@ask-llm/plugin 0.14.0 → 0.16.2

package/CHANGELOG.md

@@ -0,0 +1,966 @@
+# @ask-llm/plugin
+
+## 0.16.2
+
+### Patch Changes
+
+- [#314](https://github.com/Lykhoyda/ask-llm/pull/314) [`bb13eb0`](https://github.com/Lykhoyda/ask-llm/commit/bb13eb0698317545fef776f716df461bb21b8936) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Adopt Google's GA `gemini-3.8-flash` as the Gemini quota-fallback default and mirror it through the plugin's Gemini runner, agent, skill, and Pi surfaces. The `gemini-3.1-pro-preview` primary default, `ASK_GEMINI_FALLBACK_MODEL` override, and Antigravity's independent `gemini-3.5-flash` fallback remain unchanged ([#312](https://github.com/Lykhoyda/ask-llm/issues/312)).
+- Updated dependencies [[`bb13eb0`](https://github.com/Lykhoyda/ask-llm/commit/bb13eb0698317545fef776f716df461bb21b8936)]:
+  - @ask-llm/gemini-mcp@1.9.0
+  - @ask-llm/mcp@0.9.2
+
+## 0.16.1
+
+### Patch Changes
+
+- Updated dependencies [[`bfb24b2`](https://github.com/Lykhoyda/ask-llm/commit/bfb24b2327d910fc9e940de58b399ec7c54fda20)]:
+  - @ask-llm/gemini-mcp@1.8.1
+  - @ask-llm/grok-mcp@0.1.4
+  - @ask-llm/codex-mcp@0.7.7
+  - @ask-llm/ollama-mcp@0.6.1
+  - @ask-llm/antigravity-mcp@0.7.4
+  - @ask-llm/mcp@0.9.1
+
+## 0.16.0
+
+### Minor Changes
+
+- [#304](https://github.com/Lykhoyda/ask-llm/pull/304) [`f9f3e9d`](https://github.com/Lykhoyda/ask-llm/commit/f9f3e9d14be950cb142b7d0e9944b755106b28ea) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Bump the factory-default Ollama model from `qwen3.6:27b` to same-size-class `qwen3.8:27b` (official library `latest` / 27b tag, ~18 GB Q4_K_M). `ASK_OLLAMA_MODEL` overrides are unchanged; a missing local model still fails with an actionable `ollama pull` error and no silent substitution.
+
+### Patch Changes
+
+- [#300](https://github.com/Lykhoyda/ask-llm/pull/300) [`a24889e`](https://github.com/Lykhoyda/ask-llm/commit/a24889e958af2962a0fc0e31cdd7d5ab042a5973) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Refresh the MCP SDK, validation libraries, Pi host SDK, and transitive runtime dependencies, including security-fixed Hono, URI, archive, HTTP, and parser releases.
+
+- [#306](https://github.com/Lykhoyda/ask-llm/pull/306) [`c132496`](https://github.com/Lykhoyda/ask-llm/commit/c13249605ae54557ff52b137b3c872edcedd2f07) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Adopt Google's GA `gemini-3.7-flash` as the Gemini quota-fallback default and mirror it through the plugin's Gemini runner, agent, skill, and Pi surfaces. The `gemini-3.1-pro-preview` primary default, `ASK_GEMINI_FALLBACK_MODEL` override, and Antigravity's independent `gemini-3.5-flash` fallback remain unchanged ([#298](https://github.com/Lykhoyda/ask-llm/issues/298)).
+- Updated dependencies [[`a24889e`](https://github.com/Lykhoyda/ask-llm/commit/a24889e958af2962a0fc0e31cdd7d5ab042a5973), [`c132496`](https://github.com/Lykhoyda/ask-llm/commit/c13249605ae54557ff52b137b3c872edcedd2f07), [`f9f3e9d`](https://github.com/Lykhoyda/ask-llm/commit/f9f3e9d14be950cb142b7d0e9944b755106b28ea)]:
+  - @ask-llm/antigravity-mcp@0.7.3
+  - @ask-llm/codex-mcp@0.7.6
+  - @ask-llm/gemini-mcp@1.8.0
+  - @ask-llm/grok-mcp@0.1.3
+  - @ask-llm/ollama-mcp@0.6.0
+  - @ask-llm/mcp@0.9.0
+
+## 0.15.0
+
+### Minor Changes
+
+- [#290](https://github.com/Lykhoyda/ask-llm/pull/290) [`af77cd8`](https://github.com/Lykhoyda/ask-llm/commit/af77cd8b90cb836f87a39893d52e983a36fbea53) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Add an exact Grok + GPT-5.6 Sol brainstorming panel with Cursor Agent as the preferred model-neutral harness, explicit direct-Grok alternatives, deterministic partial-failure synthesis rules, truthful route/model attribution, and no Gemini or silent fallback in the two-model workflow.
+
+- [#291](https://github.com/Lykhoyda/ask-llm/pull/291) [`d989ec9`](https://github.com/Lykhoyda/ask-llm/commit/d989ec916f71eefe5fe0814d5c1eb75d29dfe89f) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Add a first-class Claude Code `/grok-pair` workflow with explicit Cursor Agent, xAI API, or Grok CLI routes and no silent fallback. Add Cursor Plugin/Agent Skills support for `/codex-pair` with consent, bounded context, exact Codex model/effort/include options, persisted session reuse, cancellation, and actionable diagnostics. Unified Ask LLM now forwards supported reasoning/include options, rejects `includeDirs` on resumed Codex threads instead of dropping them (enforced once in the shared Codex executor so the split `ask-codex` and Pi tools fail closed too), and Cursor Agent consultations support validated include directories plus structured session resume. The Claude plugin keeps bundling only Codex; `@ask-llm/mcp` and `@ask-llm/grok-mcp` are user-scoped installs for the Grok routes. Unified startup now detects authenticated Grok CLI-only installations without requiring an API key or server-wide harness override (an explicit `ASK_GROK_HARNESS` keeps readiness on that harness), while execution remains pinned to the request's explicit harness with no fallback and a CLI-only default-route call reports the `harness: "grok-cli"` pin instead of a bare missing-key error. The Cursor plugin manifest exposes exactly `/codex-pair` and `/grok-pair` with explicit empty `agents`/`commands`/`hooks`, and its `mcp.json` bundles only the unified `ask-llm` server (split Codex/Grok servers are optional user installs).
+
+### Patch Changes
+
+- [#293](https://github.com/Lykhoyda/ask-llm/pull/293) [`fc4be66`](https://github.com/Lykhoyda/ask-llm/commit/fc4be66cef40a0d3691540fad404b5a11b93a0e4) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Document Pi's pre-dispatch refusal of brainstorm participant lists that mix routed model specs with bare provider names.
+
+- Updated dependencies [[`d989ec9`](https://github.com/Lykhoyda/ask-llm/commit/d989ec916f71eefe5fe0814d5c1eb75d29dfe89f), [`fa272ee`](https://github.com/Lykhoyda/ask-llm/commit/fa272ee9c5ea1bd8ea85673fc0a757a0cd81a509), [`af77cd8`](https://github.com/Lykhoyda/ask-llm/commit/af77cd8b90cb836f87a39893d52e983a36fbea53)]:
+  - @ask-llm/mcp@0.8.0
+  - @ask-llm/grok-mcp@0.1.2
+
+## 0.14.0
+
+### Minor Changes
+
+- [#279](https://github.com/Lykhoyda/ask-llm/pull/279) [`9d27169`](https://github.com/Lykhoyda/ask-llm/commit/9d27169fbe22c2ffbfae0be9d6cba841b98e42f1) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Add first-class Grok consultations through explicit xAI API or official Grok CLI harnesses, with exact model selection, strict no-fallback diagnostics, redacted credentials, cancellation, telemetry, and opt-in live tests. Add a separate model-neutral Cursor Agent harness that requires provider and exact Cursor model attribution, runs read-only, and never changes trust or spend settings. The Cursor provider enum is `claude`, `codex`, `gemini`, `grok` in the unified server and Pi, and the requested model must belong to that family (Auto and noncanonical IDs are refused); `AskResponse` gains an optional `reportedModel` carrying Cursor's display label while `model` echoes the exact requested catalog ID. Prompts above 16 KB reach Grok CLI through a private `--prompt-file` (only when `grok --help` advertises it; otherwise they fail before spawn) and Cursor Agent over stdin. xAI effort coercion (`xhigh` applied as `high` on older models) and served-model alias resolution are disclosed, and an effort-rejecting 4xx is classified with the supported list.
+
+### Patch Changes
+
+- [#277](https://github.com/Lykhoyda/ask-llm/pull/277) [`7a20e22`](https://github.com/Lykhoyda/ask-llm/commit/7a20e22c69578f0972da8914964dc089f1da8f8d) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Register the Ask LLM Codex MCP transport with the Claude Code plugin and make `/sol-review` distinguish missing registration from service unavailability before using its explicit CLI fallback.
