openvisio-agent 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -0,0 +1,797 @@
+# Changelog
+
+## [0.22.0] — 2026-09-10
+
+- Carry the agent’s configured role and voice through every session, with cached identity when the roster is unavailable.
+- Let agents request their own coding workspace and carry forward findings without asking teammates to reassign work. Record the continuation in the source context graph and Studio.
+- Bound graph recall to direct source neighbors so shared nodes cannot pull in unrelated conversations.
+
+- Let the agent's native final turn end a cycle. Remove required code mutations, ticket updates, PR evidence, and forced recovery turns from the completion decision.
+- Deliver and persist the agent's actual response, including research, questions, and blockers, without automatically completing the ticket or rerunning an unchanged assignment after restart.
+- Expose advertised MCP capabilities independently of scheduling classification; allow native reading, search, browsing, planning, and context tools in reply sessions while keeping local writes scoped to coding workspaces.
+- Keep Claude context warm like Codex and OpenCode, tolerate unavailable optional history, and treat runtime deadlines as inactivity watchdogs.
+
+## [0.21.1] — 2026-09-10
+
+- Recover identifier-owned assignments even when the agent is missing from `list_agents` or the roster request fails. Keep numeric-assignee compatibility, fresh ticket verification, and reassignment guards.
+- Center Studio and its transparent sidebar together, with the OpenVisio logo, locally bundled Satoshi, and OA-style cards with white frames and recessed gray panels.
+- Show recorded task activity across agents and add Plan, Commands, and Response views with bounded content and responsive layouts.
+- Add a Documentation card in the sidebar and a mobile header link to the local guide.
+
+## [0.21.0] — 2026-09-09
+
+- Add per-agent Studio settings for reply and coding models, with runtime model choices, private atomic saves, stale-edit protection, and live application to the next request.
+- Start Studio automatically alongside backend watchers and support app/chat buttons that open a selected agent's model settings.
+- Surface OpenCode main-request rate limits promptly, release the blocked session, and include a Studio settings CTA in the blocker.
+- Distinguish rate-limited cycles from successful completions in Studio and document local-machine controls and upgrade requirements.
+
+- Route explicit ticket-creation requests through the authenticated coordination bridge and recognize creation failures without replaying the mutation.
+- Skip confirmed duplicate mentions before network lookups; bound optional thread context to one second while retaining authoritative final-delivery checks.
+- Include message identities in duplicate logs and report intake and delivery timing separately from queue and model time.
+
+## [0.20.0] — 2026-09-08
+
+- Add `openvisio-agent studio`: a local live viewer of watcher processes, cycles, explicit plans, tool calls, and coding progress, with a separate demo mode.
+- Mark unfinished cycles and runtimes from stopped or replaced watchers offline; retain stable keyboard focus during updates and reveal linked cycles through existing filters.
+- Ship a plain-language user guide and local, printable Studio help with keyboard instructions, status explanations, setup, and troubleshooting.
+- Record bounded, credential-redacted activity locally without blocking agent execution; closing the viewer leaves agents running.
+- Include the executable scenario catalogue in the npm package so its advertised command works after installation.
+- Add an executable catalogue of over 1,000 BYO workspace scenarios, including production watcher integration sequences and machine-readable results.
+- Unify assignment identity precedence, recover owned-thread context, keep distinct messages distinct, and persist threaded replies through delivery outages without rerunning models.
+- Correct cancellation, timeout, session cleanup, tool evidence, memory isolation, transport retry and parsing, PR authorization, and task-column edge cases found by the scenario suite.
+- Align the runtime specification, prompts, and README on model preservation, setup PR authority, retries, and recovery behavior.
+- Fix issues reproduced in live validation: prefer the server's `create_task_comment` capability, keep Codex commentary out of final replies, and remove agent-directory credentials before ACP model delivery.
+- Subscribe to the verified organization for live channel events, restore the subscription after reconnect, and share guarded mention routing without self-replies or duplicate fanout responses.
+
+## [0.19.12] — 2026-09-08
+
+- Register agent-authored completion threads as owned conversations, and recover older roots from verified backend thread authorship before filtering follow-ups.
+- Route explicit build/test repair requests using the completion thread's PR context, preserve original-thread delivery, and retain redirect, cancellation, and replay guards.
+
+## [0.19.11] — 2026-09-08
+
+- Enable routine PR branch publishing in coding setup, shared by future clones and linked worktrees. Keep an opt-out and repository revocation.
+- Check authorization-blocked tickets every two seconds, clear stale failure gates when authorized, and recover legacy helper denials once.
+- Route new threads to the agent’s dedicated channel, preserve source-thread replies, and stop older answers from suppressing fresh follow-ups.
+- Remove unreachable pre-Mastra Codex/OpenCode runners, lazily load the watcher for CLI commands, retain bounded warm sessions, and use asynchronous Git snapshots.
+- Reconcile three projects concurrently and start ticket work before optional activity reads. Keep per-thread ordering with bounded parallel replies.
+- Require completed ACP tool evidence; route helper failures as structured blockers. Allow scoped coordination mutations without enabling local tools, and never retry those mutations after ambiguous failures.
+- Deduplicate unchanged memory observations and separate per-thread write waits. Log queue, preflight, first-event, and runtime latency.
+
+## [0.19.10] — 2026-09-08
+
+- Route ticket implementation requests and assignment notifications through live assignment lookup into independent coding workers before the restricted chat runtime runs.
+- Pick up actionable assignments discovered during pending-ticket questions, unless the requester explicitly asks for status only. Preserve ownership checks, queue deduplication, and review/testing handoffs.
+- Keep automatic backlog pickup working when the activity feed is unavailable, and resolve agent identity when a ticket lookup arrives before startup reconciliation.
+- Explicit `--chat-only` installations still require a coding workspace; no remote runtime dispatch API is available in this watcher.
+
+## [0.19.9] — 2026-09-08
+
+- Fix reproduced missing-credential MCP failures by isolating the Codex stdio bridge from inherited HTTP server configuration.
+- Preserve exact model selections, persist same-model shorthand resolution, honor the Codex chat model, and disable automatic generation/family/effort substitution.
+- Log redacted ACP error details and distinguish completed turns with tool failures from clean success.
+- Other findings from the integration audit remain outstanding.
+
+## [0.19.8] — 2026-09-08
+
+- Publish the accumulated local 0.19.5–0.19.7 changes: pending-ticket reads, warm ACP sessions, and the Codex chat MCP allowlist.
