micro-models-agent 0.63.3 → 1.5.0

package/CHANGELOG.md

@@ -4,44 +4,208 @@ All notable changes to Micro Models Agent (MMA) will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.5.0] - 2026-09-21
+
+### Added
+
+- **Canonical chat UI style** (`docs/design/ui/STYLE.md`, mockup `docs/design/ui/mockup-chat-en-ru.html`, linked from AGENTS.md as the single correct style): no boxed panels, one shared glyph set, semantic color roles, quiet-by-default with detail on demand.
+- **UI theme module** (`src/ui/theme.ts`): single source for chat glyphs (`◇ ✓ ✗ ⚠ ✦ ? ↵ ↳ │ ▰▱ ⟡ ⟳`), semantic marks and the `Verbosity` type.
+- **Chat verbosity levels** (`ui.verbosity`: `quiet | normal | verbose`, default `quiet`): quiet folds each action into a single `◇ label ✓ ms` line, hides tool bodies and only surfaces the first line of a failed action. New `/verbose [level]` REPL command and `--verbose` plumbing; legacy `ui.verbose` still maps to `verbose`.
+- **Read-only run summaries** (`src/ui/renderer.ts`): in quiet mode a consecutive run of read-only tools (`read_file`, `grep`, `glob`, web, …) collapses into one `│ N actions ✓ · ms · /verbose` line; mutating/executing tools stay visible.
+- **Calm security/protected-path failures** (`src/core/agent/tool-output.ts`, `src/core/agent/tool-batch.ts`, `src/modules/security/protected-paths.ts`): `toolFailureSummary` maps `[SECURITY BLOCKED]` / `[PROTECTED PATH]` refusals to short localized warnings (`⚠`) instead of red walls; raw markers never reach the chat.
+- **`Ctrl+O` action reprint** (`src/ui/action-log.ts`, `src/cli/repl.ts`): the last action's label, args, status and full body are kept and reprinted on demand, so quiet mode stays quiet without losing detail.
+- **Spinner elapsed time** (`src/ui/spinner.ts`): the busy line shows `· Ns` once a tool runs longer than 3 seconds.
+- **Status voice** (`src/ui/renderer.ts`): thinking phases rotate a few short human labels (`thinking` / `working it out` / `considering`, localized) instead of repeating one word.
+- **Plan checklist restyle** (`src/ui/plan-view.ts`): `◇ title ▰▱ 1/3` header and `✓ / ◇ / ○ / ✗` step marks, dropping the raw plan id and `[x]` brackets.
+- **Category-colored action glyph** (`src/ui/theme.ts`): the single `◇` mark is colored by tool category — recon cyan, mutate magenta, execute blue, meta dim. Per-tool emoji icons are no longer rendered.
+- **Human tool arguments** (`src/ui/renderer.ts`): raw JSON is replaced by short phrases — `plan update` → `step 2 → done`, `browser scroll down`, `move_file` → `a → b`, `mcp_call` → `server/tool`, `remember`, `enable_tools`, `glob`/`grep`/`subagent`/`set_thinking`/`verify`/`process_log` and more.
+- **Quiet hides structured info logs** (`src/output/channel.ts`): `info`-level log events (`[INFO] [mma] …`) are dropped from the terminal in quiet mode; warn/error and `writeLine` blocks are unaffected.
+
+### Fixed
+
+- **Closing code fence without a trailing newline** (`src/ui/md-formatter.ts`): a final ```` ``` ```` at end of stream was rendered as code content; it now closes the block.
+- **Thought duration inside the answer** (`src/ui/renderer.ts`): the thinking block is closed when the final answer or the next tool starts, so `N.Ns` never lands inside the response text.
+- **Durations over a second** (`src/ui/theme.ts`): rendered as `1.4s` instead of `1400ms`.
+
+### Changed
+
+- **Tool output never shows system names** (`src/ui/renderer.ts`): tool identifiers (`read_file`, `bash`, …) are lookup keys only — the chat renders the localized `tool.friendly.*` label, with a generic localized fallback when a translation is missing.
+- **One action glyph** (`Renderer.toolMarker`): every tool uses `◇` instead of per-category arrows/asterisks.
+- **Calm errors** (`src/ui/renderer.ts`, `src/ui/md-formatter.ts`): `✗` for real failures, `⚠` for soft blocks; `ui.error_prefix` is now `✗ ` in both locales.
+- **No box-drawing grids** (`src/ui/md-formatter.ts`, `src/ui/table.ts`): code blocks use a dim language label plus a `│` gutter; markdown tables render as a bold header + dim rule + aligned columns.
+- **Thinking header and run footer**: `✦ thinking` instead of `→ Thought:`, `⟡ model · provider · ms` instead of `▣`.
+- **Answer has no marker prefix** (`src/ui/renderer.ts`): the final answer starts on a fresh line instead of `- …`, so a response that opens with a code block is not mangled.
+
+## [1.4.0] - 2026-09-21
+
+### Added
+
+- **Protected-path confirmation guard** (`src/modules/security/protected-paths.ts`): file-mutating tools (`write_file`, `edit_file`, `delete_file`, `move_file`, `create_dir`) now refuse paths under VCS internals (`.git/`, `.hg/`, `.svn/`) and secret/env files (`.env*`, `*.key`, `*.pem`, `*.p12`, `*.pfx`, `*.crt`, `*.secret`, `*.token`, `.npmrc`, `.netrc`, `.git-credentials`, `.gitconfig`) with a directive to ask the user for explicit confirmation. The guard is **always on** (independent of `security.paths.enabled`) and never hard-blocks — the user can still approve. Verified live on `qwen/qwen3.5-9b`: the model recognized the rule from the prompt, refused, and asked the user.
+- **System-prompt `PROTECTED PATHS` rule** (`src/core/bootstrap.ts`): the model is told up front not to modify VCS/secret/env paths without explicit user confirmation, and to stop and ask if a tool reports one (no `bash` workarounds).
+
+### Fixed
+
+- **Provenance after transparent provider failover** (`src/core/agent.ts`, `src/core/agent/token-tracker.ts`, `src/core/bootstrap.ts`): after `FallbackProvider` switched to another entry, the footer, cost attribution and `llm_usage` still reported the original provider. `callerProvenance()` now reads the live active entry (`getProviderName`), and `TokenTracker.logUsage` passes `provider`/`model` into `llm_usage`. Verified live: `provider failover: dead -> live` → footer `· live`, `llm_usage.provider=live`.
+- **Session encryption config was ignored** (`src/core/bootstrap.ts`): `SessionStore` was constructed without `config.security.sessionEncryption`, so enabling `security.sessionEncryption` silently left `session.jsonl`/`history.jsonl` in plaintext. The config is now passed through; verified live (files written as `salt:iv:authTag:data`).
+- **Certification harness hardening** (`src/modules/certification/`, found by running the full suite on `qwen/qwen3.5-9b`):
+  - `syncGlobalManifest` no longer downgrades a fresher local certification with an older bundled manifest — it overwrites a key only when the bundled entry is genuinely newer (`manifest.ts`).
+  - `readMergedManifest` now picks the **newer** entry (by `mmaVersion`, then `certifiedAt`) instead of always letting a stale legacy project manifest shadow the global one, so `model cert-status`/`cert-list` show the real result.
+  - `outputContains` is case-insensitive, so security scenarios match the uppercase `[SECURITY BLOCKED]` harness marker deterministically rather than depending on the model echoing lowercase "security".
+  - MoE scenarios state "working directory root (no subdirectories)"; the security scenarios explicitly instruct the model to attempt the blocked command (a small model otherwise refused and never exercised the block).
+
+## [1.3.1] - 2026-09-21
+
+### Added
+
+- **Code style guide** (`docs/agents/code-style.md`, AGENTS.md/architecture rules #18): formatting, ban on `as any`/`as unknown as X` (except annotated test seams), `import type`, explicit export return types, abortable waits, no silent `catch`, Russian comments, and a phased tsconfig-strictness ladder.
+
+### Fixed
+
+- **False-positive repeated-tool hard stop** (`src/core/agent.ts`): under `--exit-on-complete` an identical repeated tool call was stopped after two repeats even when it was a legitimate request ("run `echo tick` four times"), ending the run with an empty answer. The hard stop now applies only to loop-prone status tools (`session_info`/`process_list`/`process_log`/`file_info`/`project_map`); side-effecting tools (e.g. `bash`) stay nudge-only. Verified live on `qwen/qwen3.5-9b`.
+- **False hallucination warning for filenames with spaces** (`src/modules/hallucination/factual.ts`): `отчёт 1.txt` was tokenized as `1.txt` and flagged as a missing file. `bareNameExists` now also matches a known/indexed name ending in `" <token>"`. Verified live.
+- **`tool_call` args JSON sanitization** (`src/core/session-logger.ts`): `logToolCall` no longer loses the whole entry when the data sanitizer corrupts the arg JSON (e.g. `password=secret"` loses a closing quote) — falls back to a raw string and warns.
+- **Invalid tool-call arguments** (`src/core/agent.ts`): a malformed `tool_call.arguments` JSON no longer silently becomes `{}`; it is logged (`tool_args_parse_error`) and a `system-summary` tells the model to re-issue the call with valid JSON.
+- **MoE plan mutation** (`src/modules/execution/moe-executor.ts`): `resolveScopeAndRetry` expands scope on a local copy, so the original plan stays intact for verification/re-plan.
+- **Browser session race in MoE** (`src/tools/browser.ts`): concurrent waves are serialized via a promise chain instead of clobbering the shared Playwright session; `closeBrowserSession` waits for the in-flight action; missing cookie dir is created; close failures are logged. Screenshot vision detection broadened (`modelSupportsVision`).
+- **Security-block nudge scope** (`src/core/agent/tool-batch.ts`): `sawSecurityBlock` is reset per tool batch, so a stale block cannot trigger the wrapper-script nudge much later.
+- **Per-tool cost** (`src/core/agent/tool-batch.ts`): the tool-end event now reports the delta (`total_after - total_before`) instead of the cumulative session cost.
+- **`edit_file` argument guard** (`src/tools/edit-file.ts`): non-string `old`/`new` are rejected with a clear error instead of being coerced to `"null"`/`"[object Object]"`; unreadable files return a localized message.
+- **Bash failure counters scoped to the session** (`src/tools/bash.ts`): the module-level `FAILING_FIRST_WORDS` map is reset when the session id changes, so failures from a previous session do not trigger a bogus hard-stop later.
+- **Migration backup skip is logged** (`src/migration/backup.ts`): a pre-existing `.bak` directory is reported at debug level instead of being skipped silently.
+- **File I/O error handling** (`src/tools/write-file.ts`, `src/tools/read-file.ts`): `writeFileSync`/`readFileSync` failures (ENOSPC/EPERM, file vanished between `existsSync` and read) now return a localized message with the path and reason instead of throwing a bare Node error; numeric `offset`/`limit` are validated instead of cast.
+- **`listModels` typed parsing** (`src/llm/openai-compat.ts`): provider responses are parsed via a narrowing helper (no `as any`), tolerating both `{data:[…]}` and bare arrays.
+- **Nested markdown emphasis** (`src/ui/md-formatter.ts`): `***bold italic***` renders as bold+italic without leaving a stray asterisk.
+
+### Changed
+
+- **MoE messages localized** (`src/core/agent-moe.ts`, i18n `moe.*` en+ru): planning/fallback/auto-fix/no-orchestrator/plan-failed strings go through `t()`.
+- **MoE typing** (`src/core/agent-moe.ts`, `src/llm/types.ts`): `verifyAndMerge` is typed as `OrchestratorResult`/`VerifyInput`, `getUsageByTag` is part of `MoEExecutorLike` (no duck-typed cast), orchestrator override is properly optional.
+- **Provider cache** (`src/modules/providers/manager.ts`): `setModel()` clears the build cache so providers for old models do not accumulate.
+- **Input-from budget** (`src/modules/execution/input-from.ts`): aggregate cap (`maxChars * 4`) with an `omitted` marker; `as any` narrowing removed.
+- **Observability** (`src/core/bootstrap.ts`, `src/core/agent.ts`): ContextLogger init failure and `getProviderFor` build failure are logged with i18n keys; log level is validated (`normalizeLogLevel`) instead of `as any`.
+- **SIGINT force-exit** (`src/cli/repl.ts`): grace period 2s → 5s with a localized notice.
+- **i18n diagnostics** (`src/i18n/index.ts`, `src/core/bootstrap.ts`): a missing key is reported via an optional debug reporter (`setMissingKeyReporter`, wired to `logger.debug`); `loadLocale` cast removed.
