@sunilaleti/hx 0.0.0-stage → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,1138 @@
+# Changelog
+
+What shipped in each released version of HX, newest first.
+
+This file is the release record and part of the product: it ships inside the
+package, `hx changelog` prints it, and a session can answer "what's new?" or
+"which version added web search?" from it rather than from a guess. `hx docs`
+prints the manual next to it.
+
+The rules, enforced by `tests/e2e/test_cli.py` so a release cannot forget them:
+
+- Every released version has a `## [x.y.z] - YYYY-MM-DD` section here, and the
+  version in `package.json` always has one. Bumping the version without
+  writing the section fails the suite before the tag exists.
+- Work that has landed but is not tagged lives under `## [Unreleased]`. At
+  release time that heading is renamed to the new version and dated, and a
+  fresh empty `## [Unreleased]` takes its place.
+- Entries say what a user can now do, in one line each, naming the command,
+  setting or key that reaches the feature. A changelog nobody can act on is a
+  git log with extra steps.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+the project follows [semantic versioning](https://semver.org/).
+
+---
+
+## [Unreleased]
+
+---
+
+## [1.0.0] - 2026-10-31
+
+### Changed
+
+- The TypeScript build is the release: install it with `npm install --global @sunilaleti/hx`,
+  and run the same command again to update.
+- With nothing signed in, `hx` opens straight into the TUI, under the HX logo, and says to type
+  `/login`, instead of asking for an OpenRouter key in the shell before anything is on screen.
+  A model whose route is not signed in says to `/login` or pick another with `/model`, and the
+  first message after signing in goes through.
+
+### Removed
+
+- `hx upgrade`. Update by running the install command again.
+- The beta channel (`@sunilaleti/hx@next`). Every version is a stable release on `latest`.
+- The Python build. `hx-cli` on PyPI stops at 0.2.20 and gets no more releases. To move over,
+  run `uv tool uninstall hx-cli` and install from npm: `~/.hx` carries over as it is.
+  `install.sh` now checks for Node.js 22.15 or newer and installs from npm.
+- The `live` tests, which drove the Python build's internals against real APIs.
+
+### Security
+
+- A server in a project's `.hx/mcp.json` no longer starts by itself: a cloned repository could
+  run any command the moment `hx` opened in it. HX names each waiting server and what it runs;
+  `hx mcp approve <server>` starts it, and `hx mcp add` approves what it adds. An approval is for
+  that command, so a server whose command changes waits again. Existing project servers need
+  approving once.
+- Read, Grep, Glob, Symbols, Write and Edit ask before touching `~/.ssh`, `~/.aws`, `~/.gnupg`,
+  `~/.kube`, `~/.config/gh`, `~/.docker/config.json`, `~/.netrc`, `~/.npmrc`, `~/.pypirc` and
+  HX's `auth.json`, in every mode and through symlinks. The sandbox kept the shell out of them,
+  but these tools run outside it. An allow rule naming the file opens it.
+- A command hidden inside another no longer passes as read-only: `cat <(rm -rf src)`, `>(...)`,
+  zsh's `=(...)` and glob qualifiers, an `awk` program that pipes to or reads from a command,
+  `@include`, and `find -fprint0` all ask now.
+- A deny rule holds however the command is spelled: behind `NAME=value` assignments, by full
+  path, or behind a wrapper such as `nohup`, `timeout`, `sudo` or `xargs`. An allow rule no
+  longer covers a command with assignments it does not name.
+- `acceptEdits` covers only the project: a write outside it, through a symlink that leads out
+  of it, or into its `.git` or `.hx` folder asks.
+- `$HX_HOME` (`~/.hx`), which holds every transcript, is made private to its owner (`0700`).
+
+### Fixed
+
+- Reads that come before a write in one turn run concurrently, as reads elsewhere do.
+- A login shell that does not speak POSIX sh - csh, tcsh, fish - no longer makes every command
+  wait out its timeout: commands run in bash.
+
+---
+
+## [0.3.0-beta.1] - 2026-10-31
+
+### Changed
+
+- HX is rewritten in TypeScript and runs on Node.js 22.15 or newer. Install it with
+  `npm install --global @sunilaleti/hx@next`, and `hx upgrade` updates it through npm. The
+  commands, keys, screens, settings and `~/.hx` are the same, so a session started on the Python
+  build resumes here and the other way round.
+- The Symbols tool takes its grammars from `npm install --global @vscode/tree-sitter-wasm`.
+
+### Fixed
+
+- An OpenRouter reply that broke off after its first words is no longer retried from the start,
+  which showed those words twice.
+
+---
+
+## [0.2.20] - 2026-10-26
+
+### Changed
+
+- A tool call is one row with no background: a coloured marker shows how it ended, and what came
+  back hangs under it from a `⎿`, for example `● grep TODO` over `⎿  3 results`. A call that
+  gave nothing back takes half the rows it did, one with a summary a row less, and a failed call
+  is still the red `✗`. Output too long for the row wraps on that edge rather than being cut at
+  the side of the screen.
+- Tool calls are a step quieter than the answer, and what they gave back a step quieter again,
+  so the answer is what you read first. A shell command is no longer bold. An approval still
+  shows the command at full strength. A theme sets the new levels with `toolTitle`,
+  `toolArgs` and `toolOutput`; a theme without `toolArgs` keeps its `accent` for them. The
+  `ansi` theme has only the terminal's own two greys, so there a tool header stays at the
+  answer's strength and only its arguments and output step down.
+- `toolPendingBg` no longer colours anything, and a theme no longer needs it. A pi theme that
+  sets it still loads.
+
+### Fixed
+
+- `"theme"` in settings and `HX_THEME` choose the palette at startup again. Every session
+  opened in `dark` until `/theme` was run.
+
+---
+
+## [0.2.19] - 2026-10-22
+
+### Added
+
+- On a ChatGPT or Claude subscription, the status bar has a usage line: how much of each usage
+  window is spent and when it renews, for example
+  `5h 16% (renews 06:30 am) | 7d 14% (renews Mon Oct 26 04:00 am)`. A window turns yellow at 75%
+  and red at 90%, and drops to 0% by itself when it renews. `/cost` lists the same windows.
+- With an older Claude Code, which gives no percentage below its warning level, a window shows
+  only when it renews, for example `5h (renews 06:30 am)`.
+
+### Fixed
+
+- A ChatGPT plan that is out of usage is no longer retried three times. HX says which window
+  is spent and when it resets.
+- On a narrow terminal, the status bar drops the token counts and the cache field before the
+  context gauge. It no longer cuts a field in the middle of a number.
+- A Claude usage limit message gives its reset time in the same form as the usage line.
+- A resumed session can edit the files it read before. `hx resume` and `/resume` used to
+  forget every read, so the model saw a file in its history and still had its edit refused
+  with "has not been read in this session". A file changed since that read is still refused
+  until the model reads it again.
+- After `/clear`, the new session can no longer edit a file that only the previous session read.
+- `/rewind` keeps the reads from before the prompt it goes back to. An edit to a file that was
+  read earlier and then restored is no longer refused.
+- A subagent's reads count for the subagent only. The main session must read a file itself
+  before it edits it.
+- The refusal of an edit to an unread file tells the model to use the Read tool, because a
+  file shown by a shell command does not count.