+- Known limitations: the integration audit identified unresolved reply suppression, permission classification, work-evidence, identity lookup, and latency issues. This version does not resolve those findings.
+
+## [0.19.7] — 2026-09-07
+
+- Fix Codex ACP's opaque MCP permission requests by enforcing a strict read-only tool allowlist in the private chat bridge, safely approving those requests, and retrying idempotent chat reads once.
+
+## [0.19.6] — 2026-09-07
+
+- Permit named OpenVisio team-state reads in chat-only ACP sessions while continuing to reject mutations, local filesystem access, and execution, fixing live project lookups reported as cancelled.
+
+## [0.19.5] — 2026-09-07
+
+- Answer pending-ticket questions with fast watcher-owned MCP reads, avoiding model-side project discovery and `list_agents` cancellation failures.
+- Keep Mastra ACP sessions warm per ticket or conversation thread, cache model negotiation, send the static charter once per session, and bound idle reply sessions with LRU eviction.
+
+## [0.19.4] — 2026-09-07
+
+- Stop promoting read-only reply discovery failures such as `list_agents` into generic intervention blockers; the watcher supplies its known identifier and reserves fail-closed blocker delivery for failed mutations.
+
+## [0.19.3] — 2026-09-07
+
+- Recover untagged human follow-ups in persistently owned threads during backlog reconciliation, including messages suppressed by the former pre-routing duplicate acknowledgement.
+
+## [0.19.2] — 2026-09-07
+
+- Preserve recipient ownership after an agent is explicitly tagged in a thread, so later human follow-ups are handled without repeated @mentions; explicit redirects, stand-downs, and other-agent chatter still fail closed.
+
+## [0.19.1] — 2026-09-07
+
+- Negotiate Codex and OpenCode selections against each ACP session's advertised models, resolving shorthand family names to the closest available effort-qualified or provider-qualified model before work starts.
+- Normalize versioned Claude model names to stable family aliases and configure Claude's native ordered fallback models for unavailable or overloaded selections.
+
+## [0.19.0] — 2026-09-07
+
+- Run Codex and OpenCode workers as isolated Mastra ACP sessions while preserving their existing local authentication, OpenVisio MCP access, worktree scoping, cancellation, and evidence gates.
+- Persist ticket and conversation context with Mastra Memory and local libSQL; retain the compact JSON graph only as an exact delivery/deduplication ledger.
+- Stop broadcasting working, thinking, and typing presence updates from autonomy workers, eliminating notification noise during long runs.
+- Run up to three independent ticket workers concurrently while serializing tasks that share a mutable worktree; keep reply delivery serialized and cancellation scoped to the matching worker.
+- Include a bounded, credential-redacted failure reason beside each failed Codex MCP call so transport, authorization, throttling, and backend errors are distinguishable.
+
+## [0.18.15] — 2026-09-07
+
+- Launch Codex ticket cycles and their recovery attempt with the prepared ticket worktree as the actual process directory, rather than relying only on a prompt hint.
+
+## [0.18.14] — 2026-09-07
+
+- Pause an evidence-gate failure at its resulting ticket revision so the watcher's own blocker update and backlog reconciliation cannot create an infinite retry loop; resume once after a genuine ticket change.
+- Direct assigned coding work to an existing ticket-specific local worktree and keep completion-delivery retries from rerunning repository work.
+
+## [0.18.13] — 2026-09-07
+
+- Route feature tickets containing words such as “message”, “status”, or “label” to the coding lane unless they begin with an explicit coordination command.
+- Supply exact internal project/ticket argument shapes to assigned-task tool calls and log remote MCP failures with credentials removed.
+
+## [0.18.12] — 2026-09-07
+
+- Route Codex through a local authenticated MCP bridge that removes credential fields from model-visible schemas and injects them into backend calls outside the model.
+
+## [0.18.11] — 2026-09-07
+
+- Teach Codex agents to discover deferred OpenVisio MCP actions with native tool search before claiming the server or a ticket lookup is unavailable.
+
+## [0.18.10] — 2026-09-07
+
+- Make the injected OpenVisio MCP server required for Codex cycles and allow 30 seconds for startup, preventing a failed tool connection from becoming a successful prose-only reply.
+- Keep live assignment and ticket lookups available in watcher-delivered replies so agents resolve task slugs themselves.
+
+## [0.18.9] — 2026-09-07
+
+- Fail closed on unaddressed human activity fanned out from previously mentioned threads, while recognizing exact full-name mentions and punctuation correctly.
+- Make agents resolve assigned work through the live OpenVisio MCP board before asking teammates for a project or ticket slug.
+- Keep OpenCode fast reply cycles MCP-only with explicit denials for local grep, file, shell, web, and delegation tools, preventing oversized ripgrep JSON records from disrupting chat replies.
+
+## [0.18.8] — 2026-09-05
+
+- Replace assignment coalescing with independent FIFO cycles, stable-key duplicate suppression, shared backlog/event verification, and authoritative checks before queued work starts.
+- Give reply runners a chat-only workspace configuration; add explicit OpenCode reply permissions and keep thread cancellation effective during recovery.
+- Bound MCP requests and activity calls, discover paginated tool lists, and avoid resetting healthy sessions after late expiry responses.
+- Retain unresolved tool failures across recovery; reject unknown completion states and Codex MCP error results as evidence.
+- Await model process termination before releasing cancelled lanes, and terminate POSIX tool process groups during cancellation/shutdown.
+- Save credentials, replay state, and memory atomically with private permissions. Remove ticket-text authorization shortcuts and unsafe branch-reset/blanket-staging instructions.
+- Preserve complete mention instructions and carry explicit source-thread identity into blocker delivery.
+
+## [0.18.7] — 2026-09-04
+
+- Claude, Codex, and OpenCode coding cycles now require completed runtime-observed repository actions; assistant prose and a successful process exit can no longer close work by themselves.
+- A progress or intent message no longer ends a coding cycle. The watcher preserves the original request and thread context through one focused continuation, permits a distinct final result after progress, and requires that final result before conversation-originated code work is accepted.
+- Recovery delivery keeps only the latest verified answer, so an earlier promise is never concatenated into the final watcher-owned reply.
+
+## [0.18.6] — 2026-09-02
+
+- BYO coding prompts now treat an existing local repository as the primary code surface and reserve linked-codebase read/write/branch/commit tools for cases where a repository cannot be obtained locally.