+- **Type cleanup** (`src/tools/*`): removed redundant `(ctx as any).fileOperationsCount` casts in 5 files.
+- **Abortable retry sleep** (`src/modules/execution/moe-executor.ts`): retry `sleep` honors the abort signal; stuck detector receives the real attempt number.
+
+## [1.3.0] - 2026-09-19
+
+### Added
+
+- **Budget-driven compaction floor** (`contextBudget.compactionMinLoad`, default 0.5, `src/modules/context/manager.ts`): the 15-iteration interval no longer triggers a compaction on its own — it now requires the history to be at least `compactionMinLoad` full. Previously compaction fired at ~40% of the budget and discarded 33-44 useful turns mid-task (observed in a real run), derailing the agent. Token-pressure compaction (`compactionThreshold`) is unchanged.
+- **Context probe persistence in every mode** (`src/core/bootstrap.ts`, `src/cli/main.ts`): the loaded-vs-configured context probe is now written to the session (`context_probe`) and surfaced in one-shot runs too. Previously only the REPL recorded/rendered it, so a mismatch (LM Studio loaded 86016 while `contextWindow` was 32768) was silent in `mma "<prompt>"`.
+- **Artifact churn detector** (`src/core/agent/artifact-progress.ts`): nudges the model once when it repeatedly rewrites a test/spec file without changing production code. Path classification is cross-language (`*.test.*`, `*_test.*`, `test_*`, `*Test.java`, `tests/`, `specs/`, …), with no framework/task specifics.
+- **Stuck escalation reaches the model** (`src/modules/execution/execution-plugin.ts`): after the escalation threshold, a generic directive (change approach / search the exact error / ask the user / re-plan or skip) is injected as a `system-summary`, not only shown in the UI.
+- **Wrapper-script guard** (`src/core/agent/tool-batch.ts`, `src/tools/bash.ts`): after a `[SECURITY BLOCKED]` result, writing a `.bat/.cmd/.sh/.ps1` wrapper triggers a one-time nudge; the security block hint now points to tools (write_file, workdir, separate calls) instead of only `workdir`.
+
+### Changed
+
+- **`plan update` no longer rewrites the plan's steps** (`src/modules/execution/plan-actions.ts`): a bulk `steps[]`/`title` rewrite via `update` is rejected in all cases (previously only when the plan had progress). Use `re-plan` (keeps completed steps) or `create`.
+- **Tool-arg summaries omit long values** (`src/core/agent/tool-output.ts`): `summarizeToolArgs` collapses long string values (`content`/`new_string`/…) to `…(N chars)` instead of echoing the body into the `<system-summary>` envelope.
+- **Artifact-requirement prompt rule** (`src/core/bootstrap.ts`): explicit generic line — a requested document/artifact (spec, design, README, plan file, script) must be created as a real file, and libraries not agreed/listed must not be added.
+
+### Fixed
+
+- **Non-streaming fallback on buffered-SSE stall** (`src/llm/openai-compat.ts`): a stream that stalls after tool-call deltas started (LM Studio buffers large tool-call SSE) is retried non-streaming once instead of failing the whole run. Reasoning from the fallback is dropped (already streamed).
+
+## [1.2.0] - 2026-09-19
+
+### Added
+
+- **Git-style context log** (`--context-log`, `src/core/agent/context-log.ts`, config `contextLog`, env `MMA_CONTEXT_LOG`): writes the full LLM context (system prompt + tool definitions + message history) to `<session>/context.diff`. Snapshot 0 is the complete context (every line `+`, like a new git file); each later snapshot is a plain unified line diff (`-` removed, `+` added) against the previous iteration. Sections are `[SYSTEM]`, `[TOOLS]`, `[HISTORY]`. Secrets are redacted via a dedicated, conservative pattern set (`redactContextSecrets`; `contextLog.redact`, default on) that targets recognizable tokens (sk-, ghp_, AKIA, JWT, Bearer, `api_key=`/`token=`/`password=`) and leaves ordinary context text (skill names, `pass "background: true"`, etc.) intact. The file is append-only: a second run adds a `run <pid> · <timestamp>` separator and restarts with a full snapshot while snapshot numbering continues. Model **reasoning/text/tool calls** are not part of the outgoing context and are recorded as separate `[OUTPUT]` annotations (`▍`), never diffed. Hooked in `Agent.executeSingleAgentLoop` next to the prefix monitor; no-op when disabled.
+
+## [1.1.0] - 2026-09-19
+
+### Added
+
+- **Reasoning mode in the REPL prompt** (`src/cli/repl.ts`, i18n `repl.you_reasoning`/`repl.you_reasoning_cont`, en+ru): the input prompt now shows the active reasoning state - `You [auto]:` under the auto policy, `You [auto→high]:` when a level override is in effect, and the effective level (`You [high]:`) in a fixed mode. The label is rebuilt after every slash command and after a run, so a `set_thinking` override and `/reasoning <level>` are reflected immediately.
+
+### Fixed
+
+- **`/reasoning <level>` had no effect in auto mode** (`src/core/agent/reasoning-resolver.ts`, `src/core/agent.ts`, `src/tools/set-thinking.ts`): the chosen level was stored in `reasoningState.level` but never consulted while `reasoning.mode` was `auto`, so the policy always won. It is now a **persistent manual override** (`ReasoningState.manual`) that takes priority over the auto policy and is cleared by `/reasoning auto`; `set_thinking` keeps its transient cooldown behavior.
+
+## [1.0.1] - 2026-09-18
+
+### Fixed
+
+- **Garbled streamed output** (`src/ui/md-formatter.ts`): the live partial line was streamed raw and then overwritten with the formatted line using a cursor rewind equal to the **last chunk's** length (and, on completion, it re-formatted only the tail). Any line delivered in multiple chunks — i.e. every real answer — left the raw prefix on screen and mixed it with the formatted text (missing/swapped Cyrillic characters, leaked `▍` markers, broken tables; observed in `ses_mu6w6jmk`). The stream now tracks the **cumulative** displayed line, rewinds the full display width, and opts in to partial streaming only for rich terminals (`reservedCols` keeps the `- ` prefix from wrapping). A partial that would exceed the terminal width now freezes instead of wrapping, where a relative cursor move is meaningless.
+- **REPL banner directory** (`src/cli/repl.ts`): `Директория` showed `process.cwd()`, which `bun run` sets to the package root — so `mma -d <dir>` reported the wrong folder. It now shows the agent workspace (`baseDir`).
+- **Misleading prompt-overflow warning** (`src/core/bootstrap.ts`, `src/core/agent.ts`, i18n en+ru): the per-block startup/summary warning compared a single block's size against the whole system-prompt budget and claimed e.g. "AGENTS.md (3232 tok) exceeds the budget (3276 tok)" when the block fits and only the aggregate does not. Both messages now state the total requirement (`~N tok`) alongside the block that gets compressed.
+- **Interactive-command hint** (`src/tools/bash.ts`): a command that aborts waiting on stdin without a TTY (`Operation cancelled`, `stdin is not a TTY` — e.g. a bare `bun create`) now returns a non-interactive remedy instead of letting the model retry it unchanged.
+- **Infinite status-tool loop** (`src/core/agent.ts`): identical `session_info`/`process_list`/`process_log`/`file_info`/`project_map` calls are nudged and then hard-stopped in interactive runs. Mutating tools stay nudge-only, so a legitimate edit/build/read cycle is not cut short.
+- **Removed the "short/empty response" uncertainty warning** (`src/modules/hallucination/confidence.ts`): a short but valid reply (greeting, terse acknowledgement, one-line confirmation) was flagged as uncertain even though the warning neither retried nor blocked anything. Real truncation is already caught by the provider's `finish_reason: "length"` and emptiness by the empty-response retry, so the check only produced false positives on legitimate answers.
+- **First-run input freeze + wizard corruption** (`src/cli/relaunch.ts`, `src/cli/main.ts`, `src/ui/line-editor.ts`): the wizard and the REPL must not share a process. On Bun/Windows the raw-mode `LineEditor` only receives keypresses when it is the first stdin consumer, and reusing one editor across `wizard → bootstrap → REPL` leaked prompt/frame state. First run now collects settings with the cooked-mode `SetupPrompt` (no raw-mode/readline), persists them, and **re-execs the CLI in a fresh process** (`spawnSync`, inherited stdio, `MMA_POST_SETUP=1` guard) — the new process sees the config, skips the wizard, and creates its editor first thing. Separately, the DSR cursor query is now **opt-in on Windows** (`MMA_DSR=1`; default on elsewhere) because ConPTY could mis-decode the `ESC[row;colR` reply as typed input (every wizard prompt answered "R"); it is also never sent while a `question()` is pending.
+
+## [1.0.0] - 2026-09-18
+
+### Added
+
+- **Unified output bus**: new `src/output/` layer — `OutputEvent`/`OutputBus` (`types.ts`, `bus.ts`) with monotonic ids, one-to-many fan-out and per-subscriber exception isolation. Producers emit events instead of writing to the terminal directly.
+- **Single terminal writer**: `OutputChannel` (`channel.ts`) owns `process.stdout`/`stderr` and coordinates with the REPL prompt. Four ownership modes — `idle` (prompt owns the screen; `log`/`block` go through `printAbove`), `streaming` (direct passthrough; a partial line is closed before any `log`), `modal` (events queued FIFO, flushed on `endModal`), `quiet` (human output dropped for `--json`). One singleton per process (`getDefaultChannel()`); `clearScreen()` clears via the prompt sink, and synchronous bursts are batched into a single `printAbove` + frame render.
+- **Prompt-aware line editor**: `LineEditor.printAbove()` prints a block above the input frame and redraws it; `suspendFrame()`/`resumeFrame()` hand the terminal to the agent during streaming; `setInputEnabled(false)` swallows printable keys while keeping Ctrl+C. The DSR cursor anchor is re-enabled with a 150 ms timeout fallback and `MMA_DSR=0` opt-out (ConPTY can buffer DSR replies).
+- **Machine-readable sinks**: JSON (`json-sink.ts`) and session (`session-sink.ts`) subscribers on the bus; `--json` results now include a `diagnostics` array of warn/error events. `writeMachineJson()` (`machine.ts`) is the one sanctioned raw-stdout JSON contract.
+- **Plugin output surface**: `HostBridge.subscribeOutput()` (`src/modules/types.ts`) lets plugins (web-ui, trace-server) observe log/probe/banner events and re-broadcast them.
+
+### Changed
+
+- **All output routes through the bus**: `Logger`, `Renderer`, `Spinner`, REPL, CLI subcommands, setup wizard, certification, security commands and the MCP client now emit to `OutputBus`/`OutputChannel` instead of writing directly. The REPL drives terminal ownership explicitly (`beginStreaming`/`endStreaming`, `suspendFrame`/`resumeFrame`).
+- **Background probes log silently**: the startup context/reasoning probes (`src/core/bootstrap.ts`) write to `app.jsonl` via `logger.logSilent` and no longer interleave with the wizard or prompt.
+- **Setup wizard runs before bootstrap**: first-run orchestration (`src/cli/setup-order.ts`) runs `setup` → `applyAnswers` → `bootstrap`, so no background probe starts while the wizard owns the terminal.
+- **Interactive tools use `PromptIO`**: `question`/`approve` read through an injected `PromptIO` (`src/tools/prompt-io.ts`) instead of opening a competing readline interface.
+- **Root logger lines gain a `[mma]` source tag**: the default logger emits with `source: "mma"`, so root log lines are now `[INFO] [mma] <ISO> — <text>` (previously `[INFO] <ISO> — <text>`). Subsystem loggers keep their own prefix and are unchanged.
+
+### Removed
+
+- **Direct `console.*` / `process.*.write` in `src/`**: forbidden by the new guard test (`tests/output/no-direct-console.test.ts`), with a tiny allowlist — `crash-handler` (must survive a broken output layer), `output/machine.ts` (JSON contract), `browser/bridge-server.mjs` (child-process JSON-RPC pipe) and the non-TTY REPL `printAbove` fallback.
+- **Unused Logger color helpers** (`LEVEL_COLORS`/`isColorEnabled`) — colors moved to `formatEventLine` (`src/output/format.ts`).
+- **Dead `PluginOutputBridge`** — superseded by `HostBridge.subscribeOutput`.
+
 ## [0.63.3] - 2026-09-17
 
