@orion-agents/orion-code 0.1.8 → 0.1.9

package/CHANGELOG.md

@@ -0,0 +1,445 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Delivery status legend
+
+This project distinguishes three delivery states. **Never present unreleased work as released.**
+
+| State             | Meaning                                      | Criterion                                  |
+| ----------------- | -------------------------------------------- | ------------------------------------------ |
+| **Published**     | Tagged source is installable from npm        | git tag exists **and** `npm publish` done  |
+| **npm-published** | Registry version exists without full release | exact npm version, but tag/release may lag |
+| **Merged**        | In the default branch, not yet installable   | merged, **no** tag / not published         |
+| **Candidate**     | Reviewable source, no release promise        | committed PR branch or owned worktree      |
+
+Evidence labels follow `docs/archive/releases/v0.1.x/targets-v0.1.3-v0.1.3-2.md`:
+`met` / `partial` / `unmet` / `not_run` — where `not_run` means "blocked by environment",
+which is **not** a pass.
+
+## [Unreleased]
+
+## [0.1.9] — CANDIDATE
+
+> **Status: candidate.** Source, CI, exact tarball, npm `next`, tag, GitHub Release, and stable
+> `latest` are independent receipts. This section must be updated after each delivery action; it
+> does not claim publication in advance.
+
+### Added
+
+- Add a typed semantic Compact pipeline with atomic message groups, canonical fingerprints,
+  structured ContextItems, TaskContract/evidence/capability reinjection, bounded manual focus, and
+  deterministic fallback diagnostics.
+- Add Compact Checkpoint V2 receipts with source/replacement hashes, target-headroom validation,
+  Harness/Goal bindings, transactional candidate installation, rollback, and V1 read compatibility.
+- Add HarnessKernel TaskContract V3 criteria, evidence-to-criterion receipts, deterministic state,
+  Capability Profiles, ProgressDelta, and typed StopDecision projections.
+- Add mature-agent Compact benchmark fixtures and lifecycle trace events for prepare, validate,
+  commit, rollback, and boundary transitions.
+- Add bounded project-level `compactInstructions` for manual and automatic compaction; caller
+  guidance remains subordinate to protocol, safety, criteria, evidence, failures, and pending work.
+
+### Changed
+
+- Replace Goal's fixed five-continuation stop with criterion/evidence completion, no-progress,
+  blocker, provider, explicit budget, and user-abort decisions. Resource circuit breakers remain
+  bounded and resumable.
+- Bind subagent reservations to child query/provider accounting; keep deprecated turn fields only
+  as compatibility inputs rather than task-complete semantics.
+- Load a bounded memory index at startup and retrieve relevant content per turn with an auditable,
+  body-free prompt manifest.
+- Extend `/context explain` with section budgets, capability identity, output/safety reserves, and
+  the latest committed Compact receipt.
+
+### Fixed
+
+- Serialize usage JSONL appends with an independent cross-process lock and replay-safe request IDs
+  (#206).
+- Contain project context, project instructions, and explicit skill reads at a canonical project
+  boundary; project-provided `@file` content remains untrusted data (#207).
+- Make smaller-context model switches run and commit a semantic preflight before changing the
+  active model.
+- Reject stale Compact candidates when the transcript tail or active checkpoint changes between
+  prepare and commit, while preserving append-only session history.
+- Stop treating request/tool budgets or an unsatisfied completion gate as successful task
+  completion; render resumable typed decisions consistently.
+
+### Security
+
+- Reject symlink and non-regular project context paths, revalidate opened descriptors, and redact
+  boundary errors without exposing out-of-project file contents.
+
+## [0.1.8] — 2026-08-15
+
+> **Status: published.** Tag `v0.1.8` identifies the source;
+> `@orion-agents/orion-code@0.1.8` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Added
+
+- Add schema-level and scheduler-level finite safe-integer validation for bounded tool inputs,