+
+- [#273](https://github.com/Lykhoyda/ask-llm/pull/273) [`e685565`](https://github.com/Lykhoyda/ask-llm/commit/e68556513c59c8a2c56a64c0443c9b36eff0ec64) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Claim Pi codex-pair pending findings with an exclusive lock file instead of a rename, so two sessions on Windows can no longer claim the same finding.
+
+- Updated dependencies [[`e685565`](https://github.com/Lykhoyda/ask-llm/commit/e68556513c59c8a2c56a64c0443c9b36eff0ec64), [`9d27169`](https://github.com/Lykhoyda/ask-llm/commit/9d27169fbe22c2ffbfae0be9d6cba841b98e42f1), [`c3f3da4`](https://github.com/Lykhoyda/ask-llm/commit/c3f3da4682d7dd91118b06bd2272b0b3e5ebc1e2)]:
+  - @ask-llm/codex-mcp@0.7.5
+  - @ask-llm/gemini-mcp@1.7.2
+  - @ask-llm/grok-mcp@0.1.1
+  - @ask-llm/ollama-mcp@0.5.7
+  - @ask-llm/antigravity-mcp@0.7.2
+  - @ask-llm/mcp@0.7.0
+
+## 0.13.0
+
+### Minor Changes
+
+- [#264](https://github.com/Lykhoyda/ask-llm/pull/264) [`2433d79`](https://github.com/Lykhoyda/ask-llm/commit/2433d79453363ece39fb08da6d585039da224274) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Add first-class Pi host support to the canonical dual-host plugin package, including portable skills, native provider tools, deterministic multi-provider dispatch, consent-gated lifecycle pairing, package/install CI, and abortable provider execution.
+
+### Patch Changes
+
+- Updated dependencies [[`2433d79`](https://github.com/Lykhoyda/ask-llm/commit/2433d79453363ece39fb08da6d585039da224274)]:
+  - @ask-llm/gemini-mcp@1.7.1
+  - @ask-llm/codex-mcp@0.7.4
+  - @ask-llm/ollama-mcp@0.5.6
+  - @ask-llm/antigravity-mcp@0.7.1
+
+## 0.12.8
+
+### Patch Changes
+
+- Updated dependencies [[`634dcf6`](https://github.com/Lykhoyda/ask-llm/commit/634dcf643a60c1c878672d5407936b192558aaa0)]:
+  - @ask-llm/antigravity-mcp@0.7.0
+
+## 0.12.7
+
+### Patch Changes
+
+- Updated dependencies [[`1d0984b`](https://github.com/Lykhoyda/ask-llm/commit/1d0984bd6996ac1864db9cdb5a46d84e17b750fc)]:
+  - @ask-llm/codex-mcp@0.7.3
+
+## 0.12.6
+
+### Patch Changes
+
+- Updated dependencies [[`0c35001`](https://github.com/Lykhoyda/ask-llm/commit/0c350017f43e971b9274eb865d5c5c9e33fbcbd7)]:
+  - @ask-llm/gemini-mcp@1.7.0
+
+## 0.12.5
+
+### Patch Changes
+
+- [#246](https://github.com/Lykhoyda/ask-llm/pull/246) [`a1f62ad`](https://github.com/Lykhoyda/ask-llm/commit/a1f62ad1625c4248876c40842801fe0c4403c561) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Pin the brainstorm-coordinator's raw agy call to the agy 1.1.5 model contract (`--model gemini-3.1-pro --effort high`) ([#243](https://github.com/Lykhoyda/ask-llm/issues/243)).
+
+- Updated dependencies [[`a1f62ad`](https://github.com/Lykhoyda/ask-llm/commit/a1f62ad1625c4248876c40842801fe0c4403c561), [`a1f62ad`](https://github.com/Lykhoyda/ask-llm/commit/a1f62ad1625c4248876c40842801fe0c4403c561)]:
+  - @ask-llm/antigravity-mcp@0.6.0
+  - @ask-llm/gemini-mcp@1.6.17
+  - @ask-llm/codex-mcp@0.7.2
+  - @ask-llm/ollama-mcp@0.5.5
+
+## 0.12.4
+
+### Patch Changes
+
+- [#240](https://github.com/Lykhoyda/ask-llm/pull/240) [`b648785`](https://github.com/Lykhoyda/ask-llm/commit/b648785c9c3243cbe9c1ad33efd590653709d452) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - `/sol-review` no longer depends on agent improvisation when the `ask-codex` MCP tool is unavailable in the subagent context ([#232](https://github.com/Lykhoyda/ask-llm/issues/232)). The skill preflights the transport, the `sol-reviewer` agent sanctions an exact CLI fallback (`codex exec -m gpt-5.6-sol -c model_reasoning_effort="high" -s read-only --ignore-user-config --ignore-rules --skip-git-repo-check`) with plugin-namespaced tool variants recognized as primary transport, transport fallbacks must be disclosed like model fallbacks, and a missing CLI stops the review instead of degrading to another transport, model, or sandbox mode.
+
+## 0.12.3
+
+### Patch Changes
+
+- [#237](https://github.com/Lykhoyda/ask-llm/pull/237) [`ba569cc`](https://github.com/Lykhoyda/ask-llm/commit/ba569cc1f8346ef2db76e6733fa9d9f222f61242) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Expose an explicit `sandbox` opt-in on the `ask-codex` tool. Every Codex run now
+  defaults to `--sandbox read-only` (ADR-136), which silently broke `/codex-image`
+  because Codex could no longer write the generated PNG to disk. `ask-codex` now
+  accepts an optional `sandbox` enum (`read-only` | `workspace-write`, default
+  `read-only`) that passes through to the executor as a deliberate opt-out of the
+  read-only review contract for flows that must have Codex write files. The
+  `/codex-image` skill now sets `sandbox: "workspace-write"`; review, second-opinion,
+  and analysis flows continue to run read-only.
+
+- [#237](https://github.com/Lykhoyda/ask-llm/pull/237) [`ba569cc`](https://github.com/Lykhoyda/ask-llm/commit/ba569cc1f8346ef2db76e6733fa9d9f222f61242) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Keep managed review paths read-only, isolate concurrent compare runs, fix
+  special-character Stop-gate paths, and include the MIT license in every
+  published package tarball.
+- Updated dependencies [[`ba569cc`](https://github.com/Lykhoyda/ask-llm/commit/ba569cc1f8346ef2db76e6733fa9d9f222f61242), [`ba569cc`](https://github.com/Lykhoyda/ask-llm/commit/ba569cc1f8346ef2db76e6733fa9d9f222f61242)]:
+  - @ask-llm/codex-mcp@0.7.1
+  - @ask-llm/antigravity-mcp@0.5.1
+  - @ask-llm/ollama-mcp@0.5.4
+
+## 0.12.2
+
+### Patch Changes
+
+- Updated dependencies [[`a3c3ba3`](https://github.com/Lykhoyda/ask-llm/commit/a3c3ba38fc1643059f4d5a75208b99e580ae9d4b)]:
+  - @ask-llm/shared@0.6.0
+  - @ask-llm/codex-mcp@0.7.0
+  - @ask-llm/antigravity-mcp@0.5.0
+  - @ask-llm/gemini-mcp@1.6.16
+  - @ask-llm/ollama-mcp@0.5.3
+
+## 0.12.1
+
+### Patch Changes
+
+- [#230](https://github.com/Lykhoyda/ask-llm/pull/230) [`394c305`](https://github.com/Lykhoyda/ask-llm/commit/394c305806607ca5db4803c666a0ebdc3304c2db) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Move every public MCP package into the canonical `@ask-llm` npm organization,
+  while preserving the existing executable names for compatibility.
+- Updated dependencies [[`394c305`](https://github.com/Lykhoyda/ask-llm/commit/394c305806607ca5db4803c666a0ebdc3304c2db)]:
+  - @ask-llm/gemini-mcp@1.6.15
+  - @ask-llm/codex-mcp@0.6.2
+  - @ask-llm/ollama-mcp@0.5.2
+  - @ask-llm/antigravity-mcp@0.4.2
+
+## 0.12.0
+
+### Minor Changes
+
+- [#228](https://github.com/Lykhoyda/ask-llm/pull/228) [`b27b69e`](https://github.com/Lykhoyda/ask-llm/commit/b27b69ef6a83d1fe03c51da2b90cc98f0994fbb8) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Add `/fable-review` and `/sol-review`, two read-only review skills that launch
+  isolated reviewer agents that request native Fable and explicitly pin OpenAI GPT-5.6 Sol,
+  respectively. Both workflows validate findings against the source and report
+  only high-confidence issues.
