Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.1] - 2026-08-08

Component Versions

Note: os-skills remains at v0.6.1; it did not change in this release and is listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.14.0, added resumable workspace sessions, MCP management, runtime introspection, and DashScope prompt caching, agents can recover long-running work and extend capabilities while reducing repeated prompt cost (#1546, #1592, #1778, #1949, #2046)
• agentsight: Updated to v0.9.1, added optimization and trajectory analysis together with case containment, system audit, and ActPlane risk enforcement, users can diagnose agent quality and cost while investigating and containing risky behavior (#1728, #1789, #2051)
• agent-sec-core: Updated to v0.9.0, expanded prompt, PII, code, and observability hooks across Qoder CLI, Qwen Code, and Codex, users can apply consistent security policies across supported agent runtimes (#1473, #1480, #1495, #1501, #1529, #1535)
• tokenless: Updated to v0.7.3, added reversible compression with MCP retrieval plus Cosh-NG response and command compression, agents can reduce model context while recovering truncated payloads on demand (#1285, #1376, #1669)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, file-metadata repair, and interactive progress, administrators can select published versions and recover installation drift with visible operation phases (#1700, #1740, #1987, #2036)

Updated

• copilot-shell: Updated to v2.8.0, added the consent-gated /ktuner command, exported COSH_SESSION_ID, and reused compatible cosh-ng authentication during switching, users can tune hosts, correlate subprocess activity, and move between shells with less setup (#1279, #1491, #1951)
• agent-sec-core: Updated to v0.9.0, added Qoder CLI and Qwen Code hook coverage, Codex PII and observability hooks, custom PII rules, and Chinese prompt-injection detection, users receive broader protection across prompts, tool calls, skills, and agent output (#1473, #1495, #1501, #1522, #1554)
• agentsight: Updated to v0.9.1, added ATIF v1.7 trajectory analysis, accuracy/performance/cost workspaces, case containment, system audit, and risk dashboards, users can trace multi-agent behavior and act on optimization or security findings (#1728, #1789, #1828, #2051)
• tokenless: Updated to v0.7.3, added stash-backed reversible compression, an MCP retrieval server, Cosh-NG compression, and macOS/Qwencode adapter support, agents can save tokens across more runtimes without permanently losing compressed content (#1285, #1376, #1669, #1894, #1964)
• agent-memory: Updated to v0.2.6, added synchronous indexing plus focused-query and OR-ranked recall fallbacks, agents can retrieve newly captured memories from verbose or stopword-heavy prompts (#1520, #1574, #2047)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, telemetry controls, macOS arm64 npm delivery, file-metadata repair, and phase-based progress, users can select published versions across Linux and macOS, control reporting, and repair Linux installation drift (#1619, #1700, #1740, #1962, #1987, #2036)
• skillfs: Updated to v0.4.0, added Hermes nested-skill compatibility, configurable read-time transforms, authenticated live-source resolution, and hardened permission boundaries, agents can consume adapted skill views while source mutations remain safely controlled (#1146, #1484, #1517)
• ws-ckpt: Updated to v0.4.2, added telemetry gating and automatic recovery of orphaned pre-init backups, users can recover workspaces after interrupted initialization without stale backup state (#1509, #1601)
• cosh-ng: Updated to v0.14.0, added session recovery, MCP tools, slash-command introspection, and prompt-cache observability, agents can resume complex work, extend capabilities, and diagnose cache savings (#1530, #1546, #1592, #1778, #1949, #2046, #2075)

[1.0] - 2026-07-06

Component Versions

Highlights

• anolisa: Updated to v0.1.20, delivered unified CLI gateway with full component lifecycle and adapter orchestration, users can install/update/diagnose all components with a single command
• cosh-ng: Updated to v0.11.0, completed Core/Shell separation and AI-augmented terminal, Agent can execute structured OS operations deterministically across distros
• agent-memory: Updated to v0.2.1, added user data sovereignty and 4-type memory classification, users can query/forget/control auto-captured memories
• tokenless: Updated to v0.6.1, added compression toggle with A/B testing and QwenCode adapter, users can quantify Token savings per strategy without affecting task execution