+  including `exec_command.timeout`, `exec_command.maxOutputBytes`, and `list_files.maxDepth` (#203).
+- Add a renderer-neutral budget-stop view with usage, last completed work, and visible recovery
+  actions across TUI, terminal, print, JSON, and `/loop-stats` (#204).
+- Add typed tool-authorization provenance and an explicit BUILD/PLAN/AUTO network-permission
+  architecture contract; AUTO stays prompt-free after hard policy and explicit deny checks (#175).
+- Add repository-layout, cleanup-manifest, and per-issue verification ledgers for auditable release
+  ownership and recovery.
+
+### Changed
+
+- Restrict the npm package to the single runtime icon and enforce packed size, unpacked size, entry
+  count, required files, and unexpected-path budgets during release checks.
+- Move maintained scripts into `scripts/release`, `scripts/smoke`, and `scripts/maintenance`; archive
+  historical v0.1.x plans under `docs/archive/releases/v0.1.x`.
+- Enforce renderer command scope before special command dispatch, integrating the behavior reviewed
+  in PR #201 for issue #179.
+- Keep session transcript append metadata incremental and cover a 5,000-row history without a
+  full JSONL rescan (#172).
+
+### Fixed
+
+- Publish file-lock owner metadata atomically and quarantine stale legacy zero-byte recovery
+  sentinels so an interrupted writer cannot permanently block `/resume`.
+- Verify the existing security, persistence, TUI/performance, release/dependency, and Goal lifecycle
+  candidate fixes for issues #170–#200 with focused regression batches and real renderer smokes.
+- Keep Goal completion evidence durable across failure, compact, restart, and resume, then
+  automatically leave Goal mode after a passing audit (#189).
+- Update PTY harnesses to current provider profiles and durable trace/status assertions so the
+  release matrix exercises source code without deprecated configuration fallbacks.
+
+### Removed
+
+- Remove 18 unreferenced tracked documentation images, 15 superseded `test-runtime` probes, the
+  unused `src/ink` helper, and the unreferenced `src/ui-v2` experiment after replacement mapping.
+
+## [0.1.7] — 2026-08-13
+
+> **Status: published.** Tag `v0.1.7` and its GitHub prerelease identify the source;
+> `@orion-agents/orion-code@0.1.7` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Added
+
+- Add `/plan [task]` as the task-scoped, read-only planning entry with an automatically saved exit
+  transition and restoration of the previous interactive/auto mode.
+- Add an original Orion Pixel terminal identity with a portable pixel mascot, semantic poses,
+  restrained motion, and safe classic/NO_COLOR/narrow-terminal fallbacks.
+- Add persisted TUI themes, motion, mascot, status-line, and semantic keymap configuration plus
+  `/theme`, `/keymap`, `/statusline`, and `/queue` command surfaces.
+- Add a bounded shared-runtime follow-up queue: Enter steers the active turn while Tab queues FIFO
+  work without interrupting it.
+
+### Changed
+
+- Remove the `/mode` command and its `/perm` compatibility alias. Base modes now change only through
+  `Shift+Tab`; `/plan` remains the task entry and model-driven `enter_plan_mode` stays unavailable,
+  so Plan state has one lifecycle authority and completion never starts implementation in the same
+  turn.
+- Replace renderer-local status strings with a typed Chrome projection for Goal, model, permission,
+  context, effort, queued follow-ups, and active work.
+- Complete Ctrl+R history search, Ctrl+E external composition, empty Ctrl+D exit, and Esc-owned
+  interruption behavior while preserving native terminal scrollback.
+- Show stable sequence numbers for active subtasks and keep critical Goal, evidence, research, and
+  permission state visible before lower-priority chrome.
+
+### Fixed
+
+- Automatically exit Goal mode after a persisted passing completion audit, restore the underlying
+  BUILD/PLAN/AUTO mode, retain the completed Goal sidecar as an audit receipt, and reconcile the
+  narrow crash window where the terminal sidecar was saved before the session binding was cleared.
+- Route explicit `exit goal mode` / `退出 goal 模式` intent through the same deterministic runtime