+
+## 0.11.1
+
+### Patch Changes
+
+- [#222](https://github.com/Lykhoyda/ask-llm/pull/222) [`ae7780c`](https://github.com/Lykhoyda/ask-llm/commit/ae7780c67327224eea760ade42b61df3d9a32b54) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Update Codex defaults to the GPT-5.6 family: GPT-5.6 Sol is now the
+  quality-first model for MCP calls, reviews, brainstorming, image orchestration,
+  and codex-pair, with GPT-5.6 Terra as the balanced quota fallback. The legacy
+  preferred-model escape hatch remains available, but no longer adds a redundant
+  attempt when it resolves to the Sol default. `ask-codex` now accepts an optional
+  `reasoningEffort`; general calls preserve `medium`, while `/codex-review` and
+  `/brainstorm` use `high`.
+- Updated dependencies [[`ae7780c`](https://github.com/Lykhoyda/ask-llm/commit/ae7780c67327224eea760ade42b61df3d9a32b54), [`ae7780c`](https://github.com/Lykhoyda/ask-llm/commit/ae7780c67327224eea760ade42b61df3d9a32b54)]:
+  - ask-gemini-mcp@1.6.14
+  - ask-codex-mcp@0.6.1
+  - ask-ollama-mcp@0.5.1
+  - ask-antigravity-mcp@0.4.1
+
+## 0.11.0
+
+### Minor Changes
+
+- [#220](https://github.com/Lykhoyda/ask-llm/pull/220) [`1089a21`](https://github.com/Lykhoyda/ask-llm/commit/1089a215657594a1c569dcd6c180d94750b1dab6) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Codex `/codex-review` and `/brainstorm` now prefer `gpt-5.5-pro` when the Codex
+  account is entitled, falling back transparently to `gpt-5.5` (then `gpt-5.4-mini`
+  on quota). Those two commands opt in automatically; the raw `ask-codex` tool can
+  opt in with the new `preferred` arg. `ASK_CODEX_PREFERRED_MODEL` customizes which
+  model the preferred tier uses (default `gpt-5.5-pro`) — it does not by itself
+  enable preferred mode. `/multi-review`'s Codex leg inherits the preferred tier
+  via the shared `codex-reviewer` agent (its binary-fallback path stays on
+  `gpt-5.5`); `codex-pair` and `/codex-verify` are unchanged. (ADR-132)
+
+### Patch Changes
+
+- Updated dependencies [[`1089a21`](https://github.com/Lykhoyda/ask-llm/commit/1089a215657594a1c569dcd6c180d94750b1dab6)]:
+  - ask-codex-mcp@0.6.0
+
+## 0.10.2
+
+### Patch Changes
+
+- [#218](https://github.com/Lykhoyda/ask-llm/pull/218) [`f69ac41`](https://github.com/Lykhoyda/ask-llm/commit/f69ac415db370ced8bc427e6ec0d85d1eed846b5) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - `/compare` now includes **Antigravity** in its default provider set, matching `/brainstorm-all` and `/multi-review`. The skill dispatches to gemini, codex, ollama, and antigravity in parallel (ADR-050 backgrounding + per-PID wait) and renders a fourth `### Antigravity` section side-by-side. Previously `/compare` silently excluded Antigravity even though it is a first-class provider (ADR-125/128). A user can still request a subset (e.g. "compare gemini and codex"). A load-bearing contract test now pins the `antigravity-run.js` dispatch leg so it cannot regress.
+
+## 0.10.1
+
+### Patch Changes
+
+- [#213](https://github.com/Lykhoyda/ask-llm/pull/213) [`4002985`](https://github.com/Lykhoyda/ask-llm/commit/400298591b07635624c3ceafa07288692ec0f524) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-pair: the Stop drain, `blockOn: HIGH` gate, and UserPromptSubmit drain now cover every repository edited during the session — not just Claude Code's current working directory. In multi-repo sessions where an edit lands in a different repo than the cwd, that repo's queued verdicts now drain at turn-end and its unaddressed HIGH findings correctly block "done" (issue [#209](https://github.com/Lykhoyda/ask-llm/issues/209), ADR-131). A new session-scoped marker registry under the OS temp dir bridges the watch hook (which knows the edited repo) to the cwd-anchored Stop/prompt hooks. Behavior is unchanged for single-repo sessions and when the hook payload carries no `session_id`.
+
+## 0.10.0
+
+### Minor Changes
+
+- [#208](https://github.com/Lykhoyda/ask-llm/pull/208) [`5b0e6a4`](https://github.com/Lykhoyda/ask-llm/commit/5b0e6a4f72070f13e0b6fa16e843cc5f2c1c155d) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-pair seamless pairing (ADR-130): auto-pauses now self-heal — TTL expiry (quota 6h / failures 24h, `CODEX_PAIR_QUOTA_PAUSE_TTL_MS` / `CODEX_PAIR_FAILURES_PAUSE_TTL_MS`), immediate expiry when the plugin version changed since the pause, a SessionStart paused-reminder/auto-resume notice, and `/codex-pair-resume` clearing the failure counter. Every verdict is now emitted on the documented model-visible channel (PostToolUse `hookSpecificOutput.additionalContext`) alongside `systemMessage`. The Stop-gate drains queued debounce verdicts at turn-end for all projects and, with `blockOn: HIGH`, blocks once per turn while reviews are still in flight (settling debounce windows, running codex calls, and the new worker `reviewing` handoff marker).
+
+## 0.9.6
+
+### Patch Changes
+
+- [#206](https://github.com/Lykhoyda/ask-llm/pull/206) [`93b024c`](https://github.com/Lykhoyda/ask-llm/commit/93b024c640492d99ef1cc020752d560f957733bb) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-image skill: document gpt-image-2 capabilities (legible in-image text ~99%, up to 4K + custom dimensions, embedded C2PA provenance manifest + invisible AI-origin watermark) so prompt-building accounts for them. Follow-up to the gpt-image-2 model correction; docs/prose only.
+
+## 0.9.5
+
+### Patch Changes
+
+- [#204](https://github.com/Lykhoyda/ask-llm/pull/204) [`b284c08`](https://github.com/Lykhoyda/ask-llm/commit/b284c08442265d4e931bd86761b0826210a0df74) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-image skill: correct the image model to `gpt-image-2`. OpenAI shipped gpt-image-2 on 2026-04-21 (replacing gpt-image-1 and the interim 1.5), and Codex's server-side `image_generation` tool now uses it — verified via the C2PA provenance manifest embedded in a live render (`gpt-image` version `2.0`). Updated the SKILL.md description + example footer, and refreshed the stale "2–6 minutes" wall-time to sub-minute for simple images (measured 44–52s; a few minutes for complex/4K thinking-mode renders).
+
+## 0.9.4
+
+### Patch Changes
+
+- [#199](https://github.com/Lykhoyda/ask-llm/pull/199) [`553b93b`](https://github.com/Lykhoyda/ask-llm/commit/553b93b9587df53b3b0b583b323955663b27ed64) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - 2026-07-02 audit hardening batch (ADR-128):
+
+  - **shared**: new canonical `PROVIDERS` tuple + `ProviderName` type (single source of truth for the provider list); new `relativeDirSchema` for includeDirs-style params; `ASK_OLLAMA_TIMEOUT_MS` / `DEFAULT_OLLAMA_TIMEOUT_MS` in `EXECUTION`; chunkCache now creates its dir 0700 and chunk files 0600 (and tightens dirs from older releases); `registerTools()` fails fast on duplicate tool names; stderr accumulation switched to `Buffer[]` (parity with stdout).
+  - **ollama**: the `/api/chat` call finally has a timeout — `AbortController` bounded by `ASK_OLLAMA_TIMEOUT_MS` > `GMCPT_TIMEOUT_MS` > 600s default, with an actionable timeout error; previously a wedged Ollama server hung `ask-ollama` forever.
+  - **codex**: JSONL output that parses into events but contains no agent message now throws an actionable error (naming the thread id, with truncated raw output) instead of returning the raw JSONL dump as the "response"; plain-text output still passes through. `includeDirs` on `ask-codex`/`ask-codex-edit` now validates paths (relative only, no `..`/`~`) — parity with `ask-gemini-edit`.
+  - **gemini**: empty-string `sessionId` now bypasses the response cache (parity with codex/ollama, ADR-063 semantics) — previously a cached body with `sessionId: undefined` was returned instead of performing the session turn; includeDirs cache-key construction no longer mutates the caller's array.
+  - **llm-mcp**: `multi-llm` outputSchema and the no-providers-detected fallback enum now include `antigravity` (previously the declared contract rejected antigravity usage stats); REPL `/provider` help derives from the provider registry.
+  - **plugin**: plugin.json + marketplace.json description/keywords now name Antigravity; manifest tests assert all four runner binaries.
