wordmark header that collapses to a slim sticky
-  bar after the first turn, a first-run **Welcome / empty-state** card, and a
-  status bar with a colored **context gauge** (threshold colors), a **tokens/sec**
-  read-out while running, and a contextual hint.
-- **Legible tool output.** Colored unified diffs (green adds / red removes) and
-  per-tool rich previews (`edit_file`/`write_file`/`read_file`/`bash`/`list_dir`/
-  `glob`). Long previews collapse to 8 lines and expand with `Ctrl+O` or
-  `/expand [n]`.
-- **Autocomplete.** A slash-command palette and `@file` path completion popup
-  (`Tab`/`→` to complete, `Up`/`Down` to move, `Esc` to close).
-- **Full line editing.** Home/End, word jump/delete, kill-to-start/end, and
-  multi-line vertical cursor navigation, with prompt-history recall at the edges.
-  Unknown control/escape sequences are dropped instead of inserted.
-- **Reliability under load.** Ink `<Static>` finalization for settled entries and
-  a streaming delta coalescer, so long/fast sessions stay flicker-free.
-- **Calm feedback.** Ephemeral, auto-dismissing **toasts** for transient acks;
-  the transcript keeps only durable content (messages, tool cards, run errors).
-- `reducedMotion` config (also `ARGON_REDUCED_MOTION`; implied by `--no-color`)
-  replaces spinners with a static glyph.
-
-### Changed
-
-- History scrollback now uses the **native terminal scrollback** that `<Static>`
-  prints into (this supersedes the never-implemented `PgUp`/`PgDn` promise).
-
-## 0.1.0
-
-Initial release — a Claude-Code / Codex-style interactive terminal UI (TUI) on
-top of `@argon-agent/core`.
-
-### Added
-
-- **Interactive TUI** (React + Ink): gradient header, streaming transcript with
-  markdown + syntax highlighting, collapsible thinking blocks, live tool-call
-  cards, a status bar (model / context % / tokens / cost / elapsed), and modal
-  overlays (settings, model picker, help, confirm).
-- **Built-in toolset** wired into the core agent at full permission:
-  `read_file`, `write_file`, `edit_file`, `list_dir`, `glob`, `grep`, `bash`.
-- **Layered configuration** (defaults → user file → env/`.env` → flags) with
-  live in-TUI editing of provider / model / base URL / API keys / thinking level
-  / max tokens. Secrets are masked and the config file is written `0600` on POSIX.
-- **One-shot / print mode** (`argon -p`) for scripting and piping, plus
-  `argon config` / `argon config set` / `argon config path` / `argon models`.
-- **Session control**: abort (Esc), steer-while-running, follow-up queue,
-  double-Ctrl-C exit, `/save` / `/resume` JSON sessions.
-- **Timeout invariant** (`idleTimeout ≥ toolTimeout`) so a long single tool run
-  is never killed by the idle watchdog.
-- **Never-silent failures**: pre-flight API-key validation, error-StreamEvent
-  rendering, and a guard that surfaces a swallowed agent error instead of a
-  blank no-op (headless exits `1`/`2` accordingly).
+# Changelog
+
+All notable changes to `@aragon-agent/cli` are documented here. Entries at
+`0.4.x` and earlier refer to the package by its former name, `@argon-agent/cli`
+— those releases really were published under that name, so they are left as they
+were written.
+
+## Unreleased
+
+### Added
+
+- **Following the plan through, on a budget you can do arithmetic on.** A run
+  that ended with steps outstanding used to print one sentence and stop. It now
+  asks three questions the CLI already knew the answers to — did you abort it,
+  did it error, did the list move — and does one of three things.
+
+  With the default `notify` the sentence is unchanged, except that a run **you**
+  cancelled with `Esc` now says nothing at all: being told what you just
+  interrupted is the CLI answering a question nobody asked.
+
+  With `/todo follow auto` it continues the plan itself, after announcing
+  `Continuing with 4 remaining steps in 3s - Esc to stop.` Auto-continuation was
+  refused last release as "an unbounded cost loop wearing a helpful hat", and
+  that judgement stands — what changed is that the loop is now bounded first.
+  A continuation that completes no step buys exactly one more attempt; a single
+  plan is continued at most 25 times however productive it looks; and a re-plan
+  forgives the first counter but never the second, so a model that reshapes its
+  list every turn cannot lift the ceiling. A run that ended with an error never
+  auto-continues in any mode. `Esc` cancels, and so does typing anything.
+
+  Whatever sends the continuation — the timer or `/todo continue` — now sends
+  the numbered list of open steps rather than the words "continue with the
+  remaining todo items", so a plan whose `todo_write` has scrolled out of the
+  context window is still followed exactly. Neither path records that text in
+  your prompt history any more; it is not something you typed.
+
+  Under `-p` there is no grace window, because there is nobody there to use it,
+  which is precisely why the two counters rather than the human are the
+  protection there. `[todo] continuing (3 steps left)` and
+  `[todo] 3 steps unfinished` go to stderr, suppressed by `--quiet`, and an
+  unfinished plan still never changes the exit code.