+  clear boundary as `/goal exit`, reject completion retries without new runtime evidence, and cap
+  each autonomous continuation below fresh-user loop budgets.
+- Sanitize every dynamic startup-banner field, including 8-bit C1 CSI/OSC forms, before writing it
+  to the terminal (#164).
+- Serialize global configuration read-modify-write transactions across processes and add an atomic
+  session catalog for indexed lookup and bounded listing (#157, #159, #163).
+- Reject brace-quantified and overlapping-alternative ReDoS patterns, while distinguishing benign
+  command substitution from visible recursive deletion in permission policy; contain command cwd
+  inside the workspace across permission and execution paths (#160, #162, #169).
+- Require explicit risk metadata on every built-in slash command, cover drift-guard prepare/execute
+  enforcement and session rename success/scoping, and make coverage a release gate (#158, #166,
+  #167, #168).
+- Pin all third-party GitHub Actions in CI to immutable commit SHAs (#165).
+
+### Compatibility
+
+- `/goal exit` remains the canonical slash command; explicit natural-language exit intent is routed
+  to the same operation. Removed `/goal clear --yes` and `/target clear --yes` syntax is still
+  rejected and is not restored as a compatibility alias.
+
+## [0.1.6] — 2026-08-12
+
+> **Status: published.** Tag `v0.1.6` and its GitHub Release identify the source;
+> `@orion-agents/orion-code@0.1.6` is published through the npm `next` dist-tag.
+> Stable `latest` remains `0.1.4`; promotion is a separate decision.
+
+### Changed
+
+- Require explicit user authorization before a model-created Goal can become active and bound
+  non-user continuation loops so a Goal cannot run indefinitely without returning control (#150).
+- Replace destructive Goal clearing with `/goal exit`, which aborts the active turn, rejects any
+  pending permission request, and clears persisted Goal state. The old `/goal clear --yes` and
+  `/target clear --yes` forms are intentionally rejected rather than retained as aliases.
+- Make the default dependency-health report reproducible without registry access; registry-backed
+  `npm audit` and `npm outdated` reports now require explicit `--full-network` (#155).
+
+### Fixed
+
+- Preserve `vector.db` during brand migration when native SQLite verification is unavailable and
+  report the actionable ABI/rebuild cause instead of misclassifying it as corruption (#149).
+- Remove real embedding-provider calls from vector tests, make source-only import tests independent
+  of prebuilt `dist/`, and select installed Node runtimes by numeric version (#140, #144, #146).
+- Keep dependency policy mandatory in prepublish/release gates and synchronize release version
+  claims across README and release metadata (#129, #147).
+- Anchor macOS seatbelt secret-file denies to the stable project root and make `exec_command`
+  permission prechecks use the same explicit command cwd as execution (#151, #153).
+- Strip ANSI/OSC/C0/C1 control sequences from terminal-ui transcript and streamed assistant output
+  before it reaches the terminal writer (#154).
+- Make memory drift validation perform a bounded project symbol scan, expose it through
+  `/memory validate`, and fail inconclusive scans closed instead of silently accepting them (#156).
+
+### Compatibility
+
+- This pre-1.0 release contains an intentional command-line breaking change: scripts using
+  `/goal clear --yes` or `/target clear --yes` must migrate to `/goal exit`. Goal/session storage
+  remains additive and compatible; the removed command syntax is not supported as an alias.
+
+## [0.1.5] — 2026-08-11
+
+> **Status: npm-published.** `@orion-agents/orion-code@0.1.5` is available through the npm
+> `next` dist-tag. No `v0.1.5` Git tag or GitHub Release exists, and stable `latest` remains
+> `0.1.4`; those delivery states are intentionally recorded separately.
+
+### Added
+
+- Added a typed slash-command descriptor registry, exact invocation grammar, compatibility
+  lifecycle metadata, busy policies, and canonical `/goal`, `/session`, `/context`,
+  `/commit-plan`, `/rewind`, `/subagents`, and `/effort` control surfaces.
+- Added provider-aware effort capability resolution, scoped persistence, immutable retry