+
+- Updated dependencies [[`5d53a1e`](https://github.com/Lykhoyda/ask-llm/commit/5d53a1e637adcb2e72667e8bc32f5f2c6aa2150c), [`553b93b`](https://github.com/Lykhoyda/ask-llm/commit/553b93b9587df53b3b0b583b323955663b27ed64)]:
+  - ask-antigravity-mcp@0.4.0
+  - @ask-llm/shared@0.5.0
+  - ask-ollama-mcp@0.5.0
+  - ask-codex-mcp@0.5.0
+  - ask-gemini-mcp@1.6.13
+
+## 0.9.3
+
+### Patch Changes
+
+- [#195](https://github.com/Lykhoyda/ask-llm/pull/195) [`f65e72f`](https://github.com/Lykhoyda/ask-llm/commit/f65e72f03b975a93d480091687729350b78788d6) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Fix the Codex quota-fallback model: default to `gpt-5.4-mini` instead of `gpt-5.5-mini`.
+
+  `gpt-5.5-mini` is rejected with a `400 "not supported when using Codex with a ChatGPT account"` on ChatGPT-plan accounts — the common case for the `codex` CLI, where plan quota is account-wide — so when `gpt-5.5` hit a usage limit the fallback retry failed (`…fallback also failed`) instead of producing a cheaper answer. `gpt-5.4-mini` is confirmed to work on both ChatGPT-plan and API-key accounts and is now the default `ASK_CODEX_FALLBACK_MODEL`. The `gpt-5.5` primary default is unchanged, and API-key users who prefer `gpt-5.5-mini` can still pin it via `ASK_CODEX_FALLBACK_MODEL`. The codex-pair plugin default is updated to match. See ADR-126 (closes [#194](https://github.com/Lykhoyda/ask-llm/issues/194)).
+
+- Updated dependencies [[`f65e72f`](https://github.com/Lykhoyda/ask-llm/commit/f65e72f03b975a93d480091687729350b78788d6), [`4938dba`](https://github.com/Lykhoyda/ask-llm/commit/4938dbaeb422e3c5dcfd5ed2780ad030b819a832)]:
+  - ask-codex-mcp@0.4.1
+
+## 0.9.2
+
+### Patch Changes
+
+- [#192](https://github.com/Lykhoyda/ask-llm/pull/192) [`8ff1d02`](https://github.com/Lykhoyda/ask-llm/commit/8ff1d02b08a8f9f47752d27f1feb64dff9b35d05) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - Default `ask-antigravity` to **Gemini 3.1 Pro (High)** — the strongest reasoning tier — and add a **Gemini 3.5 Flash (High)** rate-limit fallback.
+
+  Previously `ask-antigravity` defaulted to Gemini 3.5 Flash (High) with no fallback. It now leads with the Pro reasoning tier for the code-review / second-opinion workload and retries once on Flash when Pro hits a subscription rate limit (`RESOURCE_EXHAUSTED` / `429` / quota), mirroring the cross-tier quota fallback that `ask-gemini` and `ask-codex` already use. If the resolved model is already the fallback (or the caller pinned it via `ASK_ANTIGRAVITY_MODEL`), there is nothing to fall back to and the actionable rate-limit message is returned. Non-rate-limit failures (auth, not-installed, timeout) are surfaced as-is and never trigger a fallback. Override the default with the `ASK_ANTIGRAVITY_MODEL` env var (run `agy models` for options).
+
+- Updated dependencies [[`8ff1d02`](https://github.com/Lykhoyda/ask-llm/commit/8ff1d02b08a8f9f47752d27f1feb64dff9b35d05)]:
+  - ask-antigravity-mcp@0.3.0
+
+## 0.9.1
+
+### Patch Changes
+
+- Updated dependencies [[`1feaaa2`](https://github.com/Lykhoyda/ask-llm/commit/1feaaa2ca51e79fb334af780aaf0ecaa83b5bd8f)]:
+  - ask-ollama-mcp@0.4.0
+
+## 0.9.0
+
+### Minor Changes
+
+- [#187](https://github.com/Lykhoyda/ask-llm/pull/187) [`5757bee`](https://github.com/Lykhoyda/ask-llm/commit/5757bee9029303118cb9e58040617c3390e959b2) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-pair: a primary-model quota error followed by a **structurally-unavailable fallback model** now auto-pauses cleanly (kind `quota`, with the reset hint) instead of cascading to the 3-failure backstop. On ChatGPT-plan Codex accounts the `gpt-5.5-mini` fallback is rejected with a 400 ("not supported when using Codex with a ChatGPT account") — because plan quota is account-wide, a cheaper fallback never applied. The hook now recognizes the broken fallback ladder as the same "no usable model" exhaustion as the no-ladder case and re-throws the primary quota error so its reason + reset hint reach the pause notice. ADR-123.
+
+### Patch Changes
+
+- Updated dependencies [[`206943d`](https://github.com/Lykhoyda/ask-llm/commit/206943deb83975e7b06f461771087210617d7287)]:
+  - @ask-llm/shared@0.4.0
+  - ask-codex-mcp@0.4.0
+  - ask-gemini-mcp@1.6.12
+  - ask-ollama-mcp@0.3.7
+  - ask-antigravity-mcp@0.2.3
+
+## 0.8.0
+
+### Minor Changes
+
+- [#181](https://github.com/Lykhoyda/ask-llm/pull/181) [`85d8801`](https://github.com/Lykhoyda/ask-llm/commit/85d88018723fffe530c2e21c601acad62c312ec4) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - codex-pair now pauses itself when the provider is dead instead of erroring on every edit ([#176](https://github.com/Lykhoyda/ask-llm/issues/176)). Quota exhaustion (both models) auto-pauses with a one-time notice including the parsed reset hint; 3 consecutive failures of any kind trigger the same backstop. Failure reasons now surface the real codex error (stdout JSONL error event) instead of the "Reading prompt from stdin..." stderr banner, and ChatGPT-plan quota phrasings ("You've hit your usage limit") are now classified for the existing model fallback. Resume stays manual: /codex-pair-resume.
+
+## 0.7.8
+
+### Patch Changes
+
+- Updated dependencies [[`fc40dcb`](https://github.com/Lykhoyda/ask-llm/commit/fc40dcbca3256d1558c2910bb30df64f373876ab)]:
+  - ask-gemini-mcp@1.6.11
+  - ask-codex-mcp@0.3.11
+  - ask-ollama-mcp@0.3.6
+  - ask-antigravity-mcp@0.2.2
+
+## 0.7.7
+
+### Patch Changes
+
+- Updated dependencies [[`2f12b43`](https://github.com/Lykhoyda/ask-llm/commit/2f12b43c5b8111e3f726ee52fc237ca31df0b4b0)]:
+  - @ask-llm/shared@0.3.4
+  - ask-codex-mcp@0.3.10
+  - ask-antigravity-mcp@0.2.1
+  - ask-gemini-mcp@1.6.10
+  - ask-ollama-mcp@0.3.5
+
+## 0.7.6
+
+### Patch Changes
+
+- Updated dependencies [[`0e14e19`](https://github.com/Lykhoyda/ask-llm/commit/0e14e19fd55dad04c4cc31b55336a970de01ef0b)]:
+  - ask-antigravity-mcp@0.2.0
+
+## 0.7.5
+
+### Patch Changes
+
+- Updated dependencies [[`fe3ee41`](https://github.com/Lykhoyda/ask-llm/commit/fe3ee41b65908125a88f711b0a2fd560cb286e30)]:
+  - ask-gemini-mcp@1.6.9
+
+## 0.7.4
+
+### Patch Changes
+
+- Updated dependencies [[`d88606f`](https://github.com/Lykhoyda/ask-llm/commit/d88606f9ec7c1dcc48308d4cadfd8731c9ade8d8)]:
+  - ask-gemini-mcp@1.6.8
+
+## 0.7.3
+
+### Patch Changes
+
+- [#123](https://github.com/Lykhoyda/ask-llm/pull/123) [`f12e43c`](https://github.com/Lykhoyda/ask-llm/commit/f12e43cd1926c399f6ee1778ea711f9093ed8620) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # Release workflow hardening — failure-tracking issue + Release status badge
+
+  Two complementary fixes that make release-workflow failures visible
+  after the fact, born from the lived-experience finding that PR [#112](https://github.com/Lykhoyda/ask-llm/issues/112)'s
+  release run sat with a red X for 5 days without anyone noticing.
