@visual-z/xeno 0.13.1 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # xeno changelog
 
+## 0.14.0 — 2026-11-14
+
+Commands (breaking):
+- The slash command list is reorganized: 24 commands are listed, in six groups (Session, Model, Work, Inspect, Knowledge, System), down from 49. The other names are no longer listed but still work exactly as before when typed: `/usage`, `/context`, `/state` and `/control` are under the new `/status`; `/name`, `/export`, `/import`, `/clone` and `/copy` under `/session`; `/thinking`, `/scoped-models` and `/models` under `/model`; `/login` and `/logout` under `/provider`; `/config`, `/trust` and `/reload` under `/settings`; `/hotkeys`, `/changelog` and `/debug` under `/help`; `/branches` and `/processes` under `/tasks`; `/accept` and `/acceptance` under `/goal`; `/exit` under `/quit`. Typing an old name shows where it now lives, and many can also be written as a sub-command, such as `/settings reload`.
+- In the `/` list, Tab completes the command name and shows its arguments; Enter runs it. Tab no longer runs a command.
+- Bare `/session` and `/status` open a menu instead of printing details. The `/model` picker, provider and settings pickers and the `/goal` menu reach the commands folded into them.
+- The `/` menu is grouped by purpose when nothing is typed, shows each command's arguments and whether Enter runs it, opens a picker or opens a menu, scrolls past ten rows, and ends with a key hint. `/help` in the TUI opens the same list as a dialog.
+- Completion acts on the word under the cursor, including after cursor moves, mouse clicks and wide characters, and running a command from the palette keeps the draft.
+
+Look (breaking for the default colour):
+- The first frame is drawn in the terminal's colours: xeno remembers the palette each terminal last reported in `~/.xeno/terminal-palette.json` and repaints once only if the terminal now answers differently. Startup no longer waits about 300 ms for colours.
+- The default accent is a new xenon blue-violet, adjusted for contrast against your terminal's background. Set `accent: terminal` to get the terminal's ANSI blue back. Reasoning text uses the muted colour and inline code a tint toward the accent. Backgrounds are never painted; green, red and yellow mark only glyphs.
+- The transcript hangs on one vertical line. Each tool call is a row with a dotted leader to its result (exit code, counts, duration, lines changed); a context segment change is drawn as a cut with what the handoff carried; each finished turn ends with a stamp saying how it ended and how many receipts covered the changes. Tool and turn durations come from the logged times.
+- The input box shows what is happening on its top edge (running, quiet for a while, awaiting approval, accepted, retrying) and no longer says Ready when idle; the model and reasoning level sit at bottom left, mode, approval and segment use at bottom right. The sidebar has no border and four sections: Goal, Context, Files, Usage. At 80–109 columns the top bar is one line.
+- The mascot is redrawn and moves only when something happens: it blinks, watches the input while you type, perks up when the `/` menu opens, startles on errors and sleeps when the window loses focus. It stays still with animation turned off. The greeting adds a "last here" row for the previous session.
+
+Context:
+- When a request has finished and the context already holds more than half of the usable window, or 128k tokens, whichever is smaller, the next request starts a new segment, so finished work no longer rides along in every later request. Interruptions, "continue" after a failure, interjections and running goals do not trigger it.
+- For models billed at a higher rate past a context length (gpt-5.5-pro and gpt-5.4-pro at 272k, Gemini 3.1 Pro and grok-4.x at 200k), the usable window stops at that line. A larger window you set yourself is still used, and xeno says the rest is billed at the higher rate.
+- When a handoff is too long, it keeps the most recently touched files, gates, branches and processes instead of the alphabetically last ones.
+
+Tools:
+- `grep` uses ripgrep under permission rules too, over the files the rules admit, so it is no longer much slower than `rg` in the shell.
+- Empty optional arguments count as not provided, so models that fill every field no longer fail `write`, `history` and `note`.