+  snapshots, structured renderer events, and additive reasoning/effort usage ledger metadata.
+
+### Changed
+
+- Split agent mode from tool permission policy and constrained the empty command palette to a
+  primary, searchable surface while retaining explicit advanced and compatibility commands.
+- Made dependency, Jest-major, tag/changelog, and prepublish checks fail closed.
+- Made the dependency policy reject runtimes outside the declared Node 20/22/24 matrix (#133).
+- Added version-tag CI triggers, synchronized the Jest 29 lockfile, and moved the candidate
+  package/install metadata to `0.1.5` (#134, #135, #141).
+- Made the dependency policy prove the installed OpenAI client on each CI runtime instead of
+  inferring Node support from an engine-string regex, and added a real sqlite-vec load/query
+  probe (#137, #142).
+
+### Fixed
+
+- Canonicalized recursive `rm` targets before safety evaluation and routed batch confirmations
+  and local fast paths through the shared permission policy (#125, #126, #132).
+- Repaired Goal completion audit persistence, entity decoding, confirmation fallback, and TUI
+  submission/projection behavior (#127).
+- Classified every recursive `rm` flag form as destructive so broad tool rules cannot silently
+  approve shell deletion (#136).
+- Made concurrent session registration reserve capacity atomically across processes,
+  with atomic heartbeats and serialized stale-lock recovery (#121).
+- Serialized session transcript, metadata, statistics, summaries, and deletion updates under a
+  per-session cross-process lock so counters cannot lose concurrent writes (#138).
+- Deferred native SQLite loading to semantic-storage boundaries and added actionable
+  ABI diagnostics for memory, maintenance, migration, and dependency checks (#111).
+- Removed real Ollama/OpenAI calls from vector unit tests by using deterministic embedding
+  fixtures, eliminating timeout-driven release flakiness (#139, #140).
+
+## [0.1.4-2] — 2026-08-09
+
+> **Status: published.** Tag `v0.1.4-2` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.4-2`, `next` dist-tag). Stable `latest` remains `0.1.4`.
+
+### Changed
+
+- Split the slash-command registry and chat runtime into bounded modules, removed
+  deprecated OpenHorse type aliases, and made strict lint rules fail the build.
+- Upgraded the OpenAI SDK to the Node-20-compatible 6.x line, removed unused runtime
+  dependencies, and added automated dependency policy/update checks.
+- Added structured diagnostics, provider recovery metrics, runtime-matrix CI, and
+  real PTY research lifecycle coverage.
+
+### Fixed
+
+- Closed persistence races, checkpoint corruption/rollback gaps, task-capacity and
+  response-parsing bugs, tool-call group corruption, context compaction errors, and
+  provider retry/stream recovery inconsistencies.
+- Hardened forked-agent capabilities, harness evidence/sandbox enforcement, AWS auth,
+  command execution gates, and macOS sandbox fail-closed behavior.
+- Completed the research contract across controlled web access, redirects, budgets,
+  atomic CAS persistence, citation durability, renderer events, and restart/resume.
+- Added conversational Goal abandonment with explicit user authorization and corrected
+  Goal boundary/audit/no-progress semantics.
+- Made `prepublishOnly` build before the release pack gate so clean checkouts and final
+  tarballs are validated against the same generated `dist` output.
+
+## [0.1.4] — 2026-08-06
+
+> **Status: published.** Tag `v0.1.4` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.4`, `latest` dist-tag). Released 2026-08-06.
+> Work that remains a worktree-only draft carries no release promise (see legend).
+
+Aligns `package.json` / `package-lock.json` with the `v0.1.4` release so the
+CLI banner, HTTP `User-Agent`, and crash/telemetry reports stop misreporting `0.1.3`.
+
+### Changed
+
+- **Release metadata (#10):** bumped `package.json` and `package-lock.json` to
+  `0.1.4` so `orion --version` and the outbound `User-Agent` reflect the development line.
+- **Type safety (#5):** removed ~22 `any` usages (120 → 98 on the committed tree):
+  - native `Intl.Segmenter` typing via the `ES2022.Intl` `lib` (no more `(Intl as any)` casts);