+
+  New surfaces: `/todo follow <notify|auto|off>`; `--todo-follow <mode>`;
+  `ARAGON_TODO_FOLLOW`; and `todo.followThrough` in `config.json`. The default
+  is `notify`, so a session that does not ask for any of this behaves as it did.
+
+- **A plan strip for inline mode.** Inline mode has no fixed frame and so no
+  rail, which left every pipe, every `CI=1`, every `TERM=dumb` terminal and
+  every window under twelve rows able to see `todo 3/7` but not *which* step was
+  running. There is now a one-row strip under the transcript —
+  `todo 3/7  >  Adding the rail to AppShell        +2 done` — windowed on the
+  same step the rail would have anchored on. It truncates rather than wrapping
+  and is exactly one row at every width, so the composer does not move.
+  `--no-todo-panel` hides it along with the rail.
+
+### Changed
+
+- `npm run typecheck` now covers the test tree in both packages. `tsconfig.json`
+  excludes `__tests__` so the build never emits fixtures, and vitest transpiles
+  without typechecking — between the two, a widened required field could break
+  ten test files while `npm run build` and `npm test` were both green. Twelve
+  such errors had accumulated; all twelve were fixture drift and all twelve are
+  repaired, with no suppressions and no production type relaxed to accommodate a
+  fixture.
+
+- **TODO planning, and a rail to watch it in.** For work with three or more
+  distinct steps the agent now keeps a visible plan: it writes a checklist with
+  a new `todo_write` tool, marks exactly one item in progress, and ticks it off
+  before starting the next. In full-screen mode the list is rendered as a
+  right-hand rail about a fifth of the terminal wide, windowed around the step
+  being worked on rather than sliced from the top. Ask for something small and
+  nothing appears — the prompt tells the model not to plan work it can finish in
+  one or two steps, and a one-item list against an empty plan is refused
+  outright, so a session that never plans has byte-identical layout to a build
+  without this feature.
+
+  The list is a projection of what the model believes, and that single rule
+  decides everything else: `/clear` keeps it (the conversation is still there),
+  `/reset` drops it, `/save` writes it and `/resume` restores it — and resuming
+  a session that carries no list CLEARS the current one rather than leaving a
+  plan on screen whose conversation has just been replaced. A finished plan
+  survives to the start of your next message so you get to see `7/7 done`; an
+  unfinished one survives "continue" and "now do the rest", then expires after
+  three unrelated turns rather than holding a fifth of the screen for the rest
+  of the session. A run that ends with items left over produces a notice and
+  `/todo continue`; nothing auto-continues on your behalf.
+
+  "One step at a time" is enforced by structure rather than asked for in a
+  prompt: any payload with two in-progress items is repaired down to one, and a
+  list with none promotes the first unfinished item. Whatever the model sends,
+  the panel has exactly one current row.
+
+  New surfaces: the `todo_write` tool; `/todo [status|on|off|panel on|off|clear|
+  continue]`; `--todo` / `--no-todo` and `--todo-panel` / `--no-todo-panel`;
+  `ARAGON_TODO=0`; and `todo.enabled` / `todo.panel` in `config.json` (a third
+  key, `todo.followThrough`, arrived with the follow-through entry above).
+  `panel` is
+  separate from `enabled` on purpose — a screen-reader user wants the planning
+  discipline without the column, and the system prompt varies one sentence to
+  match. Under `-p` the plan goes to stderr as `[todo] 3/7 <step>` lines,
+  suppressed by `--quiet`. Below 80 columns, behind an overlay, in inline mode
+  or on a short terminal the rail is not mounted and the counter appears in the
+  status bar instead; the transcript keeps at least 62 columns at every width.
+
+- **Output token limits that cannot themselves fail a run.** Every model and
+  every provider now defaults to 64000 output tokens, and that number is
+  configurable from the TUI, from a flag, from `ARAGON_MAX_TOKENS`, and by hand
+  in `~/.aragon-agent/config.json`. Leave it alone and it stays 64000.
+
+  What is new is that the number is an *ambition*. `gpt-4o` caps at 16384 and
+  `gemini-1.5-pro` at 8192; sending 64000 to either is an HTTP 400 that ends the
+  turn with a raw provider string in the transcript. The cap is now clamped down
+  to whatever the target model actually accepts, from a per-model table plus
+  whatever the provider's own model list reports. For a model nothing knows — a
+  proxy, a `--base-url` endpoint, something that shipped last week — the request
+  goes out at 64000, and if the provider objects, `aragon` reads the real ceiling
+  out of the error text, repairs the request, sends it exactly once more, and
+  remembers the answer for the rest of the session. One warning line; the run
+  continues.
+
+  Two combinations that were a guaranteed 400 on every request are fixed with
+  it: `--thinking xhigh` asks for a 65536-token budget while Anthropic requires
+  `max_tokens` to be strictly greater than it, and OpenAI's reasoning family
+  (`o1`, `o3`, `gpt-5`) rejects the `max_tokens` parameter name outright in
+  favour of `max_completion_tokens`.
+
+  New surfaces: `/max-tokens [<n>|auto|default]`, which with no argument reports
+  the setting *and* the effective cap for the live model; an `Effective:` line
+  under the settings screen's `Max tokens` field, so a value the model will not
+  honour is visible before you save it; `--max-tokens auto`; and
+  `aragon config set maxTokens <n|auto|default>`, which echoes the value that was
+  actually stored rather than the one you typed.
