@orion-agents/orion-code 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -0,0 +1,445 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Delivery status legend
+
+This project distinguishes three delivery states. **Never present unreleased work as released.**
+
+| State             | Meaning                                      | Criterion                                  |
+| ----------------- | -------------------------------------------- | ------------------------------------------ |
+| **Published**     | Tagged source is installable from npm        | git tag exists **and** `npm publish` done  |
+| **npm-published** | Registry version exists without full release | exact npm version, but tag/release may lag |
+| **Merged**        | In the default branch, not yet installable   | merged, **no** tag / not published         |
+| **Candidate**     | Reviewable source, no release promise        | committed PR branch or owned worktree      |
+
+Evidence labels follow `docs/archive/releases/v0.1.x/targets-v0.1.3-v0.1.3-2.md`:
+`met` / `partial` / `unmet` / `not_run` — where `not_run` means "blocked by environment",
+which is **not** a pass.
+
+## [Unreleased]
+
+## [0.1.9] — CANDIDATE
+
+> **Status: candidate.** Source, CI, exact tarball, npm `next`, tag, GitHub Release, and stable
+> `latest` are independent receipts. This section must be updated after each delivery action; it
+> does not claim publication in advance.
+
+### Added
+
+- Add a typed semantic Compact pipeline with atomic message groups, canonical fingerprints,
+  structured ContextItems, TaskContract/evidence/capability reinjection, bounded manual focus, and
+  deterministic fallback diagnostics.
+- Add Compact Checkpoint V2 receipts with source/replacement hashes, target-headroom validation,
+  Harness/Goal bindings, transactional candidate installation, rollback, and V1 read compatibility.
+- Add HarnessKernel TaskContract V3 criteria, evidence-to-criterion receipts, deterministic state,
+  Capability Profiles, ProgressDelta, and typed StopDecision projections.
+- Add mature-agent Compact benchmark fixtures and lifecycle trace events for prepare, validate,
+  commit, rollback, and boundary transitions.
+- Add bounded project-level `compactInstructions` for manual and automatic compaction; caller
+  guidance remains subordinate to protocol, safety, criteria, evidence, failures, and pending work.
+
+### Changed
+
+- Replace Goal's fixed five-continuation stop with criterion/evidence completion, no-progress,
+  blocker, provider, explicit budget, and user-abort decisions. Resource circuit breakers remain
+  bounded and resumable.
+- Bind subagent reservations to child query/provider accounting; keep deprecated turn fields only
+  as compatibility inputs rather than task-complete semantics.
+- Load a bounded memory index at startup and retrieve relevant content per turn with an auditable,
+  body-free prompt manifest.
+- Extend `/context explain` with section budgets, capability identity, output/safety reserves, and
+  the latest committed Compact receipt.
+
+### Fixed
+
+- Serialize usage JSONL appends with an independent cross-process lock and replay-safe request IDs
+  (#206).
+- Contain project context, project instructions, and explicit skill reads at a canonical project
+  boundary; project-provided `@file` content remains untrusted data (#207).
+- Make smaller-context model switches run and commit a semantic preflight before changing the
+  active model.
+- Reject stale Compact candidates when the transcript tail or active checkpoint changes between
+  prepare and commit, while preserving append-only session history.
+- Stop treating request/tool budgets or an unsatisfied completion gate as successful task
+  completion; render resumable typed decisions consistently.
+
+### Security
+
+- Reject symlink and non-regular project context paths, revalidate opened descriptors, and redact
+  boundary errors without exposing out-of-project file contents.
+
+## [0.1.8] — 2026-08-15
+
+> **Status: published.** Tag `v0.1.8` identifies the source;
+> `@orion-agents/orion-code@0.1.8` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Added
+
+- Add schema-level and scheduler-level finite safe-integer validation for bounded tool inputs,
+  including `exec_command.timeout`, `exec_command.maxOutputBytes`, and `list_files.maxDepth` (#203).
+- Add a renderer-neutral budget-stop view with usage, last completed work, and visible recovery
+  actions across TUI, terminal, print, JSON, and `/loop-stats` (#204).
+- Add typed tool-authorization provenance and an explicit BUILD/PLAN/AUTO network-permission
+  architecture contract; AUTO stays prompt-free after hard policy and explicit deny checks (#175).
+- Add repository-layout, cleanup-manifest, and per-issue verification ledgers for auditable release
+  ownership and recovery.