+  - typed SQLite rows in `src/memory/vector-store.ts` (`MemoryRow` / `MemoryVectorRow`);
+  - `unknown`-typed task params in `src/services/task-manager.ts`;
+  - typed provider-error messages in `src/services/provider-resilience/error-classifier.ts`.
+
+### Fixed
+
+- **Lint (#6):** resolved unused-vars / prefer-const warnings and removed dead code
+  (17 ESLint `no-explicit-any` / unused-var alerts cleared).
+
+## [0.1.3] — 2026-08-05
+
+> **Status: published.** Tag `v0.1.3` exists and the package is on npm
+> (`@orion-agents/orion-code@0.1.3`). The model-config subset (`/model` / `/models`)
+> is merged; the security/tooling subset below shipped in this release.
+
+This release hardens the execution surface (sandbox POC, tool-allowlist ReDoS,
+plan-mode bypass, SSRF / API-key leakage) and rounds out developer-facing tooling
+(git tools, TUI permission interaction, incremental input, goal-tool diagnostics).
+
+### Added
+
+- **Shell sandbox POC** (`src/tools/sandbox.ts`)
+  - Commands are wrapped as an **argv array**, never re-parsed by an intermediate shell
+    (eliminates quote-injection surface).
+  - **Runtime backend probes** for `seatbelt` / `bubblewrap` / `docker` via `spawnSync`
+    — capability is never inferred from `which`.
+  - **Fail-closed**: a configured profile that cannot be applied (no backend, unusable
+    backend, unknown profile/backend) **refuses execution** instead of silently degrading.
+  - Default `profile: 'none'` is fully backward compatible with the legacy `sh -c` path.
+  - Docker backend runs with a **`--read-only` rootfs** and explicit `rw` bind-mounts for
+    the workspace + tmp + user `writableRoots`; network is blocked unless `allowNetwork`.
+  - Wired into `src/tools/index.ts` (`exec_command` plan + `checkPermissions` gate) and
+    `src/services/global-config.ts` (`sandbox` config at global + project scope).
+- **Git tooling** (`src/tools/git.ts`)
+  - Structured read-only `git_diff` / `git_log` / `git_branch` / `git_status`
+    (with ahead/behind for the tracking branch).
+  - Risk-graded `git_commit` (state-write, `isDestructive() => true`) and the pre-existing
+    `git_push`. There is **no** `git_stage` tool; staging happens via `git_commit`'s
+    `paths` / `all` arguments.
+  - All paths confined to the repository; `paths` rejects glob / pathspec syntax;
+    output is redacted.
+  - ⚠️ **Known gap**: `git_commit({ all: true })` stages _every_ tracked modification.
+    The index snapshot / rollback and user-visible preview required by plan §P1-C are
+    **not implemented** — prefer explicit `paths`.
+- **TUI permission interaction** (`/permissions` command)
+  - Toggle tool-confirmation live; immediately rewrite in-memory config **and** persist to disk.
+  - Status-bar `perm:` chip reflects the current mode; a system confirmation message is appended
+    to the session. A failed `updateGlobalConfig` leaves the in-memory state unchanged.
+
+### Changed
+
+- **Tool allowlist — ReDoS hardening** (`src/services/tool-allowlist.ts`)
+  - Regex-compiled glob matchers replaced by a **linear dual-pointer matcher**
+    (`O(pattern × subject)`, `O(1)` extra state, no catastrophic backtracking). Regressed by a
+    pathological `(a*)*b`-style input test.
+- **Plan-mode bypass fixed** (`src/framework/tool-scheduler.ts`)
+  - Plan-mode commands no longer short-circuit permission checks with a default allow; they go
+    through the same gating as interactive mode.
+- **SSRF / API-key hardening** (`src/tools/web.ts`, `src/utils/mask.ts`)
+  - Per-hop redirect host checks, a response-body hard cap, and full API-key masking in logs/output.
+- **Incremental input during a running turn**
+  - Supplementary user input is echoed immediately (G1), accumulated without loss (G2),
+    dedupe-guarded, and reflected in status text (G4).
+- **Goal tools** (`src/runtime/goals/tools.ts`)
+  - `update_goal` / `update_goal_plan` / `create_goal` failures now return a **diagnostic `output`**
+    instead of an empty string.
+- **Config model** (`src/services/global-config.ts`)
+  - `sandbox` config at both global and project scope, with documented schema / defaults / migration /