 ### Fixed
+
 - **Plan-alignment false positives hard-blocked legitimate writes**: `checkPlanAlignment` (`src/modules/execution/module.ts`) could accumulate 3 "outside the current step" warnings and block a tool call the agent needed for the current step (observed in `ses_mu5wed4r`: the current step's own `src/main.ts` was blocked). Causes fixed:
-  - **Path separators were not normalized** (root cause): model tool calls pass absolute Windows paths (`C:\…\src\main.ts`) while plan steps name files relatively (`src/main.ts`); the raw substring comparison never intersected backslash vs forward slash, so *every* write was treated as off-path. Both sides now go through `planPathToken` (forward slashes + lowercase) before matching.
+  - **Path separators were not normalized** (root cause): model tool calls pass absolute Windows paths (`C:\…\src\main.ts`) while plan steps name files relatively (`src/main.ts`); the raw substring comparison never intersected backslash vs forward slash, so _every_ write was treated as off-path. Both sides now go through `planPathToken` (forward slashes + lowercase) before matching.
   - The completed-step rewrite exemption compared paths one-directionally (`finishedPaths.some((s) => s.includes(p))`), so a done step naming `main.ts` did not exempt a rewrite of `src/main.ts` — the overlap check is now bidirectional, mirroring the current-step comparison.
   - Read-only diagnostic/structural tools were not exempt: `lsp_check` (mandated by the system prompt after every write) and `project_map` now join the allow-list (`PLAN_ALIGNMENT_EXEMPT_TOOLS`), alongside the other filesystem-reads, web/memory/session reads, process introspection and interactive prompts. Only file-mutating tools are pinned to the current step's file tokens.
 - **Plugin-blocked calls were treated as real tool failures**: a guard refusal (`onBeforeTool` → `false`/string) is now flagged `blocked` on `ToolResult` and propagated to the context message (`src/tools/executor.ts`, `src/core/agent/tool-batch.ts`, `src/modules/context/manager.ts`). Blocked calls no longer feed the compaction "Already tried & failed — do NOT repeat" memory, the per-tool repeated-failure rule, or the consecutive-failure recovery counter — so a transient guard (or a guard bug) cannot convince the agent to never retry a correct action.
 
