apex-code 0.0.1-alpha.0 → 0.0.1-alpha.10

package/CHANGELOG.md

@@ -1,5 +1,476 @@
+# Apex Code changelog
+
+## [0.0.1-alpha.10] - 2026-08-28
+
+- Commits made inside a session now carry your identity. `--tmpfs /home` leaves git's global
+  config resolution pointing at an empty directory, so every fresh workspace failed with
+  `Author identity unknown` and the only cure was setting `user.name` and `user.email` by hand,
+  per repository, forever. The supervisor still sees the host home before the sandbox hides it,
+  so it reads those two keys there and projects a synthesized config read-only. Synthesized
+  rather than copied: a real `~/.gitconfig` can carry a `credential.helper` that runs a command
+  or an `insteadOf` rule holding a token, and projecting the file wholesale would hand both to
+  the child. Repository-scope config still wins inside the session, exactly as it would on the
+  host.
+
+- A request to a host the allowlist does not name now pauses and asks instead of failing.
+  Previously the allowlist was fixed when the session started, so a refused host was terminal:
+  the only remedy was to exit, edit global settings, and start again. Approving permits that one
+  host and nothing else for the rest of the session, is never written to settings, and declining
+  is not remembered -- a second attempt asks again, because a cached refusal is indistinguishable
+  to the user from the boundary having quietly stopped asking. Concurrent connections to the same
+  refused host raise one prompt rather than one each. Non-interactive modes (`--print`,
+  `--mode json`, `--mode rpc`) still deny without asking, now because the approver is only built
+  when a terminal exists rather than because of a mode check that could be forgotten.
+
+  The prompt is drawn by the supervisor and answered on its terminal, not by the session. That is
+  a security property rather than a presentation choice: the channel the child would ask over has
+  no peer authentication, so an approval asserted from inside the boundary would be
+  indistinguishable from one forged by a postinstall script or a git hook -- exactly the code the
+  boundary exists to contain. The session's only role is to stop drawing while the human answers.
+  See `docs/adr/0023-supervisor-owned-escalation-authority.md`.
+
+- `git push` works from inside a session, without a credential ever entering the workspace. A git
+  credential cannot be projected the way `auth.json` is, because it is not one file with a stable
+  shape -- it is whatever the host's configured helper answers per host, and reimplementing that
+  resolution in the child would be a second, quietly diverging copy of git's own. So the
+  credential stays on the host: the child runs a helper speaking git's ordinary protocol, and the
+  supervisor answers by running `git credential fill` in its own environment. What crosses the
+  boundary is the answer to one question about one host. The host must already be reachable by
+  the session, since git only asks after a server challenged it and a request for an unreachable
+  host is not git doing its job; and you must release it, once per host, for that session only.
+  Only reads are served, so the session still cannot rewrite your credential store.
+
+- A command the boundary refuses can now run once, with your approval, in a separate sandbox. A
+  refused write is refused by the kernel inside a namespace whose mounts are fixed for its
+  lifetime, so unlike a refused host there is nothing to hold open while a human decides. The
+  approved command therefore runs in a second child, and the session's own namespace is never
+  modified -- its next attempt at the same operation is refused exactly as before. Nothing is
+  remembered between commands, because a command is not a stable subject to grant against and a
+  remembered approval would silently cover the next one naming the same directory. See
+  `docs/adr/0024-per-command-sandbox-escalation.md`.
+
+- `--add-dir <path>` makes another directory writable, and `--sandbox danger-full-access` runs
+  with no OS boundary at all, announcing itself and asking for confirmation at a terminal. The
+  opt-out was deliberately withheld until now: shipping an escape hatch into a boundary that
+  could not be worked with would have made the hatch the ordinary way to use the product. With
+  identity, network escalation, and the credential channel in place, the reasons to reach for it
+  are gone. Neither flag can be set from project settings, so a repository cannot grant itself
+  either; and turning the sandbox off cannot come from settings of any scope, only from a flag
+  typed for that run.
+
+- `--permission-profile <name>` selects a saved combination of allowed hosts and writable roots
+  from global settings. It carries boundary inputs only -- it cannot express a permission mode,
+  because conflating the tool gate with the OS boundary is the misreading that makes
+  `bypassPermissions` look like a sandbox escape, and it cannot express "no boundary" either.
+  Unknown keys are ignored rather than rejected, so a profile written for a later version does
+  not break this one.
+
+- Two read-only files projected from the same host directory no longer hide each other. Each
+  projection laid a `tmpfs` over the file's parent, so a second one replaced the first and the
+  child got `ENOENT` for a file that was supposed to be there. Only one projection existed until
+  this release, which is why nothing had caught it; projections are now grouped so one `tmpfs`
+  per directory carries every file bound into it.
+
+- Documentation that contradicted itself is fixed. The README said `/share` uses your
+  authenticated GitHub CLI forty lines after saying the sandbox hides those credentials; the
+  roadmap listed interactive escalation as delivered Phase 2b scope while ADR 0005 deferred it;
+  and the user guide said the sandbox restricts writes and network "to what the permission layer
+  has allowed", which conflates two independent layers -- the boundary is fixed by the supervisor
+  before the gate ever runs.
