@knightcodeai/cli 0.17.4 → 0.18.0

package/CHANGELOG.md

@@ -0,0 +1,1293 @@
+# @knightcodeai/cli
+
+## 0.18.0
+
+### Added
+
+- Added a generated reference for every `models.json` field, including routing a built-in provider through a proxy `baseUrl`.
+
+- Added `knightcode app-server`, a headless multi-thread server over a JSON-RPC-shaped stdio protocol, with durable history, bounded payload retrieval, per-thread tool approvals with command-prefix allows, typed turn errors, a removable message queue, settings writes, and idle unloading.
+
+- Added ownership locks on live session files, with a fork offer when resuming a session open in another KnightCode process.
+
+### Changed
+
+- Changed the npm package and the installer to ship KnightCode as JavaScript that runs on your own Node.js instead of a per-platform binary with Bun embedded, cutting the download from about 125 MB to about 3 MB; KnightCode now requires Node.js 22.19 or newer, and the standalone binaries remain available from GitHub releases for machines without Node. An npm install updating from an earlier version can report a failed update after installing this one; restart KnightCode to use it.
+
+- Changed the default NVIDIA model to `nvidia/nemotron-3.5-super-vl-120b-a12b`.
+
+### Fixed
+
+- Fixed retries for gateway errors that say the request failed, the stream was interrupted, or the HTTP/2 stream failed.
+
+- Fixed the `codemode` tool failing with `ModuleNotFound` in the standalone binaries, and image resizing in those binaries silently running on the main thread instead of in its worker.
+
+## 0.17.4
+
+### Fixed
+
+- Fixed retries for node-fetch errors worded "request to <url> failed, reason:", including a Google token refresh that reports an empty reason. Those failures now retry like other fetch transport errors.
+
+- Fixed tool results that contain only whitespace being sent as text. OpenAI and Google requests now treat that text as empty and use the same placeholder as a result with no text.
+
+- Fixed compaction summaries that failed with "generation hit the token cap" when reasoning used up a fixed output limit. Summary requests no longer set maxTokens, so the provider sizes output from the model's limit and the request that was sent. reserveTokens only decides when automatic compaction starts.
+
+## 0.17.3
+
+### Changed
+
+- Changed Kimi Coding to use Chat Completions at https://api.kimi.com/coding/v1, the protocol the official Kimi Code client uses. K3, K3-256K and Kimi For Coding accept tools declared in later system messages, so tools loaded mid-conversation keep the prompt cache. Kimi Code Highspeed rejects tool-bearing system messages and keeps added tools in the top-level list.
+
+### Fixed
+
+- Fixed Kimi Coding requests failing with HTTP 404. The provider uses Anthropic Messages at https://api.kimi.com/coding again, so the client no longer appends /v1/messages to a base URL that already ends in /v1.
+
+- Fixed turning thinking off for Claude Haiku 5.5 and Opus 5. Those models accept disabled thinking, but KnightCode kept thinking on the way it does for Opus 5.5. Off now sends disabled thinking and leaves out effort markers, which Anthropic rejects while thinking is disabled.
+
+- Fixed thinking from a previous model being replayed as visible text after switching models. Thinking from another model is now dropped: its signatures and encrypted reasoning only work with the model that produced them, and readable thinking sent as plain text made the new model treat it as part of its own reply.
+
+- Fixed images in failed tool results being replaced by a note for Anthropic and for Claude on Bedrock. Both reject images inside an error tool result, so the images are now sent right after the turn's tool results with a caption naming the tool call.
+
+- Fixed closing an extension overlay removing a different overlay. When another overlay had opened above it, closing the lower one hid the topmost overlay instead and left the closed one on screen.
+
+- Fixed retries when a provider says the service is temporarily unavailable, including when the message has no status code.
+
+- Fixed the default model for the Xiaomi providers. It was `mimo-v2.5-pro`, which Xiaomi no longer lists, so choosing a Xiaomi provider without a model found nothing; the default is now `mimo-v2.6-pro`.
+
+## 0.17.2
+
+### Changed
+
+- Changed OpenAI GPT-6 models to keep the prompt cache when the thinking level changes. A change now goes in as a configuration update instead of rewriting the reasoning effort, so earlier turns stay cached. Sign-in with ChatGPT and proxies keep the previous behavior.
+
+- Changed Kimi Coding to Chat Completions at `api.kimi.com/coding/v1`. K3, K3-256K, and Kimi For Coding keep tools loaded mid-conversation in later system messages, so the prompt cache holds. Highspeed still puts added tools in the top-level list because it rejects tool-bearing system messages.
+
+### Fixed
+
+- Fixed the context window for Codex GPT-6.1 Sol. Codex reports 500,000 tokens for that model. Other Codex models stay at 272,000.
+
+- Fixed thinking being stored after the answer text when a proxy such as LiteLLM sends reasoning and content in the same OpenAI-compatible stream chunk. The message now keeps the order the model produced.
+
+- Fixed gateway errors reading "Unable to forward upstream stream" failing the turn. They are now retried like other transient provider errors.
+
+- Fixed Gemini 4 models ignoring the selected thinking level. Gemini 4 Argon rejected `thinkingBudget`, so Gemini 4 and later now send `thinkingLevel`.
+
+- Fixed the provider chosen for a model reference depending on catalog order. `--model`, `--models`, `/model` and credential printing now share one resolver: credentials decide between providers that offer the same model, an ambiguous match is reported instead of falling through to a fuzzy match, and a `:<thinking>` suffix no longer changes the provider. A `--models` entry offered by several providers is added for each, with a warning.
+
+- Fixed OpenCode and OpenCode Go requests that went to routes which no longer exist. Gemini models on OpenCode Go now work, and MiniMax M2.7 uses Anthropic Messages.
+
+- Fixed empty quoted prompt-template arguments. `""` and `''` stay in place, so later arguments are not shifted and positional defaults still apply.
+
+- Fixed read-tool line ranges built from numeric strings and nulls. The TUI, the session tree, and HTML export now show the same range.
+
+- Fixed finished tool calls whose arguments were not valid JSON. The tool no longer runs with only the fields parsed before the error. The model is told the arguments were malformed.
+
+- Fixed Xiaomi MiMo requests that sent `reasoning_effort`. MiMo only accepts a thinking on/off toggle, so the control is off or high and `reasoning_effort` is no longer sent.
+
+## 0.17.1
+
+### Added
+
+- Added a `sessionShareDestination` setting (`auto`, `gist` or `radius`) so `/share` can be pinned to a GitHub gist or a Radius artifact.
+
+### Fixed
+
+- Fixed Anthropic requests failing when a tool returned an error result that contained an image; the image is now replaced with a short text note.
+
+- Fixed repeated codemode timeouts or aborts accumulating surviving workers; at most two codemode workers now run at once across sessions, counting a cancelled worker until it exits.
+
+- Fixed stopping a codemode script or reaching its deadline waiting for a non-interruptible built-in to return on Bun; the call now ends promptly.
+
+- Fixed resumed sessions dropping tools activated during the session. Resume now restores the session's active tools, with `--tools +name`/`-name` entries applied to them, unless `--tools` with tool names, `--no-tools`, or `--no-builtin-tools` selects tools explicitly.
+
+- Fixed tool-call arguments losing fields when a string contained an invalid `\u` escape such as `\usepackage`; the text is now kept literally.
+
+## 0.17.0
+
+### Added
+
+- Added `KNIGHTCODE_CLIPBOARD_OSC52=1`, which also sends copied text to the terminal with OSC 52 for remote clients that leave no SSH variables, such as a multiplexer attached from another machine or a remote IDE daemon.
+
+- Added `aliases` to tool namespaces; codemode's `describeNamespace()` and the `namespace` option of `searchTools()` match them, and MCP namespaces use the server name.
+
+- Added per-key OpenRouter model lists: with an OpenRouter key, KnightCode lists only the chat models that key may use, with the key's context size, max output, and prices, including guardrails and regional endpoints set as the base URL in `models.json`. The list is saved and used offline.
+
+- Added `reachesTools` to tool definitions, so tools that reach other tools (such as `codemode` and `tool_search`) declare which tools a call may reach; the MCP extension uses it to wait for the servers a call needs and to decide whether a replacement `codemode` or `tool_search` tool can reach MCP tools.
+
+- Added elapsed time while a codemode script runs and its total time once it finishes to the codemode tool row, like bash rows.
+
+### Changed
+
+- Changed codemode declarations of MCP tools to spell out the result type (`content`, `structuredContent`, `isError`) instead of referring to `CallToolResult<T>`, which `describeTool()`, `searchTools()` and `ALL_TOOLS` showed without defining it; the codemode description no longer includes the shared MCP types.
+
+- Changed codemode tool declarations to show input constraints such as integer, minimum and maximum, length, pattern and default as `@` tags on property comments, so scripts see them without the tool repeating them in its description.
+
+- Changed compaction, branch summaries and bug reports to leave thinking blocks out of the conversation they serialize; replayed thinking is often not part of the live context, so including it could make a summarization request larger than the context it summarizes and fail on every attempt.
+
+- Changed the JSON schemas for settings, models, keybindings and themes to be served from https://knightcode.dev/schemas/ instead of GitHub raw URLs; the bundled themes, docs and examples now use the new `$schema` address, and existing files with the old address keep validating.
+
+### Removed
+
+- Removed the experimental `knightcode server` and `knightcode client` commands (behind `KNIGHTCODE_EXPERIMENTAL=1`), their plugin and session-worker processes, and the `KNIGHTCODE_SERVER_DIR`, `KNIGHTCODE_SERVER_ID` and `KNIGHTCODE_RADIUS_GATEWAY` variables; the Radius gateway override only served the removed Radius relay.
+
+### Fixed
+
+- Fixed Anthropic tools marked `strict: "prefer"` failing when the provider rejects the strict tool set for grammar size, tool count, or union limits; the request is now retried once with those tools non-strict, and `strict: "require"` tools stay strict.
+
+- Fixed credential updates failing on Windows with EPERM when a just-removed `auth.json.lock` directory was still delete-pending; the lock is now retried briefly.
+
+- Fixed `before_agent_start` not firing for runs started by `knightcode.sendMessage(..., { triggerTurn: true })`, which let the system prompt change mid-run and broke the provider prompt cache. `BeforeAgentStartEvent` is now a union on `messageType` (`"user"` or `"custom"`), and the session counts as busy from the start of run setup, so messages sent meanwhile join the starting run.
+
+- Fixed the codemode tool description to say that a tool whose declaration returns an object also resolves on failure when it returned that object, so scripts check its fields instead of expecting a rejection.
+
+- Fixed codemode blocking the process for seconds to minutes after scripts with many `text()` calls; joining the output items was quadratic.
+
+- Fixed codemode ignoring a `// @options:` line that is not the first line of the script, which ran the script without the requested `timeout_ms`; the call now fails with an error before the script runs.
+
+- Fixed an MCP tool call that was cancelled or timed out while waiting for a shared OAuth refresh still being sent to the server once the refresh finished.