New Components

• anolisa: First release v0.1.16, built unified CLI gateway managing component install/update/uninstall with dual-backend (RPM + Raw), users can deploy the entire ANOLISA stack with anolisa install --all
• cosh-ng: First release v0.11.0, implemented deterministic Agent-OS interface with 5-crate workspace, Agent can execute cross-distro structured system operations via stable API
• skillfs: First release v0.3.2, built FUSE virtual filesystem for agent skills with view-based SKILL.md exposure, Agent can discover and load skills from a mounted directory

Updated

• agent-memory: Updated to v0.2.1, added sovereignty tools (about/forget/consent), AMA export/import, 4-type classification, and incremental consolidation resilient to SIGKILL, users can control memory retention and migrate memories across agents
• tokenless: Updated to v0.6.1, added compression on/off toggle with dry-run mode, SLS JSONL telemetry default-on, and QwenCode adapter, developers can A/B test compression strategies and monitor Token savings in SLS dashboard
• agentsight: Updated to v0.7.1, added Token saving visualization (strategy pie chart + line-level diff), security dashboard, and container/K8s full support, users can visually assess which optimization saves the most Tokens
• copilot-shell: Updated to v2.6.1, added /model dialog for multi-provider switching and SLS session telemetry (32-field JSONL), users can freely switch LLM providers without losing configuration
• agent-sec-core: Updated to v0.7.0, added Skill Ledger integrity chain with GPG signing workflow and Prompt Scanner, users can audit skill security status and get confirmation prompts before risky operations
• os-skills: Updated to v0.6.1, added ANOLISA Guide knowledge skill (13 official docs) and OpenClaw pre-check with bootstrap, Agent can reference accurate product documentation in responses
• ws-ckpt: Updated to v0.4.1, added auto-cleanup scheduling and TOML config hot-reload, users can set retention policies that take effect without restarting the daemon

Changed

• Documentation governance established via specs/documentation-standard.md
• Bilingual naming convention unified to _zh.md (migrated from legacy _CN.md)

[0.6] - 2026-06-12

Component Versions

Highlights

• agent-memory: First release v0.1.0, delivered sandboxed filesystem MCP memory server, Agent can persistently store and retrieve context across sessions via BM25 search
• tokenless: Updated to v0.4.1, added Hermes Agent plugin and Tool Ready 4-stage pre-check, Agent environments are automatically validated before tool execution to avoid wasted retries
• agentsight: Updated to v0.5.0, added Skill-level Token metrics and Hermes support, users can pinpoint which Skills consume the most Tokens

New Components

• agent-memory: First release v0.1.0, built 19-tool MCP server with namespace isolation and BM25 background index, Agent can read/write/search persistent memory in a sandboxed filesystem
• cosh-ng: First release (MVP), completed production-ready functionality for deterministic OS operations, Agent can execute structured commands with predictable output format

Updated

• tokenless: Updated to v0.4.1, added Hermes adapter runner and Tool Ready mechanism (4-stage env pre-check as cosh extension), Agent tool calls are pre-validated reducing Token waste from environment failures
• agentsight: Updated to v0.5.0, added Skill-dimension Token/call metrics and Hermes matcher with SSL support, users can see per-Skill Token breakdown in the dashboard
• agent-sec-core: Updated to v0.5.0, added PIIChecker (output PII detection + desensitization) and Skill Scanner (text/code scan + lifecycle trigger), Agent output containing sensitive information is automatically intercepted
• copilot-shell: Updated to v2.4.1, added cross-session auto memory extraction and hook reason visibility in UI, users can see exactly why a security hook blocked an operation

[0.5] - 2026-05-28

Component Versions

Highlights

• tokenless: Updated to v0.4.0, added Hermes plugin and Tool Ready environment mechanism, Agent tool execution failures due to missing dependencies are prevented before Token consumption
• agent-sec-core: Updated to v0.4.0, delivered PIIChecker and Skill Scanner first version, Agent output is scanned for sensitive information leakage

Updated

• tokenless: Updated to v0.4.0, developed Hermes Agent plugin with Tool Ready 4-stage env pre-check and history compression, Agent runtime dependencies are auto-verified before execution
• agent-sec-core: Updated to v0.4.0, added PIIChecker for output PII detection and Skill Scanner baseline capabilities, users are protected from unintentional sensitive data exposure
• agentsight: Updated to v0.4.0, added Skill-level metrics display, users can view Token consumption grouped by Skill
• os-skills: Updated to v0.4.0, added Nightly automated test coverage, skill quality is continuously validated