+
+- **Team subagents.** The agent can now hand independent parts of a job to up to
+  five short-lived subagents that run in parallel, then read one combined report
+  of what each of them found. It decides for itself whether to delegate, so a
+  session that never calls the new `task` tool is byte-for-byte the session that
+  existed before. On by default; `--no-team` or `team.enabled: false` turns it
+  off, and `aragon config set team.maxSubagents <n>` sets the width (1-10; the
+  10 is a hard ceiling no config file can raise).
+
+  A subagent is a full agent with the same tools and working directory but no
+  memory of your conversation, so its brief has to be self-contained. It cannot
+  delegate further and it cannot ask you anything. Plan mode and a skill's
+  `allowed-tools` ceiling both reach one level down, so delegating is never a
+  way around either; `--confirm` queues subagent confirmations one at a time and
+  labels each with the subagent that is asking.
+
+  Subagents can message each other with `team_send` / `team_wait`, delivered by
+  attaching the message to the recipient's next tool result rather than
+  interrupting it. The limits are deliberate — 6 messages each, one every 15
+  seconds, 24 per dispatch — and every refusal is a plain result naming the
+  limit rather than an error, because an error invites the retry the limits
+  exist to prevent.
+
+  While a dispatch runs, a roster sits between the transcript and the composer
+  and the status bar carries `agents 3/5`; both disappear when it finishes and
+  the transcript keeps a card you can expand with `Ctrl+O`. `Esc` aborts every
+  subagent and returns the partial report. Under `-p` the transitions go to
+  stderr and the subagents' tokens are folded into the `[usage]` footer, so the
+  cost readout cannot under-report what the team spent.
+
+  Full documentation, including the limits table and how team mode interacts
+  with plan mode, skills and `--confirm`, is in the README.
+
+- **The subagent roster now shows what each subagent is doing, and shows the
+  ones that are working.** Where every row used to say `thinking` for minutes at
+  a time, it now says `bash: npm test -w cli`, `read: src/api/routes.ts`,
+  `waiting for a2`, or the tail of the sentence the subagent is currently
+  writing. On a narrow terminal the same row falls back to a file name and a
+  program name rather than wrapping, and the elapsed clock keeps its place at
+  every width.
+
+  The five visible rows are now the five that matter: whatever is running comes
+  first, then whatever is queued, then the most recent results. Above five
+  subagents the old panel showed the five that had finished first and hid
+  everything still working behind `+3 more`, which is the opposite of what the
+  roster is for. `+3 more` now says how many of the hidden ones are still going.
+
+- **A subagent no longer waits two minutes for a message nobody can send.**
+  `team_wait` now checks whether anyone could actually answer before it blocks:
+  if the teammate it named has already finished, does not exist, or is itself
+  waiting in a way that cannot be released in time, it returns straight away and
+  says which. Nothing is refused that could still have been answered — including
+  by a third teammate further down the chain — and the subagent is told what to
+  do instead rather than handed an error.
+
+- **A subagent whose very first request dies on a rate limit is retried once.**
+  Only a genuine cold start qualifies: no turn completed and no tool ran, so
+  there is nothing to undo. It restarts after two seconds, the roster says
+  `starting (retry)`, and the report notes `retried 1x`. Pressing `Esc`, a
+  timeout, or any subagent that had already begun work is never retried.
+
+### Changed
+
+- **`"maxTokens": null` in `config.json` now means AUTO** — use each model's own
+  ceiling, never above 64000. It previously resolved to 64000 by accident (the
+  layered resolver skipped `null`), and there was no way to express AUTO through
+  any supported write path. If you have a `null` there today, the only difference
+  is a downward clamp on models whose real ceiling is below 64000 — the direction
+  that prevents failures rather than causing them. Absent still means 64000, and
+  an explicit number still means that number.
+
+- **`config.json` holds settings again.** The prompts you type are no longer
+  stored in it. They move to `~/.aragon-agent/prompt-history.jsonl` — one JSON
+  object per line, `0600` on POSIX — and the submit counter and the "notice
+  already shown" flag move to `~/.aragon-agent/state.json`. `↑` and `↓` behave
+  exactly as before.
+
+  Two things get better. Opening `config.json` to change your model no longer
+  means scrolling past a transcript of your own typing, and copying it to
+  another machine no longer carries your prompts along. And submitting a message
+  no longer rewrites the file that holds your API keys: `config.json` is written
+  when you change a setting, and at no other time.
+
+  **Your history and counters are migrated automatically, once, at the next
+  launch.** Nothing is printed, because nothing changes for you. The dead
+  `recentModels` key — which nothing has ever written — is dropped.
+
+  If you go back to 0.5.x after upgrading, that version does not know about the
+  new file and `↑` will look empty. Nothing has been lost: the entries are still
+  in `prompt-history.jsonl`, and upgrading again brings them back.
+
+### Added
+
+- **`aragon history`** — `path`, `list` (`-n`, `--json`) and `clear --yes` for
+  the prompt history, alongside the existing `aragon logs` commands. Entries are
+  stored verbatim, so `clear` is how you erase them; `aragon config set
+  historyEnabled false` stops new ones being recorded without deleting or hiding
+  what is already there.