+
+---
+
+## [0.2.18] - 2026-10-18
+
+### Security
+
+- Edit and Write no longer leave a private file's new content readable by other users while
+  they write it. The temporary file now gets the file's own mode before any content goes in.
+
+### Fixed
+
+- An edit through a symlink says which file it changes. The approval reads "config.yml is a
+  link to ~/shared/config.yml", and so does the answered approval and the result the model
+  gets. A link into a missing directory is refused in words, not with a raw error.
+- The transcript names a symlink by its own name, not by the name of its target.
+- A failed tool's error wraps in the transcript instead of being cut at the window's edge, so
+  a reason that comes after a long path stays readable.
+- An edit to a CRLF file that differs only in line endings is refused as identical. It used to
+  be reported as applied, with nothing changed.
+- Counts of one read in the singular when a limit leaves something out: "1 more line",
+  "1 more match", "1 more result". So do the other counts that still had "1 lines" forms.
+
+---
+
+## [0.2.17] - 2026-10-18
+
+### Security
+
+- The API keys HX itself signs in with (`HX_OPENROUTER_API_KEY`, `OPENROUTER_API_KEY`, and the
+  Tavily and Devin keys) are no longer passed to the commands it runs. An auto-approved `env`
+  used to put them straight into the model's context.
+- `xxd -r`, `xxd in out`, `uniq in out` and `sort --compress-program` now ask before they run.
+  They write files or run a program, but they were auto-approved as read-only commands.
+- A long option cut short now counts as the full option, as getopt_long and git read it.
+  `sort --compress=sh`, `sort --out=f`, `git grep --open-files-in=sh` and `git branch --del`
+  were auto-approved as read-only. So were `xxd in -p` and macOS `uniq in -c`, which write a
+  file named after the flag.
+
+### Fixed
+
+- A command that reads stdin (`cat`, `read`, `ssh host ls`) no longer breaks the shell. It used
+  to swallow every later command, which then reported success without running. Commands now
+  get end-of-file on stdin, and a command with an unclosed quote fails on its own.
+- Background jobs no longer read from the terminal, so a dev server cannot take keystrokes
+  from the prompt.
+- Background jobs get `HX=1` and `TERM=dumb`, the same as other commands. A tool that colours
+  its output for a real terminal used to write escape codes into the job's log.
+- Non-ASCII command output no longer shows `�` where a read split a character.
+- An edit to a CRLF file keeps CRLF on every line. Each edit used to rewrite the whole file
+  with LF, and the diff did not show it. `old_string` with plain newlines now matches there.
+- A hashline replacement that ends with a newline no longer adds a blank line after it.
+- Edit and Write keep a file's mode, so a script stays executable, and write through a
+  symlink instead of replacing it with a regular file.
+- With `--cwd`, or `hx resume` from another directory, the approval shows the diff of the
+  file the edit will change. It used to read a relative path from the shell's directory.
+- An edit's `+N -M` and its diff now include changed lines that start with `--` or `++`,
+  such as SQL comments.
+- "Always allow" on a command HX cannot split into parts, such as a heredoc with an
+  apostrophe, is now honoured in later sessions instead of asking again.
+- Counts of one read in the singular: "read 1 line", "1 result", "1 match", "1 tool".
+- Write reports the number of lines the way Read numbers them. A file ending in a newline
+  was reported one line longer.
+- The status bar shortens a long project path from its start, so the project's name and
+  branch stay visible. Before the first request, the cache field reads "no cache".
+
+---
+
+## [0.2.16] - 2026-10-13
+
+### Fixed
+
+- The "Working…" status and the tool spinners now keep moving while a tool runs. They
+  used to vanish or freeze from the moment the model asked for a tool until its next reply,
+  so a long command looked like an idle session. The clock now counts the whole turn, not
+  only the time since the last model reply.
+- A tool call waiting on an approval shows `?` and does not spin, and its "Took" counts
+  only the run, not the time you spent deciding. A denied call never ran, so it shows no
+  "Took" at all.
+
+---
+
+## [0.2.15] - 2026-10-04
+
+### Changed
+
+- `/login` and `hx auth login` list the accounts as OpenAI, Claude, OpenRouter, Devin. At the
+  `hx auth login` menu, Enter still picks OpenRouter.
+
+### Fixed
+
+- `/login claude-code` behind a network whose TLS inspection signs with a certificate not
+  valid for servers ("unsupported certificate purpose") now gives Claude Code's reason and
+  the fix: have the network fixed or exempted, or set `HX_SSL_NO_VERIFY=1` meanwhile. It
+  used to give the whole sign-in URL and no fix. Turns and HX's own requests that fail the
+  same way give the same advice, not "add the CA", which is trusted already.
+- A `HX_CA_BUNDLE`, `SSL_CERT_FILE` or `REQUESTS_CA_BUNDLE` that names a file holding no
+  certificates no longer crashes HX at startup. HX says so and verifies against the system
+  trust store, and does not hand the file to Claude Code.
+- A wrapped error notice no longer shows a bright green background under every line after
+  the first.
+
+---
+
+## [0.2.14] - 2026-10-04
+
+### Added
+
+- When the installed Claude Code is behind its current release - and so lists older Claude
+  models than your subscription can run - `/model` says so under the list, with the command
+  that updates it (`brew upgrade --cask claude-code` for a Homebrew install, otherwise
+  `claude update`). After updating, the next `/model` lists the new models; no
+  refresh needed.
+
+### Changed
+
+- The model catalogue is refreshed from inside the `/model` picker: press `ctrl+r`. The
+  list updates in place and keeps your filter and selection; the outcome, or why the refresh
+  failed, shows under the list. With no models at all, `/model` now opens anyway and says
+  so, so `ctrl+r` is there to fill it.
+
+### Removed
+
+- `/models refresh`. It sat one letter away from `/model` and did nothing without its one
+  argument; use `ctrl+r` in the `/model` picker.
+
+### Fixed
+
+- On the `claude-code` route, the context window is the one Claude Code reports, not a
+  200k guess: Opus 5.5 runs with 1M. Claude Code lists its models without their sizes, and
+  what it serves depends on the plan, so a model starts at the window it was measured
+  serving on every plan - 1M for Opus 5.5, Sonnet 5.5, Sonnet 5 and Opus 4.7, 200k
+  otherwise - until its first turn reports the real window and maximum output for your
+  account. From then on the context gauge, the compaction threshold, the `/model` picker
+  and later sessions all use it, and a catalogue refresh keeps it.
+- A model Claude Code lists at its long context - Fable 5.1 as `claude-fable-5-1[1m]` -
+  runs at it: `/model` offers `claude-code/claude-fable-5-1[1m]` at 1M, where HX used to
+  drop the `[1m]` and run the model at its standard context.
+- A turn refused because the model, or its 1M context, needs usage credits your Claude plan
+  has off no longer reads "usage limit is reached. It resets at ...": HX says what needs the
+  credits, where to turn them on, and which model runs without them. Once they are on, the
+  next turn runs.
+- After a catalogue refresh (`ctrl+r` in `/model`, or signing in), the session in progress
+  measures its context against the refreshed window, not the one it started with.