+
+## [0.0.1-alpha.9] - 2026-08-28
+
+## [0.0.1-alpha.8] - 2026-08-27
+
+- Hardened the cross-platform sandbox regression suite: POSIX-only credential-channel lifecycle cases are skipped on Windows, dead-supervisor cleanup uses a genuinely exited process, and macOS session-lease assertions compare canonical paths.
+
+- Sandboxed credential writes now preserve the credential store's cross-process mutation
+  contract. The original channel read a credential in the child and later replaced it on
+  the host, so concurrent OAuth refreshes could derive from the same token and overwrite
+  each other. The supervisor now holds the host lock while the child callback decides the
+  mutation. First-run `/login` also creates and writes the canonical host `auth.json`
+  instead of silently saving under workspace sandbox state. The protocol validates roots
+  and credential shapes, uses byte and connection limits, keeps its socket in a private
+  directory, cleans up active clients and dead-supervisor socket artifacts, and never
+  includes a rejected secret in audit text.
+
+- A custom system prompt no longer throws away what the active tools contribute. Setting one,
+  with `--system-prompt` or a discovered `SYSTEM.md`, replaced the entire prompt: not only the
+  Apex-authored prose it is meant to replace, but also the Available tools list and every
+  guideline the registered tools and extensions add. A session started that way sent the model
+  a bare handful of lines, so guidance like preferring `grep` over `bash` for searching simply
+  never arrived, and the model had no prose inventory of its own tools. The replay harness had
+  been computing both and passing them alongside the custom prompt since it was written, which
+  is how the drop surfaced. A custom prompt now replaces the Apex-authored prose only. Tool
+  snippets, tool guidelines, project context, skills, and the working directory are all still
+  delivered, because none of them are the prompt's text to override. This adds about 237 tokens
+  to a custom-prompt session that registers the full tool set, and the enforced static-prefix
+  budget was re-measured accordingly.
+
+- `web_search` snippets now end on a whole word. The truncation budget cut at an exact
+  character count, so a long highlight could end "specificatio" -- which reads as
+  corruption rather than as a limit. The trim now backs up to the last word boundary
+  inside the budget; a snippet whose first word alone exceeds the budget still cuts
+  hard, because an intact fragment beats an empty one.
+
+- The suite harness now scrubs every provider credential variable the registry reads,
+  not only the `*_API_KEY`-shaped ones. Regression `7209` broke on a `GEMINI_API_KEY`,
+  and the fix matched credential-shaped suffixes -- but `HF_TOKEN`,
+  `COPILOT_GITHUB_TOKEN`, the Bedrock container/web-identity variables, and the Vertex
+  ADC trio reach the registry through names no suffix covers, so a developer exporting
+  any of them still broke the faux-only assumption the suite is built on. The names and
+  suffixes together now cover every source `getEnvApiKey` consults, and a test pins
+  that coverage so a new provider's variable is caught the day it matters.
+
+- Starting a sandboxed session no longer pays for a lock library and an HTTP stack it
+  never uses. The supervisor loads `settings-manager` on every launch to resolve the
+  network allowlist before the child exists, and that module statically imported
+  `proper-lockfile` (write-path only) and `http-dispatcher` (which loads `undici`) for
+  two small timeout definitions. Measured with the committed
+  `scripts/measure-supervisor-imports.mjs --dist`, A/B on one machine: the
+  settings-manager import fell from 1969ms to 577ms and the whole supervisor import path
+  from 2729ms to 812ms under load-23 (calmer runs: ~197ms to ~110ms). The lock library
+  is now required on first settings write, keeping `withLock` synchronous, and the
+  idle-timeout default/parser moved to a leaf module the dispatcher re-exports -- one
+  definition, but loading a settings file no longer costs an HTTP stack.
+
+- `/login` now works inside a sandboxed session. Every interactive session runs under the
+  OS sandbox, which mounts `auth.json` read-only -- correct for keeping the agent from
+  tampering with credentials, but it also meant the documented way to store a provider key
+  failed with a raw `EACCES` pointing at a file the user could plainly write from their own
+  shell. Credential writes now travel a supervisor-owned unix socket instead: the child asks,
+  the supervisor writes, and only literal secrets are accepted. A value that would resolve
+  as a `!command` or `$VAR` reference is refused and the refusal says why, because such a
+  value written through this channel would be a sandbox escape (the host executes it on the
+  next resolve). Reads are unchanged on both sides of the boundary, the read-only mount
+  stays, and every write -- accepted or refused -- appears in the sandbox violation tail
+  the supervisor prints on exit. Linux is verified by a live sandboxed turn in the suite;
+  macOS is verified at the profile level, with the same live gate now running on macOS CI
+  rather than Linux only.
+
+- `web_search` now has a backend. The tool has been registered in every session since Phase 4
+  but no search vendor was ever wired in, so the model would pick it when a search would help
+  and get an error telling it to pass a TypeScript SDK option — advice aimed at an embedder,
+  not at the person who asked the agent to look something up. An Exa backend now ships behind
+  the same `WebSearchOperations` seam that was already there. Set `EXA_API_KEY` and it works
+  with no further configuration; `webSearch.apiKey` in settings points at a different variable
+  or a secret manager (`!op read ...`) when you want one. The credential is resolved per search
+  rather than at session start, so it never goes stale mid-session. The backend's host is added
+  to the sandbox network allowlist automatically once a credential exists, so
+  `network.allowedHosts` needs no entry for it, and nothing is opened for anyone who never sets
+  a key. When no key resolves the tool still fails loudly rather than returning zero results.