+
+- **The mouse wheel scrolls what is under the pointer.** In full-screen mode the
+  wheel now scrolls the transcript three rows per notch (a page with `Shift`),
+  scrolls an open overlay when the pointer is over one, and steps prompt history
+  one entry per notch when the pointer is over the input box — the same code
+  path `↑` / `↓` use, so it inherits the rule that an in-progress draft is never
+  overwritten. A slim rail on the viewport's right edge shows where you are in
+  the conversation.
+
+  **This fixes a destructive bug.** Previously the wheel recalled prompt history
+  no matter where the pointer was, because the alternate screen makes terminals
+  translate each notch into arrow keys. Wheeling while composing a message
+  silently replaced the draft with an old prompt, and nothing scrolled.
+
+  **Selecting text with the mouse now requires `Shift`+drag** in most terminals.
+  That is the standard convention for "an application is tracking the mouse" and
+  it applies to everyone, including people who never scroll with the wheel — so
+  the first session says so once, in the transcript, and never again. Turn the
+  whole feature off with `--no-mouse`, `ARAGON_MOUSE=0`, or
+  `aragon config set mouse false`; the wheel then does nothing rather than
+  reverting to the old behaviour. Inline mode (`--no-fullscreen`) is untouched:
+  your terminal's own scrollback already does the right thing there.
+
+  Under `tmux` with `mouse on`, tmux keeps the wheel for itself and the app
+  never sees it. `set -g mouse off` hands it back.
+
+### Changed
+
+- **Your files moved to `~/.aragon-agent/`.** Config, sessions, installed skills
+  and the usage counters now live in one directory in your home — on Windows
+  `C:\Users\<you>\.aragon-agent\`, and the same path on macOS and Linux. They
+  used to be split across `%APPDATA%\aragon-agent-nodejs\Config` and
+  `%LOCALAPPDATA%\aragon-agent-nodejs\Data` (or the XDG equivalents), which are
+  correct locations and terrible answers to "where do I change the model?".
+
+  **The move happens once, automatically, on first launch, and prints a line on
+  stderr when it does.** Nothing is deleted: `config.json` is COPIED rather than
+  moved, and the old directories are left where they are, so reinstalling 0.5.0
+  remains lossless. `aragon config home` prints the new location and names the
+  old ones. Once you are satisfied, you can delete them yourself.
+
+  `ARAGON_HOME` relocates the whole tree. It has to be a real environment
+  variable — the path is resolved before any `.env` is read, so putting it in a
+  `.env` will not work. `aragon config home` always prints what is actually in
+  use.
+
+### Added
+
+- **Logging.** Records go to `~/.aragon-agent/logs/aragon-<date>.log` as JSON
+  Lines: startup and exit, config writes, turn boundaries with token counts,
+  tool names with durations, skill loads, and every uncaught error. Files rotate
+  by day and by size (`log.maxFileBytes`, default 5 MiB) and the oldest beyond
+  `log.maxFiles` (default 10) are deleted.
+
+  **`info`, the default, records no conversation content**, so attaching a log
+  to a bug report is safe. `--log-level debug` (or `--verbose`) adds prompts,
+  replies and tool arguments truncated to `log.previewChars`; `trace` adds them
+  in full. Those two write what you typed — check before sharing one.
+
+  API keys are removed at every level by two independent passes: fields whose
+  name looks like a credential are blanked whatever they hold, and every string
+  is scanned both for known key formats and for the literal keys this process is
+  holding — which is what covers a custom endpoint whose key looks like nothing
+  in particular. `log.redactSecrets false` turns both off and warns you on
+  stdout when you set it.
+
+  Nothing is ever uploaded. There is no network path out of this subsystem.
+
+  New commands: `aragon logs path | list | tail [-n N] [--follow] [--level lv]
+  [--json] | clear --yes | open`, and `/logs` inside the TUI. New flags:
+  `--log-level`, `--verbose`, `--log-file` / `--no-log-file`, `--log-dir`. New
+  environment variables: `ARAGON_LOG_LEVEL`, `ARAGON_LOG_FILE`, `ARAGON_LOG_DIR`
+  — these three, unlike `ARAGON_HOME`, can come from a `.env`.
+
+- **`aragon config get <key>` / `list [--json]` / `edit` / `home`.** `get` and
+  `list` mask every secret, `--json` included. `edit` opens `config.json` in
+  `$VISUAL` / `$EDITOR` (`notepad` on Windows), takes a `config.json.bak` first,
+  and re-parses on exit — an invalid edit is reported immediately, and the
+  backup is named in the message.
+
+- **`/reload`** re-reads `config.json` into the running session, for when you
+  have edited it in another window. Refused while a run is in progress: swapping
+  the model mid-turn would let the second half of an answer come from different
+  settings than the first, with nothing afterwards able to explain the result.
+
+- **Log level in the settings screen**, alongside provider / model / thinking.
+  The rest of the log settings — and `redactSecrets` above all — stay
+  command-line-only, so the one switch that can put credentials on disk cannot
+  be flipped with an arrow key.