+
+- Fixed `knightcode mcp login --timeout` being described as a wait for the browser; it limits the whole sign-in, including requests to the authorization server.
+
+- Fixed MCP servers with resources keeping their tools out of the first prompt while a slow resource listing finished (a large drive, for example). Connecting no longer lists resources; `/mcp` and `knightcode mcp list` now show that a server offers resources, and the resource tools still list and read them on demand.
+
+- Fixed MCP tool calls failing when the server returns structured content that is not an object (an array, `null` or a primitive, as MCP 2026-07-28 allows); codemode declarations of MCP tools without an output schema now type `structuredContent` as `unknown` instead of an object.
+
+- Fixed OpenRouter router models such as `openrouter/auto` showing a cost of -$1,000,000 per 1M tokens; OpenRouter's negative placeholder prices are now 0.
+
+- Fixed print mode succeeding silently when the response stopped at the model's output token limit: it still prints the partial text, and now also warns on stderr and exits 1.
+
+- Fixed `~` in resource setting patterns such as `!~/skills/pdf`, `+~/x` and `-~/x` never matching, because it was compared literally instead of expanded to the home directory.
+
+- Fixed "The upstream provider returned an error" not being retried as a transient provider error.
+
+- Fixed images in Herdr rendering as text placeholders; Kitty graphics are now enabled there.
+
+- Fixed the mouse wheel sending raw escape sequences to an open dialog instead of scrolling the transcript.
+
+- Fixed delayed terminal replies (color queries and version or graphics responses) being typed as keystrokes, such as a stray Ctrl+G opening the external editor.
+
+## 0.16.0
+
+### Added
+
+- Added /usage to show remaining subscription allowance and reset times for connected Claude, Codex and Grok sign-ins.
+
+### Removed
+
+- Removed the discontinued KnightCode IDE's engine and ACP adapter, along with the `"engine"` extension mode and the `lastIdeVersion` setting; the CLI itself is unchanged.
+
+### Fixed
+
+- Fixed macOS 27 killing KnightCode at launch with `SIGKILL (Code Signature Invalid)`: the macOS binaries are now re-signed after compiling.
+
+## 0.15.2
+
+### Fixed
+
+- Fixed added and removed line backgrounds disappearing when scrolling horizontally in the remote diff view.
+
+- Fixed a nested git worktree whose AGENTS.md is a symlink to the main repo's copy so that file is loaded once. The walk compared the file's real path, which made the symlink look like the main repo's file and dropped both.
+
+## 0.15.1
+
+### Added
+
+- Added JSON schemas for settings, models, keybindings, and themes. Theme files that contain unknown fields are now rejected.
+
+### Fixed
+
+- Fixed Claude Sonnet 5.5 cache-read pricing to the published $0.10 per million tokens.
+
+- Fixed running tool-call indicators using the accent color instead of neutral grey, including Bash, PowerShell, and other tools using the default rendering shell.
+
+- Fixed Mistral streams being cut off when the response body lasts longer than the request timeout. The timeout now applies only while waiting for response headers.
+
+- Fixed the input cursor stretching across edge cells in terminals that extend cell colors into the window padding; with `showHardwareCursor` enabled, only the terminal cursor is drawn.
+
+- Fixed web tool call titles to display Web Search and Web Fetch instead of raw tool names.
+
+## 0.15.0
+
+### Added
+
+- Added OpenAI's GPT-6 Luna decision model, and image input for classifiers whose input includes images.
+
+- Added terminal program status reports (OSC 7501) for working, blocked, done, error, and idle. Set KNIGHTCODE_PROGRAM_STATUS=0 to turn them off.
+
+- Added Claude Haiku 5.5, including adaptive thinking and its long-context price bracket.
+
+- Added plan mode: `/plan` blocks file edits and other mutating tools until you approve a submitted plan, and turns on web search and fetch while planning.
+
+- Added Azure provider notes for deployment name mapping, the API version override, and custom Foundry models.
+
+### Changed
+
+- Changed tool results and assistant messages so they record how long they took, and the transcript uses that duration after a reload.
+
+- Changed context estimates from 4 to 3.5 characters per token, so the output limit leaves more room.
+
+- Changed Radius so a fetched account catalog replaces the shipped baseline, including when every model is disabled.
+
+- Changed output padding so it also covers tool output, `!` command output, and summary blocks.
+
+- Changed codemode results so text and image items stay separate, several text items are marked in order, and console calls share one block.
+
+- Changed codemode tool descriptions so the lookup helpers are described as async.
+
+- Changed `--tools` so a list of only `+name` and `-name` entries edits the default selection instead of replacing it.
+
+### Fixed
+
+- Fixed Anthropic login when port 53692 is already taken, by binding a free loopback port and using that redirect URL.
+
+- Fixed Mistral responses that report finish reason error, so a transient server failure is retried.
+
+- Fixed model prices so a prompt-length bracket from the catalog is kept instead of dropped.
+
+- Fixed the Kimi K3 Moonshot price so cache writes stay free. The catalog lists the input rate as the cache-write cost, and Moonshot does not bill cache writes.
+
+- Fixed hyperlinks in Herdr. OSC 8 links turn on, and image protocols stay off when an outer terminal leaks its variables.
+
+- Fixed inline image resize under node --watch. Node's own worker messages are ignored, so a picture is no longer dropped as too large.
+
+- Fixed clipboard read on Termux by using its clipboard command on Android.
+
+- Fixed bash output so a color or OSC sequence split across two chunks is still stripped from the streamed and saved text.
+
+- Fixed MCP sign-in so closing the session cancels an in-flight login and does not refresh a token on the way out. A login also stops when its time limit is reached, including while discovery is stalled.
+
+- Fixed the MCP manager so it opens while server connections are still starting, and connection actions stay available.
+
+- Fixed Bedrock Converse so OpenAI models receive their reasoning effort.
+
+- Fixed provider retries when the error says the servers are busy.
+
+- Fixed fullscreen mode so rebuilding the transcript clears the selection.
+
+- Fixed the message type docs so system messages no longer document a replace flag, and assistant messages and tool results document thinking level and nested calls.
+
+## 0.14.1
+
+### Added
+
+- Added an `ask_user` tool that lets the agent ask you one to three multiple-choice questions in a picker and wait for your answers; enable it with `/tools ask_user on`.
+
+- Added an Automatic updates toggle in `/settings` and a user-level `autoUpdate` setting, enabled by default, to disable automatic CLI update downloads while retaining update notices and manual updates, with documented configuration examples and environment-variable precedence.
+
+### Changed
+
+- Changed `/tools` so a tool named in `--tools` or `defaultTools` stays on for the session; only turning it off with `/tools` removes it.
+
+- Changed automatic update notices to a compact, right-aligned line above the input, with version tags, green restart prompts, red errors, and yellow warnings.
+
+- Changed the input bar to use a higher-contrast border while keeping its original line characters and height.
+
+## 0.14.0
+
+### Added
+
+- Added native llama.cpp classifiers for decision models such as Julia-1. llama.cpp 0.6.0 reports `decisions` in a model's output modalities, and KnightCode calls those models through the System One endpoint. Chat models still answer from next-token probabilities.
+
+- Added `*` patterns to `--tools` and `--exclude-tools`, for example `--tools read,codemode,'mcp__radius__*'`, and `--no-mcp` to disable the built-in MCP support for one run.
+
+### Changed
+
+- Changed the prompt input border to use the theme's `border` color at every thinking level; the footer still shows
+  the level and shell input keeps its `bashMode` color. The `thinking*` theme colors are no longer used.
+  Breaking change: `Theme.getThinkingBorderColor(level)` is removed; extensions must use `Theme.getEditorBorderColor()`.
+
+- Changed the working spinner and verb to the theme's accent mixed 20% toward its text color, with a shimmer in the
+  theme's text color, both in the prompt border and on the standalone status row; they no longer change color with
+  the thinking level.
+
+### Fixed
+
+- Fixed a codemode script that patched built-ins (such as `Array.prototype.toJSON = ...`) crashing the host process and leaving the call unsettled. Built-ins are now frozen before the script runs, and malformed payloads from the sandbox worker fail the call as a `sandbox` error.
+
+- Fixed codemode scripts not receiving images from `read`: `tools.read()` now resolves to an image block for image files, which `image()` shows.
+
+- Fixed Codex requests ignoring a caller's `originator` and `User-Agent` headers. Those headers now replace the defaults. Authorization and the ChatGPT account id stay fixed.
+
+- Fixed system prompt rules and the skills hint naming tools hidden by `prepareLoadout`. Hidden tools are left out of the rules, the skills hint names no tool when the file reader is hidden, and `codemode` shows each tool's prompt guidelines with its declaration; `ToolLoadout` gains `getPromptGuidelines()`.
+
+- Fixed Bedrock requests that fail with `The pending stream has been canceled` after a stalled HTTP/2 connection not being retried automatically.
+
+- Fixed MCP session shutdown returning while a server was still connecting, leaving its transport open until the server answered or timed out.
+
+- Fixed MCP OAuth sign-in failing with `invalid_redirect_uri` on servers with OpenID Connect client registration: KnightCode now registers as a native client.
+
+- Fixed managed self-update leaving every previous release on disk. After a successful update KnightCode keeps the release that ran the update and the release just activated, and deletes older version directories.
+
+- Fixed the standalone binary loading `.env` and `bunfig.toml` from the working directory before startup. Project secrets no longer enter the process environment, and a project preload can no longer crash the binary.
+
+- Fixed `--tools` removing MCP tools, which left `knightcode --tools codemode` without any MCP servers. `--tools` now keeps MCP tools unless an entry starts with `mcp__`.
+
+## 0.13.0
+
+### Added
+
+- Added background updates during interactive sessions for installer-managed installs, global npm and pnpm installs, and downloaded release binaries, with a download notice and an "Update ready — restart to apply" notice when it finishes.
+
+- Added temp-file copies of images shown by codemode `image()`: the result names each saved path before the image, so a later turn can copy or attach it.
+
+- Added `knightcode update` support for binaries downloaded from GitHub releases: the matching release archive is checksum-verified, smoke-tested, and swapped in place, keeping a renamed binary's name and any unrelated files beside it.
+
+### Changed
+
+- Changed the `azure-openai-responses` provider id to `azure`, which now also serves Azure Foundry Chat Completions deployments such as DeepSeek V4 Pro. Rename the `azure-openai-responses` key to `azure` in `auth.json`, `models.json`, and `settings.json`; `AZURE_OPENAI_DEPLOYMENT_NAME_MAP` now applies to Chat Completions deployments too.
+
+### Fixed
+
+- Fixed a closed or revoked terminal being recorded as a crash and prompting a bug report on the next start.
+
+- Fixed Home and End scrolling the transcript in fullscreen mode instead of moving the editor cursor; transcript top and bottom are now Ctrl+Home and Ctrl+End.
+
+- Fixed syntax highlighting losing its color after the first line of a multiline token, such as a Python docstring.