+
+- `grep` and `ls` now report how many results exist, not just where they stopped. Truncated
+  output said `200 matches limit reached`, which tells an agent it hit a wall but not whether
+  it saw 200 of 204 or 200 of 20,000 — so the usual next move was another call with a bigger
+  limit purely to find out. Both now say `200 of 847 total matches shown`, and the follow-up
+  call is only spent when it is actually worth spending. `ls` had the number in hand already.
+  `grep` gets it from ripgrep's own closing summary, which means the search now runs to
+  completion instead of being killed at the limit; the tail of an rg scan is far cheaper than
+  the model round trip it replaces. `find` is unchanged, because `fd` caps at the source and
+  an exact total there would mean a second full traversal.
+
+## [0.0.1-alpha.7] - 2026-08-21
+
+- The permission mode is now switchable from `/settings` instead of only at launch through
+  `--permission-mode`. Every mode already existed and worked; there was simply no way to
+  reach one from a running session, so `bypassPermissions` in particular was documented but
+  effectively unreachable for anyone who had already started typing. The row writes to user
+  scope (`~/.apex-code/agent/permissions.json`) and applies to the next tool call, because
+  the gate re-reads the store on every decision. Choosing `bypassPermissions` takes a
+  confirm step first, since the row is arrow-cyclable like every other setting and
+  "allow every tool call" should not be one stray keypress away. `--permission-mode`,
+  `.apex-code/permissions.json`, and `permissions.local.json` all still outrank a user-scope
+  write, so when one of them is in force the setting reports what actually applies rather
+  than appearing to save and doing nothing. Any mode other than `default` is now named in
+  the footer: `bypassPermissions` and `plan` both look like the agent misbehaving rather
+  than a mode being on. Shift+Tab still cycles the thinking level and is unchanged.
+
+## [0.0.1-alpha.6] - 2026-08-21
+
+- Fixed skills being invisible in every sandboxed session. The OS sandbox hides the host
+  home directory and repoints `HOME` and the agent directory into the workspace, so the two
+  directories skills discover from (`~/.apex-code/agent/skills`, `~/.agents/skills`) resolved
+  to empty workspace paths — no user-scope skill ever loaded, silently, since the sandbox
+  landed. Both roots are now mounted back in, read-only, at their original host paths, the
+  same mechanism already used for the host-owned credential file. A root that resolves —
+  directly or through a symlink — onto the host home directory or an ancestor of it is refused
+  rather than mounted, since mounting it would re-expose the whole home tree the sandbox
+  deliberately hides. A skill whose name isn't a valid slash-command token (spaces, capitals —
+  loading stays lenient, per the Agent Skills standard's own allowance) is now invocable
+  through a derived command token instead of never resolving.
+- The system prompt now lists skill names only, alphabetically, bounded by a fixed token
+  budget, instead of each skill's full description and file location inline. A real
+  115-skill library cost 6,742 prefix tokens under the old shape against a 128-token margin
+  — unaffordable at any size, since it's the one prefix contributor sized by the user's own
+  data rather than the product. A new `skill_search` tool resolves a skill's description on
+  demand; `read` still loads its full content, unchanged. A library too large to list in full
+  states how many names were left out and points at `skill_search`.
+- `/model` now picks in two steps: a provider first, then that provider's models. The single
+  flat list mixed every model from every configured provider into one scroll, so choosing one
+  meant reading past dozens of rows belonging to providers you weren't after. The provider
+  screen shows each provider's model count and marks the one the session is on. Escape steps
+  back to the provider list; ctrl+c still closes outright. Two cases skip the provider step,
+  where it would cost a keystroke and decide nothing: a single configured provider, and
+  `/model <search>`, which still opens straight onto matches drawn from every provider. Fuzzy
+  search, the all/scoped tab, and the background catalog refresh are unchanged.
+
+## [0.0.1-alpha.5] - 2026-08-20
+
+- `edit` and `write` now capture bounded language-server diagnostic evidence after a
+  mutation. Records identify the selected server when known, count diagnostics by
+  severity without storing diagnostic messages, distinguish stable unavailable states,
+  and report when the 1,000-diagnostic collector bound truncated a result. Sessions
+  without configured LSP diagnostics keep their previous tool contracts and evidence.
+- The interactive startup screen now leads with the Apex Code brand mark and a short metadata
+  column — version, model, and working directory — rather than a keybinding list. The previous
+  screen spent four of its five elements on instructions and never showed which model was
+  loaded or which directory the session was rooted in, the two things that actually differ
+  between launches. The full keybinding cheatsheet moved behind `--verbose`. `ctrl+o` still
+  expands tool output and loaded resources; it just no longer unfolds the header.
+- The startup mark degrades rather than breaking: a compact variant below 36 columns, and a
+  line-drawing variant under `terminal.symbolPreset: "ascii"`, whose users opted out of block
+  glyphs precisely because their terminal renders them badly. The metadata column is dropped
+  before it would be squeezed, and a long working directory keeps its leaf rather than its
+  root, so `cwd` still identifies the session.