+
+### Fixed
+
+- **A malformed `config.json` no longer resets everything in silence.** A stray
+  comma used to send the model, theme, timeouts, skills and (as far as you could
+  tell) your API key back to defaults, with nothing anywhere explaining it. The
+  fallback is unchanged — a bad config still never stops the CLI from starting —
+  but it now says so, and records why.
+
+- **Ctrl+C now flushes pending log records in every mode.** The signal handlers
+  only existed in the full-screen branch, so `-p`, the inline renderer and every
+  subcommand took Node's default termination, which does not run exit handlers.
+
+### Added
+
+- **Plan mode.** `Shift+Tab` toggles between `BUILD` (everything as before) and
+  `PLAN`, a read-only research-and-design posture. `/plan [on|off|status]` is a
+  first-class equivalent for terminals that swallow `CSI Z`, and `--plan` /
+  `--no-plan` / `ARAGON_PLAN=1` / `planModeDefault` cover the startup case.
+
+  In `PLAN`, `write_file`, `edit_file`, `bash`, `skill_install` and
+  `skill_create` are refused **at the tool boundary**, so read-only is a
+  property of the wiring rather than a promise in a prompt. `bash` is refused in
+  full, `git status` included: a shell string cannot be classified reliably, and
+  a gate that is right most of the time is worse than one that is always right,
+  because you stop trusting the badge. The refusal names `read_file` / `glob` /
+  `grep` as the alternatives.
+
+  Two tools exist only while a human is attached. `ask_user` renders a
+  keyboard-driven wizard - 1-5 questions, 2-4 options each, exactly one marked
+  `RECOMMENDED`, plus an `Other...` free-text option - where pressing `Enter`
+  through the wizard accepts every recommendation. `submit_plan` renders the
+  plan as a scrollable card: `a` approves, `r` sends written feedback (`<-`
+  returns to the card), `Esc` dismisses. **Approving flips the session to
+  `BUILD` immediately and the same run continues into implementation.**
+
+  Dismissing a plan asks for a better one rather than stopping - the agent is
+  told to refine and resubmit - so the way out of a run is `Esc` twice: the
+  first closes the card, the second aborts the run.
+
+  Toggling mid-run is asymmetric on purpose: `build -> plan` applies at once,
+  `plan -> build` is deferred to the end of the run (the status bar shows
+  `PLAN -> BUILD` meanwhile) so a run launched under a read-only guarantee
+  cannot start writing files because of one stray keypress.
+
+  `aragon -p --plan "..."` registers no question or plan tool - there is nobody
+  to ask - but the read-only gate still applies, so it means "tell me how you
+  would do this, and do not touch my repository".
+
+- Three flat config keys: `planModeDefault` (default `false`),
+  `planModeMaxAskRounds` (default `4`, clamped `[1, 10]`) and
+  `planModeHumanTimeoutMs` (default `1800000`, clamped `[60000, 7200000]`). All
+  three are settable with `aragon config set`. Additive, as always: a config
+  file written by an earlier version loads unchanged.
+
+### Fixed
+
+- A `--confirm` prompt no longer races the idle watchdog. Taking longer than
+  `idleTimeoutMs` over `Proceed? (y/N)` used to abort the run with no
+  explanation; every human wait now suspends the watchdog and restarts it in a
+  `finally`.
+
+- Honor an explicit `NODE_TLS_REJECT_UNAUTHORIZED=0` setting in the CLI and the
+  official npm release workflow while hiding only Node's standard insecure-TLS
+  warning. Other process warnings remain visible.
+
+## 0.5.0
+
+### Breaking
+
+- **The package is renamed `@argon-agent/cli` → `@aragon-agent/cli`.** The brand
+  was always meant to be *Aragon*, matching AragonMesh; the missing `a` was a
+  typo that reached the registry. Install with:
+
+  ```
+  npm uninstall -g @argon-agent/cli
+  npm install -g @aragon-agent/cli
+  ```
+
+  `@argon-agent/cli` is deprecated and receives no further releases. **The
+  executable is still `aragon`** — the command you type does not change.
+
+- **Environment variables are `ARAGON_*`, not `ARGON_*`.** There is no
+  compatibility fallback: `ARGON_MODEL`, `ARGON_PROVIDER`, `ARGON_BASE_URL`,
+  `ARGON_THINKING`, `ARGON_MAX_TOKENS`, `ARGON_THEME`, `ARGON_FULLSCREEN`,
+  `ARGON_SKILLS`, `ARGON_SKILLS_DISABLED`, `ARGON_SKILLS_PATH` and
+  `ARGON_REDUCED_MOTION` are all ignored from this release on. Rename them in
+  your shell profile and CI. Provider keys (`ANTHROPIC_API_KEY`,
+  `OPENAI_API_KEY`, `GOOGLE_API_KEY`, `GEMINI_API_KEY`) are untouched.
+
+- **The project-level skills directory is `.aragon/skills`, not
+  `.argon/skills`.** This one lives in your repository, so rename it yourself:
+
+  ```
+  git mv .argon .aragon
+  ```
+
+  A config file that already persisted the old default keeps working — an
+  explicitly saved `skills.projectDirs` still wins over the default — but the
+  shipped default is now `['.aragon/skills', '.claude/skills']`. Update it with
+  `aragon config set` if you want the new default.