+- `/model anthropic` (or typing `anthropic` in the picker) lists the Claude models your Claude
+  Code subscription runs, first, ahead of the per-token OpenRouter ones; `openai` does the same
+  for Codex. Several words match in any order: `/model anthropic sonnet`.
+
+---
+
+## [0.2.13] - 2026-10-04
+
+### Added
+
+- Claude Pro/Max route: `hx auth login claude-code`, then
+  `hx --model claude-code/claude-sonnet-5`. Runs Claude models on your Claude
+  subscription through the official Claude Code CLI, with HX's own tools,
+  approvals and transcript. `/model` lists the account's models and `/effort`
+  their levels.
+- Behind a TLS-inspecting proxy the `claude-code` route takes the same
+  settings as every other route: `HX_CA_BUNDLE` reaches Claude Code as
+  `NODE_EXTRA_CA_CERTS` and `HX_SSL_NO_VERIFY` as
+  `NODE_TLS_REJECT_UNAUTHORIZED=0`, Claude Code's own `CLAUDE_CODE_CERT_STORE`
+  and `CLAUDE_CODE_CLIENT_CERT` / `_KEY` / `_KEY_PASSPHRASE` (for a network
+  that requires a client certificate) pass through, and a certificate failure
+  it reports names the fix.
+- On the `claude-code` route, a turn Anthropic bills as Extra Usage while
+  your plan still has room says so, and names HX's part of the system prompt,
+  instead of claiming the plan's usage limit is reached. A turn whose prompt
+  carries HX's own system prompt text (a copied `system-prompt.md`, an
+  AGENTS.md, an agent definition) is refused before it is sent, naming where
+  the text is; `hx prompt` shows the sources.
+
+### Fixed
+
+- A subagent that fails - a provider error, a refused prompt, the turn limit -
+  reports why to the parent model, instead of "(the subagent returned no
+  text)".
+- `Glob` with a pattern of `.` or `./` returns an error saying to use `*` or
+  `**/*`, and an absolute pattern one naming the `path` and relative pattern
+  to send instead, on every Python version, instead of a Python exception.
+- With `tui.enterWhileBusy` set to `"steer"`, `alt+enter` queues a message
+  behind the running turn, as the prompt says. It used to steer like `enter`,
+  leaving no way to queue in that mode.
+- The status bar's `⧗N queued` count stays visible in a project with a long
+  path or branch name; the path is shortened instead of the count being cut off.
+
+---
+
+## [0.2.12] - 2026-10-01
+
+### Fixed
+
+- `/exit` and `ctrl+d` return the shell at once. They used to wait up to 10
+  seconds on a model call renaming the session; sessions are no longer renamed
+  on the way out, in the TUI or with `hx -p`.
+- A name set with `/title` is no longer replaced by a generated one, including
+  one that was still being generated when you set it.
+- The session name is generated from the opening and the latest stretch of the
+  conversation, not only its first 2000 characters.
+- A session left before its first name came back is named from your first
+  message, instead of being listed by `/resume` with no name.
+- A session left with `/resume` into another directory is renamed for what it
+  became, by the HX that starts there, in the background.
+
+---
+
+## [0.2.11] - 2026-10-01
+
+### Fixed
+
+- `esc` while a tool runs no longer breaks the session: the next question is
+  answered instead of every later turn failing. A session that was interrupted
+  or killed mid-tool before this release also carries on after `hx resume`.
+- `esc` during a `Bash` command stops the command. The next `Bash` call gets its
+  own output and exit code, not what was left of the one stopped.
+- An interrupted call keeps what it printed, on screen and for the model, and
+  reads "Interrupted after <time>" instead of looking like a failure.
+- A tool that finished keeps its result when `esc` lands while its
+  `PostToolUse` hook runs.
+- `Bash` shows a short line such as "Starting..." as soon as it is printed,
+  rather than only when more output follows.
+
+---
+
+## [0.2.10] - 2026-09-29
+
+### Fixed
+
+- `AGENTS.md` at the repository root now applies when HX is started in a
+  subdirectory, followed by each `AGENTS.md` down to that directory.
+- Subagents started with `Task` now follow `~/.hx/AGENTS.md` and the project's
+  `AGENTS.md`, as the main session does.
+- A saved `/effort` level shows on the status bar from the first screen of every
+  new session, not only after `/effort` is run again.
+- `ctrl+l` switches the model and saves it for later sessions, as `/model` does;
+  it used to relabel the status bar only.
+- `/model`, `ctrl+l` and `/effort` open with the cursor on the choice in force.
+
+---
+
+## [0.2.9] - 2026-09-27
+
+### Added
+
+- `~/.hx/AGENTS.md` holds your own instructions and is loaded into every
+  session in every project, ahead of the project's `AGENTS.md`. The first
+  session creates it empty, ready to fill in. `hx prompt` and `/prompt` now
+  name each `AGENTS.md` in force, and `/prompt` says when one has changed on
+  disk since the session started.
+
+### Fixed
+
+- An `AGENTS.md` or system-prompt override that is not valid UTF-8 is skipped
+  like an unreadable one, instead of stopping HX from starting.
+
+---
+
+## [0.2.8] - 2026-09-27
+
+### Changed
+
+- `ctrl+z` undoes in the prompt and `ctrl+shift+z` redoes; `cmd+z` and
+  `cmd+shift+z` do the same in terminals that pass cmd through (kitty,
+  WezTerm). Apple's Terminal sends `ctrl+shift+z` as `ctrl+z`, so there it
+  undoes. Suspend no longer has a default key: bind `app.suspend` in
+  `keybindings.json`, which now also accepts `cmd+` and `option+`.
+
+### Fixed
+
+- A markdown table wider than the terminal - pasted into the prompt or in a
+  reply - wraps its cells inside their columns instead of cutting them off,
+  so every word shows; in a terminal too narrow for its columns it is drawn as
+  `header: value` records. A bold phrase or link that wraps keeps its style
+  on the next line.
+- A long draft in the prompt wraps between words instead of splitting them
+  across rows; only a word longer than the row still breaks inside it. The
+  cursor after the last character of a full row no longer hides that
+  character.
+- The welcome lines wrap on a narrow terminal instead of being cut off
+  mid-word.
+
+---
+
+## [0.2.7] - 2026-09-27
+
+### Added
+
+- `HX_OPENROUTER_BASE_URL` points the OpenRouter route at any OpenAI-compatible
+  endpoint - a gateway, a recording proxy.
+- Pressing `esc` on a running turn leaves an "Interrupted" line in the transcript,
+  so a reply cut off mid-sentence no longer reads as a finished one.
+- A paste over 10 lines or 1000 characters shows in the prompt as
+  `[Pasted text #1 +40 lines]` and is sent in full; the token moves and deletes
+  as one character, and survives history recall and `ctrl+k`/`ctrl+y`.
+- `\` then `enter` inserts a newline in any terminal, including Apple's Terminal
+  and tmux without extended keys, where `shift+enter` cannot be told from `enter`. `\\` then
+  `enter` sends a message that ends in a backslash.
+
+### Fixed
+
+- `shift+enter` inserts a newline instead of sending the message in kitty, Ghostty,
+  WezTerm, iTerm2 and tmux (with `extended-keys on`): HX now asks the terminal for
+  the kitty keyboard protocol, falling back to xterm's modifyOtherKeys, and hands
+  it back on exit, `ctrl+z` and `/fullscreen`. `ctrl+shift+z` (redo) works there too.