+- The first-run theme picker now shows the Apex Code mark instead of the leftover upstream one.
+- New `apex` theme, now the default on dark terminals. It replaces the inherited palette's
+  unrelated accent/blue/cyan split with a single cool-teal primary that carries through the
+  accent and every border, over layered near-black surfaces. Semantic names (`primary`,
+  `surface`, `panel`, `grid`) replace raw colour names, and the harsher inherited values —
+  notably pure `#ffff00` for warnings — give way to desaturated ones that sit together.
+  `dark` and `light` are unchanged and still selectable via `/theme`; light terminals continue
+  to default to `light`, as there is no light brand palette yet.
+- The input box now shows a teal `>` prompt marker on its first line, with wrapped and
+  additional lines indented to align under it, and a dim placeholder — `Ask anything, / for
+  commands, ! for bash` — while the input is empty. On a terminal too narrow to spare the
+  marker's columns, the box silently falls back to the previous full-width layout rather than
+  overflowing.
+- A leading `/command` in the input box is now tinted with the accent colour as you type it,
+  so it reads as an invocation rather than as ordinary text. Arguments after the command stay
+  plain, and the tint survives the cursor landing in the middle of the token.
+- Fixed the startup "What's New" section replaying the entire changelog — roughly 270 entries
+  going back to November 2025 — on every single launch. Three defects compounded. The stored
+  "last seen" version was parsed with `split(".").map(Number)`, so any prerelease
+  (`0.0.1-alpha.4`) collapsed to `0.0.0` and every entry in the file compared newer; because
+  the version was then re-stamped in the same unparseable form, the flood repeated on the next
+  launch instead of clearing. The upstream Pi history retained in this file for attribution
+  (`0.10.0`–`0.84.1`) was still in scope, and those versions sort *above* Apex Code's own
+  `0.0.x` line, so no amount of version comparison would ever have suppressed them. And the
+  version heading regex discarded the prerelease identifier, leaving `alpha.2`, `alpha.3`, and
+  `alpha.4` indistinguishable from each other. Version parsing and comparison are now
+  semver-correct including prerelease precedence, parsing stops at the `## Upstream Pi history`
+  boundary, and an unparseable stored version now shows nothing rather than everything.
+  `/changelog` is scoped to Apex Code's own releases for the same reason; the upstream history
+  remains in the file as written attribution.
+
+## [0.0.1-alpha.4] - 2026-08-18
+
+- Fixed `fd not found. Downloading...` / `Failed to download fd: fetch failed` (and the same
+  pair for ripgrep) on every sandboxed startup. The OS sandbox replaces `/home` with an empty
+  tmpfs, so the child could not see host installations of `fd` and `rg` even though its `PATH`
+  still named them, and `--unshare-net` plus an empty `network.allowedHosts` meant the fallback
+  download could not reach GitHub either. The supervisor now resolves both tools on the host —
+  installing them there once if missing, where the network is still reachable — and projects
+  each one read-only into the child at the path its own lookup already checks. One host-side
+  install now serves every workspace, and no network access is required at startup.
+- The OS sandbox no longer reports `Sandbox violation (unknown)` when a sandboxed process
+  simply failed on its own, on either Linux or macOS. An invalid API key, a failing test command, or a script exiting 1
+  are not boundary refusals, and reporting them as such sent users looking for a refusal that
+  never happened. Genuine filesystem and network refusals are still recorded.
+- The OS sandbox now permits the built-in model-provider hosts and the update check by
+  default, so a fresh install can reach its provider without first discovering
+  `network.allowedHosts` and the provider's endpoint. Configured hosts are added on top;
+  `network.allowDefaultHosts: false` restores the previous deny-all behaviour. Providers whose
+  endpoint depends on account or environment configuration — Bedrock, Azure, Cloudflare,
+  Vertex — still need an explicit entry.
+- A request refused by the sandbox network allowlist now says which host was refused and how to
+  permit it, instead of surfacing undici's bare `fetch failed`. The refusal is also attempted
+  once rather than retried three times, since an allowlist decision cannot change on retry.
+- Fixed the OS sandbox failing to start with `Error: listen EINVAL: invalid argument` in any
+  workspace with a moderately long path. The allowlist proxy's Unix socket lived under the
+  workspace, and AF_UNIX caps socket paths at 108 bytes, leaving only ~72 characters for the
+  project's own directory layout — a deep-but-ordinary checkout could not launch at all. The
+  socket now uses a short path in the system temp directory, bind-mounted into the child, and
+  is cleaned up on exit.
+- Fixed `/share` reporting `GitHub CLI is not logged in. Run 'gh auth login' first.` inside the
+  OS sandbox, where that diagnosis is wrong and the suggested fix does not help. The sandbox
+  cannot reach the host's gh credentials — `~/.config/gh` sits under the tmpfs that replaces
+  `/home`, `XDG_CONFIG_HOME` is redirected, and the token usually lives in a system keyring.
+  The message now points at the workflow that works: `/export` inside the session, then
+  `gh gist create --public=false <file>` outside the sandbox.