+    redaction / rollback (P1-E). Project config shallow-overrides global per key.
+
+### Security
+
+- Sandbox execution is fail-closed and verifiable: on hosts with a usable backend, the OS-enforcement
+  assertions exercise **real kernel-level confinement** (Docker `--read-only` + bind-mounts verified on macOS).
+- Allowlist matching is ReDoS-safe.
+- Web tool rejects redirect-based SSRF pivots and never leaks API keys in output.
+
+### Out of scope (this release)
+
+Deliberately deferred to a later version per the architecture review
+(`docs/archive/releases/v0.1.x/v0.1.3-2-plan.md`):
+
+- **Hook system (#27)** — external scripts expand the permission / timeout / secret / audit surface and
+  need a standalone technical design.
+- Several `v0.1.3-2` plan items (writable / background sub-agents, generic MCP SSE/HTTP/OAuth, queue
+  injection / project-instruction files, custom slash commands, domestic-differentiation, Goal self-repair)
+  are tracked for **v0.2**.
+
+### Evidence
+
+Verified by `npm run release:check` on **2026-08-05**:
+
+- **Full Jest suite (Node 24.14.0): 3045 tests — 3042 passed, 1 failed, 2 skipped; 179 suites passed.**
+  The single failure is `tests/terminal-ui-pty.test.ts` (sandbox `safe-delete` `EACCES`) → `not_run`.
+- Focused v0.1.3-2 suites: `sandbox` 30 (incl. live Docker OS-enforcement assertions),
+  `tool-allowlist` 38, `web-ssrf-bypass` 21, `git-tools` 7, plus `tool-confirmation` /
+  `permission-mode` / `incremental-input` / `goal-tools` / `tool-scheduler` / `config`.
+- `tsc --noEmit` **0 errors**; ESLint **0 errors / 137 warnings** (pre-existing `no-explicit-any`).
+- `npm pack --dry-run` OK — 1098 files, 5.23 MB unpacked.
+- CI / real-PTY / tarball clean-install evidence remains environment-gated and labelled `not_run`
+  rather than substituted by a local green run.
+
+**Corrections to earlier claims.** The previously reported "10 focused suites: 173/173" was a
+cherry-picked subset that excluded failing suites. A full run surfaced pre-§8 test rot in
+`tests/agent-runtime-controller.test.ts`, `tests/runtime-ui-parity.test.ts` and
+`tests/turn-controller.test.ts` (they asserted latest-only revision semantics and the old
+English status strings). These were realigned with the §8 G1/G2 design — the product behaviour
+was not changed. The PTY smoke scripts `scripts/terminal-ui-pty-smoke.py` /
+`scripts/tui-ui-pty-smoke.py` were updated to wait for the current Chinese status text.
+
+> Run the suite with **Node 24.14.0**. Node 22 produces 14 spurious `better-sqlite3` failures
+> (native module built for `NODE_MODULE_VERSION 137`, Node 22 requires `127`).
+
+### Still open (release gate)
+
+- `docs/archive/releases/v0.1.x/targets-v0.1.3-v0.1.3-2.md` P0-C Goal sidecar overwrite protection — `unverified`.
+- Worktree not yet frozen into a commit (index currently holds the 42 in-scope files).
+- No `v0.1.3` tag; not published.
+
+## [0.1.2] — 2026-08-02 · Published (tag `v0.1.2`)
+
+Goal reliability release. Typed continuation for a single session with a single active Goal;
+safe pause after restart/resume requiring explicit recovery; runtime evidence ledger with
+per-criterion completion audit and precise stop reasons; confirmation was single-session scoped.
+
+## [0.1.1] — 2026-07-31 · Published
+
+Command contract, TUI as the default path, OpenHorse migration and data-safety convergence;
+terminal-ui repositioned as the diagnostics build, Ink formally deprecated.
+
+## [0.1.0] — 2026-07-28 · Published
+
+First public TUI baseline.
+
+---
+
+## Maintenance rules
+
+1. Run `npm run release:check` before every release. It verifies version consistency
+   (`package.json` / `package-lock.json` / both README install pins / the Chinese README
+   "current version" marker), CHANGELOG presence, `git diff --check`, worktree cleanliness,
+   lint, types, the full test suite, and `npm pack --dry-run`.
+2. `release:check` is **read-only**: it never runs `git tag`, `git push`, PR, merge or
+   `npm publish`. Those stay separately authorized.
+3. When an entry moves Candidate → Merged → Published, **move it to the matching section**.
+   Leaving a stale status label is a release-gate failure.
+
+(Legacy release notes under `docs/mvp/` are not maintained in this file.)