+
+## [0.18.5] — 2026-09-01
+
+- BYO system prompts now reserve numeric project/task ids for MCP arguments and require the backend's project-scoped ticket slug in every human-facing message, comment, PR description, summary, blocker, and result.
+- Watcher-owned completion reports use canonical uppercase slugs such as `OVS-57`. Older backends that omit a slug fall back to the ticket title instead of exposing or inventing a numeric reference.
+- Verified assignment prompts carry both identities explicitly: the slug for communication and the numeric ids for tool calls, preventing models from copying database ids into conversation.
+
+## [0.18.4] — 2026-09-01
+
+- Conversation events are now treated as wake-up hints, not ownership. The watcher validates the actual source message and ignores redirects, explicit other-agent recipients, and unaddressed agent-authored chatter before starting a model.
+- A direct stand-down cancels queued or running work for that source thread across Codex, Claude Code, and OpenCode, suppresses stale final delivery, and receives at most one terse confirmation.
+- Coding intent now requires both an action and a concrete repository target, so product discussion containing words such as “feature”, “API”, or “file” cannot accidentally start a full coding cycle.
+- Generic “picked this up” messages were removed. Activity state shows accepted work; the first durable message is a verified result or concrete blocker.
+- Watcher-owned Codex prompts now have one consistent delivery contract: `post_message` is disabled and the watcher performs the authoritative, cancellation-aware thread post.
+- The companion bare-agent frontend path is thread-scoped, fail-closed on ambiguous follow-ups, and revalidates a live conversation before allowing `post_message`.
+
+## [0.18.3] — 2026-09-01
+
+- BYO watchers now discover and cache the backend MCP `tools/list` response instead of assuming every deployment exposes the same optional tools.
+- A missing `comment_ticket` tool no longer strands verified completions in an endless reconnect retry loop. Completions continue through the verified ticket state and deduplicated project-channel report; blockers fall back to an `update_ticket` description note.
+- Backend prompts no longer advertise absent ticket-comment tools or mistake MCP resource discovery for team actions.
+
+## [0.18.2] — 2026-08-31
+
+- Backend MCP initialization now supports both Streamable HTTP modes. A successful initialize without `Mcp-Session-Id` is treated as stateless instead of fatal; stateful session expiry still gets one bounded reinitialize and retry.
+- Concurrent startup probes share one initialize promise, and stateless tool 4xx responses no longer cause initialize loops.
+- OpenCode's generated API-key MCP configuration now explicitly disables OAuth discovery and uses a bounded connection timeout, matching the current official remote-MCP configuration.
+- Every OpenCode work and reply lane now gets a private per-agent config directory. The code repository is passed separately with `--dir`, and a higher-precedence runtime config prevents stale shared-workspace credentials from replacing the active agent identity.
+- Backend introductions are watcher-owned for Claude, Codex, and OpenCode. First connection no longer spends a model cycle that can hallucinate relay-only inbox tools.
+- Backend prompts explicitly forbid `get_marching_orders`, `poll_inbox`, and `get_resource`, while failed OpenCode tool events retain a bounded, credential-redacted diagnostic in watcher logs.
+
+## [0.18.1] — 2026-08-31
+
+- Codex message delivery is now watcher-owned. Guarded cycles cannot call `post_message`; the watcher fetches the real backend thread, recognizes this agent across REST and WebSocket sender shapes, and skips an exact or already-answered reply before rendering.
+- Reconnected activity mentions now pass through the same per-message path as live WebSocket mentions instead of one batched model reply. Stable delivery keys and independent queued replies persist across restarts.
+- BYO agents now maintain a bounded local memory graph keyed by real project, ticket, channel, thread, and message ids. Verified task states, blockers, and deliveries are recalled only for related work so agents do not redo or re-say completed actions.
+- Codex now prefers OpenVisio's authenticated linked-codebase branch, commit, and pull-request MCP tools, avoiding local `git push`. Repositories without that tool path have a one-time scoped fallback: `authorize-pr-push` installs a narrow Codex rule; `push-pr-branch` accepts no arguments and can only push `HEAD` to the matching authorized `agent/*` branch; `revoke-pr-push` removes access.
+- A missing PR-push authorization produces one visible blocker and pauses the ticket. Reconciliation detects the local authorization later and resumes the same ticket without requiring approval text to be copied into the ticket.
+
+## [0.18.0] — 2026-08-31
+
+- Codex cycles now recover from an expired command-session id by starting a fresh command instead of polling the dead process again. Exact non-fatal Codex model-catalog and stale-process diagnostics no longer appear as agent activity, while genuine tool and cycle failures remain visible.
+- OpenCode BYO cycles now use the CLI's JSON event stream and must show completed repository and ticket actions before the watcher accepts a coding task as successful. Exit code zero and model prose alone are not completion evidence.
+- An OpenCode acknowledgement without work triggers one focused recovery cycle. If evidence is still incomplete, the watcher reports the blocker, releases the de-duplication key, and keeps the ticket eligible for later task events and reconciliation retries.
+- Ticket comments are first-class backend MCP actions again. The watcher adds one persisted, evidence-verified completion comment for every assigned coding handoff, while blockers continue to comment on the ticket immediately.
+- Single-watcher locking now uses atomic file creation and fails closed. WebSocket mentions and reconciliation activity also share a short-lived content signature, preventing one logical message from creating two reply cycles.
+
+## [0.17.6] — 2026-08-30
+
+- Agent-authored messages now use a first-person voice throughout. Completions say “I finished”, blockers say “I'm blocked”, and introductions rely on the sender identity already displayed by the app instead of restating the agent's name.
+- The shared reply discipline explicitly forbids third-person self-reference in acknowledgements, progress, blockers, results, and routine conversation.
+
+## [0.17.5] — 2026-08-30
+
+- Successful assigned coding work now produces exactly one runtime-owned project-channel result after the watcher verifies both a review/done ticket handoff and a real GitHub PR URL.
+- Completion delivery mentions the ticket creator when available, survives reconnects through a persisted pending queue, and persists a revision key so duplicate task events cannot repost it.
+- Ticket comments no longer count as channel completion, and the coding model is told not to race the watcher with its own backlog announcement.
+
+## [0.17.4] — 2026-08-30
+
+- Tickets in review, testing, QA, verification, or approval columns are now settled handoffs for the coding watcher. Reconnect reconciliation clears stale policy pauses and does not spend another model cycle on a PR that is waiting for human review.
+- Moving a ticket back to an actionable column still produces a fresh `task:updated` work cycle.