+
+### Added
+
+- **Automatic migration of your user-level state.** On first run, 0.5.0 moves
+  the `env-paths` config and data directories from `argon-agent` to
+  `aragon-agent` — your API key, sessions and installed skills come with it, and
+  each installed skill's `.argon-skill.json` manifest is renamed to
+  `.aragon-skill.json` so `skills update` and `skills uninstall` still recognise
+  it. The migration prints one line to **stderr**, runs once, and is skipped
+  entirely if the new directory already exists. If it fails for any reason the
+  CLI still starts; the old directory is never deleted when a cross-volume copy
+  was needed.
+
+- The opening wordmark now reads `ARAGON` and is 52 columns wide (was 44).
+  Terminals between 52 and 55 columns show the single-line banner rather than a
+  clipped wordmark.
+
+- **Skills.** A skill is a directory holding a `SKILL.md` (YAML frontmatter +
+  Markdown body) plus optional `reference/`, `scripts/` and `assets/`. Skills
+  reach the model through three levels of progressive disclosure: a name +
+  one-line "when to use" catalog in the system prompt (≤ 6 000 bytes total),
+  the full body only when the model calls the `skill` tool, and bundled files
+  only when it reads them with `read_file` / `bash`. A skill therefore costs a
+  line of context rather than its whole body. How many fit in Level 1 depends on
+  description length and language — roughly 30 with terse English descriptions,
+  roughly 10 with Chinese ones at the character cap; past that the catalog
+  truncates and `skill_find` covers the remainder.
+- Four model-facing tools: `skill` (load), `skill_find` (search installed
+  skills), `skill_install` (install from a local directory, git repo, or https
+  `SKILL.md` / `.zip`) and `skill_create` (author a new one from a procedure the
+  agent just worked out).
+- **`aragon skills update <name> | --all`**, with `--dry-run`, `--force` and
+  `--check`. Re-fetches from the source recorded in the install manifest,
+  preserving `installedAt` and recording `updatedAt` / `previousVersion`. Refuses
+  before downloading anything when the installed copy has local edits, and
+  re-validates the source against the *current* `skills.allowedHosts` rather than
+  the one in force at install time. Not exposed to the model.
+- **Catalog ranking.** Level 1 entries are ordered by scope, then by how recently
+  and often each skill was used, so truncation drops what you do not use rather
+  than what sorts last alphabetically. With no usage data the order is unchanged.
+- **`skill_find`**, advertised in the prompt only when the catalog actually
+  truncated. Searches installed skills by name, description and keyword; never
+  reaches the network, never returns `activation: manual` skills, and tells the
+  model to ask for a source rather than invent one when nothing matches.
+- **Cross-process install lock.** Install / create / remove / update take a
+  per-directory advisory lock, closing a race in which two concurrent installs
+  could interleave their atomic-replace steps and delete a skill with no error.
+  Self-expires after 60 s; waits at most 5 s; only ever released by its owner.
+- **Load-time integrity.** Discovery re-checks `SKILL.md` against the sha256
+  recorded at install, at no extra I/O. `skills.integrity` selects
+  `off` / `warn` (default) / `strict`.
+- **Local usage counters** at `<data>/skill-usage.json` — skill name, count and
+  timestamp only, never transmitted, disabled with `skills.usageTracking=false`.
+  Automatically injected `activation: always` skills are not counted.
+- Config keys `skills.integrity` and `skills.usageTracking`; `aragon skills list
+  --sort=recent` and `/skills list --sort=recent`.
+- Every usable skill also becomes a slash command: `/<skill-name> [args]`, with
+  `$ARGUMENTS` / `$1..$9` substitution. On a name clash the built-in command
+  always wins and the skill is reachable as `/skill:<name>`.
+- `/skills` management: `list`, `info`, `install`, `remove`, `enable`,
+  `disable`, `reload`, `create`, `trust`, `untrust`.
+- `aragon skills …` non-interactive equivalents plus `path` and `doctor`.
+  Exit codes follow `config set`: `0` ok, `1` run-time failure, `2` usage.
+- Four discovery scopes in ascending precedence: bundled (`<pkg>/skills`), user
+  (`<data>/skills`), project (`<cwd>/.aragon/skills` and, read-only,
+  `<cwd>/.claude/skills` for Claude Code interop), and `ARAGON_SKILLS_PATH`.
+- New flags `--no-skills`, `--skill <name>` (repeatable) and `--skills-yes`;
+  env `ARAGON_SKILLS`, `ARAGON_SKILLS_PATH`, `ARAGON_SKILLS_DISABLED`; config keys
+  `skills.enabled`, `skills.requireApproval`, `skills.catalogMaxBytes`,
+  `skills.bodyMaxBytes`.
+- One bundled skill, `skill-creator`, documenting how to write a good one.
+- New runtime dependency: `fflate` (~30 KB, MIT, zero transitive deps) for zip
+  extraction. `@aragon-agent/core` gains no dependency.