+
+  ## What changes
+
+  ### `release.yml` — open a tracking issue on failure
+
+  Adds a final step gated on `if: failure() && steps.changesets.outcome ==
+'failure'` that uses `actions/github-script@v7` to:
+
+  - Check for an existing open issue with the `release-broken` label
+  - If one exists: post a comment with the new run URL + commit SHA
+    (avoids issue-spam on consecutive failures)
+  - If none exists: open a new issue titled "Release workflow failed on
+    <sha7> — publish blocked" with labels `release-broken` + `urgent`,
+    body containing the run URL, commit SHA, likely-cause checklist
+    (NODE_AUTH_TOKEN expired/wrong-type, package permission change, npm
+    outage), and the fix path
+
+  Safety note: uses the octokit API exclusively, no shell evaluation of
+  untrusted input. All `context.*` values are GitHub-runtime trusted
+  (sha, runId, serverUrl, repo).
+
+  ### `README.md` — Release status badge
+
+  Adds a Release badge next to the existing CI badge so the workflow
+  failure state is visible to anyone visiting the repo:
+
+  ```markdown
+  [![Release](https://img.shields.io/github/actions/workflow/status/Lykhoyda/ask-llm/release.yml?branch=main&label=release&logo=npm)](https://github.com/Lykhoyda/ask-llm/actions/workflows/release.yml)
+  ```
+
+  ## What this does NOT change
+
+  The publish step itself is unchanged. These fixes don't prevent
+  failures — they make failures surface loudly so they get fixed
+  promptly. Publish behavior, version-bump logic, MCP Registry sync,
+  unified GitHub Release creation — all byte-identical.
+
+- Updated dependencies [[`53c0708`](https://github.com/Lykhoyda/ask-llm/commit/53c07080f7e62355d18a4d423bf76a65ab473dc7)]:
+  - @ask-llm/shared@0.3.2
+  - ask-gemini-mcp@1.6.6
+  - ask-codex-mcp@0.3.8
+  - ask-ollama-mcp@0.3.3
+
+## 0.7.2
+
+### Patch Changes
+
+- [#113](https://github.com/Lykhoyda/ask-llm/pull/113) [`c28c90c`](https://github.com/Lykhoyda/ask-llm/commit/c28c90c0cbfce994c99618244dcab3215e78e297) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # ADR-098 — codex-pair task-agnostic re-positioning + `/codex-pair` user-invocable dashboard
+
+  Two coupled documentation + UX changes for the codex-pair surface:
+
+  ## 1. Task-agnostic re-framing across 5 documentation surfaces
+
+  Every place that described codex-pair's value via the ADR-077 four-task
+  benchmark's specific probe domains ("float-money precision, validation
+  bypass, edge-case clamping") in sentences like "Use codex-pair when handling
+  money / security-sensitive code" caused LLMs reading the ask-llm codebase
+  as project context to hallucinate that ask-llm itself has money handling
+  and auth paths. ask-llm is a CLI bridge between MCP clients and LLM CLIs
+  with none of that code.
+
+  The rewrite replaces domain-specific framing with code-characteristic
+  language ("code with hidden invariants the model can't infer from one
+  file", "code where latent bugs cost more than per-edit review", the
+  "looks fine, runs wrong" failure-mode class). The recall improvement is
+  explicitly attributed as task-agnostic — measured across four
+  structurally different fixtures (todo CRUD, URL shortener, RFC-spec
+  implementation, stateful business logic), not just one. Each surface
+  that lives in the LLM-readable corpus now includes an explicit "ask-llm
+  itself is a CLI/MCP bridge with none of these properties; codex-pair
+  runs here for dogfooding" disclaimer. Empirical numbers (2/10 → 7/10
+  → 10/10) are preserved verbatim — only surrounding framing changes.
+
+  Surfaces touched: `packages/claude-plugin/skills/codex-pair/SKILL.md`,
+  `packages/claude-plugin/README.md`, `apps/docs/plugin/hooks.md`,
+  `apps/docs/plugin/skills.md`, `apps/docs/plugin/overview.md`.
+
+  ## 2. `/codex-pair` user-invocable dashboard
+
+  `codex-pair/SKILL.md` flips from `user_invocable: false` to `true` with
+  a Phase 1–5 orchestration block at the top:
+
+  - **Phase 1**: Detect state (marker walk, pause sentinel check, recent
+    log tail)
+  - **Phase 2**: Branch on detected state
+  - **Phase 3** (no marker → setup): Auto-detect project context by
+    reading `README.md` + `package.json` + alternative manifests; draft a
+    `.codex-pair/context.md` with project-purpose summary + 3-5 inferred
+    domain invariants; use `AskUserQuestion` with the draft as the
+    recommended option's `preview` field so the user sees content before
+    deciding; ASK before modifying `.gitignore`
+  - **Phase 4** (paused): Structured status table with paused-since
+    timestamp + resume instruction
+  - **Phase 5** (active): Structured status table with marker
+    model + surface threshold + cost-per-review estimate + last 5 reviews
+    summary + active ignore/include patterns + pause instruction
+
+  The existing hook reference documentation (when-to-use, cost
+  characteristics, output format, configuration knobs, empirical
+  justification) moves below the orchestration block but is unchanged
+  in substance — it serves as Claude's reference for explaining hook
+  behavior to users mid-orchestration.
+
+  Zero new code under `scripts/` — the entire orchestration uses Claude's
+  existing tool surface (Bash, Read, AskUserQuestion). Plugin test count
+  unchanged at 313 (no new code to test; the orchestration is natural-
+  language phase instructions, structural pinning would over-couple).
+  Lint clean across 6 workspaces.
+
+- [#120](https://github.com/Lykhoyda/ask-llm/pull/120) [`daeec3d`](https://github.com/Lykhoyda/ask-llm/commit/daeec3dd989e6bc70616cc37bdb612dd05812823) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # ADR-099 — codex-pair Karpathy baseline principles in review prompt
+
+  Adds a new `## Baseline review principles` section to the codex-pair
+  review prompt template at `packages/claude-plugin/prompts/review.txt`,
+  adapting three diff-evaluable rules from the Karpathy CLAUDE.md
+  (https://github.com/multica-ai/andrej-karpathy-skills/blob/main/CLAUDE.md):
+
+  1. **Simplicity** — flag features beyond what was asked, single-use
+     abstractions, unrequested configurability, impossible-scenario error
+     handling, 200-line code that could be 50.
+
+  2. **Surgical scope** — flag drive-by refactors of unrelated adjacent
+     code, style refactors mixed with substantive logic edits, orphan
+     imports/variables/functions, style drift from the file's existing
+     conventions.
+
+  3. **Hidden assumptions** — flag behavior depending on unstated
+     invariants the next reader can't see, simpler alternatives the diff
+     didn't consider when obvious, multiple valid interpretations of the
+     task with one silently picked.
+
+  The fourth Karpathy rule (Goal-Driven Execution) was intentionally
+  excluded — it's a metaprocess rule about how to approach a task with
+  no concrete evaluation target on a code diff. Tracked as a candidate
+  for separate CLAUDE.md inclusion in a follow-on.
+
+  ## Why universal (Option A) over project-scoped opt-in
+
+  The baseline is intentionally on for every opted-in project: same
+  review criteria everywhere, regardless of whether the project supplied
+  a marker. Project-specific invariants in `.codex-pair/context.md`
+  take precedence per the section's framing ("Treat violations as MED or
+  HIGH findings unless a project-context rule below explicitly overrides
+  them"), so projects retain the ability to override baseline behavior
+  without removing it.
+
+  ## Cost + cache impact
+
+  - ~360 tokens per review of prompt overhead (~$0.0015 at current
+    codex pricing — negligible vs the $0.04–0.07 per-review codex spend)
+  - Cache invalidation is one-time per project on the first edit after
+    upgrade because the prompt content change → cache key change. Each
+    opted-in project pays one extra codex spawn per file on the first
+    post-upgrade edit, then back to normal cache-hit rates.
+
+  ## What's unchanged
+
+  The hook source (`codex-pair-watch.mjs`) is byte-identical. This is a
+  prompt-only change. ADR-077 silent-on-error, ADR-082 cache key shape,
+  ADR-087 inflight lock, ADR-089 golden-fixture contract — all unchanged
+  in mechanism (the golden fixture content is updated to match the new
+  template, preserving the byte-identical pin).
+
+  Plugin test count unchanged at 313; lint clean across 6 workspaces.
+
+  ## Reversibility
+
+  Two file edits + one test-assertion update if empirical follow-on
+  shows the baseline doesn't earn its keep. ADR-099 documents the
+  reversal cost up front.
+
+- [#121](https://github.com/Lykhoyda/ask-llm/pull/121) [`5bb4dff`](https://github.com/Lykhoyda/ask-llm/commit/5bb4dff1793939c26303239c93b8f0b271cdeef3) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # ADR-100 — codex-pair prompt A/B benchmark harness
+
+  Scaffolds an empirical validation harness for prompt-template changes
+  at `packages/claude-plugin/scripts/benchmark/`. Built initially to
+  validate ADR-099 (Karpathy baseline principles), but reusable for any
+  future prompt change.