+
+## [0.17.3] — 2026-08-30
+
+- Blocker ticket fallbacks no longer quote the channel's approval CTA, preventing the agent's own ticket update from being mistaken for human authorization and immediately releasing the pause.
+
+## [0.17.2] — 2026-08-30
+
+- Blocker delivery now carries explicit project, ticket, and channel metadata instead of trying to recover ticket identity from model prompt prose. Backlog blockers therefore alert the project channel and update/comment on the correct ticket.
+- Every BYO runtime blocker now has a visible delivery path: policy refusal, timeout, spawn/runner error, failed MCP action, and failed evidence recovery.
+- Push-authorization CTAs include the rejected commit, remote alias, branch, and exact approval wording when available.
+
+## [0.17.1] — 2026-08-30
+
+- Codex safety-policy rejections are now classified as blocked outcomes instead of successful cycles. The watcher stops recovery/retry churn, persists the paused ticket, and publishes an action-required notice with the rejected command.
+- Policy-blocked tickets resume only after their ticket carries explicit authorization for the repository push, or after they are completed or unassigned.
+- Assigned and reconciled coding tasks now resolve a project activity channel and emit `thinking` followed by a heartbeat-backed `working` state even when no channel mention started the task.
+- Work and reply lanes now own independent activity targets, preventing reply typing from overwriting or clearing a concurrent coding status. Working heartbeats are reduced to one every 20 seconds, while stale thinking and typing indicators expire quickly in the app.
+
+All notable changes to `openvisio-agent`. This project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [0.17.0] — 2026-08-30
+
+### Changed
+
+- Rebuilt the Codex BYO runtime around the documented agent WebSocket contract and a normative state machine in `docs/CODEX_BYO_AGENT_SPEC.md`.
+- `task:assigned` is now the primary pickup signal. Assignment events must pass a fresh `get_ticket` ownership/open-state verification before a cycle starts; `task:updated` remains a compatibility signal.
+- Startup recovery processes one authoritative open ticket per work cycle rather than handing a model an undifferentiated batch.
+- Codex completion and blocker claims are evidence-gated. An incomplete recovery emits `WORK_CYCLE_FAILED`, leaves the ticket retryable, and cannot be treated as done based on model prose.
+
+### Fixed
+
+- Agent activity now calls authenticated `POST /channels/:id/agent-state` and backs off on HTTP failures. The invalid `agent_status` WebSocket frame has been removed.
+- Codex MCP `post_message` calls now drive the documented typing state.
+- The frontend now consumes `channel:agent:thinking`, `channel:agent:working`, and `channel:agent:typing`, matching the backend protocol.
+
+### Added
+
+- `npm run certify` is a mandatory pre-release gate covering shipped syntax, behavior tests, frontend typecheck, package contents, diff hygiene, task verification, lane isolation, activity protocol, and completion evidence enforcement.
+
+## [0.16.2] — 2026-08-29
+
+### Fixed
+
+- Completed, closed, resolved, cancelled, and archived tickets are excluded across status fields, timestamps, and decorated board-column names.
+- Processed WebSocket mentions and recovered activity IDs persist across restarts, preventing old mentions from generating fresh unsolicited replies.
+- Backlog-only work updates its ticket with evidence but cannot announce progress or completion in an unrelated channel. Channel results require an explicit source thread.
+
+## [0.16.1] — 2026-08-29
+
+### Fixed
+
+- Multi-mention messages are filtered before starting a model. An agent mentioned in an earlier thank-you now stays silent when a later `@agent` receives the actual request, while explicitly shared requests still reach both agents.
+
+## [0.16.0] — 2026-08-29
+
+### Added
+
+- A single watcher now runs two independent Sol lanes: one serialized repository-work lane and one reply lane. Mentions can be answered immediately while an assigned coding task continues, without starting a second WebSocket watcher or duplicating event delivery.
+- Coding mentions receive one immediate threaded acknowledgement from the reply lane and are queued for execution on the work lane, preventing concurrent edits to the same workspace.
+
+## [0.15.2] — 2026-08-29
+
+### Fixed
+
+- Preserve WebSocket error-envelope details instead of logging every backend rejection as `{}`.
+- Detect backend stages that reject `agent_status` and disable the live-status heartbeat after the first rejection, preventing repeated errors and unnecessary battery/network use during long Codex cycles.
+
+## [0.15.1] — 2026-08-29
+
+### Changed
+
+- Codex now uses `gpt-5.6-sol` for every watcher cycle, including messaging, mentions, coordination, MCP work, backlog recovery, and coding. The Codex lightweight lane is disabled.
+
+## [0.15.0] — 2026-08-29
+
+### Fixed
+
+- Codex coordination now defaults to `gpt-5.6-terra`; Luna is no longer used by default for MCP-dependent watcher cycles. Sol remains the coding model.
+- Codex JSONL output now records the exact OpenVisio MCP tools invoked and reports failed calls without exposing credentials.
+- Assigned-ticket cycles must prove both MCP task interaction (`get_ticket`/`list_tasks` and `update_ticket`) and a repository mutation before they count as complete. Read-only shell inspection no longer satisfies the completion gate.
+- Incomplete Codex cycles receive one focused Sol recovery turn naming the missing MCP or repository actions instead of silently accepting a promise.
+
+## [0.14.0] — 2026-08-29
+
+### Fixed
+
+- Backend/BYO reconciliation now uses the MCP tools that actually exist: `list_agents`, `list_projects`, `list_tasks`, `list_task_types`, and `list_activity`. The backend does not expose `get_marching_orders`, `poll_inbox`, or `comment_ticket`.
+- Assigned non-completed tickets are filtered by the BYO agent's numeric id or identifier and handed directly to the heavy coding lane with task/project metadata.
+- Recent activity mentioning the agent is recovered on start/reconnect and routed to the reply lane without calling nonexistent inbox tools.
+- Removed the backend model-driven startup/daily coordination sweep that could find coding tickets and then publicly say it was unable to code. Zero-model reconciliation replaces it.
+- Backend prompts no longer require nonexistent ticket-comment tools; agents update/move tickets with `update_ticket` and report results in the channel.
+
+## [0.13.1] — 2026-08-29
+
+### Fixed
+
+- Codex completion recovery now catches silent exits and plain-text promises too, not only acknowledgements posted through an MCP message tool. A coding cycle with no repository action retries unless it verified that no task was assigned or reported a concrete blocker.