+- **Release tooling for the scope change.** `npm run verify:brand` scans every
+  file that `npm pack` would put in the tarball — README and `dist/` included —
+  and blocks the release on any surviving `argon` reference, with only the four
+  documented exceptions (the two CHANGELOGs and the legacy-state migration
+  module, which hold the old names by definition). `packages/cli` also gains a
+  `prepublishOnly: npm run build`, so a publish that bypasses
+  `publish-latest.ps1` can no longer ship a `dist/` that is out of step with the
+  sources. `deprecate-legacy.ps1` retires `@argon-agent/*` on the registry, and
+  refuses to do so until the replacements are actually published.
+
+### Changed
+
+- The globally installed executable is now `aragon`. The previous `argon` and
+  `argon-agent` aliases are no longer installed.
+- `config/store.ts` now deep-merges the `skills` section on both read and write,
+  the same treatment `apiKeys` already received. Without it a partial patch such
+  as the one `/skills disable` sends would replace the whole section and
+  silently discard `trustedProjectDirs`, `allowedHosts` and `requireApproval`.
+- `slashSuggestions` accepts `-` and `:`, so kebab-case and `skill:`-namespaced
+  commands autocomplete. Previously `/my-sk` produced no popup at all.
+- `AgentController` now has a single `agent.setSystemPrompt()` call site, so a
+  `/cwd` change can no longer drop the skill catalog out of the prompt.
+- With skills off or none installed, the system prompt and the 7-tool array are
+  byte-identical to the previous release.
+- Added a repository-level PowerShell release workflow that automatically
+  updates CLI and Core versions, synchronizes their dependency and lockfile,
+  verifies both tarballs, and publishes them in dependency order.
+
+### Security
+
+- Installing a skill requires an explicit human approval that **probes for a
+  human first and refuses when there is none**. Under `-p` there is no TUI and
+  therefore no approver, so `skill_install` is refused with an actionable
+  message rather than writing a third-party directory unattended. Use
+  `--skills-yes` (or `skills.requireApproval=false`) to opt out deliberately.
+- Project skill directories require a one-time trust confirmation before they
+  are loaded — cloning an unfamiliar repository does not grant it the ability
+  to inject instructions into your session.
+- Git is invoked only via `execFile` with an argv array and `shell: false`, and
+  owner / repo / ref / subdirectory fragments are whitelisted and refused if
+  they begin with `-`. A leading dash matters even with a pure argv array:
+  `--upload-pack=<program>` makes git execute that program.
+- Zip extraction is streamed and gated on **actually written** bytes, per-entry
+  size, compression ratio and entry count, all of which can abort mid-archive.
+  The size a zip *declares* is written by whoever built it and is never trusted.
+  Path traversal, absolute entries, symlinks and Windows device names are
+  refused, and a rejected archive is removed rather than left half-extracted.
+- Network fetches are `https:` only, restricted to `skills.allowedHosts`,
+  re-checked on every redirect (max 3), size-capped, and refuse IP literals and
+  loopback.
+- Nothing a skill ships is executed at install time, and the executable bit is
+  not preserved. Scripts run only when the model invokes `bash` explicitly.
+  There is no sandbox: approval blocks *silent* installation, it does not make
+  a skill you approved safe.
+
+## 0.3.0
+
+A full-screen TUI release. `@argon-agent/core` is untouched, no new runtime
+dependency is added, and the headless/print contract, exit codes, and
+slash-command semantics are unchanged. The 0.2.0 inline renderer remains
+available in full via `--no-fullscreen`.
+
+### Added
+
+- **Full-screen mode (default).** `aragon` now takes over the terminal's
+  alternate screen buffer — the same mechanism `vim` / `htop` / `lazygit` use.
+  Your shell history is covered, not erased, and comes back untouched on exit.
+  The frame is a fixed `rows - 1` tall, so **the composer and the status bar sit
+  at the physical bottom of the screen from the very first frame**: empty
+  session, long session, mid-scroll, or overlay open.
+- **Brand region.** A six-row gradient ASCII wordmark on a roomy empty session,
+  degrading to a banner, then a single-line bar, then a bare wordmark as space
+  runs out. Row 1 always begins with the brand glyph.
+- **Self-drawn scrolling.** `PgUp` / `PgDn` by the page, `Shift+↑` / `Shift+↓` by
+  the line. The viewport auto-follows new output while pinned to the bottom;
+  scrolling away shows `↑N` in the status bar plus a "N new lines" hint, and
+  submitting a message always re-pins.
+- **Exit replay.** After leaving the alternate screen the session is replayed
+  into the normal buffer as plain, colorless text, so the conversation does not
+  evaporate with the screen. Turn it off with `--no-exit-transcript`.
+- **New flags** `--fullscreen` / `--no-fullscreen` / `--no-exit-transcript`, the
+  env var `ARGON_FULLSCREEN=0|1`, and the config keys `fullscreen`,
+  `exitTranscript`, and `transcriptWindow`.
+- **Automatic downgrade.** A non-TTY stdout, `TERM=dumb`, CI, and terminals under
+  12 rows / 40 columns fall back to the inline renderer. Only the non-TTY gate is
+  un-overridable — `--fullscreen` beats the rest.
+
+### Changed
+
+- The status bar lost its round border and is now exactly one row; it had been
+  spending an eighth of a 24-row terminal framing a single line of text.