+
+### Changed
+
+- Restrict the npm package to the single runtime icon and enforce packed size, unpacked size, entry
+  count, required files, and unexpected-path budgets during release checks.
+- Move maintained scripts into `scripts/release`, `scripts/smoke`, and `scripts/maintenance`; archive
+  historical v0.1.x plans under `docs/archive/releases/v0.1.x`.
+- Enforce renderer command scope before special command dispatch, integrating the behavior reviewed
+  in PR #201 for issue #179.
+- Keep session transcript append metadata incremental and cover a 5,000-row history without a
+  full JSONL rescan (#172).
+
+### Fixed
+
+- Publish file-lock owner metadata atomically and quarantine stale legacy zero-byte recovery
+  sentinels so an interrupted writer cannot permanently block `/resume`.
+- Verify the existing security, persistence, TUI/performance, release/dependency, and Goal lifecycle
+  candidate fixes for issues #170–#200 with focused regression batches and real renderer smokes.
+- Keep Goal completion evidence durable across failure, compact, restart, and resume, then
+  automatically leave Goal mode after a passing audit (#189).
+- Update PTY harnesses to current provider profiles and durable trace/status assertions so the
+  release matrix exercises source code without deprecated configuration fallbacks.
+
+### Removed
+
+- Remove 18 unreferenced tracked documentation images, 15 superseded `test-runtime` probes, the
+  unused `src/ink` helper, and the unreferenced `src/ui-v2` experiment after replacement mapping.
+
+## [0.1.7] — 2026-08-13
+
+> **Status: published.** Tag `v0.1.7` and its GitHub prerelease identify the source;
+> `@orion-agents/orion-code@0.1.7` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Added
+
+- Add `/plan [task]` as the task-scoped, read-only planning entry with an automatically saved exit
+  transition and restoration of the previous interactive/auto mode.
+- Add an original Orion Pixel terminal identity with a portable pixel mascot, semantic poses,
+  restrained motion, and safe classic/NO_COLOR/narrow-terminal fallbacks.
+- Add persisted TUI themes, motion, mascot, status-line, and semantic keymap configuration plus
+  `/theme`, `/keymap`, `/statusline`, and `/queue` command surfaces.
+- Add a bounded shared-runtime follow-up queue: Enter steers the active turn while Tab queues FIFO
+  work without interrupting it.
+
+### Changed
+
+- Remove the `/mode` command and its `/perm` compatibility alias. Base modes now change only through
+  `Shift+Tab`; `/plan` remains the task entry and model-driven `enter_plan_mode` stays unavailable,
+  so Plan state has one lifecycle authority and completion never starts implementation in the same
+  turn.
+- Replace renderer-local status strings with a typed Chrome projection for Goal, model, permission,
+  context, effort, queued follow-ups, and active work.
+- Complete Ctrl+R history search, Ctrl+E external composition, empty Ctrl+D exit, and Esc-owned
+  interruption behavior while preserving native terminal scrollback.
+- Show stable sequence numbers for active subtasks and keep critical Goal, evidence, research, and
+  permission state visible before lower-priority chrome.
+
+### Fixed
+
+- Automatically exit Goal mode after a persisted passing completion audit, restore the underlying
+  BUILD/PLAN/AUTO mode, retain the completed Goal sidecar as an audit receipt, and reconcile the
+  narrow crash window where the terminal sidecar was saved before the session binding was cleared.
+- Route explicit `exit goal mode` / `退出 goal 模式` intent through the same deterministic runtime
+  clear boundary as `/goal exit`, reject completion retries without new runtime evidence, and cap
+  each autonomous continuation below fresh-user loop budgets.
+- Sanitize every dynamic startup-banner field, including 8-bit C1 CSI/OSC forms, before writing it
+  to the terminal (#164).
+- Serialize global configuration read-modify-write transactions across processes and add an atomic
+  session catalog for indexed lookup and bounded listing (#157, #159, #163).
+- Reject brace-quantified and overlapping-alternative ReDoS patterns, while distinguishing benign
+  command substitution from visible recursive deletion in permission policy; contain command cwd
+  inside the workspace across permission and execution paths (#160, #162, #169).
+- Require explicit risk metadata on every built-in slash command, cover drift-guard prepare/execute
+  enforcement and session rename success/scoping, and make coverage a release gate (#158, #166,
+  #167, #168).
+- Pin all third-party GitHub Actions in CI to immutable commit SHAs (#165).