+
+## [0.13.0] — 2026-08-29
+
+### Fixed
+
+- BYO watchers now recognize task assignments across `agent_id`, camelCase, nested `agent.id`, `assigned_agent`, and wrapped event payload variants.
+- Every process start and WebSocket connection establishes a proper MCP session and reconciles both `poll_inbox` and `get_marching_orders`, recovering mentions, follow-ups, and tasks missed while offline.
+- A zero-model five-minute backlog check discovers pending work without spending model tokens. Unchanged tasks retry after 30 minutes until completed instead of being forgotten after an acknowledgement.
+- Assigned work moves directly into a coding cycle with explicit instructions to start, verify, open a PR, update the ticket, and report evidence rather than promise future work.
+
+## [0.12.0] — 2026-08-29
+
+### Added
+
+- `openvisio-agent stop --name <agent>` unloads launchd/systemd first, terminates every remaining watcher matching that exact agent name, and clears the stale lock.
+
+### Fixed
+
+- Background installation now removes orphaned manual watchers before loading the replacement service, preventing KeepAlive from repeatedly spawning new conflicting processes.
+- Duplicate-watcher errors point to the new one-command cleanup instead of telling users to chase a PID.
+
+## [0.11.1] — 2026-08-29
+
+### Fixed
+
+- Codex coding cycles no longer ask for a pre-work acknowledgement. The first update must contain verified work or a concrete blocker.
+- Assigned tasks default to the coding lane unless they are explicitly board or messaging operations, preventing vaguely titled implementation tasks from being stranded in coordination.
+- The watcher inspects Codex JSONL activity and runs one focused recovery cycle when Codex posts an acknowledgement but performs no repository action.
+
+## [0.11.0] — 2026-08-28
+
+### Changed
+
+- Route messaging, triage, introductions, catch-up checks, and board movement to a lightweight coordination lane. Claude defaults to Haiku and Codex defaults to `gpt-5.6-luna` there.
+- Reserve Sonnet for Claude coding cycles and `gpt-5.6-sol` for Codex coding cycles. Assigned tasks and mentions with clear repository-work signals route to the coding lane.
+- Improve recall and workspace discipline: consult available history before asking users to repeat context, reuse existing clones, read repository `AGENTS.md`, preserve unrelated work, and close every direct concern with a verified result or explicit blocker.
+- Prefer plain punctuation and avoid em dashes in agent replies.
+
+## [0.10.1] — 2026-08-28
+
+### Fixed
+
+- Codex cycles no longer pass mutually exclusive `--sandbox` and
+  `--approve-for-me` flags. Chat-only cycles stay read-only; coding cycles use
+  Codex's reviewed workspace-write approval mode.
+- Duplicate-watcher errors explain why launchd/systemd replaces killed PIDs and
+  print the exact service-stop and log-tail commands.
+- Background installs no longer record an ephemeral `_npx` cache executable;
+  they install and use a stable global `openvisio-agent` binary.
+
+## [0.10.0] — 2026-08-28
+
+### Added
+
+- Codex is now a first-class autonomy runtime via `--agent codex`, using official
+  non-interactive `codex exec`, an isolated OpenVisio MCP configuration, and safe
+  read-only/workspace-write sandbox modes.
+
+### Changed — battery and token efficiency
+
+- Claude exits immediately after its one event cycle instead of remaining resident
+  until another event arrives. This releases the CLI process, file watchers, memory,
+  and idle CPU between tasks.
+- Idle frontend watchers back off from one request every 6 seconds to one per minute
+  (with 5-second polling only during recent activity), cutting idle wakeups by ~90%.
+- A frontend service restart no longer spends a model turn on an unconditional
+  catch-up sweep. The sweep runs only when the first inbox response contains an
+  outstanding task; the daily safety sweep remains.
+- Backend startup catch-up sweeps are capped to once per six hours per agent, so
+  launchd/systemd restart loops cannot repeatedly spend a full model cycle.
+
+## [0.9.0] — 2026-08-28
+
+### Changed — big token-cost reduction
+
+- **No more context accumulation across cycles.** The warm Claude session used to
+  keep up to 15 independent cycles (`MAX_TURNS=15`), so each new cycle re-billed the
+  ENTIRE history of the previous ones (every file read, git output, prior reply) —
+  cost grew quadratically. Autonomy cycles are self-contained, so the session now
+  recycles after EACH cycle (`MAX_TURNS=1`): a cycle only pays for its own work.
+- **Charter + creds moved to a cached system prompt.** The large static charter
+  (toolbox, work ethic, reply discipline) and the AUTH note used to be re-sent inside
+  every cycle's user message — never cached. They now ride in the session system
+  prompt (`--append-system-prompt`), which Claude prompt-caches, so they're billed
+  once and read cheaply on subsequent cycles. Per-cycle messages are now just the
+  small event context + instruction. opencode (no system-prompt flag) folds them into
+  the message but still never accumulates.
+
+Net effect: a routine mention→reply cycle costs a small fraction of what it did before.
+
+## [0.8.1] — 2026-08-27
+
+### Fixed — opencode agents couldn't call the team tools
+
+- The prompts hard-coded Claude Code's tool namespace (`mcp__openvisio-team__post_message`),
+  but opencode exposes MCP tools as `openvisio-team_post_message` — so an opencode agent
+  fumbled every tool call. Prompt tool references are now runtime-agnostic (bare names +
+  a note that the runtime may prefix them; call whatever appears in the tool list).
+  Verified end-to-end: opencode loads the openvisio-team MCP and executes its tools
+  headlessly via `opencode run … --auto`.
+- REMINDER: an agent only runs on opencode if it was connected with `--agent opencode`
+  (the "Runs on" dropdown in the connect modal, or the flag on the CLI). Without it the
+  agent runs on Claude Code — check `~/.openvisio/<name>.json` has `"agent": "opencode"`.
+
+## [0.8.0] — 2026-08-27
+
+### Added — live agent status (thinking / working / typing)
+
+- The watcher now broadcasts what it's doing so humans can see an agent pick up and
+  act on their message in real time. It sends `{type:'agent_status', channel_id,
+  state}` over the WS as it works: **thinking** the instant a mention arrives →
+  **working** while the cycle runs (heartbeat every ~9s) → **typing** the moment it
+  calls `post_message` → **done** to clear. See `docs/AGENT_STATUS.md` for the wire
+  contract the backend fans out as `agent:status`, and the frontend's in-channel
+  status line + floating "acting elsewhere" notices.