+- `shift+enter` also inserts a newline on macOS in terminals that send it as a
+  plain `enter` (VS Code's, Apple's Terminal) or as `option+enter` (the Claude
+  desktop app's terminal panel): HX asks macOS which modifiers are held when the
+  key arrives. A real `option+enter` still steers, an `enter` hard on the heels of
+  a shifted character (`?` then `enter`) still sends, and `HX_MODIFIER_PROBE=0`
+  turns the check off.
+- A multi-line paste keeps its line breaks. Terminals send them as carriage
+  returns, which HX was deleting, so a pasted table arrived as one long line.
+- Lines typed with `shift+enter` stay separate lines in the transcript instead of
+  being joined into one paragraph.
+- On macOS the sandbox now refuses *writes* to credential paths (`~/.ssh`,
+  `~/.aws`, `~/.hx/auth.json`, ...) as well as reads, so a session opened in your
+  home directory cannot plant an `authorized_keys` entry.
+- On Linux the same holds for a credential path that does not exist yet: a
+  session opened in your home directory with no `~/.ssh` could create one and
+  plant an `authorized_keys` on the host. HX now creates such a path, empty and
+  private (`0700` for a directory, `0600` for a file), and mounts a read-only
+  shadow over it. Existing credential directories are shadowed read-only too, so
+  a write fails with "Read-only file system" instead of vanishing.
+- Shell commands the model runs show their output in the transcript again - the
+  last lines, with `ctrl+o` for the rest - instead of only "Took 12ms".
+- `/context` no longer fails with "'UsageLedger' object has no attribute
+  'total_tokens'"; it lists what fills the window.
+- `/copy` copies the last reply and says how it was copied, instead of failing.
+- `/theme light` reports "Theme: light" rather than "Theme: None".
+- `/compact` on a short session says only that there is nothing to compact, no
+  longer followed by a "Compacting…" that never finishes; a compaction that
+  saves nothing still reports that it finished, and the context gauge keeps
+  counting the system prompt afterwards.
+- `/help` lines its key descriptions up however long a binding is, and a long
+  row in `/agents`, `/cost` or any other command output wraps under its own
+  column instead of at the left edge.
+- The "always allow" option on an approval names where the rule is really
+  saved (`~/.hx`), and the answered approval shows a file relative to the
+  project rather than as an absolute path.
+- `/permissions` no longer says the same thing twice.
+
+---
+
+## [0.2.6] - 2026-09-23
+
+### Added
+
+- Sign in to remote MCP servers over OAuth. A server that asks for it -
+  Atlassian's `https://mcp.atlassian.com/v2/mcp`, for one - shows as needing
+  sign-in; `/mcp login <server>` or `hx mcp login <server>` opens the browser
+  and the tools arrive without a restart. Tokens refresh on their own;
+  `/mcp logout <server>` forgets them. `"oauth": {"clientId": ...}` in
+  `mcp.json` covers servers without client registration.
+- MCP servers that change their tool list mid-session have the new list
+  swapped in, whether they announce it in a reply or on their own stream.
+- `hx mcp add NAME --url URL --header "Name: value"` saves headers, such as an
+  API token, with the server.
+- `/mcp reconnect <server>` restarts one server without restarting HX.
+- `/resume` always offers a list to switch to: this directory's sessions
+  first, then every other directory's, each row naming where it lives.
+  Picking one from elsewhere restarts HX in that directory on it, with the
+  same `--mode` and `--model`. The session already open is no longer listed,
+  and the list is no longer cut at 20.
+
+### Fixed
+
+- `/resume` said "No previous sessions in this directory" in a fresh
+  directory, or inside a session resumed from another one, instead of
+  listing anything.
+- `hx resume <id>` ran the session in whatever directory you typed it in,
+  not the one it was recorded in, so its paths and tool calls pointed at the
+  wrong project.
+- `hx mcp add NAME --url URL`, `--user`, and server arguments like `npx -y`
+  were refused as unknown options, so none of them could be run.
+- `hx mcp add` dropped headers from the entry it wrote.
+- A remote MCP server that expires its session is initialized again instead
+  of failing every call until HX restarts.
+- A multi-line shell command no longer breaks the screen. Its approval shows
+  one row per line, the tool call shows the first line and `+N lines`
+  (`ctrl+o` shows the rest), and the approval options and prompt are no longer
+  drawn several times over.
+- `/resume` from inside a resumed session showed the resumed conversation
+  pushed off the top of the screen, leaving only the "Resumed" notice.
+- A session title with a line break in it no longer splits its row in the
+  `/resume` picker.
+- Started in your home directory, the status bar named it `~/.`; it now reads
+  `~`.
+
+---
+
+## [0.2.5] - 2026-09-23
+
+### Added
+
+- Images as input. `ctrl+v` attaches the image on the clipboard, dragging an
+  image file into the terminal attaches it, and `hx -p "..." --image PATH`
+  attaches one to a headless prompt. Each shows in the prompt as
+  `[Image #N]`.
+- `Read` returns image files as images, so the model can look at a screenshot
+  or mockup it is pointed at with `@path`.
+- Images returned by MCP tools reach the model instead of being dropped.
+- Every route carries images: OpenRouter, the Codex subscription and the Devin
+  subscription. Large images are scaled and re-encoded to fit each route's
+  limits.
+- A model that does not accept images is warned about when one is attached,
+  and is told the image was left out rather than sent a request that fails.
+  The `/model` picker marks the models that can see images.
+
+### Fixed
+
+- Background jobs are waited for, not only signalled, when a session closes.
+  An unwaited subprocess transport was collected after the event loop had
+  gone, which raised `Event loop is closed` as an unraisable warning on CI
+  runs that otherwise passed.
+
+---
+
+## [0.2.4] - 2026-09-19
+
+### Added
+
+- `/trace [path]`: write the whole session to one self-contained HTML page and
+  open it. The system prompt, the project context, the skills index, every tool
+  schema, every prompt and reply, every thinking block, every tool call beside
+  the result it produced, the per-call token ledger and the files HX changed.
+  Late-injected reminders and compacted turns are included behind a toggle.
+  A session still running traces as it stands, including the turn that just
+  landed. The page follows your system's dark or light setting and a button
+  overrides it; nothing is fetched and nothing is uploaded.
+- `hx trace [SESSION_ID] [PATH]`: the same page for any transcript on the
+  machine, without starting a session. Defaults to the last session in this
+  directory and prints only the path, so `open "$(hx trace)"` works. Either
+  argument may be given alone - a lone one that looks like a path is one.
+- The system prompt and the tool schemas are now written to the transcript on a
+  session's first provider call, so a trace of a finished session can say what
+  the model was told and not only what it said.
+
+### Security
+
+- Permission rules are matched against the path a specifier resolves to, not
+  the text it was written as. `deny: Read(~/.ssh/**)` was got past by asking
+  for `../../.ssh/id_rsa`, or through a symlink planted in the project. The
+  same resolution stops an allow rule leaking: `allow: Edit(src/**)` used to
+  cover `src/../../etc/passwd`.
+- `WebFetch` is matched against every URL it was given rather than the first,
+  so `deny: WebFetch(https://host/**)` is no longer a question of list order.