+
+- Fixed `knightcode update` for npm and pnpm installs hanging forever on a stalled package manager, failing on Windows while another KnightCode session held a native file, and reporting success when the installed binary was missing or still old.
+
+## 0.12.0
+
+### Added
+
+- Added a shimmer to the knight in the startup header. In truecolor terminals it plays once at startup, then holds still, and stops early if the header scrolls away.
+
+- Added per-thinking-level sampling parameters for OpenAI-compatible models. `samplingParamsByThinkingLevel` in `models.json` overrides the model's `samplingParams` for the active thinking level, and a request can still override either.
+
+- Added a randomly picked verb to the working indicator for each prompt, such as `Pondering…`, with a highlight that sweeps across it.
+
+### Changed
+
+- Changed edit and write results to show line-numbered diffs with tinted added and removed rows, highlighted changed words and syntax-highlighted code; overwriting a file with `write` now shows a diff against its previous contents, and new files show a numbered preview.
+
+- Changed the transcript layout: user prompts start with a `❯` marker and assistant text and thinking are indented to the column tool-call text starts at. `outputPad` now sets only the right-hand margin.
+
+### Fixed
+
+- Fixed codemode failing after an update or uninstall replaced the install a session was running from. The QuickJS runtime path is now resolved once, the bundled Node worker starts from an in-memory copy, and an error after the install changed on disk shows a hint to restart the session.
+
+- Fixed cancelling a request or model refresh during an OAuth token refresh discarding the rotated credential. Providers that rotate refresh tokens, such as Sign in with ChatGPT, then rejected the next request with `refresh_token_invalidated`. Cancelling now only stops the wait for the credential lock; a refresh that has started completes and is saved.
+
+- Fixed the terminal UI drawing streamed output and other non-keyboard updates one timer tick late on Windows, about 15 ms.
+
+## 0.11.4
+
+### Added
+
+- Added copying of the OAuth sign-in URL from the message-copy keybinding on sign-in screens.
+
+- Added an opt-in MCP OAuth client metadata document, `oauth.clientRegistration` set to `cimd`. Dynamic client registration stays the default.
+
+- Added the Cloudflare Workers AI classifiers Clef and Clef Flash.
+
+- Added the built-in `ui` extension: a gradient knight header, a rounded editor frame, and a two-line footer with the model, context, cost, output speed, and the git branch with its changed files and pull request. Set `"extensions": ["-builtin:ui"]` for the plain layout.
+
+### Changed
+
+- Changed a project `mcp.json` entry that does not define a command or URL so it can only override `enabled`, `exposure`, and `toolExposure` of a global server.
+
+- Changed Anthropic mid-conversation tool updates to send each new tool inline, so redefining a tool keeps the cached prefix.
+
+- Changed Amazon Bedrock prices to include the long-context tiers from the model catalog.
+
+- Changed the notice after an update to list the top three changes, one line each, with a count of the rest and a pointer to `/changelog`, instead of printing the full release notes.
+
+- Changed the `dark` and `light` themes to warm grays with an orange accent.
+
+- Changed skill invocations, compaction and branch summaries, and extension messages to render like tool calls, in the terminal and in HTML exports, instead of as tinted `[label]` boxes.
+
+### Removed
+
+- Removed the daxnuts easter egg.
+
+### Fixed
+
+- Fixed `--models` parsing so empty entries are ignored.
+
+- Fixed code mode so a script that keeps printing stops at the output cap instead of growing without a bound.
+
+- Fixed WezTerm images so they stay on screen while the transcript scrolls.
+
+- Fixed Kitty-protocol terminals so non-PNG tool images are converted and shown.
+
+- Fixed MCP tool calls from a resumed session so they render before that server has connected.
+
+- Fixed Cloudflare AI Gateway requests for Anthropic models so dotted catalog ids are sent with the dashes Anthropic accepts.
+
+- Fixed Sign in with ChatGPT so a callback port that is already in use fails immediately instead of delivering the browser redirect to another login.
+
+- Fixed Amazon Bedrock thinking replay so models that accept block binding drop stale thinking blocks, and Claude Opus 4.6 and Sonnet 4.6 are not sent the field they reject.
+
+- Fixed provider errors that say the selected model is at capacity, so those requests are retried.
+
+- Fixed the NVIDIA default model pointing at `nemotron-3-super-120b-a12b`, which NVIDIA no longer lists; it is now `nemotron-3-ultra-550b-a55b`.
+
+### Security
+
+- Security update pins brace-expansion 5 to 5.0.12, closing a denial of service in that line's range parsing.
+
+## 0.11.3
+
+### Added
+
+- Added Anthropic workload identity federation from the Anthropic SDK environment variables `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_ORGANIZATION_ID` and `ANTHROPIC_IDENTITY_TOKEN_FILE`, plus the optional `ANTHROPIC_SERVICE_ACCOUNT_ID` and `ANTHROPIC_WORKSPACE_ID`. API keys and `ANTHROPIC_AUTH_TOKEN` take precedence.
+
+- Added a copy-code login method to Anthropic sign-in for machines where the browser runs elsewhere and the localhost callback cannot load. `/login` now asks for browser or copy-code login, and copy-code login asks you to paste the code Anthropic shows.
+
+- Added `quietStartup: "header"`, which keeps the startup header with version and key hints but hides the model scope line and loaded-resource listing.
+
+- Added Radius to `/login`: "Sign in with Radius" is the last top-level option, with its status, and after signing in `/login` offers to add the Radius MCP server to the global `mcp.json` with `"auth": { "provider": "radius" }`. Cancelling a login returns to the menu it was started from, only subscription-backed providers are labeled "subscription" (other OAuth sign-ins say "account"), and providers without credentials say "not configured".
+
+- Added `models.generateImages()` to codemode scripts. It runs image models such as OpenRouter's with the session's credentials and returns image blocks that `image()` attaches to the result; usage counts toward the session cost. Extensions can call `ctx.modelRegistry.generateImages()`.
+
+- Added `"auth": { "provider": "<provider>" }` for HTTP MCP servers to send a provider's current `/login` token as the bearer token instead of using MCP OAuth. The token is read on every request, so provider refreshes apply. It is only allowed in the global `mcp.json` and from extensions, and requires https except on loopback hosts.
+
+- Added an `oauth.authServerMetadataUrl` setting for MCP servers that advertise a wrong OAuth authorization server or none. KnightCode uses the configured metadata document instead of discovery.
+
+### Changed
+
+- Changed the default TUI mode to fullscreen. Set `tuiMode` to `"regular"` or pass `--tui-mode regular` to keep the terminal's normal scrollback.
+
+- Changed codemode to cost far fewer prompt tokens and to say how to recover from errors. The `codemode` description lists the script globals in one line each and points to the new Codemode docs page; reading a tool or `models` member that does not exist names the close matches, so scripts that probed with `typeof tools.name` must use `"name" in tools`.
+
+- Changed `/arminsayshi` to play a 3D version in fullscreen mode, with one cube per pixel of Armin.
+
+- Changed MCP OAuth credential storage to key credentials by server name and URL, so MCP servers with the same URL can sign in with different accounts. Credentials stored by URL alone move to the first server that uses them.
+
+- Changed `/reload` to enable tools newly added to the `defaultTools` setting. Tools removed from it stay enabled, tools turned off during the session stay off unless newly added, and `--tools`, `--no-tools` and `--no-builtin-tools` still override the setting.
+
+- Changed MCP servers without `direct` tools to connect in the background instead of blocking the first prompt. They are listed in a short `mcp_servers` system prompt section, and are waited for when a codemode script names them, a script searches tools, or `tool_search` runs. The `codemode` and `tool_search` descriptions no longer change when servers connect.
+
+### Fixed
+
+- Fixed provider retries aborting or firing immediately when a `Retry-After` or `retry-after-ms` value is too large to represent, such as `1e999`. They now use exponential backoff, as they do for an unparseable date.
+
+- Fixed Anthropic requests failing when a tool schema uses keywords Anthropic strict tool use rejects, such as `minimum` and `maximum`. Such tools are now sent non-strict.
+
+- Fixed MCP servers that ask for more scope (`insufficient_scope`) requesting sign-in over and over. The new sign-in requested only the missing scopes, so the new token lost access the previous one had; it now keeps the granted scopes.
+
+- Fixed memory retained per rendered message in the transcript: user messages keep one copy of each rendered line instead of two, and markdown, text and box components flatten their cached lines. A long assistant message keeps about a fifth of the heap it kept before.
+
+- Fixed deferred MCP tools that `tool_search` loaded being dropped on resume and `/reload` even when their server reconnected before the next prompt, because the session restored its tools before the MCP servers reconnected.
+
+- Fixed the system theme making pastel palettes such as Catppuccin Frappe much more vivid; palette colors now keep their chroma.
+
+- Fixed `--provider` without `--model` being silently ignored and running the default model from another provider; it now fails with an error.
+
+- Fixed prompt submission slowing down with session length, because resolving the session's model selection looked up the model catalog once per assistant message, and model lookups slowing down for providers with a refreshed remote catalog.
+
+- Fixed MCP OAuth sign-in failing with `Invalid scope` when the token response contains `"scope": ""`, and similar failures for other empty or `null` optional OAuth fields, including `expires_in: null` marking the token as already expired.
+
+- Fixed codemode scripts calling the wrong MCP tool when two tool names differ only in `-` and `_`, such as `read-file` and `read_file`. MCP tool and namespace names now replace `-` with `_` (`mcp__my-server__x` is now `mcp__my_server__x`), colliding tools of a server all get a hash suffix, and server names that differ only in `-` and `_` are rejected.
+
+- Fixed collapsed `codemode` and MCP tool results filling the screen when the output is one long line, such as minified JSON. The preview is now limited to wrapped lines instead of logical lines.
+
+- Fixed `codemode.mode: "only"` listing `read`, `bash`, `edit` and `write` in the system prompt's tool list although requests only declare `codemode`.
+
+- Fixed extension commands registered without a string name or a handler crashing KnightCode when typing `/`. The extension now fails to load with an error instead.
+
+- Fixed switching to another OpenAI Responses model after a codemode call failing with an invalid item id. A replayed grammar tool call now drops any id that does not match its item type, since `custom_tool_call` ids must start with `ctc_` and `function_call` ids with `fc_`.
+
+- Fixed Together's DeepSeek V4 Pro losing its high reasoning-effort level after Together renamed the model to `deepseek-ai/DeepSeek-V4-Pro-0813`.
+
+- Fixed color bleeding past mouse selections and search highlights in fullscreen mode when a styled token ends at the highlight boundary.
+
+- Fixed slash command completion not working after leading whitespace in the editor. Typing `  /mod` now completes to ` /model` and keeps the whitespace.
+
+### Security
+
+- Security: MCP OAuth sign-in now rejects an authorization response whose `iss` parameter names another authorization server before exchanging the code (RFC 9207).