package/README.md

@@ -2,7 +2,7 @@
 
 > **Goal-driven coding agent for the terminal.**
 >
-> v0.1.8 — repository hygiene, audited issue fixes, and actionable runtime recovery
+> v0.1.9 — semantic compact, evidence-driven completion, and autonomous progress control
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -35,8 +35,8 @@ Orion Code is a terminal-based coding agent. It wraps LLM APIs in a harness of s
 ### Install & Run
 
 ```bash
-# Install this exact published version:
-npm install -g @orion-agents/orion-code@0.1.8
+# After the registry receipt exists, install this exact prerelease version:
+npm install -g @orion-agents/orion-code@0.1.9
 # Install the current prerelease channel:
 npm install -g @orion-agents/orion-code@next
 
@@ -75,8 +75,12 @@ orion -p "review the current git diff"
 echo "summarize this project" | orion --print
 ```
 
-> **Release status.** `0.1.8` is published through the npm `next` dist-tag and is identified by the
-> `v0.1.8` tag. Stable `latest` remains `0.1.4`; promotion is a separate decision.
+Before upgrading, read the [v0.1.8 → v0.1.9 migration guide](docs/migration/v0.1.8-to-v0.1.9.md).
+Release verification is tracked in the [v0.1.9 checklist](docs/plan/v0.1.9-release-checklist.md).
+
+> **Release status.** `0.1.9` is the current release candidate for the npm `next` channel. Stable
+> `latest` remains `0.1.4`; tag, GitHub Release, npm publish, and `latest` promotion are verified as
+> separate delivery actions.
 
 ### TUI startup banner
 
@@ -263,7 +267,7 @@ backend is probed at runtime and a configured-but-unusable sandbox **fails close
 | `/permissions`         | View or change tool confirmation and edit policy                            |
 | `/config`              | Show configuration                                                          |
 | `/usage`               | Token usage and cost                                                        |
-| `/compact`             | Trigger context compact                                                     |
+| `/compact [N] [focus]` | Trigger context compact with optional retained-message threshold and focus  |
 | `/session`             | List, inspect, or rename sessions                                           |
 | `/resume`              | Resume last session                                                         |
 | `/memory`              | Memory status, reference validation, and semantic reindexing                |
@@ -276,6 +280,11 @@ backend is probed at runtime and a configured-but-unusable sandbox **fails close
 | `/context clear --yes` | Clear in-memory model context; preserve the saved session                   |
 | `/exit`                | Exit                                                                        |
 
+Project-level compact guidance can be set in
+`projects["<absolute path>"].compactInstructions` in `~/.orion-code/orion.json`. It applies to
+manual and automatic compact, is bounded and redacted before model use, and cannot override tool
+protocol, safety constraints, acceptance criteria, evidence, failures, or pending work.
+
 Agent modes are TUI actions: use `Shift+Tab` to cycle `BUILD → PLAN → AUTO`; `/mode` and `/perm`
 are not registered commands. The remaining deprecated spellings keep their v0.3.0 compatibility
 window: `/target` → `/goal`, `/commit` → `/commit-plan`, `/sessions` → `/session list`,

package/README.zh-CN.md

@@ -3,7 +3,7 @@
 > **Orion Code — 通用 Agent 驾驭框架**
 > 一个 CLI 驱动的编码 Agent，具备安全边界、工具编排、记忆系统和上下文管理。
 >
-> v0.1.8 — 仓库治理、经审计的 issue 修复与可操作的运行时恢复
+> v0.1.9 — 语义压缩、证据驱动完成与自主进展控制
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -104,10 +104,10 @@ npm start -- --print "review the current git diff"
 
 ### 全局安装
 
-固定安装该精确发布版本：
+registry 凭据存在后，固定安装该预发布版本：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.1.8
+npm install -g @orion-agents/orion-code@0.1.9
 # 安装当前预发布渠道：
 npm install -g @orion-agents/orion-code@next
 # 任意目录运行
@@ -116,8 +116,11 @@ orion
 
 也可以在源码工作树中使用 `npm ci && npm run build && npm start`。
 
-> **发布状态**：`0.1.8` 已通过 npm `next` dist-tag 发布，并由 `v0.1.8` tag 标识。
-> 稳定版 `latest` 仍为 `0.1.4`；稳定版提升是独立决策。
+升级前请阅读 [v0.1.8 → v0.1.9 迁移指南](docs/migration/v0.1.8-to-v0.1.9.md)；发布验证状态见
+[v0.1.9 准出清单](docs/plan/v0.1.9-release-checklist.md)。
+
+> **发布状态**：`0.1.9` 是 npm `next` 渠道的当前发布候选。稳定版 `latest` 仍为
+> `0.1.4`；tag、GitHub Release、npm 发布与 `latest` 晋级分别验证、独立执行。
 