[0.4] - 2026-05-13

Component Versions

Highlights

• agent-sec-core: Updated to v0.4.1, established Skill security full lifecycle with Prompt Scanner ask policy, users receive confirmation prompts before Agent executes risky instructions
• tokenless: Updated to v0.3.0, built 4-suite Benchmark comparison baselines, developers can quantify Token savings across different Skill/OS environments
• ws-ckpt: Updated to v0.2.0, expanded snapshot management commands, users can auto-clean historical snapshots by count or age policy

Updated

• agent-sec-core: Updated to v0.4.1, integrated Prompt Scanner into cosh hook and OpenClaw plugin with ask strategy, users get interactive confirmation before dangerous operations
• tokenless: Updated to v0.3.0, built batch-concurrent Benchmark platform with comparison reports, developers can one-click benchmark and compare Token savings across configurations
• agentsight: Updated to v0.4.0, optimized resident process memory footprint, 2C2G small-spec instances can run observability stably
• copilot-shell: Updated to v2.3.0, adapted SWEBench evaluation framework, developers can execute code-fix tasks and verify pass rates via cosh
• ws-ckpt: Updated to v0.2.0, enriched snapshot CRUD capabilities, users can manage workspace checkpoints with flexible retention policies

[0.3] - 2026-04-30

Component Versions

Highlights

• tokenless: Updated to v0.2.0, delivered command rewriting and TOON context compression, CLI output Token consumption reduced by 60–90%
• agentsight: Updated to v0.3.1, added Token saving Dashboard and Agent anomaly diagnostics, users can visualize savings and detect Agent interruptions
• agent-sec-core: Updated to v0.3.0, added Skill Ledger integrity tracking and Prompt Scanner, every Skill's signature chain is auditable end-to-end

New Components

• ws-ckpt: First release v0.1.0, built btrfs-based workspace checkpoint daemon, Agent can create sub-millisecond snapshots and instantly rollback filesystem state

Updated

• tokenless: Updated to v0.2.0, added command rewriting via RTK and TOON context compression, Agent CLI interactions consume 60–90% fewer Tokens
• agentsight: Updated to v0.3.1, added Token saving Dashboard (session/time-range stats) and Agent interrupt detection with drain mechanism, users can monitor savings trends and get alerted on Agent failures
• agent-sec-core: Updated to v0.3.0, added Skill Ledger full lifecycle (check/certify/bypass/status/audit) and Prompt Scanner with jailbreak detection, users can track and enforce Skill integrity policies
• copilot-shell: Updated to v2.2.1, added extension architecture (command extension + system Hook + instant activation), Skill marketplace integration, and session export (Markdown/HTML/JSON), users can extend cosh capabilities via plugins and export conversation history
• os-skills: Updated to v0.3.0, added Skill marketplace listing, Hermes install skill, and utility skills (xlsx/pdf-reader/image-gen/humanizer), users can discover and install skills from a marketplace

[0.2] - 2026-04-15

Component Versions

Updated

• agentsight: Updated to v0.2.2, added Token consumption observability with precise Tokenizer counting, users can view per-message Token breakdown in real time
• copilot-shell: Updated to v2.0.4, added independent auth (STS/ECS RAM Role) and Skill marketplace browsing, users can authenticate without AK/SK and discover available skills
• os-skills: Updated to v0.2.2, added SysAdmin skills (Linux IO/network/load diagnostics), Agent can independently diagnose common OS performance issues
• tokenless: First release v0.1.0, built Skills-level benchmark test cases, developers can compare Token consumption across different Skills quantitatively

[0.1] - 2026-03-30

Component Versions

New Components

• copilot-shell: First release v2.0.1, built AI-powered terminal assistant with Tab completion, /bash mode, sudo support, and hook security, users get an AI-native CLI experience on first login
• agent-sec-core: First release v0.1, delivered Skill signature verification, security sandbox, and system hardening, Agent operations run in a controlled least-privilege environment
• agentsight: First release v0.1, built eBPF-based zero-intrusion observability probe, users can monitor LLM API calls and Token consumption without modifying Agent code
• os-skills: First release v0.1, curated system administration, SysOM, DevOps, and cloud skills, Agent can autonomously perform common OS operations

Security

• Skill full-link encryption with digital signatures
• Hardware-level security sandbox for risk isolation
• Identity authentication and integrity verification for Skill calls

For detailed changelogs of individual components, see:

User Entrypoint

• copilot-shell
• cosh-ng
• anolisa
• os-skills

Token Saving

• tokenless

Runtime

• agent-memory
• skillfs
• ws-ckpt

Agent Observability

• agentsight

Agent Security

• agent-sec-core

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.2.6] - 2026-07-30

Fixed

• agent-memory: Updated to v0.2.6, retries short-token LIKE searches with OR matching when strict matching finds nothing and ranks stronger keyword matches first, agents can recall relevant memories from stopword-heavy prompts instead of receiving an empty result (#2040)

[0.2.5] - 2026-07-27

Fixed

• agent-memory: Updated to v0.2.5, derives focused recall queries from long English and CJK prompts and combines their results, agents can recall relevant memories from verbose prompts without silently dropping topics (#1574)

0.2.4

• fix(memory): auto-recall returns empty results after observe — synchronously reindex after memory_observe so before_prompt_build hook finds new content (#1520)
• fix(memory): install.sh sets allowConversationAccess for hooks (#1521)

0.2.3

• fix(memory): normalize OpenClaw content blocks from array of content blocks [{type:"text", text:"..."}] to string before trigger matching and hashing, so auto-capture actually fires instead of coercing to "[object Object]"
• fix(memory): add BM25 OR fallback — when implicit-AND FTS5 query returns 0 rows and there are multiple tokens, retry with '\"token1\" OR \"token2\" OR ...' so partial matches still surface instead of silent failures
• fix(memory): sanitize audit_log by replacing format!("{:.120}", query) with format!("bm25:len={}", query.len()) to prevent user query content from leaking into log paths

0.2.2

• fix memory_observe hint sanitization so YAML-escaped hints round-trip through the hand-rolled frontmatter reader (which does not interpret YAML escapes): replace yaml_escape_hint() with sanitize_hint() that only substitutes newlines and ASCII control chars with spaces; add 8 unit tests plus a real-parser round-trip test covering Windows paths with backslashes
• add max_hint_bytes (default 512) to MemoryConfig with MEMORY_MAX_HINT_BYTES env override; thread &MemoryConfig through memory_observe, the MemoryService facade, and the MCP server
• fix make install INSTALL_PROFILE=user PREFIX=$HOME/.local failing with Permission denied at install-adapter-resources: honor INSTALL_PROFILE and derive DATADIR/SHARE_DIR from $(PREFIX) so all writable paths follow the profile (system mode unchanged); aligns with the tokenless/ws-ckpt install contract
• add safe_fs security-boundary unit tests (path escape, symlink traversal, sandbox root violations) plus formatting/import-order fixes exposed by cargo fmt --all --check

0.2.1

• fix vector/hybrid search panic and empty index when an embedding provider is configured: the index worker ran on a std::thread with no tokio Handle so embeddings were never produced, and memory_search mode=vector|hybrid called Handle::block_on from a worker thread; the runtime handle is now captured at spawn and threaded through to the worker, and the search path uses block_in_place
• fix memory_get_context leaking .git internals (e.g. .git/logs/HEAD) into agent context by extending the reserved-path filter to cover .git/ via a shared is_under_git predicate in safe_fs
• fix full_scan (startup and inotify-overflow recovery) only building the BM25 index and never dense embeddings, so preexisting files were invisible to vector search until modified; a paths_without_vec query plus a backfill pass now embeds them, centralised in an embed_sync helper shared with flush
• fix memory_search returning zero hits for short CJK query terms (< 3 chars, e.g. "花名"/"小云"): the trigram tokenizer emits no tokens for terms shorter than 3 characters, so such queries now fall back to a body LIKE '%term%' substring scan that preserves recall, agent-scope filtering, and cold/superseded exclusion
• resolve embedding dimensions from the first real response instead of hardcoding 1536 (DashScope text-embedding-v3 is 1024): dimensionality is stored in an AtomicUsize seeded with the estimate and overwritten on first embed
• add anolisa-cli adapter contract via .anolisa/component.toml so the CLI adapter manager can discover the openclaw plugin bundle through the [[adapters]] TOML schema