+- The toast strip holds a fixed row in full-screen mode, so the transcript no
+  longer jumps as toasts appear and expire.
+- The composer is a rounded frame whose border color reports state (idle, has a
+  draft, running, blurred by an overlay), with the completion popup above it.
+- `Ctrl+L` repaints the frame instead of writing a clear sequence. Ink dedupes
+  identical output at two separate gates, so under a fixed frame the old
+  approach erased the screen and then declined to redraw it.
+- `Shift+↑` / `Shift+↓` no longer recall prompt history — they scroll.
+- Full-screen mode routes `console.*` into the transcript as notices rather than
+  letting Ink write them straight to stdout, which corrupts the frame's line
+  accounting.
+
+### Known trade-offs
+
+- The terminal's native scrollback and mouse wheel do not scroll the transcript
+  in full-screen mode; use `PgUp` / `PgDn`, or run with `--no-fullscreen`.
+- Mouse tracking is deliberately left off: enabling it costs text selection and
+  copy in most terminals.
+- Should a crash ever strand your terminal on the alternate screen, `reset`
+  restores it. Four independent restore paths exist to prevent that: normal
+  exit, `process.exit`, `SIGINT` / `SIGTERM` / `SIGHUP`, and Ink's own signal
+  handling.
+
+## 0.2.0
+
+A design-elevation & HCI-hardening release. No breaking changes: `@argon-agent/core`
+is untouched, no new runtime dependency is added, and the headless/print contract,
+exit codes, config keys, and slash-command semantics from 0.1.0 are unchanged.
+
+### Added
+
+- **Real theming engine.** Distinct `dark` / `light` palettes with an `auto`
+  resolution (`auto → dark`), color degradation across terminal depth
+  (truecolor → 256 → 16 → monochrome), and an ASCII glyph fallback for terminals
+  without Unicode. Honors `NO_COLOR`, `FORCE_COLOR`, `--no-color`, and
+  `TERM=dumb`. Switch live with `/theme <auto|dark|light>` (persisted).
+- **Elegant chrome.** A gradient wordmark header that collapses to a slim sticky
+  bar after the first turn, a first-run **Welcome / empty-state** card, and a
+  status bar with a colored **context gauge** (threshold colors), a **tokens/sec**
+  read-out while running, and a contextual hint.
+- **Legible tool output.** Colored unified diffs (green adds / red removes) and
+  per-tool rich previews (`edit_file`/`write_file`/`read_file`/`bash`/`list_dir`/
+  `glob`). Long previews collapse to 8 lines and expand with `Ctrl+O` or
+  `/expand [n]`.
+- **Autocomplete.** A slash-command palette and `@file` path completion popup
+  (`Tab`/`→` to complete, `Up`/`Down` to move, `Esc` to close).
+- **Full line editing.** Home/End, word jump/delete, kill-to-start/end, and
+  multi-line vertical cursor navigation, with prompt-history recall at the edges.
+  Unknown control/escape sequences are dropped instead of inserted.
+- **Reliability under load.** Ink `<Static>` finalization for settled entries and
+  a streaming delta coalescer, so long/fast sessions stay flicker-free.
+- **Calm feedback.** Ephemeral, auto-dismissing **toasts** for transient acks;
+  the transcript keeps only durable content (messages, tool cards, run errors).
+- `reducedMotion` config (also `ARGON_REDUCED_MOTION`; implied by `--no-color`)
+  replaces spinners with a static glyph.
+
+### Changed
+
+- History scrollback now uses the **native terminal scrollback** that `<Static>`
+  prints into (this supersedes the never-implemented `PgUp`/`PgDn` promise).
+
+## 0.1.0
+
+Initial release — a Claude-Code / Codex-style interactive terminal UI (TUI) on
+top of `@argon-agent/core`.
+
+### Added
+
+- **Interactive TUI** (React + Ink): gradient header, streaming transcript with
+  markdown + syntax highlighting, collapsible thinking blocks, live tool-call
+  cards, a status bar (model / context % / tokens / cost / elapsed), and modal
+  overlays (settings, model picker, help, confirm).
+- **Built-in toolset** wired into the core agent at full permission:
+  `read_file`, `write_file`, `edit_file`, `list_dir`, `glob`, `grep`, `bash`.
+- **Layered configuration** (defaults → user file → env/`.env` → flags) with
+  live in-TUI editing of provider / model / base URL / API keys / thinking level
+  / max tokens. Secrets are masked and the config file is written `0600` on POSIX.
+- **One-shot / print mode** (`argon -p`) for scripting and piping, plus
+  `argon config` / `argon config set` / `argon config path` / `argon models`.
+- **Session control**: abort (Esc), steer-while-running, follow-up queue,
+  double-Ctrl-C exit, `/save` / `/resume` JSON sessions.
+- **Timeout invariant** (`idleTimeout ≥ toolTimeout`) so a long single tool run
+  is never killed by the idle watchdog.
+- **Never-silent failures**: pre-flight API-key validation, error-StreamEvent
+  rendering, and a guard that surfaces a swallowed agent error instead of a
+  blank no-op (headless exits `1`/`2` accordingly).