+
+### Compatibility
+
+- `/goal exit` remains the canonical slash command; explicit natural-language exit intent is routed
+  to the same operation. Removed `/goal clear --yes` and `/target clear --yes` syntax is still
+  rejected and is not restored as a compatibility alias.
+
+## [0.1.6] — 2026-08-12
+
+> **Status: published.** Tag `v0.1.6` and its GitHub Release identify the source;
+> `@orion-agents/orion-code@0.1.6` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Changed
+
+- Require explicit user authorization before a model-created Goal can become active and bound
+  non-user continuation loops so a Goal cannot run indefinitely without returning control (#150).
+- Replace destructive Goal clearing with `/goal exit`, which aborts the active turn, rejects any
+  pending permission request, and clears persisted Goal state. The old `/goal clear --yes` and
+  `/target clear --yes` forms are intentionally rejected rather than retained as aliases.
+- Make the default dependency-health report reproducible without registry access; registry-backed
+  `npm audit` and `npm outdated` reports now require explicit `--full-network` (#155).
+
+### Fixed
+
+- Preserve `vector.db` during brand migration when native SQLite verification is unavailable and
+  report the actionable ABI/rebuild cause instead of misclassifying it as corruption (#149).
+- Remove real embedding-provider calls from vector tests, make source-only import tests independent
+  of prebuilt `dist/`, and select installed Node runtimes by numeric version (#140, #144, #146).
+- Keep dependency policy mandatory in prepublish/release gates and synchronize release version
+  claims across README and release metadata (#129, #147).
+- Anchor macOS seatbelt secret-file denies to the stable project root and make `exec_command`
+  permission prechecks use the same explicit command cwd as execution (#151, #153).
+- Strip ANSI/OSC/C0/C1 control sequences from terminal-ui transcript and streamed assistant output
+  before it reaches the terminal writer (#154).
+- Make memory drift validation perform a bounded project symbol scan, expose it through
+  `/memory validate`, and fail inconclusive scans closed instead of silently accepting them (#156).
+
+### Compatibility
+
+- This pre-1.0 release contains an intentional command-line breaking change: scripts using
+  `/goal clear --yes` or `/target clear --yes` must migrate to `/goal exit`. Goal/session storage
+  remains additive and compatible; the removed command syntax is not supported as an alias.
+
+## [0.1.5] — 2026-08-11
+
+> **Status: npm-published.** `@orion-agents/orion-code@0.1.5` is available through the npm
+> `next` dist-tag. No `v0.1.5` Git tag or GitHub Release exists, and stable `latest` remains
+> `0.1.4`; those delivery states are intentionally recorded separately.
+
+### Added
+
+- Added a typed slash-command descriptor registry, exact invocation grammar, compatibility
+  lifecycle metadata, busy policies, and canonical `/goal`, `/session`, `/context`,
+  `/commit-plan`, `/rewind`, `/subagents`, and `/effort` control surfaces.
+- Added provider-aware effort capability resolution, scoped persistence, immutable retry
+  snapshots, structured renderer events, and additive reasoning/effort usage ledger metadata.
+
+### Changed
+
+- Split agent mode from tool permission policy and constrained the empty command palette to a
+  primary, searchable surface while retaining explicit advanced and compatibility commands.
+- Made dependency, Jest-major, tag/changelog, and prepublish checks fail closed.
+- Made the dependency policy reject runtimes outside the declared Node 20/22/24 matrix (#133).
+- Added version-tag CI triggers, synchronized the Jest 29 lockfile, and moved the candidate
+  package/install metadata to `0.1.5` (#134, #135, #141).
+- Made the dependency policy prove the installed OpenAI client on each CI runtime instead of
+  inferring Node support from an engine-string regex, and added a real sqlite-vec load/query
+  probe (#137, #142).
+
+### Fixed
+
+- Canonicalized recursive `rm` targets before safety evaluation and routed batch confirmations
+  and local fast paths through the shared permission policy (#125, #126, #132).
+- Repaired Goal completion audit persistence, entity decoding, confirmation fallback, and TUI
+  submission/projection behavior (#127).
+- Classified every recursive `rm` flag form as destructive so broad tool rules cannot silently
+  approve shell deletion (#136).
+- Made concurrent session registration reserve capacity atomically across processes,
+  with atomic heartbeats and serialized stale-lock recovery (#121).
+- Serialized session transcript, metadata, statistics, summaries, and deletion updates under a
+  per-session cross-process lock so counters cannot lose concurrent writes (#138).