0.2.0

• add prompt-injection safety module (looksLikePromptInjection + escapeMemoryForPrompt) mirrored between Rust core and TS adapter
• add secret detection and PII redaction to the safety module
• add auto-recall before_prompt_build hook injecting relevant memories each turn
• add auto-capture agent_end hook with trigger filtering, SHA256 dedup and injection rejection
• add dense-vector semantic search via pluggable EmbeddingProvider (OpenAI /v1/embeddings, Ollama /api/embed)
• add files_vec table (schema v2) for per-file dense embeddings alongside FTS5 BM25
• add hybrid search with reciprocal rank fusion (RRF, k=60) of BM25 + vector scores
• add memory_search mode parameter (bm25/vector/hybrid) with graceful fallback to BM25
• add per-agent memory isolation via [memory].agent_scope (shared/isolated/filter), schema v5
• add memory sovereignty tools (memory_about/forget/auto_created/consent) with consent.toml preferences
• add 4-type closed memory classification (user/feedback/project/reference) to memory_observe
• add mem_export and mem_import for cross-agent memory migration (AMA archive format)
• add memory_summary tool for memory overview and source tracking
• add memory_session_context tool
• add memory_sessions and memory_timeline session history query tools
• add MEMORY.md index file and mem_index_refresh tool
• add user profile synthesis (Dreaming V3 mem_dream)
• add memory consolidation: auto-extract L1 atomic facts from session audit logs on shutdown
• add episodic memory extraction from coherent tool-call chains
• add cross-session task persistence and incremental consolidation
• add consolidation quality filters (mutual exclusion, non-derivable, date normalization)
• add time-decay ranking (exp(-λ×age_days)) applied to BM25/vector/hybrid scores
• add cold archival of old never-accessed files with mem_compact tool
• add conflict detection via BM25 similarity before writing new facts
• add category subdirectories (facts/<category>/) with memory_search category filter
• add token tracking (tokens field in AuditEntry)
• add mem_consolidate tool for manual consolidation trigger
• add corpus supplement registration for memory_search corpus=all
• add EmbeddingConfig (None/OpenAI/Ollama) with TOML parsing and env overrides
• extend memory_search signature with optional mode and category parameters
• cap memory_search query at 1024 characters to prevent FTS5 resource exhaustion
• truncate embedding error response bodies to 200 chars to prevent API key leakage
• distinguish CJK vs ASCII token estimation in ConsolidatedFact
• hold FactWriter JSONL file handle under mutex to prevent line interleaving
• derive BM25Store mount root from db path with canonicalize + starts_with traversal guard
• compute Episode duration from entry timestamps instead of chain length
• propagate session_id to extracted episodic facts
• return fact count from consolidate() for mem_consolidate reporting
• fix effectiveMode in search response to reflect actual mode used
• fix embedding API empty-response handling to return zero vector of correct dimensionality

0.1.0

• introduce filesystem memory MCP server for AI agents (Linux only) with 21 tools over stdio JSON-RPC 2.0 in three tiers (Tier A file ops, Tier B BM25 search, Tier C governance)
• add per-namespace mount under ~/.anolisa/memory/<ns>/ with optional user-namespace + private tmpfs isolation (auto/userland/userns strategies)
• enforce path sandbox via openat2(RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS) on every Tier A file open
• add SQLite FTS5 BM25 background index with transactional upsert, schema migrations, trigram CJK tokenizer and inotify-driven debounced flush
• add optional git versioning with auto-commit serialized under a per-handle mutex
• add tar.gz snapshots with strict id whitelist, atomic rename swap on restore and rollback entries under .anolisa/trash/
• add optional cgroup v2 memory.max self-limit applied before the tokio runtime starts
• add JSONL audit log (O_NOFOLLOW | O_CLOEXEC, Mutex<File>) with optional systemd-journald fan-out
• enforce profile gating (basic/advanced/expert) at both tools/list and tools/call with deny_unknown_fields on config structs
• add per-session scratch and log under /run/anolisa/sessions/<sid>/ (0700) with tmpfiles.d snippet
• add systemd user template anolisa-memory@.service with hardening (ProtectKernelTunables/Modules/Logs, SystemCallFilter, MemoryDenyWriteExecute, RestrictNamespaces, RestrictAddressFamilies=AF_UNIX)
• add RPM packaging with offline vendor tarball and single statically-linked binary (bundled SQLite + vendored libgit2)
• add OpenClaw plugin memory-anolisa with install/detect/uninstall lifecycle and 4 memory contract tools routed to the MCP server as a stdio child
• add single-source version sync from Cargo.toml into manifest/package/openclaw/mcp JSON and the bundle
• add mcp-harness example and 140 automated tests across 12 integration suites