+
+## [0.7.1] — 2026-08-27
+
+### Fixed — the REAL cause of duplicate/contradicting messages
+
+- **Single-instance lock.** The duplicates were structural, not a prompt problem:
+  TWO watchers were running for the same agent (a manual `watch` alongside the
+  background launchd/systemd service), each connected to the WS as that agent, so
+  BOTH replied to every mention — and being different versions, the two replies
+  contradicted. `watch` now takes a pid lock (`~/.openvisio/watch-<slug>.lock`) and
+  a second watcher for the same agent refuses to start (stale locks from a dead pid
+  are taken over). One agent → one watcher → one reply. NOTE: kill any extra running
+  watcher and update the global install; a lock only prevents NEW double-starts.
+- **No invented history (anti-hallucination).** The shared reply-discipline now
+  states the agent has NO memory beyond the visible thread + tool results, and must
+  never fabricate past events, competitions, results, links, PR numbers or deploy
+  URLs — if it has no record of something, say so instead of playing along.
+
+## [0.7.0] — 2026-08-27
+
+### Added — opencode runtime
+
+- **Run agents on opencode, not just Claude Code.** New `--agent claude|opencode`
+  flag on `connect`/`watch` (persisted). The cycle runner is now abstracted: Claude
+  Code keeps its persistent stream-json warm session; **opencode** runs a headless
+  `opencode run <prompt> --auto [--model provider/model]` per cycle. Both honour the
+  same event loop, workspace/code flow, intro/sweep, reply-discipline and `/model`
+  control.
+- **opencode MCP wiring.** Instead of `claude mcp add`, an opencode agent gets an
+  `opencode.json` written into its run cwd declaring the `openvisio-team` server as a
+  `{ type: "remote", url, headers }` MCP (Bearer for host agents, x-agent-api-key +
+  x-agent-identifier for backend agents). `connect --agent opencode` best-effort
+  installs the `opencode` CLI and reminds you to `opencode auth login`; the launchd/
+  systemd service PATH now includes opencode's bin dir.
+- **Models are provider/model on opencode.** The default model is left unset (opencode
+  uses its own configured default) and the in-chat `/model` command accepts
+  `provider/model` ids (e.g. `anthropic/claude-sonnet-4`, `openai/gpt-4o`).
+- Frontend: the "Connect your agent" modal has a **Runs on: Claude Code | opencode**
+  dropdown that adds `--agent opencode` to the generated setup command.
+
+## [0.6.2] — 2026-08-27
+
+### Fixed
+
+- **Double / contradicting replies to one mention (real root cause).** The fast-cycle
+  prompt told the agent to reply to the injected mention AND *then* `poll_inbox` and
+  handle follow-ups — so in a single cycle it answered the mention, polled, re-found
+  the very same thread, and answered again with a different take (0.5.1's mention
+  de-dupe didn't cover this because it's ONE event → two posts). The fast prompt is
+  now strictly either/or: **if a specific mention is given, reply once and STOP — no
+  `poll_inbox`**; only cycles with no injected mention poll for follow-ups. The
+  mention prompt also says compose-then-post-once (no "post a reply then a better
+  version"). Mention de-dupe additionally falls back to a channel+text signature when
+  the payload has no message id.
+
+## [0.6.1] — 2026-08-27
+
+### Added
+
+- **Target a specific model tier from chat.** `/model chat <m>` changes only the
+  chat/reply model; `/model code <m>` only the code-work model; `/model <m>` still
+  sets both. Natural language works too ("switch chat model to haiku"). `/model`
+  reports both tiers. Same as the CLI `--model` / `--chat-model`.
+
+## [0.6.0] — 2026-08-27
+
+### Added — model control (stop burning tokens)
+
+- **Configurable model, default `sonnet`.** The agent now spawns Claude Code with an
+  explicit `--model` (default **sonnet** — cost-effective) instead of inheriting
+  whatever `claude` defaults to (often Opus). Set it with `--model <opus|sonnet|haiku|claude-…>`
+  at `connect`/`watch`; persisted to the agent config.
+- **Cheaper chat, capable code (optional).** `--chat-model <m>` runs the lighter
+  chat/mention cycles on an even cheaper model while real code work (full/sweep
+  cycles) stays on `--model` — e.g. `--model sonnet --chat-model haiku`. The warm
+  session is respawned with the right `--model` when a cycle needs a different one.
+- **Change the model live from chat.** An engineer can `@mention` the agent with
+  `/model` (reports the current model), `/model sonnet` / `/model opus` /
+  `/model claude-…`, or "switch model to haiku" — the watcher switches under the
+  hood, persists it, recycles the session, and the agent confirms in-thread. The
+  parser is strict (a valid model name after `/model` or the word "model") so
+  ordinary messages like "use the model file" don't trigger it.
+
+## [0.5.1] — 2026-08-27
+
+### Fixed (reply-discipline edge cases seen in the wild)
+
+- **Double replies.** `agent:mention` events are now de-duped by message id, so a
+  re-delivered mention (reconnect replay / duplicate fan-out) no longer triggers a
+  second reply to the same message.
+- **Repeated acknowledgements.** The 0.5.0 "acknowledge first" turned into agents
+  posting "On it…" several times for one task. Acknowledgement is now ONCE-only:
+  the agent checks the thread/ticket and skips it if it already acknowledged, and
+  only posts again when it has something genuinely new (a result/link/blocker).
+- **Answering things meant for another agent.** A new shared REPLY DISCIPLINE block
+  (on every chat + code cycle) makes the agent act ONLY on messages addressed to it
+  (its @mention, a direct question, or a reply to its own message) and STAY OUT of
+  thread chatter or tasks aimed at someone else — fixes an agent jumping on work
+  another agent was called for. `.followUps` handling is now gated the same way.
+- **Claiming then walking it back.** The discipline block adds "be sure before you
+  speak": verify (call the tool / read the code / check state) BEFORE asserting
+  something is possible/done/broken — one clear final answer instead of thinking
+  out loud across contradicting messages.
+- **New agent slow to catch mentions.** The startup catch-up sweep now runs at ~12s
+  (was 30s) so a freshly-added agent whose WS subscription isn't live yet still
+  picks up pending mentions/tasks via the REST `poll_inbox` sweep right away.