+  The approval prompt spells the URLs out too; it said `urls=[2 items]`, which
+  answered the only question that mattered with a number.
+- The generated Seatbelt profile no longer grants write access to all of
+  `/private/var/folders` - every user's and every process's temp and cache.
+  `$TMPDIR` was resolved precisely to avoid that, and the profile handed it
+  back on the next line. This user's own container stays writable.
+- `~/.hx/auth.json` is created with mode 0600 rather than narrowed to it after
+  the tokens are written, closing a window at a predictable path where the
+  credential was readable by any local account.
+- The OAuth callback page escapes what the provider sent. An `error` parameter
+  carrying markup ran as HTML on a loopback origin that is otherwise the
+  user's own.
+
+### Fixed
+
+- Slash commands read the session that is in force rather than the one HX
+  opened with. After `/resume`, `/trace` wrote a page of zeros into the empty
+  startup session's directory and `/cost` reported nobody's usage: the command
+  context had captured the session object at startup, and `/resume` rebinds it.
+- A session whose title was the trace template's own data placeholder had the
+  whole payload spliced into the page's `<title>`.
+- A trace labelled an encrypted reasoning block "thinking (signed)", which read
+  as though the page had dropped the rest of it. It now says the text is the
+  provider's summary and the reasoning came back encrypted, and a block that
+  arrived with no summary at all says that rather than rendering an empty box.
+- MCP servers survive a large response. One JSON-RPC message is one line and
+  asyncio's stream limit is 64 KiB, so a tool returning a file did not truncate
+  - it raised out of the read loop and killed the connection for the rest of
+  the session. The limit is now 16 MiB, and overshooting it says so.
+- A tool call is no longer dropped when a stream ends without a `finish_reason`.
+  The arguments were buffered until that field arrived, so a complete call was
+  discarded and the turn reported `end_turn`: the model appeared to stop for no
+  reason, and the tokens were already paid for.
+- The Linux sandbox starts again for anyone with credential *files*. Denied
+  paths were all shadowed with `--tmpfs`, which mounts a directory and aborts
+  bwrap when aimed at a file - and six of them are files, `~/.hx/auth.json`
+  among them. Files are shadowed with `/dev/null` instead. bwrap also starts in
+  the policy's directory rather than whatever `$PWD` happened to hold.
+- `PersistentShell.cwd` follows the shell. It claimed to track it and was in
+  fact the launch directory forever, which meant a background job always
+  started where the session opened rather than where `cd` had left it.
+- A background job no longer leaks its log file descriptor for the life of the
+  session.
+- A record appended while the transcript was being written is no longer
+  dropped. The queue is taken in one step, and a failed write puts its records
+  back rather than losing them.
+- An automatic compaction with nothing to summarise is no longer announced and
+  rerun every turn for the rest of the session. `/compact` still answers either
+  way.
+- `/trace` takes `--no-open`, and never launches a *terminal* browser: with no
+  display, `webbrowser` falls through to lynx or w3m, which opens in the
+  terminal HX is drawing on and takes the session display with it.
+
+---
+
+## [0.2.3] - 2026-09-18
+
+### Added
+
+- Hooks: shell commands HX runs at `PreToolUse`, `PostToolUse`,
+  `UserPromptSubmit` and `Stop`. A hook can refuse an action (exit 2, or
+  `{"decision": "block"}`), rewrite a tool's arguments before the permission
+  engine sees them (`updatedInput`), or add a note for the model
+  (`additionalContext`). Configure them under `"hooks"` in
+  `~/.hx/settings.json`; `/hooks` lists what is loaded. Hooks declared in a
+  project's checked-in `.hx/settings.json` are ignored and reported, because
+  cloning a repository must not be enough to run commands on your machine.
+- `Symbols`: outline a file, find where a name is defined, or find where it is
+  used, over a tree-sitter parse tree rather than a regex - so a match inside a
+  comment or a string never counts. Python, TypeScript, JavaScript, Go and
+  Rust. Needs the grammars: `uv tool install "hx-cli[symbols]"`. Without them
+  the tool is not registered at all.
+- An example hook, `examples/hooks/check.sh`: after every `Edit`/`Write` it
+  runs the project's own checker (`ruff`, `tsc`, `go vet`, `cargo check`)
+  against just that file and hands the output back to the model, so a typo is
+  caught on the next turn instead of at test time.
+- Line anchors. `Read` now labels each line with a short content hash, and
+  `Edit` accepts those anchors in a `hashline` argument to replace a span
+  without retyping it. An anchor that no longer resolves means the file moved,
+  so the patch is rejected instead of landing at the wrong lines. Set
+  `"tools": {"hashline": false}` to go back to plain `cat -n` reads.
+
+### Removed
+
+- The `telemetry` setting, which was parsed and never read by anything.
+
+### Fixed
+
+- The README's Status section said there were two model routes; Devin made it
+  three in 0.2.2.
+- `MultiEdit` and `NotebookEdit` were listed as mutating tools and as edit
+  tools in the permission engine, but no such tools exist. A rule written
+  against either name silently matched nothing.
+
+---
+
+## [0.2.2] - 2026-09-17
+
+### Added
+
+- Devin subscription as a third route: `hx auth login devin` (or `/login`)
+  signs in through the browser, and `devin/<model>` ids run against the plan -
+  every model the account includes, listed by `/model` and refreshed with
+  `/models refresh`. Reasoning depths Devin ships as separate models are folded
+  into one, so `/effort` picks the depth, and router models such as
+  `devin/adaptive` are assigned per turn. A session token in `DEVIN_API_KEY`
+  works where there is no browser. Devin Enterprise accounts sign in through
+  the same command by choosing "Log in with Devin for Enterprise".
+
+### Fixed
+
+- The `/login` dialog no longer sits on "Starting…" for the whole sign-in: it
+  now updates as the flow moves on, and keeps the instructions on screen
+  alongside the link, progress and paste field instead of overwriting them.
+
+- Resizing the terminal no longer crashes the session. A window manager sends
+  a burst of SIGWINCH for one drag of a corner, and a signal landing while the
+  previous frame was still writing re-entered stdout: `RuntimeError: reentrant
+  call inside <_io.BufferedWriter>`, and HX was gone. The redraw is handed to
+  the event loop now, and the burst collapses into one repaint.
+
+- `/resume` and `hx resume` bring the whole conversation back, not only its
+  text: the reasoning, tool calls, their output and the plan are drawn again.
+  A resumed session used to show a blank tinted bar for each tool result and
+  nothing at all for the calls themselves.
+
+---
+
+## [0.2.1] - 2026-09-14
+
+### Changed
+
+- Code blocks in a reply are drawn as a block - the code on a band of its own
+  colour, syntax highlighted, with the language named at the top - instead of
+  printing the ``` fences back out as text. Themes set the band with the new
+  `mdCodeBlockBg` role, and a theme that leaves colour to the terminal, as
+  `ansi` does, gets a rule above and below instead.
+
+### Fixed
+
+- The model's reasoning is shown again. It was collapsed to a bare `Thinking…`
+  with no key wired to open it, so the text never reached the screen. `ctrl+o`
+  now folds and unfolds it, the same key that expands a tool call.