+- Deferred native SQLite loading to semantic-storage boundaries and added actionable
+  ABI diagnostics for memory, maintenance, migration, and dependency checks (#111).
+- Removed real Ollama/OpenAI calls from vector unit tests by using deterministic embedding
+  fixtures, eliminating timeout-driven release flakiness (#139, #140).
+
+## [0.1.4-2] — 2026-08-09
+
+> **Status: published.** Tag `v0.1.4-2` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.4-2`, `next` dist-tag). Stable `latest` remains `0.1.4`.
+
+### Changed
+
+- Split the slash-command registry and chat runtime into bounded modules, removed
+  deprecated OpenHorse type aliases, and made strict lint rules fail the build.
+- Upgraded the OpenAI SDK to the Node-20-compatible 6.x line, removed unused runtime
+  dependencies, and added automated dependency policy/update checks.
+- Added structured diagnostics, provider recovery metrics, runtime-matrix CI, and
+  real PTY research lifecycle coverage.
+
+### Fixed
+
+- Closed persistence races, checkpoint corruption/rollback gaps, task-capacity and
+  response-parsing bugs, tool-call group corruption, context compaction errors, and
+  provider retry/stream recovery inconsistencies.
+- Hardened forked-agent capabilities, harness evidence/sandbox enforcement, AWS auth,
+  command execution gates, and macOS sandbox fail-closed behavior.
+- Completed the research contract across controlled web access, redirects, budgets,
+  atomic CAS persistence, citation durability, renderer events, and restart/resume.
+- Added conversational Goal abandonment with explicit user authorization and corrected
+  Goal boundary/audit/no-progress semantics.
+- Made `prepublishOnly` build before the release pack gate so clean checkouts and final
+  tarballs are validated against the same generated `dist` output.
+
+## [0.1.4] — 2026-08-06
+
+> **Status: published.** Tag `v0.1.4` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.4`, `latest` dist-tag). Released 2026-08-06.
+> Work that remains a worktree-only draft carries no release promise (see legend).
+
+Aligns `package.json` / `package-lock.json` with the `v0.1.4` release so the
+CLI banner, HTTP `User-Agent`, and crash/telemetry reports stop misreporting `0.1.3`.
+
+### Changed
+
+- **Release metadata (#10):** bumped `package.json` and `package-lock.json` to
+  `0.1.4` so `orion --version` and the outbound `User-Agent` reflect the development line.
+- **Type safety (#5):** removed ~22 `any` usages (120 → 98 on the committed tree):
+  - native `Intl.Segmenter` typing via the `ES2022.Intl` `lib` (no more `(Intl as any)` casts);
+  - typed SQLite rows in `src/memory/vector-store.ts` (`MemoryRow` / `MemoryVectorRow`);
+  - `unknown`-typed task params in `src/services/task-manager.ts`;
+  - typed provider-error messages in `src/services/provider-resilience/error-classifier.ts`.
+
+### Fixed
+
+- **Lint (#6):** resolved unused-vars / prefer-const warnings and removed dead code
+  (17 ESLint `no-explicit-any` / unused-var alerts cleared).
+
+## [0.1.3] — 2026-08-05
+
+> **Status: published.** Tag `v0.1.3` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.3`). The model-config subset (`/model` / `/models`)
+> is merged; the security/tooling subset below shipped in this release.
+
+This release hardens the execution surface (sandbox POC, tool-allowlist ReDoS,
+plan-mode bypass, SSRF / API-key leakage) and rounds out developer-facing tooling
+(git tools, TUI permission interaction, incremental input, goal-tool diagnostics).
+
+### Added
+
+- **Shell sandbox POC** (`src/tools/sandbox.ts`)
+  - Commands are wrapped as an **argv array**, never re-parsed by an intermediate shell
+    (eliminates quote-injection surface).
+  - **Runtime backend probes** for `seatbelt` / `bubblewrap` / `docker` via `spawnSync`
+    — capability is never inferred from `which`.
+  - **Fail-closed**: a configured profile that cannot be applied (no backend, unusable
+    backend, unknown profile/backend) **refuses execution** instead of silently degrading.
+  - Default `profile: 'none'` is fully backward compatible with the legacy `sh -c` path.
+  - Docker backend runs with a **`--read-only` rootfs** and explicit `rw` bind-mounts for
+    the workspace + tmp + user `writableRoots`; network is blocked unless `allowNetwork`.