Changelog

0.10.0

Agent Hook Policy Controls

• Added code scanner enable flags for agent hooks. (#2001)
• Unified hook policy controls across agent integrations. (#2141)
• Added an observability hook environment toggle. (#2199)
• Restored scanner mode environment variable names. (#2212)
• Aligned code scanner hook flags across supported agent integrations. (#2229)
• Added environment-based prompt scanner gating. (#2239)

OpenClaw Hook Integration

• Added block mode support for the OpenClaw code scanner hook. (#2242)

Prompt Scanner

• Widened prompt scan inbound text field coverage. (#2277)

Skill Ledger Runtime

• Added read-only skill analysis. (#2044)
• Included raw skill directories in skill ledger checks. (#2201)
• Authenticated manifests before loading skill package contents. (#2185)

Security Events & CLI

• Added session and run filters to agent-sec-cli events queries. (#2132)

Raw Packaging

• Added component-owned raw package build targets and archive validation. (#2133)
• Updated raw hooks to use the bundled Python launcher. (#2255)

0.9.0

Qoder CLI & Qwen Code Hook Capability Expansion

• Added Qwen plugin and observability hooks. (#1473)
• Added Qoder CLI hook framework support. (#1480)
• Added Qoder prompt injection scanner hook integration. (#1529)
• Added Qwen prompt scanner hook integration. (#1538)
• Added code scanner hook integration for Qoder CLI and Qwen Code. (#1535)
• Added Qoder CLI Skill PreToolUse skill ledger checks for user and project skills. (#1552)
• Added Qwen PII hooks. (#1559)
• Added Qwen skill ledger hook integration. (#1561)
• Added Qoder CLI observability hook integration. (#1580)
• Unified Qwen Code hook trace context handling. (#1738)

Codex & OpenClaw Hook Integrations

• Added observability capability in the Codex plugin. (#1495)
• Added Codex PreToolUse PII checker hook integration. (#1501)
• Showed OpenClaw policy hints in hook responses. (#1525)

Scanner & Policy Engine

• Skipped prompt model downloads when the model cache already exists. (#1467)
• Added custom PII regex rules. (#1522)
• Satisfied L1-L3 telemetry requirements. (#1527)
• Added Chinese prompt-injection and jailbreak rules covering instruction override, authority escalation, encoding evasion, and role-play framing. (#1554)
• Unified model resources into handles to make prompt scanning resource lifecycle more consistent. (#1553)
• Made prompt scan mode configurable through environment variables. (#1620)
• Hardened audit, PII, and notify hook behavior. (#1649)

Skill Ledger Runtime

• Isolated the skill ledger worker for more reliable hook execution. (#1492)
• Resolved canonical skill roots for skill ledger checks. (#1558)
• Exposed skill ledger verdicts to hook callers. (#1577)

Build & Packaging

• Moved prompt-scan benchmarks to a standalone repository to keep the CLI package lean. (#1557)
• Rejected stale CLI wheels during packaging and runtime validation. (#1651)
• Replaced and restarted the daemon service when upgrading RPM packages. (#1681)

Testing & CI

• Fixed OpenClaw E2E test dependencies by excluding ML packages. (#1631)
• Fixed skill-ledger E2E test execution on macOS. (#1643)

Documentation

• Centralized user guides and added documentation lint CI. (#1586)

0.8.0

Build & Packaging

• Installed the Codex plugin during source builds so source deployments include the same Codex integration as packaged installs. (#1302)
• Updated source build scripts for the sec-core install flow. (#1348)
• Fixed system-mode source builds by placing uv-managed Python under the shared sec-core library directory and adding a system install smoke check. (#1400)

Code Scanner

• Added sensitive file path rules for common agent credentials to block API key exposure. (#1401)

OpenClaw Plugin

• Hardened OpenClaw deploy compatibility handling and covered deployment edge cases with unit tests. (#1358)
• Added an OpenClaw plugin cross-version E2E matrix that validates packaged plugin loading, Gateway flows, policy behavior, and observability across supported OpenClaw hosts. (#1372)

Documentation

• Added bilingual agent-sec-core user guide documentation and documentation maintenance rules. (#1311)
• Documented OpenClaw plugin deployment, compatibility, and upgrade guidance. (#1370)

0.7.1

Prompt Scanner

• Degraded scan-prompt to fast mode when model unready; rewrote DENY to WARN and enriched degraded reason with diagnostics. (#1258)