+
+## 0.11.2
+
+### Added
+
+- Added an `oauth.clientName` setting for MCP servers (`knightcode mcp add --oauth-client-name`) to change the client name sent during OAuth client registration, for servers such as Figma that only accept known clients.
+
+- Added a `description` field for MCP servers (`knightcode mcp add --description`), shown next to the server in the `codemode` and `tool_search` descriptions, and a `describeNamespace(name)` codemode helper that returns a namespace's instructions and tool names.
+
+### Changed
+
+- Changed the `codemode` description to list MCP servers instead of their tools, so it no longer changes when a server's tool list changes. Scripts find tools with `searchTools()` and read server instructions with `describeNamespace()`; `codemode-deferred` is now an alias for `codemode`, and `direct` exposure keeps tools visible to the model.
+
+### Fixed
+
+- Fixed codemode `image()` accepting malformed base64 data or unsupported image types, which stored an invalid image block that made every later provider request fail with HTTP 400. It now throws a `TypeError` unless the data is valid base64 of a PNG, JPEG, GIF, or WebP image, takes the MIME type from the image signature, and strips line breaks from wrapped base64.
+
+- Fixed codemode failing to start its script worker from the standalone Windows executable.
+
+- Fixed the `/mcp` sign-in URL not being clickable when it wraps across lines. It is now a terminal hyperlink with a `Cmd/Ctrl+click to open` line, like `/login`.
+
+- Fixed new sessions intermittently ignoring the saved default model, or warning that no models are available, when it belongs to an extension-registered native provider with a stored credential.
+
+- Fixed context overflow errors from the Z.AI China endpoint ("Prompt exceeds max length") not being recognised, so compaction and retry now trigger for them as they do for the global endpoint.
+
+## 0.11.1
+
+### Added
+
+- Added the `codemode` tool, which runs JavaScript in a sandbox whose only capability is calling tools, including MCP tools that are not declared to the model.
+
+- Added the `tool_search` tool so the model can find tools that are not declared yet and declare the matches on its next call.
+
+- Added Sign in with ChatGPT for the OpenAI provider. Provider sign-in flows share one local callback server, and the browser page still shows the KnightCode knight.
+
+- Added MCP servers, configured in `mcp.json` and managed with `knightcode mcp` and `/mcp`, including OAuth sign-in for HTTP servers.
+
+- Added GPT-6.1 Sol (`gpt-6.1-sol`) for OpenAI, Azure OpenAI Responses, and OpenAI Codex, and made it the OpenAI Codex default model.
+
+- Added Jev classifier models on Vercel AI Gateway (`typesafe-ai/jev`) and OpenCode (`jev-1.13` and `jev-1.13-free`).
+
+- Added the `fullscreenWheelScrollLines` setting so fullscreen mode can scroll one line per wheel event, a fixed number of lines, or speed up fast spins. Alt+wheel moves five times as far.
+
+### Changed
+
+- Changed `defaultTools` so a list of `+name` and `-name` entries adds or removes tools instead of replacing the whole selection.
+
+- Changed built-in extensions so `knightcode config` lists them as `builtin:<name>` and settings can disable one with `-builtin:<name>`.
+
+- Changed tool calls that have no custom renderer to show their arguments, collapsed on one line until the call is expanded.
+
+- Changed session cost to include token usage from codemode classifier calls and from tools those scripts call.
+
+- Changed bash results returned to scripts so they keep up to 1 MiB of output, with the full output in `full_output_path` when that is still not enough.
+
+- Changed System One classifier results to include token usage and its catalog cost when the service reports token counts.
+
+- Changed fullscreen redraws to keep parsed markdown and unpadded child lines across frames, and shell output now drops only control characters and interlinear annotations instead of every format character.
+
+### Fixed
+
+- Fixed llama.cpp context windows so a reload keeps the last known size when the server has not reported one, and a configured `--ctx-size` is used before the training context.
+
+## 0.11.0
+
+### Added
+
+- Added virtual models: an extension can register a selectable model, with `registerVirtualModel`, that routes each request to a physical model and thinking level. Virtual models appear in `/model`, `--model` and scoped models, the footer shows the routed model, and assistant messages record the thinking level the agent loop requested. See `docs/virtual-models.md`.
+
+- Added Claude Sonnet 5.5, with managed effort levels, mid-conversation system messages and tool changes, and no temperature control.
+
+- Added a classifier for every connected llama.cpp chat model, so choice, bool, and score questions are answered from next-token label probabilities, with an optional temperature that softens the distribution.
+
+### Fixed
+
+- Fixed OpenCode and OpenCode Go Qwen 3.8 Flash rejecting thinking blocks that have an empty signature.
+
+- Fixed Mistral reasoning requests using a hardcoded model list. A model with a thinking-level map now sends `reasoning_effort` for the requested level, including max on GLM 5.2, and sends the model's off value when thinking is off. GLM 5.3 no longer uses `prompt_mode`.
+
+- Fixed the OpenCode Go default model pointing at Kimi K2.6; it now defaults to Kimi K3.
+
+- Fixed pasting files copied in the macOS Finder inserting their icon instead of their paths. Copied files now paste as their original paths, and a failed clipboard paste shows an error instead of failing silently.
+
+- Fixed OpenAI Responses streams running tool calls that never finished. A server that omits `output_index`, such as llama.cpp, could turn two parallel calls into three with cut-off or mixed-up arguments; the stream now fails instead of running them.
+
+- Fixed the Together default model pointing at Kimi K2.6, which Together no longer lists; it now defaults to Kimi K3.
+
+## 0.10.0
+
+### Added
+
+- Added a classifier gate to `/tools` that asks a classifier model such as Jev whether each shell or file-editing call is risky and asks for confirmation before running it, and exposed `classify()` to extensions through the model registry.
+
+- Added image and classifier models to the shared model catalog, including the Jev classifier through OpenRouter and Cloudflare Workers AI, so they are listed, authenticated and refreshed like chat models.
+
+- Added a `system` theme that follows the terminal's light or dark appearance and switches when it changes. Themes can now use OKLab/OKHSL color values and text styles, and the built-in dark and light themes were redrawn with them.
+
+- Added GPT-6 Sol and GPT-6 Luna, and the new GitHub Copilot models.
+
+- Added a toggle to HTML exports that shows or hides hidden messages.
+
+- Added provider stream events for extensions: a handler receives every raw provider chunk, including metadata the normalized events drop.
+
+- Added the prompt's disposition to RPC `prompt` and `follow_up` responses, so a client can tell whether the prompt started a run, was queued, or was consumed by an extension.
+
+### Changed
+
+- Changed the Fireworks default model to Kimi K3; Kimi K2.6 is no longer served.
+
+- Changed the startup header to drop the themes section; themes stay available from `/settings`.
+
+- Changed the build to TypeScript 7 with an ES2024 target.
+
+### Fixed
+
+- Fixed path autocomplete after an opening parenthesis or backtick, and skill autocomplete while typing the `skill:` prefix.
+
+- Fixed Claude Opus 5.5 on GitHub Copilot offering effort levels the endpoint rejects.
+
+- Fixed custom themes rendering with 256 colors on truecolor terminals.
+
+- Fixed an extension loaded through two paths starting two runtimes.
+
+- Fixed pricing for OpenAI Fast mode, which is now billed like the priority service tier, and for Vercel AI Gateway 1-hour cache writes.
+
+- Fixed Kitty images being stretched; the placement size is now chosen by the smallest aspect distortion.
+
+- Fixed Mistral GLM responses splitting thinking and opening empty blocks on empty content deltas.
+
+- Fixed the terminal cursor staying hidden when an overlay closes after the UI stopped.
+
+- Fixed pinned temporary git extensions reusing the cache folder of a different ref.
+
+- Fixed read calls with a null offset or limit showing a line range instead of a full-file read.
+
+- Fixed `RpcClient` skipping the next listener when one unsubscribes while an event is dispatched.
+
+- Fixed model `samplingParams` being ignored by direct `stream()` and `complete()` calls.
+
+- Fixed new sessions not being written to disk until the first assistant reply; the session file is now saved at the first user message.
+
+- Fixed X11 clipboard text being read as an image when no image type was advertised.
+
+## 0.9.3
+
+### Changed
+
+- Changed the provider model catalog to be built when a release is built, from the published catalog sources, instead of shipping a snapshot committed to the repository. A release now carries the models and prices in effect at build time. AgentRouter is the exception, because its API refuses build machines: its catalog stays committed and is used as published. Its list changed too: `glm-5.3` and `gpt-5.6-sol` are gone and `gpt-6-astra` is available instead.
+
+### Fixed
+
+- Fixed Claude Opus 5.5 offering a `minimal` thinking level the model does not support. Anthropic publishes low through max for it, so `minimal` no longer appears in `/thinking` or model cycling.
+
+## 0.9.2
+
+### Added
+
+- Added Claude Opus 5.5 to the Anthropic catalog: 1M context, image input, xhigh and max effort levels, and the mid-conversation effort and system-message support the newer Opus models use.
+
+- Added Grok 4.7 to the xAI catalog and made it the default xAI model. xAI models now carry their long-context pricing tier, so requests above 200k input tokens are costed at the higher rate.
+
+- Added the `context_with_system` extension event. It runs after the `context` handlers on the full transcript, system messages included, and its result is sent as returned.
+
+- Added per-model image resize profiles through `inputLimits.images.resize` in `models.json` and `modelOverrides`. File attachments, `read` and tool-result images are resized once for the selected model before they enter history; built-in vision models carry the previous 2000x2000, 4.5 MiB default explicitly.
+
+- Added a crash hint naming loaded extensions whose files appear in the crash stack trace, with the commands to disable them.
+
+- Added append-only context edits and actionable turn boundaries for extensions. A `context_edit` entry omits or replaces an earlier message in future model requests without changing raw history, usage or exports, and `turn_end` plus the new `agent_before_settle` event can append entries and ask for one more provider request. See `docs/extensions.md` and `docs/session-format.md`.
+
+- Added a session scratchpad, off by default: `/tools scratchpad on` gives the agent a private per-session temp directory for throwaway files and restores its `notes.md` there after each compaction.
+
+### Changed
+
+- Changed the session file to be the source of model context. SDK code that assigned `session.agent.state.messages` to restore history no longer affects the next request: restore with `SessionManager.inMemory(cwd, { id }, entries)` or move with `session.navigateTree()`. Extensions that switch exhaustively must handle the `context_edit` entry and the `agent_before_settle` event, `turn_end` events now carry the persisted entry ids, and runs started from an `agent_settled` handler wait until every settled handler has finished.
+
+### Removed
+
+- Removed the `shouldStopAfterTurn` agent option. Return `{ action: "end" }` from `finishTurn` instead, and return nothing for error and aborted responses to keep the old normal-response-only behaviour.
+
+### Fixed
+
+- Fixed a missing or invalid `--mode` value being silently ignored; KnightCode now reports the valid values and exits with a nonzero status.