+
+## [0.5.0] — 2026-08-26
+
+### Fixed
+
+- **Task assignments are finally caught.** The watcher listened for a `task:assigned`
+  event that the backend NEVER sends — a task assigned to an agent actually arrives
+  as `task:created` (assigned on create) or `task:updated` (assignee changed), fanned
+  out org-wide (docs/WEBSOCKET.md). It now handles both, keeps only agent-assigned
+  tasks, filters to THIS agent when the payload carries the agent identifier (else the
+  cycle confirms via `get_marching_orders`), and de-dupes by task-id:agent so a noisy
+  stream of `task:updated` doesn't re-acknowledge the same assignment.
+
+### Added
+
+- **Acknowledge before starting.** On an assigned task the agent posts a one-line
+  `comment_ticket` ("On it — picking this up now") BEFORE it begins, then does the work
+  and reports — so the team sees it's been picked up (workspace etiquette). Baked into
+  the task event prompt and `CODE_FULL`.
+- **Introduction on join.** The first time an agent ever connects to a workspace it
+  posts one short, friendly intro to the general channel (who it is, that it picks up
+  assigned tasks + answers @mentions). One-time, tracked by a marker in `~/.openvisio`.
+- **Daily catch-up sweep.** A sweep runs shortly after startup (covers time offline)
+  and once every 24h: it calls `get_marching_orders` + `poll_inbox` and picks up any
+  task assigned or mention received while the agent was disconnected — TASKS first.
+  Added to BOTH the backend-WS loop and the REST warm loop (whose startup poll
+  otherwise marks pre-existing tasks "seen" and would skip offline assignments).
+
+## [0.4.0] — 2026-08-26
+
+### Changed
+
+- **Code mode is the zero-config DEFAULT — no `--workdir` per repo.** An agent lives
+  on your laptop and should just work across the whole org's code. It now operates
+  from a single WORKSPACE root (default `~/openvisio-workspace`, created on demand),
+  finds the repo a task refers to, and **clones it if you don't have it yet** — then
+  branches/tests/pushes/opens a PR inside it. Point it at an existing clones folder
+  with `--workspace <dir>` (`--workdir` is an alias), or disable code work with
+  `--chat-only`. The choice is saved to the agent config so the always-on listener
+  reuses it. (Previously code work required passing `--workdir` every time, and a
+  bare agent was chat-only — the source of "it said it couldn't check a codebase".)
+- **Agents know their job now.** Every cycle prompt opens with a CHARTER that
+  spells out the toolbox and a hard rule: *before you ever say "I can't", check
+  the tools you actually hold.* Fixes the "asked if it could check a codebase, it
+  said no — then yes once reminded there are tools" failure. Code agents are told
+  in plain words they CAN inspect a codebase, clone a repo, branch, and raise a PR.
+- **Work ethic / closing the loop.** The charter mandates finishing the work *in
+  this cycle* and reporting back as the final action — `comment_ticket` with the
+  branch + PR link + test result, plus a channel reply that `@mentions` the
+  requester by exact full name. No more "I'll do X" and stopping; the human should
+  never have to remind the agent to circle back.
+- **Real PR workflow for code agents.** `CODE_FULL` now runs the whole flow:
+  clone the named repo locally if absent → `git checkout -B agent/<slug>` → edit →
+  test → commit → **push the agent's own branch** → **`gh pr create`** → comment
+  the ticket + reply tagging the requester. Pushing a branch and opening PRs are
+  now allowed; `main`/`master`, force-pushes, merges, `gh repo delete`, and the
+  previously-blocked destructive/publish commands stay denied.
+- **Longer code cycles.** A code cycle's watchdog budget is raised from 4 → 15 min
+  so a genuine clone → test → push → PR flow finishes instead of being killed
+  mid-job (an aborted cycle is itself a "never circled back" failure). Chat-only
+  cycles keep the 4-min budget.
+- **Clear mode banner.** The watcher logs whether it's in CODE mode (printing the
+  workspace it clones/branches/PRs from) or CHAT-ONLY mode (`--chat-only`), so an
+  agent's capability is never a mystery.
+- The backend `AUTH` note is scoped to *not hunting for credentials* only, so it
+  no longer reads as "don't use Bash/grep" to a code agent that needs them.
+
+## [0.3.7] — 2026-08-26
+
+### Changed
+
+- **No more polling.** Removed the inbox sweep added in 0.3.5 — the WebSocket
+  (`task:assigned` / `agent:mention`) is the only trigger now. (It was also
+  posting a spurious threaded "follow-up" on the agent's own message.)
+- **Replies stay in the thread.** On a mention the watcher passes the thread root
+  as `parent_id` so the agent replies *inside* that thread instead of starting a
+  new top-level message.
+- **Accurate @mentions.** OpenVisio links a mention only when it's the member's
+  EXACT full name (`@First Last`). The mention prompt now hands the agent the
+  sender's exact display name and tells it to use `@<full name>` so the reply
+  actually notifies/links the user (previously `@First` alone rendered as plain
+  text).
+- Unrecognized `error` WS frames now log the backend's detail instead of a bare
+  "event error".
+
+### Note
+
+- A thread reply that does NOT @mention the agent fires no WS event, so it isn't
+  answered — that requires the backend to dispatch a thread-activity event to
+  participant agents (we won't poll for it).
+
+## [0.3.6] — 2026-08-26
+
+### Fixed
+
+- **The real credential fix.** A debug trace revealed the openvisio-team MCP bridge
+  authenticates **per tool call**, not per connection: every call needs
+  `agent_identifier` + `agent_api_key` as arguments (`post_message` 400s with
+  "Missing agent credentials" otherwise). 0.3.5's "tools are already authenticated,
+  never provide credentials" was exactly wrong. The watcher now **injects the
+  agent's identifier + api_key into every cycle prompt** and instructs the model to
+  pass both on every openvisio-team call — so it posts on the first try with no
+  shelling around to "find credentials".
+- **Removed the typing pulse.** The backend rejects `{type:'typing'}` from an agent
+  connection (it answered every pulse with an `event error`), so it's gone. The
+  `sendTyping` capability remains in the WS client for if/when the backend supports
+  agent typing.
+
+## [0.3.5] — 2026-08-26
+
+### Changed
+
+- **Replies are now near-immediate.** Debug traces showed the agent burning ~40s
+  shelling around (`Bash`/`grep` over `~/.claude`) to "find credentials" before
+  posting — even though the openvisio-team MCP tools are authenticated by the
+  connection. Every prompt now carries a hard rule: the tools are ALREADY
+  authenticated; NEVER look for API keys/tokens/config or run shell to find
+  credentials or tools — call the tools directly, act with the fewest calls, and
+  post the reply FIRST.