 ### Added
+
 - **Browser launch overrides**: `MMA_BROWSER_EXECUTABLE` (absolute path) and `MMA_BROWSER_CHANNEL` (`chrome`/`msedge`/`chromium`) let the browser tool use an installed system browser instead of Playwright's pinned Chromium. When the bundled revision is missing (offline / blocked CDN) it now falls back to `chrome`, then `msedge`, automatically (`src/modules/browser/driver.ts`, `bridge-server.mjs`).
 
 ## [0.63.2] - 2026-09-17
 
 ### Fixed
+
 - **Long answers were silently cut by the completion cap**: `max_tokens` (default 4096) is sent on every request; when the model hit it while already streaming text, `finish_reason: "length"` was ignored and the truncated text was accepted as the final answer. The provider now emits a non-fatal `warning` chunk (`src/llm/openai-compat.ts`, streaming and non-streaming paths) that the agent renders in the chat — the answer still arrives, but the user sees it was cut off. Tool-call/empty-response truncation keeps the existing recoverable-error path.
 - **Resumed sessions lost their history**: `saveAssistantMessage` and `logToolResult` (`src/core/session-logger.ts`) persisted only the first 500 chars of each assistant/tool message, so `/resume` seeded the model with truncated context. Full content is stored now; the context budget still trims what actually goes to the LLM.
 
 ## [0.63.1] - 2026-09-17
 
 ### Added
+
 - **`ui.verbose`**: opt-in chatty mode for internal orchestration status. MoE planning / re-plan / execution / scope one-liners (`src/core/agent-moe.ts`) are now behind this flag (default `false`) instead of always being written to the chat.
 
 ### Changed
+
 - **Failed tool output is no longer echoed verbatim**: the chat used to print the full model-facing `result.output` of any tool without a `display` — including `Hint:` / recovery directives / "Do NOT …" instructions written for the agent. Only the first non-empty line (the gist of the error) is shown now, in red (`compactToolError`, `src/core/agent/tool-output.ts`).
 - **Live busy spinners for tool runs**: the renderer animates while `read_file` / `write_file` / `edit_file` / `bash` / … execute and restarts the spinner on every LLM "thinking" phase. Previously the spinner stopped at the first tool call and the rest of the run looked frozen. Interactive tools (`question`, `approve`) never spin; dead `BUSY_TOOLS` set removed.
 
 ## [0.63.0] - 2026-09-17
 
 ### Added
+
 - **REPL `/provider add`**: add a provider without leaving the agent. Mirrors `mma provider add` — `/provider add <name> [--url <url>] [--key <key>] [--priority <n>] [--context-window <n>] [--rpm <n>] [--parallel <n>]`. Seeds the legacy provider into `provider.entries` on first use, saves the config and hot-reloads the agent; switch with `/provider use <name>`. `/provider` autocompletion now includes `add`; i18n `repl.provider_add_missing_value`, `repl.provider_switch_hint` (en+ru).
 
 ### Changed
+
 - **Subcommand dispatch via handler maps** (new architecture rule #17): `/provider`, `/model` and `/skill` (`src/cli/repl-commands.ts`) and `SkillNameProvider.complete` (`src/cli/completer.ts`) now resolve subcommands through a `Record<string, handler>` map instead of `if (subcmd === …)` chains.
 
 ## [0.62.0] - 2026-09-17
 
 ### Added
+
 - **Prompt-cache awareness (cloud + local)**: every provider declares its cache behavior via a new `CacheCapability` (`ProviderCapabilities.cache`, overridable per entry with `provider.entries[].cache`). The OpenAI-compatible provider now sends the right request hints per backend — `cache_prompt` (llama.cpp), `prompt_cache_key` (OpenAI), `session_id` (OpenRouter sticky routing) — while `x-opencode-session` is gated by `sessionHeader` (legacy behavior preserved when no capability is set). `parseCacheUsage` (`src/llm/cache-usage.ts`) normalizes response formats (OpenAI/LM Studio/llama.cpp/vLLM/OpenRouter/Zen/Go, DeepSeek, Anthropic, Ollama) into `Chunk.usage.cache`.
 - **Cache metrics & savings**: `ModelPrice.cachedInput`/`cacheWrite`, `calculateCostDetailed` and `CostTracker.saved` bill cached reads at the cached rate and report the savings; builtin cached-read prices for MiniMax/GLM. A client-side prefix monitor (`src/core/agent/prefix-monitor.ts`) classifies why a cacheable prefix broke (`system`/`tools`/`history`/`volatile`) even when the provider reports nothing.
 - **Cache display**: a single footer line (`Cache: 87% hit · saved $0.42`, or `Prefix stable: 93% · broke: tool set`) in the REPL, single-run result and `--json` (`cache`); `mma session show <id>` aggregates `llm_usage` into token totals and cache hit rate.
@@ -49,10 +213,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **`mma usage`**: shows the active provider's balance/usage. OpenRouter is supported (`GET /key` for per-key usage/limit, plus `GET /credits` for account balance when a management key is configured); other providers report that they do not expose an API balance (OpenCode Zen/Go show it in the web dashboard).
 