+
+- Fixed split-turn compaction summaries being refused by Claude Fable 5.1. The summarization request now separates the conversation from the instructions and asks for a continuation checkpoint instead of a prefix summary.
+
+- Fixed image-only prompts being rejected by some OpenAI-compatible providers, which refused the empty text part sent alongside the image.
+
+- Fixed text files that begin with `GIF` being treated as images and left out of `read` and `@file` input. Detection now requires the full GIF87a or GIF89a signature.
+
+- Fixed `/bug` uploading a report in offline mode. Uploads are refused with a pointer to Export as Zip, which still works offline.
+
+- Fixed prompt templates with invalid YAML frontmatter being dropped silently. They are now reported as resource warnings, and valid templates beside them still load.
+
+- Fixed the jump-to-latest label in fullscreen mode shifting sideways when the scrollbar auto-hides.
+
+- Fixed abandoned attempts staying in the model's context after an error retry or a length/overflow recovery. The retried request now omits them; the raw transcript, exports and usage totals still show them.
+
+- Fixed `context` extension handlers that filter or slice messages dropping the system prompt and tool declarations, which after extension-driven compaction left requests without built-in tools. Handlers no longer see system messages, and KnightCode restores the prompt and tools after they run.
+
+- Fixed custom OpenAI-compatible endpoints receiving strict tool schemas they may reject. Built-in models that support strict tools keep them, and a custom model can opt back in with `compat.supportsStrictMode: true`.
+
+- Fixed session files with an invalid session id in their header opening normally. Extensions build directory paths from that id, so such a file is now refused with the same error as an invalid `--session-id`.
+
+## 0.9.1
+
+### Added
+
+- Added the shipped Radius model catalog, so Radius models are listed in `/model` before the first gateway refresh and while offline; the fetched gateway catalog still overrides it.
+
+- Added the Meta provider: `/login meta` signs in with a Muse subscription through Meta's device authorization flow and mints a Model API key that is refreshed automatically, and `META_API_KEY` works as an ordinary API key.
+
+- Added prompt cache warming, which keeps a provider's prompt cache alive between turns where the model's cache lifetime is known, with `/settings` controls and a footer indicator. Extensions can observe or override each refresh.
+
+- Added `/bug`, which collects a redacted report — version, runtime, model and provider configuration, extensions, settings and this session's error diagnostics, never API keys — and either uploads it to the KnightCode maintainers or writes it as a zip you can attach to an issue yourself. Including the transcript is optional, and declining it offers a model-written summary instead. Crashes are recorded and attached to the next report.
+
+### Changed
+
+- Changed extension loading to pull in its transform dependencies only when an extension actually needs transforming, which shortens startup for everyone who has no extensions installed.
+
+- Changed the session picker to load progressively, so it opens immediately on a large session directory instead of waiting for every file to be read.
+
+### Fixed
+
+- Fixed sessions on z.ai stopping instead of compacting when the provider answers a too-long prompt with its `1261` error body rather than the usual wording.
+
+- Fixed Cerebras requests failing with a 400 when extensions declare both strict and non-strict tools; strict tool schemas are no longer sent to Cerebras.
+
+- Fixed compaction cancellation: aborting during auto-compaction could leave the turn retrying, run an extension handler after the abort, or report a cancelled compaction as a failure.
+
+- Fixed clipboard copying in headless and remote sessions by restoring the OSC 52 fallback when no native clipboard is reachable, including under WSL.
+
+- Fixed the terminal waiting on a remote prompt event that was never awaited, which could drop a prompt sent from the phone.
+
+- Fixed display-math rendering of stacked sub/superscripts, the `\bf`-style font switches, and `cases` alignment and brace placement.
+
+- Fixed slash-command ranking so a `skill:` command is matched on its bare name, putting `/idea` on `skill:research-idea` rather than `skill:deep-research`.
+
+- Fixed fullscreen images disappearing in WezTerm, which erased a Kitty image when a later row on top of it was cleared.
+
+- Fixed file-path autocomplete after CJK punctuation: a path typed after a full-width comma or colon now completes, and a completed path containing one is quoted.
+
+## 0.9.0
+
+### Added
+
+- Added unsubscribe to extension events: `knightcode.on(event, handler)` now returns a function that removes that one registration, so an extension can listen once or stop listening without reloading. Removing a handler never affects a dispatch already in progress.
+
+- Added what the desktop IDE's first run needs to `knightcode-engine`:
+
+  - `PUT /v1/models/default` records the model you pick in the IDE as your default, the same setting `/model` writes in the CLI, so both use one choice.
+  - `GET` and `PUT /v1/settings/telemetry` read and change the install-telemetry setting the CLI already has, so the IDE asks once and both follow the answer. The switch refuses to move while `KNIGHTCODE_TELEMETRY` is set in the environment.
+  - When the IDE starts the engine, it sends the same anonymous install ping as the CLI, once per IDE version, and not at all if you turned install telemetry off.
+
+- Added `/undo`: pick an earlier user message and go back to it, with the option to restore every file the abandoned turns edited. Files are backed up before each `edit` and `write`, so the restore needs no git; `/tree` and double-Escape offer the same restore. `KNIGHTCODE_DISABLE_FILE_CHECKPOINTS=1` turns the backups off.
+
+- Added click-to-expand for compaction, branch-summary and skill entries in the transcript. A left click toggles them the same way the expand shortcut does.
+
+- Added a `terminal` option to `InteractiveMode`, so an embedder or test can drive the interactive UI against its own terminal implementation instead of the process's.
+
+### Changed
+
+- Changed long shell command timings to read as minutes and hours (`26m 32s`, `2h 3m 4s`) instead of a raw seconds count; anything under a minute still shows tenths of a second.
+
+- Changed the copy shortcut's description in the hotkeys list and keybinding settings to say what it does: it copies the current selection, or the last assistant message when nothing is selected.
+
+- Changed the transcript types so tool-call arguments and tool-result `details` are declared as JSON values instead of `any`. A tool that puts a `Date`, a function or `undefined` into `details` is now a type error rather than something that silently fails to round-trip through the session file.
+
+- Changed the Kimi For Coding catalog to read from the provider's current listing, which reports the 1M-token context window and low / high / max thinking levels for `kimi-for-coding`.
+
+### Fixed
+
+- Fixed thinking blocks being dropped on the next turn when an Anthropic-compatible endpoint reports a different model name than the one requested. The requested model stays on the message, and the reported one is kept separately for cost attribution.
+
+- Fixed the "Anthropic dropped thinking" notice repeating on every turn and flooding the transcript with per-block reasons. It now shows a short count, only when a response drops more blocks than the previous one, and not again when a session is reloaded; the details stay in the session file.
+
+- Fixed a shell command killed by a signal (an OOM kill, `kill -9`, a `SIGTERM`) being reported to the model as a success. It now fails with the conventional exit code (137 for `SIGKILL`, 143 for `SIGTERM`) and keeps the output it produced before dying.
+
+- Fixed a bare `400` or `413` with no body from any provider being treated as a context overflow and triggering compaction. Only Cerebras reports overflow that way, so the rule now applies to Cerebras alone.
+
+- Fixed automatic compaction doing nothing when the newest tool result alone exceeds the retained-token budget. The cut now falls back to the assistant message that made the tool call, so older history is summarized before the next request instead of the session overflowing.
+
+- Fixed DeepSeek V4.1 Flash offering the wrong thinking levels on OpenRouter and OpenCode Go. Both now expose the low / high / max efforts the model actually accepts, and OpenCode Go lists it under its current ID, `deepseek-v4.1-flash`.
+
+- Fixed `knightcode-engine` answering a login request whose body is not JSON, or is too large, with a 500 instead of a 400 or 413.
+
+- Fixed a `before_agent_start` handler that returns `systemPrompt` (or sets `forceSystemPrompt`) not actually replacing the prompt on models that accept mid-conversation system messages: they kept the original prompt at the head and received the forced text as a later update. The forced prompt is now sent as the leading system prompt for the run, and the session transcript keeps recording the structured sections instead of the forced text.
+
+- Fixed fuzzy search in the model, session and file pickers lagging on long lists; matching now skips ahead with a native substring search and returns the same results in the same order.
+
+- Fixed Gemini requests asking for thinking levels a model does not support. Turning thinking off, or picking a level the model lacks, now falls back to the lowest level that model advertises instead of a hard-coded Gemini 3 Pro / Flash guess.
+
+- Fixed llama.cpp models whose chat template supports thinking (Qwen-style `enable_thinking`) always running as non-reasoning models. Loaded models are now checked through the server's `/props`, and those templates get an on/off thinking toggle.
+
+- Fixed two transient provider failures ending the turn instead of retrying: Cloudflare `520` responses and Azure's "currently experiencing high demand" peak-load rejections are now retried like other overload errors.
+
+- Fixed Vercel AI Gateway conversations losing their thinking on the next turn. The gateway returns thinking without a signature for models it translates, and those blocks are now replayed instead of being stripped.
+
+## 0.8.0
+
+### Added
+
+- Added `allowedFallbackModels` to Anthropic model overrides in `models.json`, so you can choose which models the server may fall back to — or set an empty array to turn server-side fallback off.
+
+- Added webfetch and websearch tools — a page as pageable, greppable markdown, and results from DuckDuckGo or Brave Search — off until enabled with the new `/tools` command, which turns each built-in tool off, on for the session, or on by default, and for websearch also picks the provider and stores the Brave API key.
+
+### Changed
+
+- Changed the system prompt and tool set to live in the transcript instead of being rewritten behind it. A session records when its instructions changed or tools became available, resuming or moving between branches restores that state, and providers that support it keep their cached prompt prefix across the change. Extensions can replace individual prompt sections through `systemPromptOptions.sections`, and the deferred-tool loading path is replaced by mid-conversation tool additions on the models that accept them.
+
+- Changed a failed copy to say why: instead of a bare "Copy failed" flash, the message now names the missing clipboard backend — `wl-clipboard`, `xclip`/`xsel` or the Termux API package — and stays on screen for five seconds.
+
+### Fixed
+
+- Fixed a `user_bash` handler that throws or returns a malformed result silently falling back to the local shell — the command is now reported as failed instead of running somewhere the extension meant to prevent. A handler must return `undefined`, exactly one of `{ operations }` or `{ result }`, and nothing else.
+
+- Fixed Baseten requests to carry session-affinity headers so a conversation keeps hitting the same replica and benefits from automatic prompt caching.
+
+- Fixed Bedrock cost reporting to bill one-hour cache writes at their higher rate instead of charging every cache write at the five-minute rate.
+
+- Fixed a local copy reporting success when no clipboard backend actually took the text: the terminal-escape fallback now only counts in a remote session, where it is the terminal that owns the clipboard.
+
+- Fixed the package's public types so extension authors can import the event and result types their hooks receive, such as `ModelSelectEvent`, `ThinkingLevelSelectEvent` and the `*Result` types, instead of redeclaring them.
+
+- Fixed the thinking levels offered for Gemini models: they now follow the reasoning efforts each model actually advertises instead of a version-number guess, so newer Flash and Pro models expose their real low/medium/high range.