+- **Typing indicator.** On an `agent:mention`, the watcher immediately pulses
+  `channel:typing` for that channel over its WS (every 3s until the cycle
+  finishes), so the agent shows as typing right away instead of going silent.
+
+### Added
+
+- **Follows up threads without a mention.** A bounded inbox sweep (every 60s, only
+  within 5 min of real activity, skipped while busy) polls for `.followUps` — so
+  thread replies the agent is part of get answered even when no `@mention` fires.
+  Idle agents spend nothing.
+
+## [0.3.4] — 2026-08-26
+
+### Changed
+
+- **Events now feed their own context into the cycle** instead of relying on
+  `poll_inbox` to re-surface them. The `agent:mention` WS payload already carries
+  `{ channel_id, message }`, so the cycle prompt now tells the agent exactly which
+  channel + message to reply to ("You were @mentioned in channel N: '…' — reply
+  there with post_message"). `task:assigned` similarly injects the task title +
+  description. This fixes the case where a mention was received over the WS but
+  `poll_inbox` returned it empty, so the cycle completed successfully **without
+  replying**. Coalesced events accumulate their context into the next cycle.
+
+## [0.3.3] — 2026-08-26
+
+### Fixed
+
+- **A hung cycle no longer silently swallows every later event.** Cycles now have
+  a 4-minute backstop timeout: if one never returns a result (e.g. an MCP tool
+  stalling on an unreachable bridge), the session is killed, `busy` is released,
+  and queued mentions proceed. Before, one stuck cycle left the watcher accepting
+  `agent:mention` events but never acting on them.
+
+### Added
+
+- **`watch --debug`** logs what each cycle actually does — session init + which
+  MCP servers loaded, every `→ tool` call, tool errors (`✗`), and assistant text —
+  so a silent/non-replying cycle is diagnosable in one run.
+- The WS loop now logs `running <fast|full> cycle…` and `busy — queued …` so it's
+  clear whether an event triggered a cycle or was coalesced.
+
+## [0.3.2] — 2026-08-25
+
+### Changed
+
+- **`connect --backend --ws …` now makes the agent always-on by default.** Setup
+  installs `openvisio-agent` globally and registers the background listener
+  (launchd on macOS, systemd `--user` on Linux) that auto-starts on login and
+  survives reboot — so tagging the agent in a channel is caught with no terminal
+  open. Previously `connect` left nothing installed (an `npx` run vanished) and the
+  WebSocket listener only ran if you manually kept `watch` open. Opt out with
+  `--no-service`; pass `--workdir <repo>` to let the always-on listener code on a
+  branch. `installService` is now exported for this.
+
+## [0.3.1] — 2026-08-24
+
+### Fixed
+
+- **MCP now registers at USER (global) scope.** `claude mcp add` defaults to
+  local (project) scope, so the `openvisio-team` tools were only present in the
+  directory `connect` ran in — and re-prompted elsewhere. Both `connect` and
+  `connect --backend` now pass `--scope user`, so the tools (with credentials
+  baked into the request headers) are available in every project without asking.
+- **`connect` removes any stale `openvisio-team` MCP registration before adding.**
+  `claude mcp add` does not overwrite an existing same-named server, so a changed
+  `--mcp-url` was silently shadowed by the old entry ("I changed the URL but it's
+  stuck on the old one"). Both connect paths now `mcp remove` (user + local scopes)
+  first, then add global.
+
+## [0.3.0] — 2026-08-24
+
+### Added
+
+- **Real-time backend autonomy over WebSocket.** A backend agent can now react to
+  `task:assigned` and `agent:mention` dispatches the instant the backend pushes
+  them, instead of polling.
+  - `connect --backend … --ws <wss-url> --mcp-url <url>` — `--ws` is the org's
+    API-Gateway WebSocket base (same value as the frontend's
+    `NEXT_PUBLIC_BACKEND_WS_URL`); `--mcp-url` registers the `openvisio-team` MCP so
+    the agent has tools to ACT on those events. Both are persisted (config +
+    `OPENVISIO_AGENT_WS_URL` in the env file).
+  - `watch --name <agent>` auto-detects a backend agent and runs the WS loop:
+    connects with `?api_key=&identifier=`, sends periodic keepalives, reconnects
+    with exponential backoff, and drives ONE Claude cycle per event (a burst of
+    mentions coalesces into a single follow-up cycle). `--install` / `--workdir`
+    work the same as the REST loop.
+  - Requires **Node ≥ 21** (built-in global `WebSocket`); on Node 20 run with
+    `--experimental-websocket`. Fails fast with a clear message otherwise.
+
+### Changed
+
+- The Claude warm-session machinery is now shared by both the REST (`--host`) and
+  WebSocket (backend) loops — identical session recycling, guardrails, and prompts.
+
+## [0.2.0] — 2026-08-21
+
+### Added
+
+- **Backend mode** — `connect --backend <url> --key <api-key> --id <identifier>`
+  registers an agent created against the OpenVisio org backend ("Connect your
+  agent"): verifies the credentials live (`x-agent-api-key` +
+  `x-agent-identifier` headers), then saves `~/.openvisio/<agent>.json` and a
+  sourceable `~/.openvisio/<agent>.env` (0600). No setup-token exchange — the
+  one-time api-key from the create screen IS the credential.
+
+## [0.1.0] — 2026-08-12
+
+### Added
+
+- `connect <ovs_code> --host <url>` — redeems the single-use setup code for the
+  agent key, registers the `openvisio-team` MCP server with Claude Code (installing
+  Claude Code if missing), and saves a `600`-perm scoped config under `~/.openvisio/`.
+  Options: `--name "<agent>"`, `--mcp-url <url>`.
+- `watch --name <agent>` — the event-driven "warm" autonomy loop: cheaply polls the
+  inbox (no model spend when idle) and pokes a single persistent Claude Code session
+  per new @mention / follow-up / ticket.
+  - `--install` — background service (launchd on macOS, systemd `--user` on Linux),
+    auto-starts at login.
+  - `--workdir <repo>` — opt-in coding mode: file + Bash tools scoped to that git
+    repo, branch-only, with a destructive-shell denylist (never pushes or merges).
+- `--help` / `--version`.
+
+### Notes
+
+- Zero runtime dependencies (Node ≥ 18, uses built-in `fetch`).
+- Replaces the previous `curl … | bash` one-paste installer with a published,
+  inspectable package.