 ### Changed
+
 - **Code comments are Russian** (new architecture rule #15).
 - **Cross-platform rule** (new architecture rule #16): processes/paths/shell/FS code must work on Windows, macOS and Linux (no `mklink`, no `npx` for local tools, quote paths, skip-not-fail tests when an OS lacks a primitive).
 
 ### Fixed
+
 - **One-shot subcommands hung when piped**: `mma session show <id> | cat` never exited because `bootstrap()` fired the background startup health check, which spawns an LSP/npx child that `process.exit` does not reap — the orphan kept the stdout pipe open. Subcommands never run an agent, so `setOneShotMode` now skips that check (detected in `main.ts` before `program.parse`). The recursive `postAction → process.exit(0)` hook (nested subcommands previously never fired it) is kept, and the startup check's `npx tsc` fallback now uses the local tsc.
 - **Prefix-cache line false alarm**: the footer treated the first iteration (`cause: unknown`, ratio 0) and normal history appends (`cause: none`) as a broken prefix. It now shows `Prefix stable …` only for a real break (`system`/`tools`/`history`/`volatile`) and surfaces the most recent such break even if later iterations are stable again.
 - **TypeScript checks were slow and unreliable**: syntax/type checks shelled out to `npx tsc`, which on Windows takes 5–13s (and tries the network without a local `typescript`), tripping test timeouts and stalling writes. New `resolveTscCommand` (`src/modules/lsp/project-root.ts`) runs the nearest local `tsc` via the current runtime (`process.execPath`), used by `verifier.ts`, `lint-on-write.ts` and `audit-runners.ts`; when no local tsc exists the check is skipped fast instead of hanging. The nested-project verifier test now links TypeScript with a cross-platform `symlinkSync(..., "junction")` instead of Windows-only `mklink`, and `bash.test.ts` resets the leaked grace window between tests.
@@ -60,35 +226,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.61.1] - 2026-09-16
 
 ### Fixed
+
 - **OpenCode Go rejected every request**: `/chat/completions` returned `400 MissingSessionID` because the OpenAI-compatible provider sent no `x-opencode-session` header. The provider now sends the live session id (threaded through `ProviderOptions` → `ProviderManager` → `Agent`/`bootstrap`, plus the MoE orchestrator) and a `micro-models-agent/<version>` User-Agent on every chat and `listModels` request.
 - **Dev runs self-updated the global install**: running from TypeScript sources (`bun run mma`, `bun --watch src/cli/main.ts`) read the checkout's `package.json` version and `npm install -g`'d the published one over the user's install. The background updater is now skipped when the entry is a TS source; real installs (`dist/main.js` via `bin/mma.mjs`) still update.
 
 ## [0.61.0] - 2026-09-15
 
 ### Added
+
 - **Budget share controls**: `mma context --system <f>` / `--reserve <f>` and REPL `/context system <f>` / `reserve <f>` set `contextBudget.systemPrompt` / `responseReserve` (validated 0.05–0.9, system + reserve < 0.95). `mma context` and `/context` with no argument now print the budget breakdown (system / reserve / history in tokens and %). `mma config set contextBudget.systemPrompt <f>` keeps working.
 
 ### Changed
+
 - **Overflow fix advice**: the "system prompt exceeds budget" warning no longer only snaps to a coarse standard context size — a 32K project was jumping straight to `131072`, which looked arbitrary and was often unusable on a local model. The hint (`prompt.overflow.hint_*`, en+ru) now states the raw requirement (`needs ~N system tokens; current budget: W × f = B`) and both levers: raise `contextWindow` to the exact minimum (with the standard size) **or** keep the window and raise `contextBudget.systemPrompt` to the required share (`mma context --system <f>`).
 
 ### Fixed
+
 - **`mma context` ignored `MMA_CONFIG_DIR`**: it saved to a hardcoded `~/.mma/config.json`; it now writes to the config dir resolved by bootstrap.
 
 ## [0.60.1] - 2026-09-15
 
 ### Fixed
+
 - **Silent prompt-overflow summarization**: the startup dry-run warns that AGENTS.md / the project map "will be summarized before the first run", but the actual summarization ran with no notice — the first prompt appeared to hang while a local model rewrote a large AGENTS.md. `resolvePromptOverflow` now emits (en+ru, `prompt.overflow.*`): a "compressing N block(s)…" line before it starts, a per-block "summarizing \"label\" (N → M tok)…" line before the model call, a "truncating …" line on the fallback, and a failure line before falling back to truncation.
 - **Hardcoded English startup logs**: model auto-load success/failure, reasoning probe result, project indexing start/finish/failure, unreadable index entries and background-processes-killed-on-shutdown were untranslated; they now use `env.*` keys (en+ru). Project indexing now announces start and completion (`Indexed N file(s)`), so a slow first walk no longer pauses startup silently.
 
 ## [0.60.0] - 2026-09-15
 
 ### Added
+
 - **`session_info` tool** (`src/tools/session-info.ts`, `alwaysOn`): the model can now answer questions about the session it is running in — id, name, model, provider, context window, message count, timestamps and **live context usage** (`tokens / history budget (percent)` from `ContextManager.getSnapshot()`). Reads live metadata through a new `sessionManager` getter on `ToolContext` (like `sessionId`/`sessionContext`), so a REPL `/new` or `/resume` is reflected immediately. Previously the model reported having "no access to session metadata".
 - **Session prompt block** (`session.info_full`, en+ru): the system prompt carries a compact `[Session: "name" (id) | model: … | context: … tokens]` line so session identity is available passively as well.
 - **Project-map command**: `mma map [summary|refresh|find <query>]` (CLI) and `/map [summary|refresh|find <query>]` (REPL) let the user inspect the index directly — `summary` prints the exact text injected into the system prompt, `refresh` re-indexes, `find` searches by path or exported symbol. Shared implementation in `src/modules/indexer/map-command.ts` (also used by the `project_map` tool for `find`).
 - **Multi-language index**: symbol extraction was TS/JS-only and the extension whitelist stopped at 10 types. New `src/modules/indexer/symbols.ts` is a data-driven registry — adding a language is one rule plus extensions. It now indexes and extracts symbols for TypeScript/JavaScript, Python, Rust, Go, Java, Kotlin, C#, Ruby, PHP, Swift, Scala, C/C++, Shell and Lua (plus data formats: JSON, Markdown, YAML, TOML, XML, HTML/CSS); symbols are deduped and capped at 40 per file. `map-select.ts` now reuses `isCodeLanguage()` instead of its own list.
 