+- Hardened the managed-tool lookup against an unusable leftover file. A projected tool is
+  bind-mounted over a file in the child's tools directory, and Bubblewrap materialises that
+  mountpoint as an empty file that outlives the namespace. `getToolPath()` now requires an
+  executable file rather than merely an existing one, and the supervisor clears stale
+  zero-byte mountpoints, so a host tool that later disappears can no longer leave the child
+  treating a 0-byte stub as its binary.
+
+## [0.0.1-alpha.3] - 2026-08-17
+
+- Fixed the Linux OS sandbox crashing with `ReferenceError: require is not defined in ES module
+  scope` when launched inside a workspace whose `package.json` declares `"type": "module"`; the
+  sandbox's network relay script is now written as `relay.cjs` instead of `relay.js`.
+
+## [0.0.1-alpha.2] - 2026-08-17
+
+- Published the Apex Code CLI and agent core through npm Trusted Publishing.
+- Added provider failover, permissions and sandboxing, context engineering, expanded tools, delegation, durable state, evidence, observability, and release hardening.
+- Completed the current product identity, environment compatibility, and cross-platform portability surface.
+- Removed implicit `pi.dev` model-catalog and share-viewer dependencies. Bundled catalogs
+  are now the default; remote catalogs and preview viewers require explicit Apex
+  environment configuration, and `/share` confirms the secret GitHub Gist upload.
+- Fixed stale Pi-branded content shipped in the packed npm tarball's `docs/` (fictional
+  installer, broken command examples, wrong file paths, an ADR 0013 hosted-service
+  reference) across 29 files; added pnpm/Yarn/Bun install commands.
+- Extended the packed-artifact identity gate to scan every packed `.md` file, not just
+  `README.md`, so this class of defect fails CI instead of shipping.
+- Replaces `apex-code@0.0.1-alpha.1`, whose `next`-tagged tarball shipped this stale
+  content; see the release-integrity runbook for the deprecation of prior versions.
+
+## Upstream Pi history
+
+The entries below are retained as historical attribution for the forked code.
+
 # Changelog
 
+## [0.84.3] - 2026-08-24
+
+### New Features
+
+- **PowerShell tool** — Use optional native PowerShell command execution on Windows. See [PowerShell Tool](docs/windows.md#powershell-tool).
+- **Safer managed updates** — Stage, verify, and atomically activate updates for installer-managed installations. See [Install and Manage](docs/packages.md#install-and-manage).
+- **Model and thinking controls** — Select thinking levels with `/thinking`, search defaults, keep selections session-scoped, and persist them explicitly with Ctrl+S. See [Models and Thinking](docs/keybindings.md#models-and-thinking).
+
+### Breaking Changes
+
+- Renamed the inherited `GoogleThinkingLevel` type to `GoogleApiThinkingLevel` and added `ResolvedGoogleThinkingLevel` for normalized adapter levels.
+
+### Added
+
+- Added an optional `powershell` tool for Windows, configurable through `defaultTools` and the SDK. See [PowerShell Tool](docs/windows.md#powershell-tool).
+- Added a `/thinking` selector and searchable default choices to the model and thinking selectors; Ctrl+S saves the selected model as the global default. See [Models and Thinking](docs/keybindings.md#models-and-thinking).
+- Added optional routing session IDs to exported compaction summary helpers so callers can preserve provider routing without enabling prompt cache writes.
+- Added transcript usage notices for compaction and branch summaries when cache miss notices are enabled.
+- Added `session_compact_failed` extension events so compaction failures and aborts expose their reason, retry state, source, and error message to handlers ([#8175](https://github.com/earendil-works/pi/issues/8175)).
+- Added inherited provider-neutral `toolChoice` support to simple stream requests.
+- Added inherited automatic Anthropic server-side refusal fallback for supported first-party models, including returned-model usage pricing ([#8017](https://github.com/earendil-works/pi/issues/8017)).
+- Added inherited configurable OpenAI-compatible thinking-token budget fields for vLLM, Qwen/SGLang, and llama.cpp servers. See [OpenAI Compatibility](docs/models.md#openai-compatibility) ([#8275](https://github.com/earendil-works/pi/pull/8275) by [@bnsd55](https://github.com/bnsd55)).
+- Added inherited China-specific ZAI Coding Plan models, including GLM-4.6V vision support and API-equivalent usage cost estimates ([#8220](https://github.com/earendil-works/pi/issues/8220)).
+- Added inherited `deepseek-v4-pro-0813` support to the Qwen Token Plan Individual catalog ([#8194](https://github.com/earendil-works/pi/issues/8194)).
+
+### Changed
+
+- Changed experimental installer-managed installations so `pi update` stages, verifies, and atomically activates the selected release in place. See [Install and Manage](docs/packages.md#install-and-manage).
+- Changed inherited built-in xAI models to use the Responses API with encrypted reasoning replay and made Grok 4.6 the default xAI model ([#8124](https://github.com/earendil-works/pi/pull/8124) by [@Jaaneek](https://github.com/Jaaneek)).
+- Changed inherited Anthropic, Azure OpenAI, Google, Mistral, and OpenAI adapters to send Pi's default `User-Agent` unless overridden ([#8305](https://github.com/earendil-works/pi/issues/8305)).
+- Changed Windows and WSL keybinding defaults to avoid terminal-reserved shortcuts for image paste, model cycling, editor undo, fullscreen transcript navigation and search, and message queueing ([#8372](https://github.com/earendil-works/pi/issues/8372)).