+
+---
+
+## [0.2.0] - 2026-09-14
+
+### Changed
+
+- The interface is drawn into your terminal's own scrollback instead of taking
+  over the screen. Finished output belongs to the terminal: scroll it, select
+  it with the mouse, copy it, pipe it, and it is still there after HX exits.
+  `/fullscreen` takes the whole window back for anyone who preferred it that
+  way - the prompt pinned to the bottom row, the transcript scrolling above it
+  with `pgup`, `pgdn`, `ctrl+home` and `ctrl+end` - and writes the choice to
+  `tui.fullscreen` for the next session. On either screen the prompt and the
+  status bar sit on the bottom row from the first frame - a conversation that
+  does not fill the window is padded above the dock, not below it, and rows a
+  closing picker gives back open above it too. The slash-command and `@`-path
+  completion lists draw above the prompt for the same reason: under it, every
+  keystroke that changed the number of matches moved the prompt and the status
+  bar with it. Exiting erases the whole interface - banner, conversation and
+  dock - and puts the shell prompt back on the row HX started on, rather than
+  leaving a dead prompt box and a status bar on screen above it, from either
+  screen: quitting out of `/fullscreen` also takes away the frame that was
+  parked underneath it.
+- Approving a tool call is now a framed prompt with one option per line, each
+  saying what it does - `always allow` states that it writes a rule to
+  `.hx/settings.local.json`. `y`/`s`/`a`/`n` still answer in one keystroke,
+  `esc` denies, and the arrow keys work for anyone who wants to read first.
+  The command shown is the one that will run, `$` and all. When two subagents
+  stop at an approval at once, the older one holds the keyboard and the other
+  says it is waiting rather than offering keys that would answer the first.
+- Your theme reaches the whole interface. Links, list bullets, block quotes,
+  horizontal rules and inline code in the model's replies now follow the
+  palette instead of a hard-coded set of colours, and headings are visibly
+  different from each other.
+- Multi-line output from `/help`, `/cost`, `/status` and the rest lines up
+  under its own first line instead of at two different indents.
+- The todo list is a block in the conversation rather than a sidebar, and
+  `/todos` and `ctrl+t` show it. A scrollback-native interface has no second
+  column to put a sidebar in.
+- Mouse selection is the terminal's, across the whole session including what
+  has scrolled off, rather than HX's own within the visible screen.
+- Text HX did not write - a file a tool read, a command's output, the model's
+  reply, a paste into the prompt - is drawn as plain text. Escape sequences in
+  it are removed rather than sent on to your terminal, so a file cannot set
+  your clipboard, rename your window, hide a link behind different words, or
+  erase what is already on screen by being read.
+- `/clear` now clears the screen and the scrollback above it, instead of
+  emptying the transcript and leaving the last session on screen. Terminals
+  that do not implement scrollback erasure - macOS Terminal.app - clear the
+  screen only.
+- `/model`, the command palette and every other picker are sized to the
+  terminal rather than to a fixed eight rows, so a tall window shows a long
+  list instead of leaving two thirds of itself empty.
+- `ctrl+z` suspends HX to the background and resuming redraws it; `ctrl+home`
+  and `ctrl+end` reach the ends of the conversation; `ctrl+_` undoes in the
+  prompt. All three were listed in `/help` and bound to nothing.
+- `ctrl+p` and `ctrl+l` are named in the hints line under the prompt, which is
+  where the keys a session offers are supposed to be discoverable.
+- A block drawn against the prompt no longer closes itself with a second rule,
+  which left a rule, a blank line and another rule under every picker and under
+  every approval. Whichever block ends up against the dock lets the dock's own
+  rule close it, and takes its own back as soon as something lands underneath.
+- The installer now opens with a terminal boot animation that draws and lights
+  the HX mark, with a clean static version for CI and redirected output.
+
+---
+
+## [0.1.9] - 2026-09-11
+
+### Changed
+
+- Project instructions live in `AGENTS.md`, the cross-agent standard, instead
+  of `HX.md`. A repo already carrying an `AGENTS.md` for another coding agent
+  is understood by HX with no extra file; `/init` writes one. `HX.md` and
+  `.hx/HX.md` are no longer read - rename yours.
+- Python 3.13 and 3.14 are supported in fact, not just by the `>=3.11` floor.
+  CI runs the suite on every supported minor, so installing on a current
+  interpreter is covered by a test run rather than by hope.
+
+### Fixed
+
+- `/model` lists the Codex models your ChatGPT account can actually run. HX
+  shipped a hard-coded pair — `gpt-5.3-codex` and its spark — that the backend
+  now refuses outright, so a paid subscription offered two models and both
+  failed. Signing in fetches the account's own list instead; `/models refresh`
+  asks again, and the last shipped list stands in when the fetch cannot happen.
+- A Codex model that the account is refused now says so in terms you can act
+  on. The backend answers with a 400 naming the model, which reads as a bad
+  model id. The message now says entitlement is per model and per account, and
+  points at `/models refresh` to get the list that is true for your account.
+- `hx auth` names the plan behind a ChatGPT login (`signed in (plus)`), and
+  `/login` says when it is a free one, since Codex is documented as needing a
+  paid plan. Neither blocks a model: entitlement is per model, and the fetched
+  catalogue is what decides it, so HX reports the plan and lets the backend
+  answer.
+- `/model` says what pays for each model. Subscription models showed
+  `$0.00/$0.00`, indistinguishable from a free OpenRouter one; they now read
+  `subscription`. The status bar tags them too — `gpt-5.6-terra (sub)`.
+- `/resume` counts prompts, not wire-format records. A session you sent one
+  prompt to listed as "31 msgs"; it now reads `1 prompt · 31 msgs`, and `/cost`
+  says "17 API requests across 1 prompt" so the two numbers reconcile.
+- The status bar follows the branch. It read `git HEAD` once at startup, so
+  checking out in an IDE or another terminal left it showing a branch you had
+  left; it now re-reads on a timer, worktrees included.
+- Selecting assistant prose or a tool block with the mouse copies it. Textual
+  can only extract text from widgets that render plain text, so dragging over
+  those blocks highlighted them and copied nothing.
+- Copying goes through `pbcopy`/`wl-copy`/`xclip` before OSC 52. Textual's own
+  copy is OSC 52 only, which macOS Terminal ignores and iTerm2 ships disabled,
+  so `ctrl+c` on a selection silently did nothing there.
+- The prompt names the steer key the way your keyboard does. It read
+  `alt+enter` everywhere, while `/help` two keystrokes away read `option+enter`
+  on macOS - the same key, spelled two ways in one window. It now comes from
+  the keybinding registry, so it follows the platform and follows a rebind.
+- `ctrl+c` reaches the copy at all. The prompt holds focus for the whole session
+  and binds that key itself, so a transcript selection was never what it
+  copied. It now copies the selection when there is one, and clears the prompt
+  when there is not, exactly as before.
+
+### Added
+
+- `models.codex_models` in settings adds Codex model ids to the `/model`
+  picker, on top of the ones fetched for your account — for an id the backend
+  serves but does not advertise, or a machine that cannot reach it.
+  `{"models": {"codex_models": ["gpt-5.6-terra"]}}` adds your own.