+
+- Fixed resuming a session by its exact ID reading every transcript in the session directory first, which made startup slow in directories with long histories.
+
+## 0.7.0
+
+### Added
+
+- Added a `knightcode-engine` binary: a headless local server that owns inference for the desktop IDE, with OpenAI-shaped chat and fill-in-the-middle endpoints. It shares the CLI's `auth.json`, so signing in to either product signs in to both.
+
+- Added reopening saved sessions to `knightcode-engine`, so the desktop IDE restores its threads after a restart instead of failing with "Loading or resuming sessions is not supported by this agent".
+
+  Its ACP agent now:
+
+  - loads a session, replaying its history;
+  - resumes, lists, deletes and forks saved sessions;
+  - lists extension commands, prompt templates and skills under `/`;
+  - after an engine restart, reopens a session it no longer holds and retries the prompt.
+
+- Added native deferred tool loading for Fireworks models on the Messages API. Name the loader tool `ToolSearch` or `tool_search` so Fireworks keeps the deferred schemas out of the cached tool prefix.
+
+- Added a /remote command that publishes the running session to the web for the signed-in account, with a phone-first app at remote.knightcode.dev that lists live and past sessions, opens every tool call, and runs slash commands in the terminal.
+
+### Fixed
+
+- Fixed the full-output file of a truncated `!` bash command sometimes being empty when read straight away: the command now finishes writing that file before its result, and the file's path, are returned.
+
+- Fixed the desktop IDE's open threads offering stale model choices after signing in or out: `knightcode-engine` now refreshes them when an account or the model catalog changes.
+
+- Fixed API keys in a project's `.env` showing up in the desktop IDE as signed-in providers that signing out could not remove: `knightcode-engine` no longer reads a `.env` or `bunfig.toml` from the directory the IDE was launched in.
+
+- Fixed `/` listing no commands in a new, loaded, resumed or forked thread in the desktop IDE: `knightcode-engine` sent the list before the IDE had registered the session, and the IDE dropped it.
+
+- Fixed errors from OpenAI-compatible providers on the Responses API always being labelled as OpenAI errors: the message now names the provider that actually failed.
+
+- Fixed Tab predictions in the desktop IDE repeating the code after the cursor: `knightcode-engine`'s `/v1/completions` now shows the model your code with the cursor marked in place, and strips code fences from the answer.
+
+## 0.6.2
+
+### Added
+
+- Added the Environment Variables reference to the documentation navigation, which previously only reached that page through inline links.
+
+- Added `ctx.modelRegistry.stream()` and `streamSimple()` so extensions can make model calls through configured providers with resolved authentication, including providers registered by extensions.
+
+- Added Ctrl+D as a reliable alternative to Ctrl+S for saving the default model and thinking level. Many terminals (including Windows Terminal) swallow Ctrl+S as XON/XOFF flow control, so the keystroke never reached the app and the default was never saved. Ctrl+S still works where the terminal delivers it.
+
+- Added `compaction.modelOverrides`, per-model `reserveTokens` and `keepRecentTokens` budgets keyed by exact `"provider/modelId"`, so a million-token model can hold a large response reserve without inflating it for every other model. Each field falls back independently to the ordinary setting and then the built-in default, and the resolved values drive manual compaction, threshold checks, overflow recovery, and the `session_before_compact` payload.
+
+### Changed
+
+- Changed the DeepSeek catalog to advertise `deepseek-flash` for DeepSeek V4.1 Flash, which accepts images and reasoning levels, in place of the retired `deepseek-v4-flash` and `deepseek-v4-flash-vision-exp` aliases, and refreshed DeepSeek input, output, and cache-read pricing.
+
+- Changed OpenRouter requests to send the `x-session-id` affinity header by default on both Chat Completions and Anthropic-compatible models, so cached prompts keep hitting the same upstream replica; setting `sendSessionAffinityHeaders: false` or disabling prompt caching still opts out.
+
+- Changed the compaction, branch summarization, and retry spinners to render in the editor border alongside the working indicator; custom editors opt in for all four with the same `embedWorkingStatus` flag.
+
+- Changed the runtime dependencies to current releases, including the Anthropic, Bedrock and Google GenAI SDKs, the proxy agents, TypeBox, undici, chalk, marked, ignore, minimatch, semver, esbuild and grok-mermaid. Google's new `TOO_MANY_TOOL_CALLS` finish reason now maps to an error stop reason.
+
+### Removed
+
+- Removed GPT-5.4 and GPT-5.4 mini from the OpenAI Codex catalog after ChatGPT accounts lost access to them; selecting either now fails at model resolution instead of at the first request.
+
+### Fixed
+
+- Fixed agent-level retry backoff doubling without a ceiling, which left the agent asleep for hours after a long provider outage. Assistant and summarization retries now cap each delay at the new `retry.maxAgentDelayMs` setting, defaulting to 60 seconds.
+
+- Fixed OpenAI Codex requests omitting the reasoning effort when thinking is off, so models that need an explicit Off level fell back to the provider default; the model's mapped Off effort is now sent, and models that map Off to `null` still send nothing.
+
+- Fixed GitHub Copilot GPT models other than GPT-5 being routed to the completions endpoint, which Copilot does not serve them from.
+
+- Fixed the event stream draining its buffered events with `Array.shift()`, which made delivery quadratic on long streams; both the event queue and the waiting-consumer queue now use an amortized O(1) FIFO.
+
+- Fixed Fireworks Messages models losing their thinking blocks on replay and collapsing native reasoning effort to a budget-based fallback; the catalog now takes effort levels from provider metadata, allows unsigned thinking, and stops advertising GLM 5.2 and Kimi K3 aliases that map onto the same level.
+
+- Fixed Mistral-hosted GLM-5.2 reasoning requests sending `prompt_mode`, which that model ignores, so thinking never turned on; they now send `reasoning_effort`.
+
+- Fixed Mistral Medium reasoning requests sending the unsupported `prompt_mode` instead of `reasoning_effort` for reasoning-capable `mistral-medium-*` model IDs such as `mistral-medium-latest`.
+
+- Fixed OpenCode and OpenCode Go requests dropping the `x-opencode-session` routing header; every API adapter now maps `sessionId` onto it while leaving an explicit caller override alone.
+
+- Fixed extension tools registered without an object parameter schema being accepted, which broke provider request serialization later; registration now rejects them with an error naming the tool and the extension.
+
+- Fixed steering and follow-up messages bypassing extension `input` handlers, so extensions could neither transform nor intercept a message queued while the agent was already streaming; both paths now run the handlers and carry their real input source.
+
+- Fixed session tree navigation starting while a compaction or another navigation was still running; it now rejects instead of moving the active leaf.
+
+- Fixed a rejected `/tree` navigation replacing the running operation's escape handler and status spinner; the compaction or summarization it collided with now keeps its own UI.
+
+- Fixed the compiled Windows executable inheriting Bun's own PE resources, so `knightcode.exe` shipped with no icon and a `FileDescription` of "Bun" — the string Windows shows as the process name in Task Manager and the taskbar. The win32 build now embeds KnightCode's own title, publisher, copyright, version, and icon.
+
+- Fixed fullscreen mode reserving a blank row for a custom footer that renders nothing.
+
+## 0.6.1
+
+### Added
+
+- Added GPT-6 Astra support across tool search, additional tools, long-context pricing, xhigh and max thinking levels, and its explicit thinking-level map.
+
+- Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode.
+
+### Changed
+
+- Changed the generated image model catalog to the current OpenRouter listing.
+
+- Changed the built-in read, write, edit, and bash tools to request strict JSON-schema sampling by default instead of only under `KNIGHTCODE_EXPERIMENTAL`.
+
+- Changed fullscreen scrollbars to render muted thin tracks with contrasting proportional two-cell-minimum thumbs, reserve an unstyled column in `always` mode, reveal hidden `auto` tracks on pointer entry, expand the same-colored thumb on hover, and support track-click jumping in addition to thumb dragging, with optional `scrollbarTrack` and `scrollbarThumb` theme colors falling back to muted and text.
+
+- Changed fullscreen transcript search to cache unchanged results, index ASCII runs, and highlight only visible matches, so latency no longer grows with transcript size.
+
+- Changed clipboard handling to use small built-in macOS, Windows, and X11 native helpers instead of an external dependency, running native reads on worker threads and making the command-line fallbacks (`pbcopy`, `clip.exe`, `wl-copy`, `xclip`) asynchronous. Incremental X11 transfers, legacy text encodings, and native image formats are preserved.
+
+### Removed
+
+- Removed Grok Build 0.1 from the built-in xAI model catalog.
+
+### Fixed
+
+- Fixed processes killed by a signal reporting success; they now map to a 128 + signal exit code.
+
+- Fixed compiled binaries shipping without the TUI's native helpers, which left clipboard reads on the command-line fallbacks and dropped Shift+Tab on Windows. Each target's prebuilds are now copied next to the executable.
+
+- Fixed `fd` failing to start on musl-based Linux distributions by downloading the statically linked musl builds of both `fd` and `ripgrep`.
+
+- Fixed post-login model selection for Radius, whose per-account catalog is empty until the first authenticated refresh; selection now waits for that refresh, defaults to `balanced`, and falls back to catalog order.
+
+- Fixed the model, scoped-model, and thinking selectors hardcoding Ctrl+S to save; the shortcut is now the `app.models.save` and `app.thinking.save` keybindings and the on-screen hint follows a rebind.
+
+- Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
+
+## 0.6.0
+
+### Added
+
+- Added per-turn thinking effort preservation for Claude models, so a conversation whose turns were answered at different effort levels no longer replays as if every turn used the current one.
+
+### Changed
+
+- Changed the agent engine to a lane-owned durable architecture, rebuilding the harness, session, protocol, client and server layers in one pass.
+  - Added `@knightcode/chord`, the application composition runtime (services, replicated state, RPC, plugins) the harness, protocol, client and server now build on.
+  - Changed the harness runtime to a lane-owned drive: durable execution primitives, an effect gate, hooks, restore, and a mutation line replace the earlier operation-task/procedure runtime, and the transitional `runtime2` and `restore` layers are gone.
+  - Changed the session layer to bound values and lists with a commit/fork/mutation-line model, storage and repository conformance suites, and session benchmarks; the SQLite backend follows it.
+  - Changed the protocol, client and server to Chord-routed services: a single `protocol.ts`, a hosted harness manager, server identities, session directories, draining, and the wrong-server/session-not-found error set replace the earlier RPC schemas and live-session manager.
+  - Changed the experimental CLI to durable server and client commands, with `--provider`, `--model`, `-e`, `--continue`, `--resume`, `--server-id` and `--session-dir`, dropping the local demo runtime and session-worker process.
+  - Changed built-in tool rendering to load from `core/tools/renderers/`, so a process that only displays tool output no longer pulls in the execution path; the KnightCode tool-output style (`Read(...)`, `Search(...)`, `Update(...)`, collapsed one-line summaries) moved with it.