+  - Wired into `src/tools/index.ts` (`exec_command` plan + `checkPermissions` gate) and
+    `src/services/global-config.ts` (`sandbox` config at global + project scope).
+- **Git tooling** (`src/tools/git.ts`)
+  - Structured read-only `git_diff` / `git_log` / `git_branch` / `git_status`
+    (with ahead/behind for the tracking branch).
+  - Risk-graded `git_commit` (state-write, `isDestructive() => true`) and the pre-existing
+    `git_push`. There is **no** `git_stage` tool; staging happens via `git_commit`'s
+    `paths` / `all` arguments.
+  - All paths confined to the repository; `paths` rejects glob / pathspec syntax;
+    output is redacted.
+  - ⚠️ **Known gap**: `git_commit({ all: true })` stages _every_ tracked modification.
+    The index snapshot / rollback and user-visible preview required by plan §P1-C are
+    **not implemented** — prefer explicit `paths`.
+- **TUI permission interaction** (`/permissions` command)
+  - Toggle tool-confirmation live; immediately rewrite in-memory config **and** persist to disk.
+  - Status-bar `perm:` chip reflects the current mode; a system confirmation message is appended
+    to the session. A failed `updateGlobalConfig` leaves the in-memory state unchanged.
+
+### Changed
+
+- **Tool allowlist — ReDoS hardening** (`src/services/tool-allowlist.ts`)
+  - Regex-compiled glob matchers replaced by a **linear dual-pointer matcher**
+    (`O(pattern × subject)`, `O(1)` extra state, no catastrophic backtracking). Regressed by a
+    pathological `(a*)*b`-style input test.
+- **Plan-mode bypass fixed** (`src/framework/tool-scheduler.ts`)
+  - Plan-mode commands no longer short-circuit permission checks with a default allow; they go
+    through the same gating as interactive mode.
+- **SSRF / API-key hardening** (`src/tools/web.ts`, `src/utils/mask.ts`)
+  - Per-hop redirect host checks, a response-body hard cap, and full API-key masking in logs/output.
+- **Incremental input during a running turn**
+  - Supplementary user input is echoed immediately (G1), accumulated without loss (G2),
+    dedupe-guarded, and reflected in status text (G4).
+- **Goal tools** (`src/runtime/goals/tools.ts`)
+  - `update_goal` / `update_goal_plan` / `create_goal` failures now return a **diagnostic `output`**
+    instead of an empty string.
+- **Config model** (`src/services/global-config.ts`)
+  - `sandbox` config at both global and project scope, with documented schema / defaults / migration /
+    redaction / rollback (P1-E). Project config shallow-overrides global per key.
+
+### Security
+
+- Sandbox execution is fail-closed and verifiable: on hosts with a usable backend, the OS-enforcement
+  assertions exercise **real kernel-level confinement** (Docker `--read-only` + bind-mounts verified on macOS).
+- Allowlist matching is ReDoS-safe.
+- Web tool rejects redirect-based SSRF pivots and never leaks API keys in output.
+
+### Out of scope (this release)
+
+Deliberately deferred to a later version per the architecture review
+(`docs/archive/releases/v0.1.x/v0.1.3-2-plan.md`):
+
+- **Hook system (#27)** — external scripts expand the permission / timeout / secret / audit surface and
+  need a standalone technical design.
+- Several `v0.1.3-2` plan items (writable / background sub-agents, generic MCP SSE/HTTP/OAuth, queue
+  injection / project-instruction files, custom slash commands, domestic-differentiation, Goal self-repair)
+  are tracked for **v0.2**.
+
+### Evidence
+
+Verified by `npm run release:check` on **2026-08-05**:
+
+- **Full Jest suite (Node 24.14.0): 3045 tests — 3042 passed, 1 failed, 2 skipped; 179 suites passed.**
+  The single failure is `tests/terminal-ui-pty.test.ts` (sandbox `safe-delete` `EACCES`) → `not_run`.
+- Focused v0.1.3-2 suites: `sandbox` 30 (incl. live Docker OS-enforcement assertions),
+  `tool-allowlist` 38, `web-ssrf-bypass` 21, `git-tools` 7, plus `tool-confirmation` /
+  `permission-mode` / `incremental-input` / `goal-tools` / `tool-scheduler` / `config`.
+- `tsc --noEmit` **0 errors**; ESLint **0 errors / 137 warnings** (pre-existing `no-explicit-any`).
+- `npm pack --dry-run` OK — 1098 files, 5.23 MB unpacked.