 ### Fixed
+
 - **Session metadata never reached the model**: `SessionModule.getSystemPromptBlock()` was collected once during bootstrap, but the session is created during that same bootstrap with `messageCount === 0`, so the block was always `null`. It is now collected through `getDynamicPromptBlocks`; content is deliberately limited to stable per-session fields (no message count) so the system prompt does not mutate every turn and the prefix KV-cache survives.
 - **Prompt-overflow messages not localized**: the overflow warnings emitted by `agent.ts` and the startup check in `bootstrap.ts` were hardcoded English; they now use `t("prompt.overflow.*")` and respect the configured locale (en+ru). The model-facing hint block stays English by design.
 - **Project map showed no source files**: the map listed the first 100 files in `readdir` walk order, which on a real workspace can be entirely docs/config/tests — on this repo the first 100 walked files contained **zero** `src/` entries, so the model had no idea about the project's code structure. New `selectMapFiles` (`src/modules/indexer/map-select.ts`) ranks source above tests above docs/config, puts the densest source directory first (no directory names hardcoded), drops lockfile noise, and sorts deterministically (KV-cache); the listing is capped at 80 files. The index still contains every file, so `project_map find` is unaffected.
@@ -97,6 +270,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.59.0] - 2026-09-05
 
 ### Added
+
 - **Instructions overflow handling**: AGENTS.md and the project map that exceed the system-prompt budget are no longer silently dropped — they are summarized by the LLM into the remaining budget (disk-cached in `<project>/.mma/cache/prompt-summaries`, invalidated by file edits/budget changes) or truncated with a marker; a small essential hint block tells the model what was compressed and to `read_file` the full source
 - **Startup overflow warning**: bootstrap dry-runs the system budget with the real block set and warns the user when instructions/project map will not fit, with a concrete fix — `mma context <N>` for a global `contextWindow`, or an edit of `provider.entries[].contextWindow` in `config/provider.json` when the active entry overrides it
 - **Context probe**: at startup MMA asks LM Studio's native API for the context length the model is actually loaded with and compares it with the configured `contextWindow` — warning on overflow risk (no auto-clamp, user decides), info suggestion when the model supports more; result logged as a `context_probe` session entry
@@ -105,16 +279,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.58.2] - 2026-09-01
 
 ### Fixed
+
 - **Stale i18n in published package**: `build:copy-assets` did not refresh `dist/i18n/en.json`/`ru.json`, so the 0.58.1 release shipped the old startup-check wording in the standalone JSON files (only `dist/main.js` had the fix). The copy step now ships the current dictionaries.
 
 ## [0.58.1] - 2026-09-01
 
 ### Fixed
+
 - **Startup check overreach**: the `lsp.startup_header` prompt block instructed the model to "fix these before continuing", overriding `SCOPE DISCIPLINE` — the 9B model started fixing pre-existing project errors the user never asked about (and skipped clarifying questions). The block is now informational (baseline only): errors are listed but the model is told to ignore them unless the current request is about them (en+ru).
 
 ## [0.58.0] - 2026-08-31
 
 ### Added
+
 - **MoE experts**: dynamic expert registry — `config.experts` (with optional `ExpertConfig.description`) is rendered into the MoE planner prompt instead of a hardcoded code/research/browser/vision list (fallback: `tool_tags`)
 - **MoE orchestrator provider**: `OrchestratorClient` builds its provider through `ProviderManager` — per-entry `contextWindow`/`retry`/`rateLimits` and failover entries are honored; `orchestrator.contextWindow` is the global fallback (legacy `{type,baseUrl,apiKey}` configs keep working)
 - **MoE success criteria**: machine-readable `success_criteria` (`file-exists:<path>`, `substring-in-file:<path>:<text>`, `command-exit-0:<cmd>`) verified by `StepVerifier.verifySubtaskCriteria` before merge; LLM-only criteria surface as warnings in the Router context
@@ -124,9 +301,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **ToolResult.usage**: sub-agent token usage propagated to the MoE executor for cost attribution
 
 ### Changed
+
 - **Reasoning policy baseline**: configurable via `reasoning.baseline` (default `medium`) — the auto policy's quiet-iteration level is no longer hardcoded, so trivial Q&A turns can start at `low`
 
 ### Fixed
+
 - **MoE hang**: sub-agents spawned by the `subagent` tool re-entered `runWithMoE` when the parent config had `moe.enabled=true` — each MoE sub-agent planned its own subtasks and spawned nested sub-agents recursively (bounded only by `maxRecursionDepth`), hanging execution for many minutes with zero progress events. Sub-agents now always run the plain single-agent loop (`moe` is a top-level orchestration mode only).
 - **MoE fallback visibility**: missing `orchestrator.model` with `moe.enabled=true` now logs a WARN with a fix hint instead of a debug-only message that made silent fallback to single-agent invisible.
 - **CLI one-shot commands hang**: `config`, `session`, `model`, `provider`, `context`, `security`, `plugins`, `changelog` printed their result but never exited — bootstrap leaves open handles (reasoning-probe fetch, indexer) and only the prompt/REPL paths called `process.exit`. Subcommand roots now exit via a `postAction` hook (verified: `session list` 2.7s / exit 0, chained `config set` persists correctly).
@@ -143,6 +322,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.57.2] - 2026-08-30
 
 ### Changed
+
 - **KV-cache**: plan block removed from system prompt; plan status now injected into `<system-summary>` envelope after every tool batch. System prompt is immutable per session — local backends retain prefix cache.
 - **Provenance**: provider entry resolution uses active entry label, not bare `provider.type`
 - **Reasoning signals**: `consecutiveToolSuccesses` and `isRepetitive` now feed real values to the reasoning policy (were hardcoded)
@@ -156,6 +336,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **errMsg**: replaces 23 occurrences of `e instanceof Error ? e.message : String(e)` across 12 files
 
 ### Fixed
+
 - **chunk_query**: one failing chunk no longer kills the entire query; per-chunk `catch` → `[FAILED]`
 - **chunk_query**: synthesis prompt capped at 20K chars with `[TRUNCATED]` marker
 - **chunk_query**: `AbortSignal` propagated to `chatText` for cancellation support
@@ -167,6 +348,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **LSP /lsp check**: fixed latent bug where `.execute()` was called with `.executeByName` signature
 
 ### Added
+
 - **Plan Reminder**: static `[Plan Reminder]` block in system prompt (never mutates)
 - **Documentation**: reentrancy warning on `executeByName()`, `PlanResult` JSDoc
 - **Tests**: `probe.test.ts` (6 cases), `command-suggest.test.ts`, `providers-factory.test.ts`, `subagent-tool.test.ts`, `agent-moe-write.test.ts`, `chunk-query.test.ts`
@@ -175,21 +357,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Security-policies**: `comparePolicies` typed (`keyof SecurityConfig` replaces `as any`)
 
 ### Removed
+
 - **Browser**: dead `buildWaitScript` export (never imported)
 
 ## [0.57.1] - 2026-08-28
 
 ### Fixed
+
 - **Publish**: republish after version bump
 
 ## [0.57.0] - 2026-08-28
 
 ### Changed
+
 - **MCP**: lazy connect — server connections deferred to first tool call. Startup no longer blocks on unreachable MCP servers (e.g. context7 offline). Discovery runs in background with 5s timeout.
 - **Updater**: `checkOnStart` and `autoInstall` disabled by default. Reduced `waitForIdle` timeout from 130s to 10s.
 - **Config**: `updater.checkOnStart` default changed from `true` to `false`
 
 ### Added
+
 - **MCP**: HTTP request timeouts (10s) on `connectSSE`, `listToolsHTTP`, `callToolHTTP`
 - **MCP**: `failedServers` tracking — servers that fail discovery are not retried
 - **MCP**: placeholder `connect` tool for not-yet-discovered servers (LLM can trigger lazy discovery)
@@ -198,17 +384,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.56.5] - 2026-08-27
 
 ### Fixed
+
 - **Hallucination**: `FactualCheck` now receives deleted files from `ConsistencyCheck` — no longer false-positives on files that were intentionally deleted in the same session
 
 ## [0.56.4] - 2026-08-27
 
 ### Fixed
+
 - **Tools**: `list_dir` now filters `.mma/`, `node_modules/`, `.git/`, `dist/`, `build/`, `coverage/` from directory listings (consistent with indexer)
 - **Hallucination**: `dotfileVariants` now tries dot-prefixing each directory component, not just basename (fixes false positive on `.mma/index-cache.json` → `mma/index-cache.json`)
 
 ## [0.56.1] - 2026-08-27
 
 ### Added
+
 - **CLI**: `mma changelog` command — show latest changelog entry or diff between versions (`--from <version>`)
 - **Updater**: show changelog after auto-update install (`updater.installed` message includes new version's changelog)
 - **Docs**: `CHANGELOG.md` included in npm package (visible via `npm info micro-models-agent`)
@@ -217,6 +406,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.56.0] - 2026-08-27
 