+- `/effort` picks how hard the current model thinks, from the levels that model
+  actually offers, and the status bar shows the depth in force next to the
+  model — `gpt-5.6-terra (sub) · high`. It applies to the next turn and is
+  saved for later sessions. Switching models re-resolves it, so a choice the
+  new model cannot reach shows as the depth it will really run at.
+- `models.reasoning_effort` sets how hard a reasoning model thinks —
+  `none` through `ultra`. Left unset, each Codex model runs at the default its
+  own catalogue entry names (`low` on GPT-6 Astra, `medium` on GPT-5.6 Terra)
+  instead of one fixed depth for every model. A value is clamped to what the
+  chosen model advertises, so `max` runs at `xhigh` on GPT-5.5 rather than
+  being refused.
+- `/mouse [on|off]` hands drag-selection back to your terminal, for when you
+  want its own selection rather than HX's. Holding alt/option while dragging
+  does the same thing without the toggle.
+
+### Changed
+
+- "Always allow" grants move out of your repository. They were written to
+  `./.hx/settings.local.json`, with a `./.hx/.gitignore` added to hide them —
+  two files of HX's in your checkout. They now live in
+  `~/.hx/projects/<project>/settings.local.json`, still scoped to the project,
+  and an existing local file is migrated on the next run.
+- Grants that much older versions appended to `./.hx/settings.json` — the file
+  a project checks in — are lifted into that same local file on the next run,
+  and HX says which ones it moved. Only `allow` moves; a project's `deny` and
+  `ask` stay shared. It happens once, so a rule you later write there by hand
+  is left alone, and an emptied `./.hx` is removed.
+- HX no longer rewrites `./.hx/settings.json` at all. Its one remaining writer
+  there, the startup pass that widens stale whole-command rules, now reports
+  them and leaves the file to its owner.
+
+---
+
+## [0.1.8] - 2026-09-10
+
+### Fixed
+
+- Publishes everything listed under 0.1.7. That tag was cut but never shipped:
+  a type annotation on the transcript's pending-approval list failed the lint
+  job, so the release build stopped before it reached PyPI. `hx upgrade` moves
+  from 0.1.6 straight to here.
+
+---
+
+## [0.1.7] - 2026-09-10
+
+### Added
+
+- **Steer a running turn.** `alt+enter` pushes a message into the turn already
+  in flight: the model call is cut off mid-stream and the next one starts from
+  what you just said. Tools already running are left to finish, so nothing is
+  half-written. With an empty prompt it steers the front of the queue, so a
+  correction you already queued need not be retyped. `/queue` lists what is
+  waiting, `/queue steer <n>` sends one now, `/queue clear` drops them, and the
+  status bar shows the depth. Set `tui.enterWhileBusy` to `"steer"` to swap the
+  two keys.
+- **Sessions are renamed as they close.** The name written after the first
+  exchange described an opening question; `/resume` now lists what the session
+  turned into. Also on `/clear` and `/resume`, which leave a session behind.
+
+### Changed
+
+- **Approvals happen in the transcript, not in a modal.** The permission prompt
+  is now a block at the end of the conversation, directly under the sentence
+  where the model said what it intended to do. It takes the keyboard while it is
+  unanswered (`y` / `s` / `a` / `n`, `v` for the rest of a clipped diff), and
+  answering collapses it into a one-line record of what was granted and how
+  widely, so a session shows every rule it accumulated.
+- **More commands are recognised as read-only, and fewer are taken on trust.**
+  The allowlist that skips the prompt entirely grew from roughly thirty entries
+  to a hundred - digests, `ps`, `readlink`, most text filters, and the read-only
+  half of `git` (`rev-parse`, `ls-files`, `cat-file`, `stash list`, and the
+  rest). Arguments now decide alongside the name: `sed -i`, `find -exec`,
+  `sort -o`, `yq -i`, `git branch -D`, an `awk` program that calls `system()`,
+  and `git -c core.pager=…` all still ask. Review it if you run HX on anything
+  you would not hand a shell.
+- **"Always allow" writes to `.hx/settings.local.json`.** Grants no longer land
+  in `.hx/settings.json`, the file a project checks in - one machine's absolute
+  paths were being committed to everyone who cloned the repo. The new layer sits
+  above project settings, and HX adds a `.hx/.gitignore` covering it. Existing
+  rules in either file keep working.
+
+### Fixed
+
+- **`/login` no longer strands you in a dead modal.** The sign-in screen was
+  driven before it had finished mounting, so the flow died on its first call and
+  left a prompt that took keystrokes and ignored Enter. Opening the browser and
+  tearing down the loopback listener also ran on the event loop, freezing the
+  TUI - including the Escape that would have cancelled.
+- Text alongside tool results reaches the model on OpenRouter-shaped routes
+  instead of being silently dropped.
+
+---
+
+## [0.1.6] - 2026-09-10
+
+### Added
+
+- **Web search, over Tavily.** `WebSearch` returns ranked results with a
+  snippet each; `WebFetch` reads up to 5 URLs as markdown. Both are registered
+  only when a key resolves, so HX without one is unchanged and pays no
+  cached-prefix cost for a tool that would always fail. Set the key with
+  `hx auth set tavily`, or `TAVILY_API_KEY` / `HX_TAVILY_API_KEY` in the
+  environment. Credits spent are reported per call and per session.
+- **Corporate TLS support.** Certificates verify against the operating
+  system's trust store, `HX_CA_BUNDLE` (also `SSL_CERT_FILE`,
+  `REQUESTS_CA_BUNDLE`) names a CA file, and `HX_SSL_NO_VERIFY=1` turns
+  verification off with a warning every session. A TLS failure is now named in
+  one line at startup and in `/model` instead of showing up as an empty model
+  catalogue with no cause.
+- **Working-tree notices.** The git branch and files that changed on disk
+  outside the session are late-injected onto the newest user message, from one
+  `git status --porcelain=v2 --branch -z` per provider call, run in a worker
+  thread so it never blocks the UI. Off with
+  `"context": {"git_notices": false}` or `HX_GIT_NOTICES=0`.
+- **File checkpoints.** Write and Edit park a file's previous bytes in a
+  content-addressed store under the session directory, keyed to the position in
+  the transcript, so a rewind can undo edits and not just words. A file whose
+  bytes moved since HX wrote them is reported and left alone rather than
+  overwritten.
+- **`hx docs` and `hx changelog`.** The manual and this file, printed from the
+  installed package. `hx docs` with no argument lists the sections;
+  `hx docs credentials` prints one. `hx changelog 0.1.5` prints one release.
+  The system prompt points at both, so questions about HX itself are answered
+  from the shipped documentation.
+
+### Changed
+
+- The model catalogue keeps the last good copy when a refresh fails, and
+  records why it failed so `/model` can say so. The static routes (the Codex
+  models) are registered even when there is no cache file and no network.
+
+---
+
+## [0.1.5] - 2026-09-09
+
+### Added
+
+- **A ChatGPT Plus/Pro route.** Sign in with `hx auth login openai-codex` (or
+  `/login` in the TUI) and run `openai-codex/gpt-5.3-codex` against your
+  subscription instead of paying per token. OAuth with PKCE against
+  `auth.openai.com`, a loopback listener on port 1455, a paste-the-URL fallback
+  for SSH and `HX_LOGIN_DEVICE_CODE=1` for the device-code flow; access tokens
+  refresh themselves.