 公众体验、交互优化和新增工作流优先落在 TUI。`terminal-ui` 不作为与
 TUI 并行发展的公众产品；Ink 只保留迁移期兼容，不再增加产品能力。
@@ -423,7 +426,7 @@ ctxPercent = (promptTokens / 模型上下文窗口) × 100
 | `/model`               | 查看或切换模型                                      |
 | `/config`              | 显示当前生效配置                                    |
 | `/usage`               | 显示详细 Token 用量和成本                           |
-| `/compact`             | 手动触发上下文压缩                                  |
+| `/compact [N] [focus]` | 手动压缩上下文，可指定保留消息数与摘要关注点        |
 | `/session list`        | 列出或搜索最近会话                                  |
 | `/resume`              | 恢复已有会话                                        |
 | `/memory`              | 记忆状态、引用漂移校验与语义索引重建                |
@@ -437,6 +440,11 @@ ctxPercent = (promptTokens / 模型上下文窗口) × 100
 | `/clear`               | 只清理当前视图，不删除 session 数据                 |
 | `/exit`                | 安全关闭并退出                                      |
 
+可在 `~/.orion-code/orion.json` 的
+`projects["<项目绝对路径>"].compactInstructions` 设置项目级压缩指引。该配置同时作用于手动和自动
+compact，进入模型前会做长度约束与敏感信息脱敏，且不能覆盖工具协议、安全约束、验收标准、证据、失败记录
+或待完成工作。
+
 Agent mode 是 TUI 交互状态：使用 `Shift+Tab` 循环 `BUILD → PLAN → AUTO`；`/mode` 与 `/perm`
 不再注册。其余旧拼写保留到 v0.3.0 兼容窗口结束：`/target` → `/goal`、`/commit` →
 `/commit-plan`、`/sessions` → `/session list`、`/session-rename` → `/session rename`、
@@ -493,7 +501,18 @@ orion-code/
 
 ## 版本历史
 
-### v0.1.8（当前版本，已发布至 next）
+### v0.1.9（当前版本，发布候选）
+
+- 将 Compact 升级为可校验、可回滚、可恢复的语义快照与 Checkpoint V2，并支持
+  `/compact [N] [focus]`；
+- 使用 TaskContract V3、criterion/evidence graph、Capability Profile、ProgressController 与
+  typed StopDecision 统一完成、暂停和继续语义；
+- 移除 Goal 固定 5 次自动续跑上限，同时保留单请求/子 Agent 资源预算、no-progress、provider、权限与
+  Abort 安全边界；
+- 修复项目上下文路径信任和 usage ledger 多进程一致性；npm `next` 发布完成前不声明已发布，也不移动
+  稳定版 `latest`。
+
+### v0.1.8（已发布至 next）
 
 - 收敛 npm 发布白名单与包体积门禁，归档历史计划并删除已证明无引用的旧资产、脚本和 UI 实验目录；
 - 完成 33 个 open issues 的逐项账本，补齐数值型工具参数边界、budget-stop 恢复提示、renderer scope 与 AUTO 网络授权可见性；

package/dist/agents/coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../src/agents/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAQzC,MAAM,WAAW,iBAAiB;IAChC,WAAW;IACX,IAAI,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC;IAC9C,aAAa;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,UAAU,CAAa;gBAEnB,MAAM,CAAC,EAAE,iBAAiB;IAYtC;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc;IAetC;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA8FrD;;OAEG;IACH,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;IAIzC;;OAEG;IACH,SAAS,IAAI;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;KACd;IAaD,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAQtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;CA6BzB;AAMD,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAKtE;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../src/agents/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAQzC,MAAM,WAAW,iBAAiB;IAChC,WAAW;IACX,IAAI,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC;IAC9C,aAAa;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,UAAU,CAAa;gBAEnB,MAAM,CAAC,EAAE,iBAAiB;IAYtC;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc;IAetC;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgGrD;;OAEG;IACH,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;IAIzC;;OAEG;IACH,SAAS,IAAI;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;KACd;IAaD,OAAO,CAAC,qBAAqB;IA8B7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAkCrB;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAmCzB;AAMD,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAKtE;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}