+- CI / real-PTY / tarball clean-install evidence remains environment-gated and labelled `not_run`
+  rather than substituted by a local green run.
+
+**Corrections to earlier claims.** The previously reported "10 focused suites: 173/173" was a
+cherry-picked subset that excluded failing suites. A full run surfaced pre-§8 test rot in
+`tests/agent-runtime-controller.test.ts`, `tests/runtime-ui-parity.test.ts` and
+`tests/turn-controller.test.ts` (they asserted latest-only revision semantics and the old
+English status strings). These were realigned with the §8 G1/G2 design — the product behaviour
+was not changed. The PTY smoke scripts `scripts/terminal-ui-pty-smoke.py` /
+`scripts/tui-ui-pty-smoke.py` were updated to wait for the current Chinese status text.
+
+> Run the suite with **Node 24.14.0**. Node 22 produces 14 spurious `better-sqlite3` failures
+> (native module built for `NODE_MODULE_VERSION 137`, Node 22 requires `127`).
+
+### Still open (release gate)
+
+- `docs/archive/releases/v0.1.x/targets-v0.1.3-v0.1.3-2.md` P0-C Goal sidecar overwrite protection — `unverified`.
+- Worktree not yet frozen into a commit (index currently holds the 42 in-scope files).
+- No `v0.1.3` tag; not published.
+
+## [0.1.2] — 2026-08-02 · Published (tag `v0.1.2`)
+
+Goal reliability release. Typed continuation for a single session with a single active Goal;
+safe pause after restart/resume requiring explicit recovery; runtime evidence ledger with
+per-criterion completion audit and precise stop reasons; confirmation was single-session scoped.
+
+## [0.1.1] — 2026-07-31 · Published
+
+Command contract, TUI as the default path, OpenHorse migration and data-safety convergence;
+terminal-ui repositioned as the diagnostics build, Ink formally deprecated.
+
+## [0.1.0] — 2026-07-28 · Published
+
+First public TUI baseline.
+
+---
+
+## Maintenance rules
+
+1. Run `npm run release:check` before every release. It verifies version consistency
+   (`package.json` / `package-lock.json` / both README install pins / the Chinese README
+   "current version" marker), CHANGELOG presence, `git diff --check`, worktree cleanliness,
+   lint, types, the full test suite, and `npm pack --dry-run`.
+2. `release:check` is **read-only**: it never runs `git tag`, `git push`, PR, merge or
+   `npm publish`. Those stay separately authorized.
+3. When an entry moves Candidate → Merged → Published, **move it to the matching section**.
+   Leaving a stale status label is a release-gate failure.
+
+(Legacy release notes under `docs/mvp/` are not maintained in this file.)

package/README.md

@@ -2,7 +2,7 @@
 
 > **Goal-driven coding agent for the terminal.**
 >
-> v0.1.7 — Orion Pixel TUI, typed status chrome, and queued follow-ups
+> v0.1.9 — semantic compact, evidence-driven completion, and autonomous progress control
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -35,8 +35,8 @@ Orion Code is a terminal-based coding agent. It wraps LLM APIs in a harness of s
 ### Install & Run
 
 ```bash
-# Install the exact audited version:
-npm install -g @orion-agents/orion-code@0.1.7
+# After the registry receipt exists, install this exact prerelease version:
+npm install -g @orion-agents/orion-code@0.1.9
 # Install the current prerelease channel:
 npm install -g @orion-agents/orion-code@next
 
@@ -75,9 +75,12 @@ orion -p "review the current git diff"
 echo "summarize this project" | orion --print
 ```
 
-> **Release status.** `0.1.7` is published through the npm `next` dist-tag and is identified by the
-> `v0.1.7` tag and GitHub prerelease. Stable `latest` remains `0.1.4`; promotion is a separate
-> decision.
+Before upgrading, read the [v0.1.8 → v0.1.9 migration guide](docs/migration/v0.1.8-to-v0.1.9.md).
+Release verification is tracked in the [v0.1.9 checklist](docs/plan/v0.1.9-release-checklist.md).
+
+> **Release status.** `0.1.9` is the current release candidate for the npm `next` channel. Stable
+> `latest` remains `0.1.4`; tag, GitHub Release, npm publish, and `latest` promotion are verified as
+> separate delivery actions.
 
 ### TUI startup banner
 
@@ -174,10 +177,12 @@ the waiting tool continues. A write failure denies the call.