+- A plain nonzero exit shows only its header and output, without a generic diagnostic.
+- A test run written as `cd x && set -o pipefail; cargo test | tail` counts as verification. Commands that could exit 0 without the gate running, such as `exit 0 && bun test`, no longer count.
+- The completion check asks for verification only for net changes inside the workspace that a gate could check; reverted, outside, ignored and document edits no longer trigger it. Verification works in large repositories by reading Git's index; receipts recorded by earlier versions are stale until the command is run again.
+- Escaped Ctrl-C (`\u0003`, `^C`) sent to a process interrupts it; background jobs a command leaves behind are named when they are stopped; a managed process that exits while nobody watches is announced before the next model request.
+- A batch of parallel calls shares a total display budget of four single calls, so up to four parallel reads come back whole. A cut-off read says where to continue.
+- Memory results are bounded and say when nothing matched; `read` can start from the end and `when` takes date ranges. A new memory `env` action answers environment questions (hosts, paths, tool versions) from facts that successful commands established, per project. Facts are not synced unless you turn them on with `/memory sync env-facts on`; the first scan after upgrading rereads xeno and Codex history once.
+- Credentials are judged by where text came from: your messages are hidden more readily (camel-case keys, "host user password" written together), while tool output keeps identifiers and code.
+- `/usage` warns when a provider route drops the model's reasoning between requests.
+- An interrupted model request records how long it waited, how many attempts it made and whether a response had started.
+
+Web:
+- `websearch` sends one request per query, reports rate limits and missing keys as such, retries once when no result can have arrived, accepts other tools' argument names (and says when it renamed one) and returns shorter highlights.
+- `webfetch` is in the default coding tools, reads long pages in windows continued from the saved page, keeps only the main content and says plainly when a page needs JavaScript or shows a bot challenge.
+- `webfetch` refuses loopback, private, link-local, `.local`, `.internal` and dot-less hosts, checked after DNS resolution and on every redirect, unless a permission rule with the new `host` selector names the host. A `no_proxy` entry written as a host name may no longer match, because the connection now goes to the checked address.
+
+Computer on macOS:
+- `fill` sets pop-up menus and checkboxes; clicking a text field puts the caret there; ordinary keys are accepted.
+- A step can name its control, and a sequence can follow the app across windows, so dismissing a dialog, filling a form and submitting is one call.
+- A sequence reads the window once before and once after, element handles stay valid while their window is unchanged, and screenshots nobody will see are skipped.
+- Opening and closing windows, alert sheets and a locked screen give results the agent can continue from. Results show each fact once.
+
+Models and usage:
+- DeepSeek's vendor-verified peak prices are kept when a refreshed model directory lists the off-peak price.
+
+Compatibility: logs written by 0.14.0 can contain a process exit reason `exited` and a segment cut reason `request_boundary`, which earlier versions reject; earlier versions skip `env_fact` memory records and rebuild a 0.14.0 handoff once in their own order.
+
+## 0.13.2 — 2026-11-05
+
+- Skills with descriptive `version` and `argument-hint` fields now load without startup warnings. Unsupported execution fields still report errors instead of being silently ignored.
+- Trusted global installs on Windows register the actual npm/Bun bin directory in the user PATH without replacing existing entries. Reopen your terminal application afterward. Bun update commands now include `--trust` so native installation is not skipped; failed native placement on Windows reports an installation error.
+
 ## 0.13.1 — 2026-11-02
 
 Models:

package/README.md

@@ -22,7 +22,19 @@ bun add -g --trust @visual-z/xeno
 ```
 
 Without `--trust`, `xeno` still starts on macOS and Linux through a small
-launcher script.
+launcher script. Windows requires `--trust` so the native executable is placed.