Skill Ledger

• Clarified skill ledger fallback warnings and sanitized finding summaries. (#1240)
• Tamed ledger reconcile noise and typed live-root skip errors. (#1232)

Security Observability

• Added observability mapping for new pii_scan at before_tool_call & after_tool_call. (#1229)

0.7.0

Codex Plugin — Full security integration for OpenAI Codex

• Added codex-plugin with code scanning, prompt scanning, skill ledger, and PII checking hooks. (#1074)
• Supported packaging codex-plugin into RPM. (#1138)
• Fixed codex-plugin paths in Makefile and CI for correct RPM install verification. (#1165)

Code Scanner

• Added code-scanner LLM mode for AI-assisted security analysis. (#1108)
• Added code-scanner static rules for expanded coverage. (#1033)

Prompt Scanner

• Added L4 multi-turn intent detection with ollama model service. (#1060)
• Routed prompt scan to daemon and added prompt model preload for reduced latency. (#786)
• Controlled prompt scan call to use daemon by env variable. (#933)

Skill Ledger — Activation daemon and policy engine

• Added Skill Ledger activation daemon for background integrity monitoring. (#857)
• Added runtime activation resolver for skill trust decisions. (#826)
• Added skill ledger activation policy for configurable enforcement. (#944)
• Updated skill ledger activation and event contracts. (#983)
• Updated Skill Ledger hook defaults and reconcile notify behavior. (#1086)
• Aligned skill ledger hooks across all agent platforms. (#1135)
• Resolved Skill Ledger FUSE and unmanaged roots handling. (#1141)
• Fail-open unsupported Hermes skill ledger scenarios. (#1155)

Daemon & Telemetry

• Added daemon service with systemd integration and RPM build support. (#1090)
• Exposed SQL query endpoint at daemon for observability queries. (#1042)
• Enhanced daemon logging including requests and jobs. (#871)
• Added telemetry schema definition and SLS JSONL writer. (#977, #1008)
• Passed agent_name to telemetry data for multi-agent identification. (#1032)
• Added logging system for structured agent-sec-cli output. (#651)
• Added security daemon socket fallback under /run/user/<uid> for user-scoped deployments. (#1129)

PII Scanner

• Extended PII scanning coverage with additional pattern detectors. (#925)

Security Observability

• Added session report command for post-session security summaries. (#703)

Sandbox

• Converged sandbox trigger rules for consistent enforcement. (#979)

Adapter & Build

• Added ANOLISA CLI component.toml for adapter manifest integration. (#1067)
• Added systemd-rpm-macros as RPM build dependency. (#1156)

0.6.0

Self-Protection — Tamper-resistance for agent-sec-core itself

• Added self-protect code-scan rules that block disabling/uninstalling agent-sec plugins on OpenClaw and Hermes. (#692)
• Optimized self-protect rules in code-scan to eliminate false positives on prefix-matched plugin names and cover Hermes uninstall/rm patterns. (#710)

Prompt Scanner

• Unified prompt-scan warning format across cosh-extension, hermes-plugin, and openclaw-plugin with structured fields (threat type, risk level, interception stage, model confidence). (#709)

Agent-Sec-CLI

• Added daemon process for agent-sec-cli to amortize startup latency across hook invocations. (#677)

Adapter & Manifest

• Added standalone ANOLISA adapter entry anolisa-for-openclaw to package sec-core OpenClaw adapter scripts and drive install/detect/uninstall via the adapter manifest. (#549)
• Added Hermes adapter runner: refactored the OpenClaw entry into a target-agnostic anolisa-adapter-runner and added anolisa-for-hermes wrapper, with per-agent adapter directory layout under sec-core. (#617)
• Centralized sec-core adapter manifest parsing across adapter scripts and moved the manifest under the cli package. (#617)

OpenClaw Integration

• Normalized OpenClaw state directory handling: use OPENCLAW_STATE_DIR for adapter filesystem state, unset OPENCLAW_HOME when invoking the OpenClaw CLI, and aligned plugin install/list/uninstall handling. (#641)

0.5.0

PII Scanner — Personal information leak detection

• Added PIIChecker scan CLI with text/file input, regex/validator-based detection, redaction, and security middleware integration. (#525)
• Added PIIChecker hooks for cosh and OpenClaw with stdin-based input passing. (#539)
• Added Hermes PII checker hook. (#556)
• Fixed scan-pii module mode detection via subprocess. (#540)