+- Changed Bun release archives to ship the native clipboard binary only inside the wrapper package, removing a duplicate platform package from each archive.
+- Changed package resource glob expansion to use Node.js's built-in implementation with deterministic visible-path matching, reducing the installed runtime dependency tree.
+- Changed the bundled Node.js runtime to load jiti only when importing an extension and Babel only when uncached source needs transformation, reducing CLI startup time and bundle size.
+- Changed syntax highlighting to initialize only twenty common languages eagerly and defer the remaining grammars until after the initial TUI render, reducing CLI startup time.
+- Changed the Node.js CLI and RPC entrypoints to load a bundled runtime, reducing startup filesystem reads while keeping the public library and legacy module paths on the modular runtime for normal dependency identity.
+- Changed session sharing to render clickable terminal links, display only the canonical Radius artifact URL, and include the current system prompt and active tool definitions in Radius session shares.
+
+### Fixed
+
+- Fixed failed extension factories leaving event subscriptions, provider registrations, and default flag state active ([#8424](https://github.com/earendil-works/pi/pull/8424) by [@acmerfight](https://github.com/acmerfight)).
+- Fixed `models.json` typings omitting the documented OpenAI-compatible `compat.supportsFinishReason` provider and model override ([#8487](https://github.com/earendil-works/pi/pull/8487) by [@petrroll](https://github.com/petrroll)).
+- Fixed `/model` and `/thinking` selections being persisted globally unless explicitly saved with Ctrl+S ([#5263](https://github.com/earendil-works/pi/issues/5263)).
+- Fixed JSON and RPC `toolcall_start` events omitting the tool call id and name ([#7953](https://github.com/earendil-works/pi/pull/7953) by [@christianklotz](https://github.com/christianklotz)).
+- Fixed extensions failing to load when the Node.js CLI runs as a single-executable application ([#8237](https://github.com/earendil-works/pi/issues/8237)).
+- Fixed nested Markdown skills inside `.agents/skills/` grouping directories not being discovered.
+- Fixed compaction and branch summarization requests exposing tools to providers.
+- Fixed single-object `edit` tool inputs failing validation by accepting them as one-edit arrays in both coding-agent and harness edit tools ([#7835](https://github.com/earendil-works/pi/issues/7835)).
+- Fixed root Markdown files such as `README.md` and `AGENTS.md` in skill directories being reported as broken skills unless they declare valid skill frontmatter ([#7805](https://github.com/earendil-works/pi/issues/7805)).
+- Fixed the default Cerebras model referencing an unavailable Z.AI model.
+- Fixed inherited OpenAI-compatible Chat Completions reasoning replay to preserve and resend assistant-level `reasoning_details` verbatim and in order ([#7994](https://github.com/earendil-works/pi/issues/7994)).
+- Fixed inherited Anthropic server-side fallback responses being priced with the requested model instead of the returned fallback model ([#8285](https://github.com/earendil-works/pi/issues/8285)).
+- Fixed inherited GitHub Copilot login triggering model-policy rate limits by limiting policy updates, retrying model discovery once, and honoring server retry delays ([#7850](https://github.com/earendil-works/pi/issues/7850)).
+- Fixed inherited Amazon Bedrock dropping and failing to replay opaque redacted reasoning from non-Anthropic models ([#8314](https://github.com/earendil-works/pi/pull/8314) by [@seiji](https://github.com/seiji)).
+- Fixed inherited Z.AI Coding Plan models deriving incomplete reasoning-effort metadata, including missing GLM-5.3 low, high, and max levels ([#8336](https://github.com/earendil-works/pi/issues/8336)).
+- Fixed inherited DeepSeek V4 Flash on OpenCode and OpenCode Go omitting its supported low thinking level ([#8181](https://github.com/earendil-works/pi/pull/8181) by [@tianshuang](https://github.com/tianshuang)).
+- Fixed inherited Azure OpenAI Responses ignoring `toolChoice` in provider-specific stream requests.
+- Fixed inherited Amazon Bedrock response hooks receiving only a synthesized request id instead of the raw response headers ([#8234](https://github.com/earendil-works/pi/issues/8234)).
+- Fixed inherited Kimi usage reporting so top-level `cached_tokens` count as cache reads instead of normal input tokens ([#8075](https://github.com/earendil-works/pi/issues/8075)).
+- Fixed inherited Google custom models ignoring `thinkingLevelMap`, which dropped extended thinking controls ([#8135](https://github.com/earendil-works/pi/issues/8135)).
+- Fixed writes to `auth.json` and `models-store.json` overriding administrator-managed file permissions and ACLs ([#7779](https://github.com/earendil-works/pi/issues/7779)).
+- Fixed UTF-8 BOM markers preventing frontmatter and user configuration files from loading ([#8337](https://github.com/earendil-works/pi/issues/8337)).
+- Fixed invalid settings files being easy to miss during interactive startup by rendering warnings with the file path inside the TUI ([#7829](https://github.com/earendil-works/pi/issues/7829)).
+- Fixed the subagent example repeatedly prompting before running project-local agents in trusted repositories ([#8261](https://github.com/earendil-works/pi/issues/8261)).
+- Fixed npm package update checks treating older registry versions as available updates, preventing `pi update` from downgrading already-newer installed packages ([#8226](https://github.com/earendil-works/pi/issues/8226)).