+
+On Windows, the global install step adds the actual global bin directory to
+your user PATH when needed. Close and reopen the terminal application after
+installing; already-running shells keep their old environment. Local project
+installs do not change PATH. If scripts were skipped, reinstall with
+`bun add -g --trust --force @visual-z/xeno`. To use the current PowerShell too:
+
+```powershell
+$xenoBin = (bun pm bin -g).Trim()
+$env:Path = "$xenoBin;$env:Path"
+xeno --version
+```
 
 ## Start
 

package/install.cjs

@@ -9,13 +9,13 @@
 //
 // If this never runs (`bun add -g` skips dependency scripts unless trusted),
 // the placeholder is itself a POSIX sh launcher that finds the same binary.
-// A failure here never fails the install: the placeholder still works.
+// The placeholder works only on POSIX. Windows must finish native placement.
 //
 // PLATFORMS must match scripts/binary-targets.ts; test/binary-release.test.ts
 // enforces that.
 
 const { spawnSync } = require("child_process");
-const { copyFileSync, existsSync, linkSync, renameSync, unlinkSync, chmodSync } = require("fs");
+const { copyFileSync, existsSync, linkSync, renameSync, unlinkSync, chmodSync, readFileSync, realpathSync } = require("fs");
 const { arch } = require("os");
 const path = require("path");
 
@@ -62,10 +62,119 @@ function place(source, dest) {
   if (process.platform !== "win32") chmodSync(dest, 0o755);
 }
 
+function windowsPathKey(value, env) {
+  const expanded = value.trim().replace(/^"(.*)"$/, "$1").replace(/%([^%]+)%/g, (token, name) => {
+    const key = Object.keys(env).find(key => key.toLowerCase() === name.toLowerCase());
+    return key === undefined ? token : env[key];
+  });
+  return path.win32.isAbsolute(expanded) ? path.win32.normalize(expanded).replace(/[\\/]+$/, "").toLowerCase() : "";
+}
+
+// Preserve the stored PATH bytes and order; normalization is for comparison only.
+function updatedWindowsPath(user, machine, bin, env, userKind = "ExpandString", machineKind = "ExpandString") {
+  if (!path.win32.isAbsolute(bin) || /[;"\r\n\0]/.test(bin)) throw Error("The global bin is not a valid absolute PATH entry");
+  const target = windowsPathKey(bin, env);
+  if ([[user, userKind], [machine, machineKind]].some(([value, kind]) => value.split(";").some(entry => windowsPathKey(entry, kind === "ExpandString" ? env : {}) === target))) return null;
+  return user + (user && !user.endsWith(";") ? ";" : "") + bin;
+}
+
+function installQuery(program, args) {
+  const result = spawnSync(program, args, { encoding: "utf8", windowsHide: true, timeout: 10000,
+    env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" } });
+  if (result.error || result.status !== 0) throw Error(`Could not query ${args.join(" ")} for the global PATH directory`);
+  return result.stdout.trim();
+}
+
+function windowsGlobalBin() {
+  const env = process.env;
+  const executable = env.npm_execpath;
+  const bun = executable && /^bun(?:\.exe)?$/i.test(path.win32.basename(executable));
+  const owns = root => windowsPathKey(__dirname, env) === windowsPathKey(path.win32.join(root, "node_modules", "@visual-z", "xeno"), env);
+  if (!bun && env.npm_config_global === "true") {
+    const prefix = env.npm_config_prefix;
+    if (!prefix || !path.win32.isAbsolute(prefix) || !owns(prefix)) return null;
+    return prefix; // npm's Windows shims live directly in the global prefix.
+  }
+  if (!bun) return null;
+  // Bun has no global-install flag in lifecycle env and no lockfile yet on a
+  // fresh install. Prove ownership from the already-linked global command.
+  const bin = installQuery(executable, ["pm", "bin", "-g"]);
+  if (!path.win32.isAbsolute(bin) || /[;"\r\n\0]/.test(bin)) throw Error("Invalid Bun global bin directory for PATH setup");
+  const shim = path.win32.join(bin, "xeno.bunx");
+  if (!existsSync(shim)) return null;
+  // Bun's BinLinkingShim format starts with a UTF-16 path followed by quote/NUL.