+
+  ## What's in the harness
+
+  ```
+  packages/claude-plugin/scripts/benchmark/
+  ├── README.md                       # usage + decision rule
+  ├── prompt-ab.mjs                   # driver
+  ├── lib/
+  │   ├── render-prompt.mjs           # mirrors lib/prompt.mjs substitution
+  │   ├── invoke-codex.mjs            # spawns codex exec --json, parses JSONL
+  │   ├── score.mjs                   # keyword-based probe matching
+  │   └── report.mjs                  # markdown report generator
+  ├── fixtures/
+  │   ├── README.md
+  │   ├── 01-overcomplication/        # Simplicity rule
+  │   ├── 02-drive-by-refactor/       # Surgical scope rule
+  │   ├── 03-orphan-imports/          # Surgical scope rule
+  │   └── 04-hidden-assumption/       # Hidden assumptions rule
+  └── templates/
+      ├── pre-baseline.txt            # main's prompt as of ADR-098
+      └── baseline.txt                # ADR-099's prompt with Karpathy block
+  ```
+
+  ## Methodology
+
+  1. Each fixture has three files: `code.ts` (sent to codex), `context.md`
+     (marker context), `probes.json` (ground-truth `should_flag` entries).
+  2. The driver renders each fixture against both templates, invokes real
+     `codex exec --json`, scores findings against probes via keyword
+     match (≥2 keyword hits per probe), emits a markdown comparison.
+  3. Decision rule for ADR-099 validation: ship if recall delta ≥ +10 pp
+     AND extra-finding delta ≤ +1/fixture; otherwise execute ADR-099's
+     documented two-file rollback.
+
+  ## Cost
+
+  ~$0.40 per full benchmark run (4 fixtures × 2 arms × ~$0.05/review).
+
+  ## What this is NOT
+
+  - NOT a runtime change — the harness is standalone tooling under
+    `scripts/benchmark/` with no imports from the runtime layer
+  - NOT auto-run on PRs — manual invocation only until variance data
+    justifies a CI gate
+  - NOT tested by vitest — one-off maintainer scripts, exercised
+    manually when run; lint covers syntax via Biome
+
+  Plugin test count unchanged at 313; lint clean across 6 workspaces.
+
+  ## Forward use
+
+  Future prompt changes (severity-vs-urgency, structured-output tweaks,
+  baseline rule extensions) can vendor a new template snapshot into
+  `templates/` and re-run against the same fixtures + decision rule.
+  The harness itself is the durable artifact; ADR-099 is the first
+  use-case.
+
+  Run with:
+
+  ```bash
+  node packages/claude-plugin/scripts/benchmark/prompt-ab.mjs \
+    --out benchmark-report.md
+  ```
+
+- [#122](https://github.com/Lykhoyda/ask-llm/pull/122) [`971ddf7`](https://github.com/Lykhoyda/ask-llm/commit/971ddf7d1e96bbab7d98eebae7d9ef065598e6e0) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # Benchmark harness fixes — SIGKILL timeout respect + graceful error-state report rendering
+
+  Two defects in the ADR-100 prompt A/B benchmark harness (`packages/claude-plugin/scripts/benchmark/`) discovered during the first real run validating ADR-099. Both fixes are isolated to maintainer tooling — no runtime impact, no test-suite changes needed.
+
+  ## Fix 1: `lib/invoke-codex.mjs` — SIGKILL respect + settled guard
+
+  **Defect**: codex ignored `SIGTERM` when mid-turn. The first benchmark run recorded fixture durations of **712s / 985s / 908s** past a 240-second `SIGTERM` — codex held the script open until its own internal lifecycle decided to exit. The promise-rejection from the timer fired, but the child process kept the Node script alive via its still-open stdio pipes.
+
+  **Fix**:
+
+  - Switch from `SIGTERM` to `SIGKILL` — codex respects the latter immediately
+  - Explicit `child.stdout.destroy()` + `child.stderr.destroy()` + `child.stdin.destroy()` to release stdio backpressure when killing
+  - `settled` guard variable prevents the `close` handler from double-settling the promise if it fires after the timer
+  - `child.on("error", ...)` handler added so spawn-failure (ENOENT, EACCES) routes through the same settle path instead of crashing the driver
+  - Default `timeoutMs` bumped 120s → 300s; codex with reasoning tokens occasionally needs >2 min for complex fixtures
+  - Timeout error message now includes captured stdout/stderr byte counts for diagnostic visibility
+
+  ## Fix 2: `lib/report.mjs` — error-state rendering without crashing
+
+  **Defect**: when ANY fixture errored on EITHER arm, `report.mjs` crashed with `Cannot read properties of undefined (reading 'recall')` because per-fixture iteration accessed `run.score.recall` without checking whether `run` had an `error` instead.
+
+  **Fix**:
+
+  - Per-fixture loop now branches on `run.error` and renders a `FAILED — <message>` section with the duration, instead of trying to render score data that doesn't exist
+  - Aggregate section now detects "at least one arm errored on every fixture" and surfaces that explicitly instead of computing a nonsensical recall delta on empty data
+
+  ## Why these matter
+
+  The harness will be re-run for every future prompt change (severity-vs-urgency refactor, structured-output tweaks, additional baseline rules). Without these fixes, a single codex non-determinism event would cost 12+ minutes of wall-clock per hung fixture, and the report would crash trying to render the result. The fixes turn the harness from "works when codex is cooperative" into "works regardless of codex's mood."
+
+  ## What's unchanged
+
+  Hook source, broker, cache, lock, parser, prompt rendering — none of these touch runtime code. Pure maintainer-tooling fix.
+
+  Plugin test count unchanged at 313; lint clean across 6 workspaces.
+
+- [#119](https://github.com/Lykhoyda/ask-llm/pull/119) [`0f67df2`](https://github.com/Lykhoyda/ask-llm/commit/0f67df285fa8b892dc31c5b8e3bc68388431d36a) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # Parallel-fire test fixtures — closes the MultiEdit + concurrent-hook test gap
+
+  Adds 6 new tests + a `slow` scenario to the fake-codex fixture, closing
+  the empirical gap surfaced by the deep-investigation tracing: the 313
+  pre-existing plugin tests used `tool_name: "Edit"` exclusively, with
+  zero MultiEdit payloads and zero concurrent-hook scenarios. The actual
+  codex-pair workload — agentic Claude making multiple Edit/Write/Multi-
+  Edit tool calls per turn — wasn't exercised by any test.
+
+  ## New tests (`packages/claude-plugin/src/__tests__/codex-pair-watch.test.ts`)
+
+  1. **MultiEdit payload acceptance** — pins that `{tool_name: "MultiEdit",
+tool_input: {file_path, edits: [...]}}` reaches the codex-spawn path
+     and logs a review entry with `tool: "MultiEdit"`. Guards against
+     silent payload-shape drift if Claude Code's MultiEdit schema ever
+     changes.
+
+  2. **Cache participation (MultiEdit→MultiEdit)** — pins that the cache
+     key is content-derived (not tool-name-derived) so identical-content
+     MultiEdit re-fires hit the cache. Closes a regression class: a
+     tool_name-specific cache bypass.
+
+  3. **Cross-file parallel fires (3 concurrent processes)** — fires 3
+     hooks concurrently via `Promise.all` on 3 different files. Verifies:
+
+     - All 3 exit 0
+     - 3 distinct review log entries with distinct file paths
+     - 3 separate cache entries across cache buckets
+     - 3 separate per-file repetition shards under `state/repetitions/`
+     - No cross-file contention (ADR-097 sharded layout invariant)
+
+  4. **Same-file in-flight coalescing (ADR-087)** — fires hook A with the
+     `slow` codex scenario, waits 250ms (past lock acquisition), fires
+     hook B on the same file. Verifies hook B logs `verdict: "skipped"`
+     with `coalesced` in the reason, emits no systemMessage, and that
+     only ONE review verdict (from hook A) lands in the log.
+
+  5. **MultiEdit + ignore gate** — verifies an ignored file matched by
+     `.codex-pair/ignore` is skipped pre-codex even when the tool is
+     MultiEdit. Guards against a tool_name-specific gate bypass.
+
+  6. **Slow-scenario fixture self-test** — sanity-pins that the new
+     `slow` scenario actually sleeps for `FAKE_CODEX_SLEEP_MS` before
+     emitting NONE. If someone breaks the fixture, this gives a direct
+     failure pointing at the cause rather than confusing race-flakes
+     in the dependent coalescing test.
+
+  ## New fake-codex `slow` scenario (`_fixtures/codex`)
+
+  Adds a configurable-latency scenario: sleeps `FAKE_CODEX_SLEEP_MS`
+  (default 500ms) then emits a NONE verdict. Enables deterministic
+  race-window control for the in-flight coalescing test without the
+  30-second `timeout` scenario's wall-clock penalty.