 ### Added
+
 - **MoE**: live re-plan loop in `runWithMoE` — orchestrator re-plans on structural failures
 - **MoE**: scope expansion protocol (`scope_request`) for cross-expert file access
 - **MoE**: Esc/interrupt support in the MoE execution path
@@ -225,6 +415,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Tools**: syntax pre-validation and auto-fix for `write_file`/`edit_file`
 
 ### Fixed
+
 - **Security**: SSRF via IPv6-mapped IPv4 and raw numeric hostnames
 - **Security**: command-validator blacklist bypasses (shell expansions, encoded chars)
 - **Security**: audit webhook retry queue drained forever (infinite loop + duplicate notifications)
@@ -244,6 +435,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.55.1] - 2026-08-25
 
 ### Fixed
+
 - **LLM**: NDJSON-tolerant stream parser for Ollama backends
 - **LLM**: mid-stream provider errors surfaced (Ollama generation failures)
 - **LLM**: `delta.reasoning` alias for thinking models
@@ -252,63 +444,75 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.55.0] - 2026-08-25
 
 ### Added
+
 - **Certification**: targeted re-run (`--scenarios <ids>`) with result merging
 - **Certification**: per-rep timeout (`--timeout <ms>` + per-scenario `timeoutMs`)
 - **Certification**: audit-gate bypass fix for `--exit-on-complete`
 
 ### Fixed
+
 - **Certification**: stale-label wording (removed impossible user instruction)
 - **Dependencies**: typescript pinned to ^5.9 (TS7 preview breaks `@types/node`)
 
 ## [0.54.0] - 2026-08-24
 
 ### Added
+
 - **Certification**: global manifest shipped with package updates (`~/.mma/certifications.json`)
 - **Certification**: bundled manifest + startup sync from package
 
 ### Fixed
+
 - **Certification**: marks only showed when running from repo root
 
 ## [0.53.0] - 2026-08-24
 
 ### Added
+
 - **Certification**: qwen3.5-9b certified 20/20
 - **Config**: `provider.maxCompletionTokens` option
 - **Certification**: label text in `mma model list` and REPL `/model`
 
 ### Fixed
+
 - **Certification**: reasoning-heavy models truncated tool_call arguments at default 4096 cap
 - **Certification**: scenario 3.5 prompt disambiguation
 
 ## [0.52.0] - 2026-08-23
 
 ### Added
+
 - **Execution**: `FS_MUTATING_TOOLS` — plan auto-advance after bash/download/subagent/mcp/pipeline/browser tools
 - **Config**: `provider.maxCompletionTokens` plumbing through ProviderManager → agent
 
 ### Fixed
+
 - **Execution**: small models create files via bash instead of `write_file`, stalling plans
 - **Execution**: `maxCompletionTokens` was never read from config
 
 ## [0.51.0] - 2026-08-23
 
 ### Added
+
 - **Plugin**: `HostBridge` interface for bidirectional agent communication
 - **Plugin**: `onTurnEnd(ctx, TurnSummary)` hook — dispatched once per completed run
 - **Plugin**: `web-ui` example plugin — browser-based chat with SSE streaming
 - **CLI**: REPL bridge wiring for web-ui submit/interrupt
 
 ### Fixed
+
 - **REPL**: `/config migrate` unreachable
 
 ## [0.50.3] - 2026-08-22
 
 ### Fixed
+
 - **UI**: REPL line editor scroll-proof rendering (absolute anchoring via DSR query)
 
 ## [0.50.2] - 2026-08-22
 
 ### Fixed
+
 - **LLM**: idle stream timeout increased 60s → 180s (LM Studio buffering)
 - **LLM**: stall diagnosis with dedicated message for SSE buffering
 - **LLM**: truncation no longer masquerades as empty response
@@ -318,6 +522,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.50.1] - 2026-08-21
 
 ### Fixed
+
 - **Security**: no longer silently overrides explicit user opt-out
 - **Lint**: skips missing lint binary (was appending error to every write)
 - **Stuck**: anti-spam for stuck-warnings (dedup via key, decay per-tool counters)
@@ -329,17 +534,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.50.0] - 2026-08-21
 
 ### Added
+
 - **Provider**: health probe (`probeProviders()` + `mma provider check`)
 - **Provider**: code-only capability routing (`ProviderManager.pickFor()`)
 - **Provider**: per-entry isolation + priority fallback order
 - **Pricing**: per-provider cost attribution + breakdown
 
 ### Fixed
+
 - **Provider**: transparent failover on 429/5xx/network errors
 
 ## [0.49.0] - 2026-08-20
 
 ### Fixed
+
 - **REPL**: stale-plan leaks — plan state no longer persists across sessions
 - **REPL**: plan checklist prints only on plan/todo tool-end events
 - **Plan**: `PlanStore` is single source of truth for UI consumers
@@ -347,22 +555,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.48.3] - 2026-08-20
 
 ### Fixed
+
 - **Hallucination**: dotfile false-positive (`.prettierrc.json` extracted as `prettierrc.json`)
 
 ## [0.48.2] - 2026-08-20
 
 ### Fixed
+
 - **REPL**: stale plan printed on first agent run of a session
 
 ## [0.47.0] - 2026-08-19
 
 ### Added
+
 - **Session**: startup diagnostics logging (environment, LSP probe, baseline typecheck)
 - **Session**: `logBaselineTypecheck()` for post-mortem visibility
 
 ## [0.46.1] - 2026-08-19
 
 ### Fixed
+
 - **LLM**: connection-break hardening (stream-level retry, no-data timeout, `[DONE]` tracking)
 - **LLM**: non-streaming timeout (was missing, could hang forever)
 - **Config**: `retry.maxStreamRetries`, `retry.noDataTimeoutMs` options
@@ -370,17 +582,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.46.0] - 2026-08-19
 
 ### Added
+
 - **Provider**: multi-provider + hot-swap + per-message provenance
 - **Provider**: `ProviderManager` with entry-based config
 - **CLI**: `mma provider add/list/use`
 - **REPL**: `/provider list/use`
 
 ### Fixed
+
 - **Path**: `safeResolvePath` POSIX bug (absolute paths re-resolved against baseDir)
 
 ## [0.45.0] - 2026-08-18
 
 ### Added
+
 - **Provider**: provider module Phase 1 (registry, presets, `createProvider()`)
 - **Provider**: `openrouter` preset
 - **Setup**: wizard menu built from `BUILTIN_PROVIDERS`
@@ -388,15 +603,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.44.0] - 2026-08-18
 
 ### Added
+
 - **Plugins**: folder plugins (subdirectory with entry file)
 - **Plugin**: `trace-server` split into folder plugin
 
 ### Fixed
+
 - **Plugin**: template-literal page inlining broke `\n` in JS strings
 
 ## [0.43.2] - 2026-08-17
 
 ### Fixed
+
 - **Execution**: plan done-gate on known compile failures (typecheck gate)
 - **Bootstrap**: live getters for `sessionId`/`sessionContext` after session switch
 - **Edit**: `edit_file` "String not found" hint to `read_file` first
@@ -404,6 +622,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.43.1] - 2026-08-17
 
 ### Fixed
+
 - **Agent**: session-interrupt no longer renders tool results after "Session ended"
 - **Executor**: `onAfterTool` plugins skipped when signal is aborted
 - **Lint**: abortable syntax checks on Esc
@@ -411,12 +630,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.43.0] - 2026-08-17
 
 ### Added
+
 - **Plan**: `plan delete <id>` + `plan purge` actions
 - **Plan**: `abort` honors `id` parameter
 - **Plan**: `replan` renumbers ids for kept steps
 - **Audit**: `resolveTestCommand` picks the project's real test runner
 
 ### Fixed
+
 - **Plan**: `switch` to already-active plan is a no-op
 - **Plan**: final audit runs for a completed plan
 - **Plan**: evidence-based plan nudge (replaces iteration counter)
@@ -427,15 +648,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.42.0] - 2026-08-16
 