+- Fixed built-in llama.cpp models disappearing from `/model` when `/llama` refreshed a configured server under `PI_OFFLINE`, and included idle-slept `sleeping` router models in the selectable catalog ([#8167](https://github.com/earendil-works/pi/issues/8167)).
+- Fixed `pi.registerFlag()` accepting default values that do not match the declared flag type ([#8064](https://github.com/earendil-works/pi/issues/8064)).
+- Fixed Z.AI Coding Plan defaults referencing the removed GLM-5.1 model ([#8096](https://github.com/earendil-works/pi/issues/8096)).
+- Fixed repeated ambiguous truncated-response recovery being mislabeled as context overflow ([#8130](https://github.com/earendil-works/pi/issues/8130)).
+- Fixed duplicate fullscreen right-click paste in VS Code-based terminals on Windows ([#8186](https://github.com/earendil-works/pi/issues/8186)).
+- Fixed inherited padded text exceeding narrow terminal widths ([#8252](https://github.com/earendil-works/pi/issues/8252)).
+- Fixed inherited wrapped Markdown table links leaking color into borders and neighboring cells, including tables inside blockquotes ([#8335](https://github.com/earendil-works/pi/issues/8335)).
+- Fixed llama.cpp login guidance to direct users to `/llama` before `/model` when no local models are loaded ([#8203](https://github.com/earendil-works/pi/issues/8203)).
+- Fixed hung pi.dev model catalog requests consuming the entire refresh deadline without retrying ([#8198](https://github.com/earendil-works/pi/issues/8198)).
+- Fixed inherited Xiaomi model catalogs listing shut-down MiMo V2 models in `/model` and `--list-models` ([#8187](https://github.com/earendil-works/pi/issues/8187)).
+- Fixed branch summary entries recording the navigation destination in `fromId` instead of the pre-navigation source leaf.
+- Fixed threshold auto-compaction being skipped when providers omit streaming usage data ([#8328](https://github.com/earendil-works/pi/issues/8328)).
+- Fixed dash-prefixed prompts being parsed as options by supporting `--` as an end-of-options delimiter ([#7269](https://github.com/earendil-works/pi/issues/7269)).
+
+## [0.84.2] - 2026-08-14
+
+### New Features
+
+- **Fullscreen transcript search** — Search and navigate matches in fullscreen mode. See [TUI Fullscreen Viewport](docs/keybindings.md#tui-fullscreen-viewport).
+- **Configurable default tools** — Choose startup built-in tools globally or per project. See [Tools](docs/settings.md#tools).
+- **Configurable fullscreen exit output** — Print the transcript or only a resume hint on exit. See [Interactive Mode](docs/usage.md#interactive-mode).
+
+### Added
+
+- Added fullscreen transcript search with `Ctrl+Shift+F`, incremental match highlighting, configurable search match theme colors, and next/previous navigation with `Enter`/`Ctrl+G` and `Shift+Enter`/`Ctrl+Shift+G`.
+- Added experimental strict JSON-schema constrained sampling for the default `read`, `bash`, `edit`, and `write` tools under `PI_EXPERIMENTAL=1`.
+- Added a fullscreen exit output setting to choose between printing the final transcript and only a session resume hint.
+- Added the `defaultTools` setting for configuring the initial built-in tool selection globally or per project.
+- Added `--use-theme <name[/name]>` to choose an initial per-run interactive theme without changing saved settings ([#7722](https://github.com/earendil-works/pi/pull/7722) by [@rwachtler](https://github.com/rwachtler)).
+- Added `expandPromptTemplates` to extension `pi.sendUserMessage()` options for explicitly dispatching commands and expanding skills and prompt templates. See [`pi.sendUserMessage()`](docs/extensions.md#pisendusermessagecontent-options) ([#7857](https://github.com/earendil-works/pi/pull/7857) by [@mrexodia](https://github.com/mrexodia)).
+- Added inherited `createGatewayBindingFetch()` for routing Cloudflare AI Gateway requests through a Workers AI binding without an API token ([#7901](https://github.com/earendil-works/pi/pull/7901) by [@Maximo-Guk](https://github.com/Maximo-Guk)).
+- Added inherited `AssistantMessage.endTurn` to preserve OpenAI Codex's terminal `end_turn` signal for diagnostics ([#7766](https://github.com/earendil-works/pi/pull/7766)).
+- Added inherited unbound single-line transcript scrolling actions for fullscreen mode. See [TUI Fullscreen Viewport](docs/keybindings.md#tui-fullscreen-viewport) ([#7903](https://github.com/earendil-works/pi/pull/7903) by [@midastruth](https://github.com/midastruth)).
+
+### Changed
+
+- Changed inherited Kimi Coding requests to use pi's runtime `User-Agent` header.
+- Replaced the inherited Mistral SDK transport with a native Chat Completions HTTP stream, eliminating its generated client and schema runtime overhead.
+- Documented the generic `AI_AGENT=pi` process marker and how it differs from `PI_CODING_AGENT=true` ([#7747](https://github.com/earendil-works/pi/issues/7747)).