+
+  ## Test count and wall-clock impact
+
+  - Test count: 313 → 319 (+6).
+  - Wall-clock: 4.2s → 7.1s (+2.9s), dominated by the 1.5s slow-scenario
+    hold-time in the coalescing test plus ~500ms for 3 concurrent
+    codex spawns in the cross-file test. Acceptable.
+  - Lint clean across 6 workspaces.
+
+  No production code changes. The fixture file (`_fixtures/codex`) is
+  test-only and not shipped to npm consumers.
+
+## 0.7.1
+
+### Patch Changes
+
+- [#111](https://github.com/Lykhoyda/ask-llm/pull/111) [`ab40290`](https://github.com/Lykhoyda/ask-llm/commit/ab40290fecdbabec75436579d06152f6218251d6) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # ADR-097 — codex-pair UX hotfix on ADR-096
+
+  Closes the four `/multi-review` findings explicitly tracked as "follow-on hotfix
+  before wide adoption" in the v0.7.0 changeset. Both Gemini and Codex
+  independently flagged each at 80+ confidence; all four reproduced empirically
+  before fixing per the ADR-095 verify-before-fixing discipline.
+
+  1. **TOCTOU race on singleton `repetitions.json`** (Gemini 95, Codex 88) →
+     state moves from `<markerDir>/.codex-pair/state/repetitions.json` to
+     `<markerDir>/.codex-pair/state/repetitions/<sha256(file)[0:16]>.json`. Each
+     shard's read-modify-write is now naturally serialized by ADR-087's per-file
+     inflight lock. Schema bumped to `v: 2`.
+
+  2. **Unbounded state growth** (Codex 85) → `sweepStaleRepetitions` drops
+     shards older than 30 days, called probabilistically (5% per update) so
+     abandoned files don't accumulate state.
+
+  3. **Cache-hit double-count under rapid re-saves** (Gemini 87) → new
+     read-only `getBlockingFromShard` surfaces blocking entries without
+     mutating state. Cache-hit branch in `codex-pair-watch.mjs` uses this
+     instead of `updateRepetitions`. Rapid undo/redo cycles can no longer
+     push a finding to BLOCKING without a real new live review.
+
+  4. **Include-list negation-only edge case** (Codex 82) → `.codex-pair/include`
+     with ONLY negation rules (e.g. just `!build/**`) previously gated every
+     file out (no positive rule = no match for anything). Now the negations
+     transform into positive ignore-list entries with an info-level log line
+     explaining the semantic mapping.
+
+  Backward-compat shims keep the v1 `loadRepetitions`/`saveRepetitions` exports
+  as no-ops so external scripts that imported the v1 surface don't break at
+  import time. No data migration needed — repetition state is advisory and
+  regenerates from continued reviews; any lingering v1 `repetitions.json` file
+  on disk is harmless (different path, ignored by new code, won't be swept by
+  the new TTL).
+
+  Test count 308 → 313 (+5 ADR-097 regressions). Lint clean across 6 workspaces.
+
+- Updated dependencies [[`ab40290`](https://github.com/Lykhoyda/ask-llm/commit/ab40290fecdbabec75436579d06152f6218251d6)]:
+  - ask-gemini-mcp@1.6.5
+  - ask-codex-mcp@0.3.7
+  - ask-ollama-mcp@0.3.2
+
+## 0.7.0
+
+### Minor Changes
+
+- [#108](https://github.com/Lykhoyda/ask-llm/pull/108) [`190e5c9`](https://github.com/Lykhoyda/ask-llm/commit/190e5c9ee95b8241b0c788e3df2ea4fd3721b074) Thanks [@Lykhoyda](https://github.com/Lykhoyda)! - # v0.7.0 — Tier 3 broker, layout consolidation, codex-pair UX improvements
+
+  Major release across the codex-pair feature: shipped the full Tier 3
+  `codex app-server` broker (eliminates ~3-10s cold-spawn per edit when
+  opted in via `ASK_CODEX_BROKER=1`), consolidated all hook state under
+  a single `.codex-pair/` directory, removed the deprecated PreToolUse
+  Gemini pre-commit hook, and added three codex-pair UX improvements
+  born from end-of-Tier-3 lived-experience review.
+
+  ## Highlights
+
+  ### Tier 3 broker — `codex app-server` integration (ADR-093)
+
+  A long-lived `codex app-server` JSON-RPC sidecar replaces the per-edit
+  cold-spawn cost (15-30s) with a warm-connection path (~5-15s, savings
+  of 3-10s per fire). Spawned once per Claude Code session, torn down at
+  SessionEnd, with stale-broker recovery for crashed-session orphans.
+
+  Implementation across four milestones:
+
+  - **M1**: Protocol discovery via `codex app-server generate-json-schema`.
+    Refined `lib/broker.mjs` interface; pinned `BROKER_PROTOCOL_VERSION =
+"v2"`, `JSONRPC_METHODS`, `JSONRPC_NOTIFICATIONS`, `buildVerdictSchema()`.
+
+  - **M2**: Hand-rolled minimal RFC 6455 WebSocket client (`broker-transport.
+mjs`, ~280 LOC) supporting both `unix://` and `ws://`; JSON-RPC 2.0
+    layer with tolerant parsing (`broker-rpc.mjs`); SessionStart spawn +
+    handshake + atomic descriptor write; SessionEnd SIGTERM grace +
+    cleanup; `clearStaleBrokerState` for orphan recovery (`broker-
+lifecycle.mjs`).
+
+  - **M3**: Real `submitReview` body — `thread/start { ephemeral: true,
+approvalPolicy: "never", sandbox: "read-only" }` → `turn/start` with
+    `outputSchema` constraint matching `parser.mjs::parseConcernsJson` →
+    listen for `turn/completed` → extract final agentMessage → return.
+    `rpc.waitFor(method, predicate, timeoutMs)` race-safe notification
+    primitive. Error mapping via `err.verdict` (matches existing
+    `verdictFromError` contract) with structured `err.timeout`,
+    `err.aborted` markers.
+
+  - **M4**: Hook integration. `isBrokerEnabled(markerDir)` checks env +
+    descriptor + protocol version + pid liveness. `runCodexWithFallback`
+    dispatches to the broker via `runWithBroker` when enabled; on
+    `err.brokerFailure` (transport / handshake / parse failures) silently
+    falls back to per-edit `spawnCodex` per the ADR-077 silent-on-error
+    contract. Cache integration unchanged — broker and spawn modes share
+    the same cache entries (cross-mode reuse is a feature).
+
+  Opt-in via `ASK_CODEX_BROKER=1`. Default-off behavior byte-identical
+  to v0.6.x.
+
+  ### `.codex-pair/` layout consolidation (ADR-092)
+
+  All hook state nested under a single project-local directory:
+
+  | Before (flat)                 | After (nested)                |
+  | ----------------------------- | ----------------------------- |
+  | `.codex-pair-context.md`      | `.codex-pair/context.md`      |
+  | `.codex-pair-log.jsonl`       | `.codex-pair/log.jsonl`       |
+  | `.codex-pair-ignore`          | `.codex-pair/ignore`          |
+  | `.codex-pair-cache/`          | `.codex-pair/cache/`          |
+  | `.codex-pair-state/paused`    | `.codex-pair/state/paused`    |
+  | `.codex-pair-state/inflight/` | `.codex-pair/state/inflight/` |
+
+  `.gitignore` collapses from 4 enumerated codex-pair entries to one
+  `.codex-pair/` line — future state files inherit the ignore
+  automatically. Path-resolver pattern in `lib/state.mjs` is the single
+  source of truth.
+
+  **Migration for existing users**: manual `mv` of legacy flat paths into
+  `.codex-pair/`. No migration helper ships; behavior is byte-identical
+  to v0.6.x once paths are moved. Cache JSON shape, log JSONL shape,
+  broker interface, atomicity contracts all unchanged.
+
+  ### Codex-pair UX improvements (ADR-096)
+
+  Three improvements identified from end-of-Tier-3 lived-experience
+  review (ADR-095), targeting the 81% finding-ignored rate observed in
+  real M2 development:
+
+  1. **Inclusion-list scoping** (`.codex-pair/include`). Gitignore-style
+     globs, mirror of `.codex-pair/ignore`. When present + non-empty,
+     ONLY files matching at least one rule are reviewed. Lets users
+     restrict codex-pair to high-stakes paths (`src/billing/**`,
+     `src/auth/**`) and avoid paying ~$0.05/edit on routine refactor
+     code. Include gate runs BEFORE ignore (include narrows; ignore
+     excludes from narrowed set).
+
+  2. **Repetition detector** (`.codex-pair/state/repetitions.json`).