 
 Machine-wide rules live at root `allowedTools`; project rules live under
 `projects["<absolute path>"].allowedTools`. Both sets are evaluated, and the most restrictive
-matching effect wins (`deny` > `ask` > `allow`). A durable `allow` can skip repeated prompts for
-a tool with known risk metadata, including external tools and explicit file edits, but it cannot
-auto-approve destructive shell/system operations or override a hard tool-policy denial, plan mode,
-an explicit `ask`/`deny` rule, or missing risk metadata.
+matching effect wins (`deny` > `ask` > `allow`). Choosing project or machine scope is explicit
+durable consent for that tool, so a durable `allow` skips repeated prompts for external tools, file
+edits, and shell operations that are not hard-blocked by command safety policy. AUTO skips all
+interactive prompts and authorizes every invocation after hard tool-policy and explicit `deny`
+checks. PLAN exposes the same registry as BUILD and inherits the independently selected permission
+policy, including durable project or machine grants.
 
 ```json
 {
@@ -203,8 +208,8 @@ an explicit `ask`/`deny` rule, or missing risk metadata.
 - Interactive persistent choices add an exact tool rule such as `allow:exec_command`; edit
   `~/.orion-code/orion.json` to audit or revoke a stored rule. `/permissions show` reports the
   active machine-wide and project rule counts.
-- `allow` only skips an interactive confirmation. It never overrides a tool's own `deny`,
-  never escapes plan mode, and never applies when risk metadata is missing.
+- `allow` skips an interactive confirmation. It never overrides a tool's own `deny`, an explicit
+  allowlist `deny`, workspace containment, sandbox restrictions, or hard command safety policy.
 - Malformed entries are ignored and listed by `/config` rather than silently applied.
 
 ### Shell execution sandbox (`sandbox`)
@@ -251,29 +256,34 @@ backend is probed at runtime and a configured-but-unusable sandbox **fails close
 
 ## Interactive Commands
 
-| Command                | Description                                                                |
-| ---------------------- | -------------------------------------------------------------------------- |
-| `/help`                | Show help                                                                  |
-| `/goal`                | Create, inspect, pause, resume, replace, budget, or exit a persistent goal |
-| `/plan [task]`         | Explore read-only, save a plan, then restore the previous agent mode       |
-| `/status`              | System status                                                              |
-| `/model`               | View or switch models                                                      |
-| `/effort`              | View or change supported reasoning effort                                  |
-| `/permissions`         | View or change tool confirmation and edit policy                           |
-| `/config`              | Show configuration                                                         |
-| `/usage`               | Token usage and cost                                                       |
-| `/compact`             | Trigger context compact                                                    |
-| `/session`             | List, inspect, or rename sessions                                          |
-| `/resume`              | Resume last session                                                        |
-| `/memory`              | Memory status, reference validation, and semantic reindexing               |
-| `/skills`              | List loaded skills                                                         |
-| `/mcp`                 | MCP server status                                                          |
-| `/doctor`              | Run diagnostics                                                            |
-| `/diff`                | Workspace diff                                                             |
-| `/commit-plan`         | Create a read-only commit plan                                             |
-| `/clear`               | Clear screen                                                               |
-| `/context clear --yes` | Clear in-memory model context; preserve the saved session                  |
-| `/exit`                | Exit                                                                       |
+| Command                | Description                                                                 |
+| ---------------------- | --------------------------------------------------------------------------- |
+| `/help`                | Show help                                                                   |
+| `/goal`                | Create, inspect, pause, resume, replace, budget, or exit a persistent goal  |
+| `/plan [task]`         | Plan with normal tool access, save it, then restore the previous agent mode |
+| `/status`              | System status                                                               |
+| `/model`               | View or switch models                                                       |
+| `/effort`              | View or change supported reasoning effort                                   |
+| `/permissions`         | View or change tool confirmation and edit policy                            |
+| `/config`              | Show configuration                                                          |
+| `/usage`               | Token usage and cost                                                        |
+| `/compact [N] [focus]` | Trigger context compact with optional retained-message threshold and focus  |
+| `/session`             | List, inspect, or rename sessions                                           |
+| `/resume`              | Resume last session                                                         |
+| `/memory`              | Memory status, reference validation, and semantic reindexing                |
+| `/skills`              | List loaded skills                                                          |
+| `/mcp`                 | MCP server status                                                           |
+| `/doctor`              | Run diagnostics                                                             |
+| `/diff`                | Workspace diff                                                              |
+| `/commit-plan`         | Create a read-only commit plan                                              |
+| `/clear`               | Clear screen                                                                |
+| `/context clear --yes` | Clear in-memory model context; preserve the saved session                   |
+| `/exit`                | Exit                                                                        |
+
+Project-level compact guidance can be set in
+`projects["<absolute path>"].compactInstructions` in `~/.orion-code/orion.json`. It applies to
+manual and automatic compact, is bounded and redacted before model use, and cannot override tool
+protocol, safety constraints, acceptance criteria, evidence, failures, or pending work.