 ### Added
+
 - **Execution**: automatic error web search (≥5 same-error repeats → web search → inject results)
 - **Config**: `errorWebSearch` section
 
 ### Fixed
+
 - **Execution**: `onAfterTool` double-counted typecheck + failure errors
 
 ## [0.41.1] - 2026-08-16
 
 ### Fixed
+
 - **LSP**: `typescript@5` pin + `--yes` for npx
 - **LSP**: sequential probing (waves) to avoid npx cache lock contention
 - **LSP**: stale config normalization
@@ -446,6 +670,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.41.0] - 2026-08-15
 
 ### Added
+
 - **REPL**: live plan checklist with progress bar
 - **UI**: tool-to-step binding (`← step N` suffix in tool headers)
 - **UI**: background command output preview
@@ -453,11 +678,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.40.1] - 2026-08-15
 
 ### Fixed
+
 - **LSP**: broken package names (`vscode-html-languageserver` → `vscode-langservers-extracted`)
 
 ## [0.40.0] - 2026-08-15
 
 ### Added
+
 - **Tools**: tool-set narrowing (on-demand enable via `enable_tools`)
 - **Config**: `tools.defaultTags` + `tools.enableOnDemand`
 - **Tools**: `alwaysOn` flag for structural tools
@@ -465,40 +692,48 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.39.1] - 2026-08-14
 
 ### Fixed
+
 - **Plugins**: dedup by version, compatibility gate, source tracking
 - **CLI**: `mma plugins list` command
 
 ## [0.38.0] - 2026-08-14
 
 ### Added
+
 - **LSP**: `lsp_check` tool for on-demand diagnostics
 - **Plan**: `plan create` guard (blocks when active plan has progress)
 
 ### Fixed
+
 - **Context**: compaction summary carries plan + read state
 - **Browser**: bridge path resolution in bundled dist
 
 ## [0.37.0] - 2026-08-13
 
 ### Added
+
 - **Plugins**: folder plugin support in `PluginLoader`
 
 ### Fixed
+
 - **Plugin**: template-literal page inlining broke `\n` in JS
 
 ## [0.36.3] - 2026-08-13
 
 ### Fixed
+
 - **UI**: REPL paste fix (batch single-render, CRLF collapse)
 
 ## [0.36.2] - 2026-08-13
 
 ### Fixed
+
 - **Updater**: silent logger, one-shot `process.exit()` killed background install, semver-aware check
 
 ## [0.36.1] - 2026-08-13
 
 ### Fixed
+
 - **Audit**: nested-file resolution, non-zero test run blocks
 - **Browser**: bridge diagnostics + one-shot restart
 - **LSP**: per-server disable + initialize retry + CSS timeout
@@ -507,11 +742,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.36.0] - 2026-08-12
 
 ### Added
+
 - **Plan**: model-declared `kind: "create"|"delete"` for steps
 - **Execution**: `FS_MUTATING_TOOLS` for plan auto-advance
 - **Config**: `provider.maxCompletionTokens` option
 
 ### Fixed
+
 - **Context**: compaction preserves session `mission`
 - **Context**: deleted files leave compaction `[Files:]` list
 - **Audit**: final audit runs real `tsc --noEmit --skipLibCheck`
@@ -520,12 +757,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.35.5] - 2026-08-12
 
 ### Fixed
+
 - **Execution**: plan-alignment phantom paths (domains/extensions treated as files)
 - **Execution**: hint/recovery dedup in `StuckDetector`
 
 ## [0.35.3] - 2026-08-11
 
 ### Fixed
+
 - **LSP**: workspace root resolved from edited file's project
 - **Audit**: skipped steps treated as terminal
 - **Bash**: Windows hint keys on original command word
@@ -534,17 +773,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.35.0] - 2026-08-11
 
 ### Added
+
 - **Tools**: `download_file` tool for binary file downloads
 
 ## [0.34.0] - 2026-08-10
 
 ### Added
+
 - **Indexer**: project profile (`[Stack: ...]` summary from manifest)
 - **Indexer**: dynamic map refresh inside sessions
 
 ## [0.33.3] - 2026-08-10
 
 ### Fixed
+
 - **Audit**: nested-file resolution (basename + path-suffix match)
 - **Plan**: `plan show` honors `id` parameter
 - **Context**: compaction interval reset per user turn
@@ -559,18 +801,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.33.2] - 2026-08-09
 
 ### Fixed
+
 - **UI**: REPL conversation layout (user/agent message dividers)
 - **Tools**: `isFilePathLike` uses allow-list of file extensions
 
 ## [0.33.1] - 2026-08-09
 
 ### Fixed
+
 - **UI**: REPL line editor redraw fix (no duplicated multi-line input)
 - **Tools**: `web_fetch`/`web_browse` description clarifications
 
 ## [0.33.0] - 2026-08-09
 
 ### Added
+
 - **RLM**: pass-by-reference sub-agent results (`ArtifactStore`)
 - **RLM**: chunked parallel queries (`chunk_query` tool)
 - **Config**: `subagent.resultMode`, `maxSummaryChars`, `artifactsDir`, `stableSystemPrompt`
@@ -578,6 +823,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.32.0] - 2026-08-08
 
 ### Added
+
 - **Browser**: driver abstraction (`PlaywrightDriver` + `BridgeDriver`)
 - **Browser**: Node bridge for Bun compatibility
 - **Config**: `browser.maxConsoleLineChars`
@@ -585,6 +831,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.31.0] - 2026-08-08
 
 ### Added
+
 - **Security**: session file encryption (AES-256-GCM)
 - **Security**: audit notifications (file + webhook)
 - **Security**: security policies (strict/balanced/permissive)
@@ -593,16 +840,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.30.0] - 2026-08-07
 
 ### Added
+
 - **Execution**: final audit gate (runs `bun test` for verification steps)
 - **Execution**: `detectTestResults()` auto-verification in bash
 
 ### Fixed
+
 - **Execution**: empty-CLI entry-point hint
 - **Bash**: Windows anti-patterns documentation
 
 ## [0.29.0] - 2026-08-07
 
 ### Added
+
 - **Bash**: smart UTF-8/OEM line decoding (fixes Cyrillic on Windows)
 - **Bash**: behavior-based background detection
 - **Bash**: stuck-detector bash awareness
@@ -610,6 +860,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.28.0] - 2026-08-06
 
 ### Fixed
+
 - **Agent**: double-Esc interrupt fix (Bun readline keypress collapsing)
 - **Agent**: abortable in-flight LLM requests on interrupt
 - **UI**: clipboard paste hint
@@ -617,12 +868,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.27.0] - 2026-08-06
 
 ### Fixed
+
 - **Security**: Windows hardening
 - **Hallucination**: fixes
 
 ## [0.26.0] - 2026-08-05
 
 ### Added
+
 - **UI**: opencode-style inline tool headers (`ui.toolStyle`)
 - **UI**: model commentary next to tool calls (`ui.toolComments`)
 - **UI**: diffs without background color
@@ -630,6 +883,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.25.0] - 2026-08-05
 
 ### Added
+
 - **LSP**: LSP module (typescript, CSS, HTML, JSON, Python, Rust, Go)
 - **Execution**: audit gate language-agnostic
 - **Bash**: Windows command hints
@@ -637,18 +891,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ## [0.24.0] - 2026-08-04
 
 ### Added
+
 - **Context**: quality formula upgrade (token load + compaction loss + error density + freshness)
 - **Read**: display mode (show only header in REPL, full content to LLM)
 
 ## [0.23.0] - 2026-08-04
 
 ### Added
+
 - **Certification**: model certification module (`mma model certify`)
 - **CLI**: cert checkmarks in model lists
 
 ## [0.22.0] - 2026-08-03
 
 ### Added
+
 - **Security**: `enabled` flag (disabled by default)
 - **CLI**: init/first-run apply wizard security answers
 - **Prompt**: system prompt & recovery messages cleanup