+     Tracks per-(file, concernHash) consecutive flag counts. Concerns
+     absent from a re-review are dropped (assumed fixed); concerns
+     present again increment. When count crosses `REPETITION_BLOCKING_
+THRESHOLD` (3), the finding is escalated.
+
+  3. **Loud-formatting** for repeated-ignored findings. When the
+     threshold is crossed, `buildVerdictMessage` prefixes the
+     systemMessage with a multi-line 🛑 banner so the consumer
+     (Claude or human) cannot silently scroll past. Poor-man's STOPPER
+     mode within PostToolUse hook constraints (Claude Code's hook
+     protocol doesn't currently support blocking the next tool call).
+
+  ### PreToolUse pre-commit Gemini hook removed (ADR-094)
+
+  The advisory-only PreToolUse hook that ran Gemini against staged
+  diffs has been removed:
+
+  - Codex-pair delivers strictly better recall continuously during
+    editing (HIGH/MED concerns surface to Claude on next turn; LOW
+    concerns log).
+  - `/gemini-review` covers the on-demand explicit-review need with
+    the same Gemini-CLI dependency.
+  - Removing eliminates per-Bash dispatch latency and simplifies the
+    "what hooks does this plugin install?" model.
+
+  **For users who relied on the advisory output**: switch to
+  `git diff --cached | ask-gemini-run "review these staged changes"`
+  or `/gemini-review` before committing. Both are documented in the
+  README.
+
+  ### Internal: codex-pair debt paydown + reviewer-agent calibration (ADR-095)
+
+  End-of-Tier-2 forensic audit of `.codex-pair/log.jsonl` revealed
+  codex-pair flagged 32 unique bugs during development; 21 were
+  ignored in flight (2 of them BLOCKING — un-sent WebSocket upgrade
+
+  - ESM `require()` — that `/multi-review` independently re-caught
+    5+ hours later).
+
+  * 6 verified-real bug fixes after empirical reproduction tracing
+  * 1 documented false-positive (`child.unref()` is by design per ADR-090)
+  * 3 deferred-known-limitations tracked in ROADMAP
+  * `agents/codex-reviewer.md` calibration: severity-first reporting,
+    mandatory reproduction paths, ADR-aware false-positive filtering,
+    anti-noise heuristics
+
+  ## What's not in this release (known follow-ons)
+
+  - Full severity-vs-urgency refactor (breaking prompt + parser change).
+  - True platform-level STOPPER signal (requires upstream Claude Code
+    support for `decision: "block"` on PostToolUse).
+  - Per-finding "acknowledged" persistence.
+  - Multi-review ADR-096 findings (TOCTOU race on repetitions.json
+    cross-file updates; unbounded state growth without TTL; include-list
+    negation-only edge case; cache-hit double-count under rapid re-saves)
+    — tracked for a follow-on hotfix before wide adoption.
+
+  ## Test count trajectory
+
+  230 → 245 (M2 PR1) → 254 (M2 PR2) → 264 (M2 PR3) → 271 (M2 hotfix [#103](https://github.com/Lykhoyda/ask-llm/issues/103))
+  → 278 (ADR-095 debt) → 284 (M3) → 289 (M3 hotfix) → 300 (M4) → 308
+  (ADR-096). All tests pass; lint clean across 6 workspaces.
+
+## 0.6.2
+
+### Patch Changes
+
+- Fix two ≥80-confidence findings from the multi-review on PR [#76](https://github.com/Lykhoyda/ask-llm/issues/76):
+
+  **1. Catch handler now uses hoisted `markerAnchor` instead of `process.cwd()`** (both Gemini and Codex flagged). The unhandled-exception path in `main().catch(...)` previously walked up from `process.cwd()` to find the marker, which undermined the v0.6.1 cross-repo fix for any error that happened AFTER payload parsing. Now: `markerAnchor` is hoisted to module scope; `main()` sets it to `dirname(filePath)` once payload is validated; the catch handler reads `markerAnchor ?? process.cwd()` — using cwd only as a true last resort when `main()` threw before payload parsing.
+
+  **2. Documented Windows compatibility caveat** for the `$PWD` workaround in `apps/docs/plugin/hooks.md`. The `sh -c '...'` form requires a POSIX shell, which Windows users on cmd.exe/PowerShell don't have natively. Added a one-line note pointing Windows users at Git for Windows (which provides `sh` via MINGW64) or recommending an absolute Windows path instead.
+
+  Both fixes are tiny (~5 LOC each), no architectural changes. New structural test pins the catch-handler hoist invariant so a future refactor can't silently regress.
+
+## 0.6.1
+
+### Patch Changes
+
+- Fix: codex-pair marker resolution now anchors to the edited file's directory, not `process.cwd()` (issue [#65](https://github.com/Lykhoyda/ask-llm/issues/65)). In multi-repo workflows where Claude Code's cwd is one repo but the edit happens in another, the previous behavior wrote logs to the cwd's repo instead of the edited file's repo, producing "where did my log go?" confusion. The fix uses `dirname(tool_input.file_path)` — always absolute per Claude Code's hook payload contract — as the marker walk's anchor. The `main().catch` unhandled-exception fallback retains its cwd-based lookup since `filePath` isn't in scope there; the structural test was tightened to allow this distinction.
+
+  Side effect: shipping this as v0.6.1 also triggers Claude Code's plugin cache refresh for pre-existing sessions still pinned to the stale v0.6.0 install (issue [#74](https://github.com/Lykhoyda/ask-llm/issues/74)) — the next `/reload-plugins` or session restart will see "new version available" and re-fetch from origin.
+
+## 0.6.0
+
+### Minor Changes
+
+- Prep v0.6.0 — codex-pair hook improvements release. Umbrella version covering a coordinated batch of hardening, observability, speed, and DX improvements to the codex-pair PostToolUse hook. Planned scope across three phases:
+
+  **Phase 1 — Hardening + observability (bundled PR):**
+
+  - Log rotation: cap `.codex-pair-log.jsonl` at ~2MB / 1000 entries via atomic rewrite (env override `CODEX_PAIR_MAX_LOG_BYTES`).
+  - Structured run-state verdicts: explicit `none | concerns | skipped | error | spawn_failed | timeout | parse_failed | cached`, mirrored into the `systemMessage` prefix.
+  - Expanded skip patterns: add font files, archives, language-specific lockfiles, minified assets.
+  - Default-model drift guard: read model defaults from a shipped `codex-pair-defaults.json` instead of hardcoded literals; structural test links the file to `codex-mcp/constants.ts`.
+
+  **Phase 2 — Foundation + adaptive context (sequential PRs):**
+
+  - Local config in marker frontmatter: YAML frontmatter in `.codex-pair-context.md` for `model`, `fallbackModel`, `timeoutMs`, `maxFileBytes`, `surfaceThreshold`. Hand-rolled zero-dependency parser.
+  - Adaptive context strategy at the file-size boundary: under-cap → full file (unchanged); over-cap + tracked → imports header + `git diff -U20 HEAD` + partial-view instruction; over-cap + untracked → head+tail slice with same instruction. Replaces today's silent skip.
+  - `.codex-pair-ignore`: gitignore-style globs for granular per-file/per-directory opt-out, no `systemMessage` on match (preserves silent-gating UX).
+
+  **Phase 3 — Speed + recovery (parallelizable PRs):**
+
+  - Content-hash response cache: `sha256(model + prompt + fileContent + surfaceThreshold)` keyed cache under `<markerDir>/.codex-pair-cache/`, 10-minute TTL, 50-file LRU eviction.
+  - Log viewer CLI: standalone `scripts/codex-pair-log.mjs` with `--latest`, `--summary`, `--file`, `--since` subcommands. Zero workspace imports.
+  - Failure-class retry with jitter: retry-once on transient network/5xx errors (`ECONNRESET`, `ETIMEDOUT`, `502`/`503`/`504`, etc.). Quota and timeout failures keep their existing terminal paths.
+
+  Constraints preserved through all items: zero workspace imports (marketplace install compatibility), always exit 0 (never break Claude's tool flow), LOW concerns stay in log only by default (ADR-077 threshold-in-hook), synchronous-blocking hook semantics (agent-accountability argument). Reasoning-effort tuning and async/fire-and-forget patterns are explicitly out of scope for this batch.
+
+## 0.5.0
+
+### Minor Changes
+
+- codex-pair hook now emits a `systemMessage` notice to Claude Code on every run — `OK` when no concerns are found, `WARN` with HIGH/MED bodies when concerns surface, and `SKIP`/`ERROR` when the hook attempts work but can't complete (unreadable file, oversize file, codex timeout). Previously the hook was silent on the happy path, so review activity was only visible in `.codex-pair-log.jsonl`. The threshold-in-hook design from ADR-077 is preserved: LOW concern bodies still go to the log only, with a count surfaced in the verdict header.