+- Credentials became one store per route in `~/.hx/auth.json` (mode 0600).
+  `hx auth` reports which routes have a credential and where it came from, and
+  `hx auth logout <provider>` forgets one.
+- `/model` offers only routes you are actually signed in to, so the picker
+  cannot select a model the session has no way to reach.
+
+The route serving a turn is decided by the model id alone: `openai-codex/*`
+goes to the subscription, everything else to OpenRouter.
+
+---
+
+## [0.1.4] - 2026-09-09
+
+### Fixed
+
+- TUI snapshot tests no longer embed the release version, so bumping the
+  version stopped failing the suite.
+
+---
+
+## [0.1.3] - 2026-09-09
+
+### Fixed
+
+- An exact slash command runs on the first `enter` instead of only selecting
+  itself in the completion list.
+
+---
+
+## [0.1.2] - 2026-09-09
+
+### Added
+
+- **Themes as data.** A theme is a JSON file - a `vars` block of colours and a
+  `colors` block mapping semantic roles onto them. Drop one in
+  `~/.hx/themes/mine.json` and `/theme mine` picks it up, no restart. Syntax
+  highlighting is theme-driven, and pi's theme files load unchanged.
+- **One keybinding registry.** Every key is defined once in `src/hx/keys.py`;
+  `/help`, the hints line and the README table all read from it, and any action
+  id can be rebound in `~/.hx/keybindings.json`. Conflicts and unknown ids are
+  reported at startup rather than silently resolved.
+- **A completion popup** above the prompt for `/` commands and `@` paths, with
+  fuzzy matching; `tab` cycles, `enter` accepts, `esc` dismisses.
+- **A readline-style prompt** with a kill ring (`ctrl+w`, `ctrl+u`, `ctrl+k`,
+  `ctrl+y`, `alt+y`), undo and redo.
+- **System clipboard support.** `ctrl+x` copies the selected message and
+  `/copy` the last reply, through `pbcopy`/`wl-copy`/`xclip`/`xsel` with an
+  OSC 52 fallback that also works over SSH.
+- The prompt is framed and the working status lives in its border.
+- `/exit` as an alias for `/quit`.
+
+### Fixed
+
+- Permission grants stay inside what the user actually approved.
+- A `/model` choice persists to user settings.
+- Slash commands run in a worker, so a slow one no longer blocks the UI.
+
+---
+
+## [0.1.0] - 2026-09-08
+
+First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/).
+
+### Added
+
+- **The agent loop**, streaming from OpenRouter with prefix caching, accurate
+  per-turn cost accounting and a stable request prefix.
+- **The tool suite**: Bash (with a background job runner), Read, Write, Edit,
+  Glob, Grep, TodoWrite and Task, with output capping that keeps the head and
+  tail of a large result and spills the rest to the session directory.
+- **The permission engine and OS sandbox.** `Tool(specifier)` rules where deny
+  beats ask beats allow, shell commands decomposed into their real segments
+  first, and Seatbelt on macOS / bubblewrap on Linux confining writes and
+  network. Modes cycle with `shift+tab`: `plan`, `default`, `acceptEdits`,
+  `bypass`.
+- **Context engineering**: late injection for per-turn state, compaction at 80%
+  of the window (or `/compact [focus]`), and cache breakpoints that only
+  advance once enough tokens have accumulated.
+- **Sessions**: persisted transcripts, `hx resume` / `/resume`, and a model-named
+  session title you can change with `/title`.
+- **Skills, subagents and MCP.** Skills are `SKILL.md` directories under
+  `.hx/skills/` or `~/.hx/skills/`, loaded on demand so a hundred installed
+  skills cost a hundred lines. Subagents (`explore`, `plan`, `general`, plus
+  your own in `.hx/agents/`) run in their own context and return one report.
+  MCP servers go in `.hx/mcp.json` or `hx mcp add`.
+- **The TUI**: transcript, status bar with token, cache and cost counters, todo
+  sidebar, model picker, command palette and per-tool renderers.
+- **Print mode** (`hx -p`), where stdout carries only the assistant's text, so
+  it pipes.
+- **Configuration** merged from defaults, `~/.hx/settings.json`,
+  `./.hx/settings.json`, `HX_*` environment variables and CLI flags, with
+  permission lists and prompt appends unioned rather than replaced.
+- `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
+  self-update, and `install.sh` bootstrapping uv with a pinned Python.
+
+[Unreleased]: https://github.com/aletisunil/hx/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/aletisunil/hx/compare/v0.3.0-beta.1...v1.0.0
+[0.3.0-beta.1]: https://github.com/aletisunil/hx/compare/v0.2.20...v0.3.0-beta.1
+[0.2.20]: https://github.com/aletisunil/hx/compare/v0.2.19...v0.2.20
+[0.2.19]: https://github.com/aletisunil/hx/compare/v0.2.18...v0.2.19
+[0.2.18]: https://github.com/aletisunil/hx/compare/v0.2.17...v0.2.18
+[0.2.17]: https://github.com/aletisunil/hx/compare/v0.2.16...v0.2.17
+[0.2.16]: https://github.com/aletisunil/hx/compare/v0.2.15...v0.2.16
+[0.2.15]: https://github.com/aletisunil/hx/compare/v0.2.14...v0.2.15
+[0.2.14]: https://github.com/aletisunil/hx/compare/v0.2.13...v0.2.14
+[0.2.13]: https://github.com/aletisunil/hx/compare/v0.2.12...v0.2.13
+[0.2.12]: https://github.com/aletisunil/hx/compare/v0.2.11...v0.2.12
+[0.2.11]: https://github.com/aletisunil/hx/compare/v0.2.10...v0.2.11
+[0.2.10]: https://github.com/aletisunil/hx/compare/v0.2.9...v0.2.10
+[0.2.9]: https://github.com/aletisunil/hx/compare/v0.2.8...v0.2.9
+[0.2.8]: https://github.com/aletisunil/hx/compare/v0.2.7...v0.2.8
+[0.2.7]: https://github.com/aletisunil/hx/compare/v0.2.6...v0.2.7
+[0.2.6]: https://github.com/aletisunil/hx/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/aletisunil/hx/compare/v0.2.4...v0.2.5
+[0.2.4]: https://github.com/aletisunil/hx/compare/v0.2.3...v0.2.4
+[0.2.3]: https://github.com/aletisunil/hx/compare/v0.2.2...v0.2.3
+[0.2.2]: https://github.com/aletisunil/hx/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/aletisunil/hx/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/aletisunil/hx/compare/v0.1.9...v0.2.0
+[0.1.9]: https://github.com/aletisunil/hx/compare/v0.1.8...v0.1.9
+[0.1.8]: https://github.com/aletisunil/hx/compare/v0.1.7...v0.1.8
+[0.1.7]: https://github.com/aletisunil/hx/compare/v0.1.6...v0.1.7
+[0.1.6]: https://github.com/aletisunil/hx/compare/v0.1.5...v0.1.6
+[0.1.5]: https://github.com/aletisunil/hx/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/aletisunil/hx/compare/v0.1.3...v0.1.4
+[0.1.3]: https://github.com/aletisunil/hx/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/aletisunil/hx/compare/v0.1.0...v0.1.2
+[0.1.0]: https://github.com/aletisunil/hx/releases/tag/v0.1.0