 
 Agent modes are TUI actions: use `Shift+Tab` to cycle `BUILD → PLAN → AUTO`; `/mode` and `/perm`
 are not registered commands. The remaining deprecated spellings keep their v0.3.0 compatibility
@@ -291,14 +301,18 @@ scheduled for removal in v0.2.0.
 
 Use `/plan` to arm planning for the next message, `/plan <task>` to start immediately, or press
 `Shift+Tab` to cycle `BUILD → PLAN → AUTO → BUILD` while preserving the draft. Orion allows
-read-only repository exploration and blocks edits, mutating commands, and external actions during
-the planning request. When the plan is decision-complete, the model calls `exit_plan_mode` once;
+the complete tool registry in every Agent mode. PLAN never blocks a call solely because of the
+mode: writes, commands, and external tools use the current `/permissions` policy and reusable
+project/machine grants. Explicit denies, workspace containment, sandboxing, and hard safety rules
+remain enforced. When the plan is decision-complete, the model calls `exit_plan_mode` once;
 Orion saves it, exits Plan, and starts implementation in a separate logical request. Base modes are
 changed only with `Shift+Tab`; the retired `/mode` and `/perm` commands are not compatibility entry
 points. Auto runs without permission or clarification prompts, while hard safety policies and
 explicit user boundaries remain enforced.
 
 See [the Plan-mode lifecycle contract](docs/plan/plan-mode-contract.md).
+Authorization precedence, AUTO network behavior, and audit provenance are defined in the
+[Agent Mode and Tool Permission Contract](docs/architecture/agent-mode-permission-contract.md).
 
 ### Persistent Goal safety contract
 
@@ -317,12 +331,17 @@ promise multi-Goal scheduling or unattended background execution.
 
 After a completion audit passes, Orion automatically clears the session's active Goal binding,
 returns the TUI to its current BUILD/PLAN/AUTO base mode, and retains the terminal Goal sidecar as
-the durable completion receipt. Use `/goal exit` to abandon before completion: it aborts the active
+the durable completion receipt. A trailing lifecycle clause such as `测试一轮，然后退出目标模式`
+is separated from the auditable work: Orion verifies `测试一轮`, then performs the same runtime-owned
+automatic exit after the audit passes. It is not treated as an impossible success criterion. Use
+`/goal exit` to abandon before completion: it aborts the active
 turn, rejects pending permission requests, and removes the persisted Goal. Explicit natural-language
 requests such as `exit goal mode` or `退出 goal 模式` route through the same deterministic runtime
-boundary. Rejected completion requests
+boundary. Session binding and Goal-sidecar cleanup fail closed as one lifecycle operation; Orion
+never reports a successful exit after only one persisted object changed. Rejected completion requests
 cannot be retried in the same turn until new runtime evidence exists, and autonomous continuation
-turns have stricter model/tool budgets than fresh user turns. The old `/goal clear --yes` and
+turns have stricter model/tool budgets than fresh user turns. Two consecutive blocked autonomous
+continuations pause for review instead of spending the full continuation window. The old `/goal clear --yes` and
 `/target clear --yes` syntax is intentionally unsupported in v0.1.6.
 
 ## Migration from OpenHorse
@@ -337,7 +356,7 @@ orion migrate openhorse --yes [--include-env]
 
 See the [v0.1.2 release notes](https://github.com/orion-agents/orion-code/blob/main/docs/mvp/v0.1.2.md),
 [Goal evidence and recovery guide](https://github.com/orion-agents/orion-code/blob/main/docs/goals/goal-evidence-and-recovery.md),
-and [execution plan](https://github.com/orion-agents/orion-code/blob/main/docs/plan/v0.1.2-execution-plan.md).
+and [execution plan](https://github.com/orion-agents/orion-code/blob/main/docs/archive/releases/v0.1.x/v0.1.2-execution-plan.md).
 
 ## Research-to-Evidence (v0.1.4, experimental)