+  // bin.zig removes the first '..\\'; resolve from the global bin's parent.
+  // Sources: Bun v1.2.17 BinLinkingShim.zig and v1.4.3 BinLinkingShim.rs,
+  // both in src/install/windows-shim; their v5 path prefix is unchanged.
+  const bytes = readFileSync(shim);
+  const header = bytes.toString("utf16le"), end = header.indexOf('"\0');
+  if (bytes.length % 2 !== 0 || end <= 0) throw Error("Unrecognized Bun command shim; could not verify the global PATH target");
+  const target = path.win32.resolve(bin, "..", header.slice(0, end));
+  return windowsPathKey(realpathSync(target), env) === windowsPathKey(realpathSync(path.win32.join(__dirname, "bin", "xeno.exe")), env) ? bin : null;
+}
+
+const READ_WINDOWS_PATH = `
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
+$userKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment')
+$machineKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment')
+try {
+  $user = if ($userKey) { $userKey.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) } else { '' }
+  $kind = if ($userKey -and $userKey.GetValueNames() -contains 'Path') { $userKey.GetValueKind('Path').ToString() } else { 'String' }
+  $machine = if ($machineKey) { $machineKey.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) } else { '' }
+  $machineKind = if ($machineKey -and $machineKey.GetValueNames() -contains 'Path') { $machineKey.GetValueKind('Path').ToString() } else { 'String' }
+  @{ user = [string]$user; kind = $kind; machine = [string]$machine; machineKind = $machineKind } | ConvertTo-Json -Compress
+} finally {
+  if ($userKey) { $userKey.Dispose() }
+  if ($machineKey) { $machineKey.Dispose() }
+}
+`;
+
+const WRITE_WINDOWS_PATH = `
+$ErrorActionPreference = 'Stop'
+$update = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([Console]::In.ReadToEnd().Trim())) | ConvertFrom-Json
+$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+try {
+  $before = [string]$key.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+  $kind = if ($key.GetValueNames() -contains 'Path') { $key.GetValueKind('Path').ToString() } else { 'String' }
+  if ($before -cne $update.before -or $kind -cne $update.kind) { throw 'User PATH changed during installation; retry the install.' }
+  $key.SetValue('Path', [string]$update.after, [Microsoft.Win32.RegistryValueKind]$kind)
+  if ([string]$key.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames) -cne $update.after) { throw 'User PATH readback did not match.' }
+} finally { $key.Dispose() }
+# Notify Explorer so newly launched terminal hosts inherit the changed environment.
+# Existing terminals must restart even if notification cannot be delivered.
+try {
+  Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public static class XenoEnvironment { [DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern IntPtr SendMessageTimeout(IntPtr window, uint message, UIntPtr wparam, string lparam, uint flags, uint timeout, out UIntPtr result); }'
+  $result = [UIntPtr]::Zero
+  [void][XenoEnvironment]::SendMessageTimeout([IntPtr]65535, 26, [UIntPtr]::Zero, 'Environment', 2, 2000, [ref]$result)
+} catch { Write-Warning 'PATH saved. Sign out and back in if restarting your terminal does not pick it up.' }
+`;
+
+function configureWindowsPath() {
+  const bin = windowsGlobalBin();
+  if (bin === null) return;
+  const powershell = path.win32.join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const run = (script, input) => {
+    const result = spawnSync(powershell, ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")],
+      { encoding: "utf8", windowsHide: true, timeout: 15000, ...(input === undefined ? {} : { input }) });
+    if (result.error || result.status !== 0) throw Error("Could not read or update the Windows user PATH; check your environment settings and retry");
+    return result.stdout;
+  };
+  const state = JSON.parse(run(READ_WINDOWS_PATH));
+  if (typeof state.user !== "string" || typeof state.machine !== "string" || ![state.kind, state.machineKind].every(kind => ["String", "ExpandString"].includes(kind))) throw Error("Unexpected Windows PATH registry value");
+  const after = updatedWindowsPath(state.user, state.machine, bin, process.env, state.kind, state.machineKind);
+  if (after === null) return;
+  // Data travels through stdin, never PowerShell source or the command line:
+  // Unicode, quotes and long PATHs cannot become code or exceed argv limits.