+  - Added click-to-expand on tool results, wired through the gutter shell so the bullet and continuation-marker layout keeps working.
+  - Fixed the reserved fork namespace guard, which tested for a stale prefix and so never matched a `knightcode.` namespace.
+  - Fixed Windows portability across the session, socket and CLI-spawning suites: `node --import` now receives a file URL, session tests resolve their workspace paths, and the Unix-socket suites are skipped where the platform cannot bind them.
+
+### Fixed
+
+- Fixed `knightcode config` ignoring the `showHardwareCursor` and `clearOnShrink` terminal settings.
+
+## 0.5.4
+
+### Added
+
+- Added an entries argument to `SessionManager.inMemory()`, so an SDK embedder can resume a session held outside the filesystem — in a database, say — without writing it to a temporary `.jsonl` file first.
+
+- Added the relational algebra join operators to LaTeX rendering: `\bowtie`, `\Join`, `\ltimes`, `\rtimes`, `\leftouterjoin`, `\rightouterjoin` and `\fullouterjoin`.
+
+- Added a `vllmPriority` compat flag for custom `openai-completions` providers. Set it on a model and requests carry a top-level `priority` field, which a vLLM server running with `--scheduling-policy priority` uses to order work; lower values are served first. Unset by default, so nothing changes for providers that do not want it.
+
+### Changed
+
+- Changed the branch summary output cap from 2048 to 4096 tokens, clamped to the model's own limit, so summaries of long branches are no longer cut off mid-sentence.
+
+- Changed the Cloudflare AI Gateway binding transport to pass requests straight to the Workers AI binding's `fetch` rather than translating them into universal-endpoint calls. `createGatewayBindingFetch` is replaced by `createAiBindingFetch(env.AI)`, which supports every method, non-JSON bodies and streaming request bodies instead of rejecting them.
+
+- Changed the bundled model catalog to a fresh regeneration from models.dev. GitHub Copilot drops eight models that the provider no longer serves (`claude-opus-4.5`, `claude-opus-4.6`, `claude-sonnet-4`, `claude-sonnet-4.5`, `gemini-3.1-pro-preview`, `gpt-4.1`, `gpt-5.2`, `gpt-5.2-codex`) and gains `claude-fable-5.1` and `gemini-3.8-flash`. This regeneration is also what activates the Copilot Fable 5 routing fix, which changed only the generator and so never reached the committed data. Baseten gains `zai-org/GLM-5.3-Fast`, Cloudflare AI Gateway gains `claude-fable-5.1`, and OpenCode Go gains `omen-alpha`.
+
+  Removals only take effect through regenerated data: the remote catalog overlay merges by id and can add or update models, but never removes them, so a model that disappears upstream keeps appearing until the bundled catalog is refreshed.
+
+- Changed the selectors in `/thinking`, `/model`, `/scoped-models`, `/trust` and per-model thinking settings to keep the active option marked while browsing, by moving the marker into a fixed column ahead of the label. `/scoped-models` now uses the same per-item toggle as the rest, strikes through models that are no longer available, and no longer collapses to a single model when the first one is toggled off.
+
+- Changed the theme settings selectors to keep the configured theme marked while browsing, matching the other selectors. Both the fixed-theme list and the light/dark lists behind Automatic now show the marker in a fixed column.
+
+- Changed the streaming working indicator to render in the editor's top border instead of on its own row above it, so the editor no longer shifts up and down as a turn starts and finishes. It picks up the editor's border colour, which already tracks the thinking level. Custom editors from extensions keep the standalone row unless they opt in with `embedWorkingStatus`.
+
+### Fixed
+
+- Fixed aborting a session leaving an in-progress compaction or branch summary running. Escape during `/compact`, or an RPC `abort`, now cancels it and waits for the session to actually be idle before returning.
+
+- Fixed Baseten's GLM-5.2 and GLM-5.2-Fast being advertised as accepting images. The catalog reports image input for them but the endpoints are text-only, so attaching an image produced a provider error instead of being caught up front.
+
+- Fixed a Codex response being dropped when the server closed the stream without a blank line after the final event. The last frame is now processed at EOF instead of being discarded with the buffer.
+
+- Fixed GitHub Copilot Claude Fable models being served through the OpenAI completions adapter, which dropped the selected reasoning level. They now route through the Anthropic Messages adapter like the other Claude 4.x and 5.x models on that provider.
+
+- Fixed Fireworks GLM models other than GLM-5.2 being served through the Anthropic-compatible endpoint, which does not accept them. Every `glm-` model on Fireworks now uses the OpenAI completions endpoint, so GLM-5.3 and GLM-5.3 Flash work.
+
+- Fixed forking a compacted session losing the messages after the compaction boundary when that boundary pointed at a label. Labels are dropped from the forked path, which left the boundary pointing at an entry that no longer existed.
+
+- Fixed importing a session file silently overwriting a stored session that happened to have the same filename. The import is now written alongside it under a numbered name.
+
+- Fixed a proxied request hanging when the server closed the stream without sending a terminal event, and a final event that arrived without a trailing newline being dropped. The first now surfaces as an error, the second is processed.
+
+- Fixed proxied plain-HTTP provider requests hanging after a tool call by tunneling them with CONNECT again, restoring the behaviour Undici changed in 8.7.
+
+- Fixed Qwen3.8 Flash offering the wrong thinking levels on the Qwen Token Plan providers: it advertised high and max, which it does not accept, instead of low, medium and xhigh. It is also now listed on the Individual plan, where it is available.
+
+- Fixed the built-in tools ignoring the working directory supplied on the extension context. `read`, `write`, `edit`, `ls`, `find`, `grep` and the shell tool resolved relative paths against the directory captured when the tool was created, so a caller running a tool against a different directory operated in the session's directory instead of its own.
+
+- Fixed `fd` and `ripgrep` failing to download behind shared egress IPs, where the anonymous GitHub API rate limit is permanently exhausted. The latest release is now resolved from the release page redirect, which costs no API quota. A failed download also reports the underlying network error instead of a bare "fetch failed".
+
+- Fixed `knightcode update` reporting every install as a standalone binary. `bin/knightcode` spawns the compiled binary out of `node_modules`, so install detection now classifies a binary by where it sits rather than by how it was built, and moves the running executable aside on Windows so npm can replace it.
+
+- Fixed the write tool reporting UTF-16 code-unit counts as byte counts by removing the misleading count from its result.
+
+## 0.5.3
+
+### Patch Changes
+
+- 6ffe494: Run the auto-compaction threshold check between turns of an agent run, so a
+  tool batch that fills the context window is compacted before the next
+  assistant request instead of overflowing it.
+- 6cfef9a: Add a `fullscreenCopyOnSelect` setting (default `true`). Turn it off and a
+  fullscreen mouse selection stays highlighted instead of being copied on mouse
+  release, and `Ctrl+X` copies the active selection rather than the last
+  assistant message.
+- eb15117: Settle the running turn before an in-memory `/fork`, so the aborted assistant
+  message and its tool results are no longer appended to the freshly forked
+  session.
+- 9a492f9: Merge Mistral streaming tool-call chunks by their `index`, so a call whose id
+  and name arrive only in the first chunk is no longer split into two tool
+  calls with truncated arguments. A name that arrives on a later chunk is
+  picked up rather than left empty.
+- 766dbca: Match `NO_PROXY` entries against the root domain and its subdomains, and parse
+  IPv6 hosts and `host:port` entries correctly, so a bare `example.com` entry
+  also bypasses the proxy for `api.example.com` and `notexample.com` no longer
+  matches it. A bare `*` entry now bypasses everything even when listed
+  alongside other entries, and an entry with a malformed port is dropped rather
+  than widened into a host-wide bypass.
+- 3ad5109: Add a `supportsMaxOutputTokens` compat flag for `openai-responses` models
+  (default `true`). Set it to `false` for a gateway that rejects
+  `max_output_tokens` and the parameter is omitted instead of failing the
+  request.
+- 94e9d3b: Stop already-prepared tool calls from running when a parallel batch is aborted
+  during preflight, so cancelling at a permission prompt no longer lets the
+  remaining tools in that batch execute.
+- 00c4a60: Ignore a failing SIGWINCH self-signal at terminal startup, so sandboxes whose
+  seccomp or LSM policy denies `kill(2)` no longer crash on launch. The
+  dimension refresh is skipped instead.
+- c058c12: Tidy the tool call transcript block. The dark theme's `green` and `red` now hold
+  the pinned diff hexes, so the success bullet, `✓` marks, bash mode and markdown
+  code blocks match the diff colours instead of staying olive. Shell tool call
+  headers are clamped to a single line — a long command no longer wraps several
+  rows of quoted URL over the transcript — and the bash expand hint follows its
+  output rather than preceding it, matching every other tool renderer. Line
+  counts in the expand hints are pluralised.
+- 743bca2: Detect Zed's integrated terminal so it gets truecolor and hyperlinks instead
+  of falling through to the conservative default, and document the Zed key
+  bindings needed for `Shift+Enter` and friends.
+
+## 0.5.2
+
+### Patch Changes
+
+- 736f894: Read EXIF orientation from JPEGs whose first APP1 segment holds XMP instead of
+  EXIF. Such images previously rendered unrotated.
+- ec0f150: Clear a delivered steering or follow-up message that carried only images. The
+  entry previously stayed in the queue forever, leaving the pending count wrong
+  and the message re-queued.
+- 13586e1: Give each `/share` its own temp directory so two shares running at once no
+  longer overwrite each other's export or delete the other's file mid-upload.
+- a90f2eb: Keep skills in the system prompt when `read` is disabled but a shell tool is
+  available, and tell the model to load `SKILL.md` with `bash` (or PowerShell)
+  instead. Skills previously vanished entirely from bash-only tool setups.
+- d28f07d: Ignore Kitty image conversions that land after the tool image at that position
+  changed, so a streamed partial image no longer replaces the final result.
+- e0fb2d8: Add AgentRouter as a built-in provider. `AGENTROUTER_API_KEY` enables five
+  AgentRouter models, defaulting to `agentrouter/glm-5.3`, with Claude routed through
+  the Anthropic Messages endpoint and the rest through the OpenAI-compatible one.
+  Token prices come from AgentRouter's rate table rather than upstream list prices;
+  cache costs remain estimates because AgentRouter does not publish its cache ratios.
+
+## 0.5.1
+
+### Patch Changes
+
+- 2990a0f: Tool calls now render as blocks in the transcript. Each one shows a
+  `Bash(...)` / `Read(...)` / `Update(...)` header with its result collapsed
+  underneath on a `⎿` gutter, instead of the flat before/after dump. The rest of
+  the chrome — boxed messages, the rounded input frame, the braille spinner, the
+  banner and footer — is unchanged.