+- Changed inherited OpenAI Responses deferred tool loading to prefer message-anchored `additional_tools` where supported while retaining tool-search and top-level fallbacks ([#7709](https://github.com/earendil-works/pi/issues/7709)).
+- Reduced inherited fullscreen rendering allocation churn by painting full-width layout rows directly instead of recompositing them on every frame.
+
+### Fixed
+
+- Fixed root Markdown files such as `README.md` and `AGENTS.md` in skill directories being reported as broken skills unless they declare valid skill frontmatter ([#7805](https://github.com/earendil-works/pi/issues/7805)).
+- Fixed single-object `edit` tool inputs failing validation by accepting them as one-edit arrays in both coding-agent and harness edit tools ([#7835](https://github.com/earendil-works/pi/issues/7835)).
+- Fixed managed-tool downloads delaying TUI startup and hiding diagnostics in fullscreen mode by mounting the TUI first and showing download progress and warnings inside it.
+- Fixed opening a model selector immediately after startup cancelling and restarting the in-progress model catalog refresh.
+- Fixed inherited GitHub Copilot login triggering API rate limits while enabling model policies by limiting concurrent policy updates ([#6187](https://github.com/earendil-works/pi/issues/6187)).
+- Fixed fullscreen transcript search snapping back to the current match during manual scrolling and fragmented mouse input leaking into the search query.
+- Fixed inherited required LaTeX arguments starting on a new line being parsed as empty ([#7760](https://github.com/earendil-works/pi/issues/7760)).
+- Updated the transitive `nanoid` development dependency to address a denial-of-service vulnerability.
+- Fixed fallback rendering for extension tool results to collapse long output and honor tool expansion ([#7979](https://github.com/earendil-works/pi/issues/7979)).
+- Fixed JSON and RPC `message_update` events dropping cumulative usage during streaming. See [JSON Event Mode](docs/json.md) and [RPC `message_update`](docs/rpc.md#message_update-streaming) ([#7982](https://github.com/earendil-works/pi/pull/7982) by [@christianklotz](https://github.com/christianklotz)).
+- Fixed `pi.sendMessage(..., { triggerTurn: false })` steering an active run instead of only recording the custom message ([#8022](https://github.com/earendil-works/pi/pull/8022) by [@cristinaponcela](https://github.com/cristinaponcela)).
+- Fixed the `defaultTools` setting dropping extension and SDK custom tools when selecting built-in defaults.
+- Fixed the subagent example rejecting YAML array syntax for the `tools` frontmatter field ([#7598](https://github.com/earendil-works/pi/pull/7598) by [@alexsavio](https://github.com/alexsavio)).
+- Fixed the subagent example dropping parent session model, thinking, and tool configuration ([#7897](https://github.com/earendil-works/pi/pull/7897) by [@virtuald](https://github.com/virtuald)).
+- Fixed custom system prompts concatenating the current working directory with later appended prompt content ([#7887](https://github.com/earendil-works/pi/pull/7887) by [@distributedlock](https://github.com/distributedlock)).
+- Fixed inherited OpenAI Responses function and custom tool calls losing namespaces during streaming, proxying, and replay ([#7709](https://github.com/earendil-works/pi/issues/7709)).
+- Fixed inherited upstream request buffer failures not triggering automatic assistant retries.
+- Fixed inherited built-in and custom DeepSeek API models sending output limits through an unsupported field.
+- Fixed inherited Amazon Bedrock replay rejecting tool arguments that contain empty object keys while preserving all valid nested values ([#7882](https://github.com/earendil-works/pi/pull/7882) by [@muyiyr](https://github.com/muyiyr)).
+- Fixed inherited DeepSeek compatibility detection for base URLs whose hostname contains uppercase letters ([#7933](https://github.com/earendil-works/pi/pull/7933) by [@yearth](https://github.com/yearth)).
+- Fixed inherited Google Generative AI and Vertex AI responses with tool calls incorrectly treating output-limit or provider-error stops as normal tool use ([#8059](https://github.com/earendil-works/pi/issues/8059)).
+- Fixed inherited fullscreen mouse drag selection and OSC 8 link activation in terminals that report generic SGR mouse release button codes ([#7963](https://github.com/earendil-works/pi/issues/7963)).
+- Fixed inherited focused fullscreen overlays not receiving mouse wheel or viewport scroll keys such as PageUp and PageDown ([#7894](https://github.com/earendil-works/pi/issues/7894)).
+- Fixed inherited LaTeX control spaces split across line endings causing complete expressions to fall back to raw source.
+- Fixed split `Alt+Enter` input over SSH being misread as Escape, added `PI_TUI_ESC_TIMEOUT` for high-latency terminals, and limited that timeout to lone Escape input ([#7899](https://github.com/earendil-works/pi/pull/7899) by [@powerfooI](https://github.com/powerfooI)).
+- Fixed inherited idle fullscreen sessions repainting and clearing text selection when the terminal loses focus ([#7892](https://github.com/earendil-works/pi/pull/7892) by [@terrorobe](https://github.com/terrorobe)).
+- Fixed fullscreen selection copy to use the host clipboard and report failure instead of claiming success when OSC 52 is unsupported ([#8110](https://github.com/earendil-works/pi/pull/8110) by [@Panoplos](https://github.com/Panoplos)).
+
 ## [0.84.1] - 2026-08-07
 
 ### New Features