+  run(WRITE_WINDOWS_PATH, Buffer.from(JSON.stringify({ before: state.user, after, kind: state.kind }), "utf8").toString("base64"));
+  console.log(`[xeno postinstall] Added ${bin} to your user PATH. Close and reopen your terminal application to run xeno.`);
+}
+
 function main() {
   const key = platformKey(), info = PLATFORMS[key];
   if (!info) {
     console.error(`[xeno postinstall] Unsupported platform: ${key}. Supported: ${Object.keys(PLATFORMS).join(", ")}`);
+    if (process.platform === "win32") process.exitCode = 1;
     return;
   }
   let dir;
@@ -73,6 +182,7 @@ function main() {
   catch {
     console.error(`[xeno postinstall] ${info.pkg} is not installed (--omit=optional, or its download failed).`);
     console.error("  Reinstall @visual-z/xeno to fetch it.");
+    if (process.platform === "win32") process.exitCode = 1;
     return;
   }
   try {
@@ -80,9 +190,17 @@ function main() {
     if (existsSync(path.join(dir, WASM))) place(path.join(dir, WASM), path.join(__dirname, "bin", WASM));
   } catch (error) {
     console.error(`[xeno postinstall] Could not place the binary: ${error.message}`);
-    console.error("  xeno still starts through its launcher, one process slower.");
+    if (process.platform === "win32") {
+      console.error("  Reinstall with npm i -g @visual-z/xeno or bun add -g --trust @visual-z/xeno. Windows requires the native binary.");
+      process.exitCode = 1;
+    } else console.error("  xeno still starts through its launcher, one process slower.");
+    return;
+  }
+  if (process.platform === "win32") {
+    try { configureWindowsPath(); }
+    catch (error) { console.error(`[xeno postinstall] PATH setup failed: ${error.message}`); }
   }
 }
 
 if (require.main === module) main();
-module.exports = { PLATFORMS, platformKey };
+module.exports = { PLATFORMS, platformKey, updatedWindowsPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "license": "UNLICENSED",
   "description": "Segmented append-only agent log with pure context and handoff projections",
   "bin": {
@@ -10,14 +10,14 @@
     "postinstall": "node install.cjs"
   },
   "optionalDependencies": {
-    "@visual-z/xeno-darwin-arm64": "0.13.1",
-    "@visual-z/xeno-darwin-x64": "0.13.1",
-    "@visual-z/xeno-linux-arm64": "0.13.1",
-    "@visual-z/xeno-linux-x64": "0.13.1",
-    "@visual-z/xeno-linux-arm64-musl": "0.13.1",
-    "@visual-z/xeno-linux-x64-musl": "0.13.1",
-    "@visual-z/xeno-win32-arm64": "0.13.1",
-    "@visual-z/xeno-win32-x64": "0.13.1"
+    "@visual-z/xeno-darwin-arm64": "0.14.0",
+    "@visual-z/xeno-darwin-x64": "0.14.0",
+    "@visual-z/xeno-linux-arm64": "0.14.0",
+    "@visual-z/xeno-linux-x64": "0.14.0",
+    "@visual-z/xeno-linux-arm64-musl": "0.14.0",
+    "@visual-z/xeno-linux-x64-musl": "0.14.0",
+    "@visual-z/xeno-win32-arm64": "0.14.0",
+    "@visual-z/xeno-win32-x64": "0.14.0"
   },
   "files": [
     "bin/xeno.exe",