+
+  Fixed a context-window overflow loop. Messages with no provider usage yet are
+  estimated at 4 chars/token, but real tokenizers land nearer 3 on code and JSON,
+  so reserving `max_tokens` against the raw estimate could push prompt +
+  `max_tokens` past the window. The provider rejected it as an overflow, the agent
+  compacted, `max_tokens` re-expanded into the freed room, and the next request
+  failed the same way. The estimated part is now padded so the reservation stays
+  inside the window.
+
+## 0.5.0
+
+### Minor Changes
+
+- dafe408: A rebuilt agent core.
+
+  The agent loop, session storage, provider layer and terminal UI were all
+  replaced. What that buys:
+
+  - **A measured ~1,100-token floor** for the system prompt and tool definitions —
+    every request is smaller, on every model.
+  - **Real multi-provider support**: Anthropic, OpenAI/Codex, OpenRouter, Amazon
+    Bedrock, xAI, Kimi, GitHub Copilot, and any custom endpoint through
+    `models.json`. OAuth sign-in where the provider supports it, API keys
+    everywhere else.
+  - **Sessions you can leave and come back to**: resume, fork, branch, search, and
+    automatic compaction when a conversation outgrows the context window.
+  - **Extensions, skills and prompt templates**, discovered from the project or
+    installed globally.
+  - **Headless mode**: `--print` with `text`, `json` or `rpc` output, for scripting
+    and for driving KnightCode from another program.
+
+  Distribution is unchanged — a self-contained compiled binary per platform, no
+  Bun or Node needed at runtime.
+
+## 0.4.1
+
+### Patch Changes
+
+- 5ffa10b: Re-inject the current todo list after each tool round so the model's plan stays in context during long turns. Only fires when the list has unfinished items and has changed since the last round.
+
+## 0.4.0
+
+### Minor Changes
+
+- aa2645e: Harness reliability: safer edits and recovery from flaky model streams.
+
+  - **No blind or stale edits.** A file must be read before it can be edited, and an edit is rejected if the file changed on disk since that read — so a write can't silently clobber newer changes. The read state is rebuilt from the transcript, so it survives a session resume.
+  - **No accidental repeats.** Identical read-only tool calls in one round run once instead of duplicating, and the loop guard stops repeated identical calls sooner.
+  - **Auto-retry on flaky streams.** Transient stream failures and empty responses retry with exponential backoff (honoring `Retry-After`); cancelling mid-backoff no longer fires an extra model call.
+  - **Tool errors self-correct.** An invalid tool call no longer ends the turn — the model gets the error back and can fix it.
+  - **No misleading diffs.** An edit diff shows only after the edit actually applies; failed or rejected edits don't render one.
+
+## 0.3.1
+
+### Patch Changes
+
+- a2679c6: Fix the `/exit` command freezing the terminal in packaged builds. Process cleanup used `spawnSync(process.execPath, ["-e", ...])` as a sleep, but in a compiled standalone binary `process.execPath` is the CLI itself, so it relaunched the TUI and blocked forever. Replaced it with an in-process sleep and made exit terminate the process explicitly.
+
+## 0.3.0
+
+### Minor Changes
+
+- 9531729: Add automatic skill discovery, hot-reload, and path-scoped skills so installed skills surface and get loaded without having to be named explicitly.
+
+  ### Added
+  - **Skill auto-discovery.** Each turn a cheap side-query compares your request against the installed skills, surfaces the relevant ones, and directs the model to load them via the `Skill` tool before responding. Surfaced skills appear as a visible `↳ Relevant skills: …` line in the chat. Controlled by the `skills.autoDiscover` setting (on by default).
+  - **Skill hot-reload.** A file watcher picks up added, edited, or removed `SKILL.md` files mid-session, so changes take effect without restarting. Controlled by the `skills.hotReload` setting (on by default).
+  - **Path-scoped (conditional) skills.** A skill with a `paths` frontmatter glob is kept out of the always-on skill list and surfaces only when you edit a file matching its globs.
+
+  ### Changed
+  - The skill index injected into the system prompt is now size-bounded: descriptions are truncated to fit the budget and, in the extreme, the listing falls back to names only — but every skill name is always shown, so no installed skill becomes undiscoverable.
+
+## 0.2.1
+
+### Patch Changes
+
+- b529674: ### Added
+
+  Memory follow-ups: feed recent tool usage into the recall selector as an extra relevance signal, frame extraction's "new messages" window from a per-session cursor (so durable facts mentioned during gate-skipped turns are still reconsidered), and drain any in-flight memory extraction on `/exit` (bounded) so a save isn't dropped at shutdown.
+
+  ### Fixed
+
+  `Tab` mode cycle so it reaches `AUTO`: previously `Tab` only toggled between `BUILD` and `PLAN`, making `AUTO` selectable solely via the `/agents` dialog. `Tab` now cycles `BUILD → PLAN → AUTO → BUILD`.
+
+  ### Removed
+
+  Drop two unused dependencies from `@knightcodeai/cli`: `pretty-ms` (never imported) and `hono` (the toast provider's `useMemo` now imports from `react` instead of `hono/jsx`).
+
+- 23a8811: Refresh the supported model catalog: add newer free and paid OpenRouter models, repoint aliases to their successors, change the default model, and drop discontinued entries.
+
+  ### Added
+
+  Refresh the supported model catalog with new OpenRouter models: `nvidia/nemotron-3-ultra-550b-a55b:free` (Nemotron 3 Ultra 550B), `nex-agi/nex-n2-pro:free` (Nex N2 Pro), `qwen/qwen3.7-plus` (Qwen3.7 Plus), `z-ai/glm-5.2` (GLM 5.2), and `moonshotai/kimi-k2.7-code` (Kimi K2.7 Code). New `qwen` and `nex` model aliases accompany them.
+
+  ### Changed
+
+  Default model is now `nvidia/nemotron-3-ultra-550b-a55b:free` (was `z-ai/glm-4.5-air:free`). The `glm`, `kimi`, and `nemotron` aliases were repointed to their successor models (`z-ai/glm-5.2`, `moonshotai/kimi-k2.7-code`, `nvidia/nemotron-3-ultra-550b-a55b:free`), and the onboarding shortlist was updated to match the new catalog.
+
+  ### Removed
+
+  Drop discontinued/older version models: `z-ai/glm-4.5-air:free`, `deepseek/deepseek-v4-flash:free`, `z-ai/glm-5.1`, `moonshotai/kimi-k2.6`, and `nvidia/nemotron-3-super-120b-a12b:free`, along with their `glm_air` and `deepseek` aliases.
+
+- b529674: ### Added
+
+  Accurate per-session cost: enable OpenRouter usage accounting (`usage.include`) so each request returns its **actual** cost. The in-app `/cost` "Session cost" now sums real costs (correct for free/cached/uncurated models) and only falls back to the local price table when a message has no reported cost.
+
+  Session grouping on OpenRouter: send the session id as the `x-session-id` header so a session's requests are grouped in OpenRouter's logs (Sessions tab) and routed stickily to the same provider for better prompt-cache hits. Requests are also tagged with the session id via the `user` field for per-request "Client User ID" attribution.
+
+  ### Changed
+
+  OpenRouter app attribution: `HTTP-Referer` → `https://knightcode.raghavseth.in` and `X-Title` → `KnightCode` (was "KnightCode CLI").
+
+## 0.2.0
+
+### Minor Changes
+
+- f2846df: Standalone query engine, concurrent tool scheduler, and Apache-2.0 licensing.
+
+  This release replaces the React `useChat`-based chat harness with a dedicated,
+  framework-agnostic query engine, adds a concurrency-aware tool scheduler, and
+  hardens the interactive terminal experience. The project is now formally
+  licensed under Apache-2.0.
+
+  ### Added
+  - **Standalone query engine.** A new engine loop drives a turn end-to-end,
+    independent of the React render tree (`lib/engine/`). It owns engine event and
+    params types, a transcript-repair pass that resolves dangling/unresolved tool
+    calls, and tool-gating decisions backed by a loop guard to prevent runaway
+    tool cycles.
+  - **`useQueryEngine` hook.** A thin React hook that drives the engine loop and
+    replaces the previous `useChat` harness entirely.
+  - **Concurrency-aware tool scheduler.** Engine-owned scheduling policy runs tool
+    rounds with bounded concurrency. Introduces an engine `ToolHost` contract and a
+    hook adapter so the engine can execute tools without depending on the UI layer.
+  - **Cross-session project memory.** Durable, non-obvious facts are extracted
+    automatically after completed turns into a per-project store
+    (`~/.knightcode/projects/<cwd>/memory/`) with a `MEMORY.md` recall index.
+    Relevant memories are recalled into the system prompt, a consolidation
+    ("dream") pass merges and prunes the store, and a `Memory` tool lets the model
+    review, correct, or forget entries.
+  - **Per-row tool spinners.** Concurrently running tools each get their own inline
+    spinner instead of a single shared indicator.
+  - **`@`-mention path expansion.** Paths referenced with `@` in a prompt are
+    expanded into the model's context at submit time.
+  - **PostToolUse `systemMessage` surfacing.** Messages emitted by `PostToolUse`
+    hooks are now surfaced to callers.
+  - **Apache-2.0 license.** Added root `LICENSE` and `NOTICE` files and `license`
+    fields in the workspace and CLI `package.json`.
+
+  ### Changed
+  - Extracted `compactHistory` out of the old `use-chat` module and moved chat
+    message types into `lib/engine/messages`.
+  - Exposed a hook-free `executeRegisteredTool` for engine use.
+  - Unified all interactive prompts onto a single shared permission panel.
+  - Dropped the unused `sessionId` from `QueryParams`.
+  - Pointed repository URLs at the KnightCodeAI org and scoped the publish
+    workflow to publishable paths.
+
+  ### Fixed
+  - **Quit behaviour:** `/exit` is now the only way to quit; Ctrl+C never exits.
+  - **Permissions:** every confirm-gated tool now shows a permission prompt, and
+    every awaited tool decision is guaranteed a resolvable prompt; scoped the
+    always-allow sweep correctly.
+  - **Markdown rendering:** convert `<br>` to real line breaks in prose, expand
+    `<br>` table cells into continuation rows, and stop rendering literal `<br>`
+    tags.
+  - **Interrupts:** render the interrupted marker after the partial response, with
+    a plain interrupted notice (no emoji or completion verb); render interrupted
+    aborts and surface queued mid-turn submits.
+  - **History integrity:** stop schema-validating history and instead quarantine
+    invalid tool calls.
+  - **State sync:** synchronize message-ref writes, guard submit re-entry, persist
+    the final turn snapshot, queue mid-turn submits, clear finished todos, and only
+    clear the compacting state when it was actually set.
+  - Hardened file reads, question cancellation, and transcript text handling, plus
+    a sweep of code-review findings across the engine and UI.
+
+## 0.1.0
+
+### Minor Changes
+
+- 13af3df: Initial public release: `knightcode` ships as a self-contained compiled binary
+  (no Bun required) distributed via platform-specific npm packages, with a headless
+  `--version` and `doctor`, embedded database migrations, and a non-blocking update
+  check.