Security Observability — Agent run metrics & posture insights

• Added security observability schema, metrics definition, and CLI with jsonl writer for agent runs. (#488)
• Added openclaw plugin for security observability. (#515)
• Added cosh hook for security observability. (#528)
• Persisted observability records to sqldb with CLI review command. (#544)
• Added observability plugin for hermes. (#553)
• Correlated security events with observability events and supported batch query. (#578)
• Respected trace-id filter in count queries. (#595)

Hermes Plugin — AI Agent integration framework

• Added hermes-plugin framework with abstract hook class and code scan capability. (#536)
• Added Hermes prompt-scan capability. (#579)
• Added Hermes PII checker hook. (#556)
• Added Hermes skill ledger hook. (#565)
• Added observability plugin for hermes. (#553)
• Supported correlation context in hermes agent plugin. (#590)
• Added hermes plugin install for rpmbuild and build from scratch. (#577)
• Stabilized Hermes skill-ledger warning delivery for non-pass skill checks. (#600)

Correlation & Tracing Context

• Unified caller tracing context across CLI, OpenClaw, and cosh with --trace-context JSON and SQLite schema v2. (#569)
• Supported correlation context in hermes agent plugin. (#590)
• Correlated security events with observability events. (#578)

Skill Ledger

• Integrated code-scanner with skill-ledger for unified security assessment. (#505)
• Updated skill ledger security interactions. (#529)
• Made openclaw skill ledger approval configurable. (#575)
• Added Hermes skill ledger hook. (#565)
• Refined skill ledger scan workflow and aligned documentation. (#529)
• Included skill-ledger e2e in install flows. (#573)
• Fixed skill-ledger hook scope limitation. (#497)
• Fixed managed skill dirs for discovery. (#510)
• Expanded home paths for skill-ledger. (#596)
• Hardened skill ledger recovery and key UX. (#575)

Code Scanner

• Added code-scan requireApproval config for openclaw. (#560)
• Added OpenClaw enableBlock hook policies. (#586)

Security Middleware & Event System

• Fixed TOCTOU race condition at sqldb read path. (#546)
• Made SQLAlchemy lazy import for non-DB subcommands. (#581)
• Lowered frequency for SQL maintenance operations. (#546)

Prompt Scanner

• Added Hermes prompt-scan capability via hermes plugin. (#579)
• Fixed warmup detection from error-string matching to file-based check. (#500)
• Fixed prompt text passing via stdin instead of argv. (#579)

Toolchain & CI

• Added build-all support with local space install for sec-core. (#527)
• Added hermes plugin install for rpmbuild and from-scratch build. (#577)
• Included skill-ledger e2e in install flows. (#573)
• Added adapter manifest for capability discovery. (#577)

0.4.0

Prompt Scanner

• Prompt scanner hook now asks user on missing model instead of fail-open. (#463)
• Added prompt injection detection benchmark dataset and evaluation toolkit. (#464)

Security Middleware & Event System

• Refactored security_events SQLite storage to SQLAlchemy ORM with multi-table extensibility and typed repositories. (#459)

Skill Ledger

• Fixed sign-skill auto-register config (exact awk match) and parse openclaw stdout unconditionally. (#445)
• Unified XDG paths under agent-sec/skill-ledger vendor namespace. (#445)
• Unified single-skill verify into structured result for consistent output. (#445)
• Converted integration tests from subprocess to Typer CliRunner. (#445)

OpenClaw Integration

• Registered plugin at openclaw gateway explicitly to support Gateway startup planning. (#446)

Refactoring

• Removed deprecated agent-sec-core skill directory; aligned README and spec with agent-sec-cli workflow. (#454)

Toolchain & CI

• Added coverage report for sec-core CI. (#431)
• Enabled rpmbuild and e2e test CI for main branch. (#432)

0.3.0

Prompt Scanner — Multi-layer prompt injection & jailbreak detection

• Added prompt injection/jailbreak detection scanner architecture with L1 rule engine (YAML-based) and L2 ML classifier (Prompt Guard 2). (#253)
• Integrated prompt scanner into cosh hook and openclaw plugin with security middleware lifecycle. (#261, #294)
• Added list-scanners command, improved CLI help, and made --scanner-version optional. (#284)
• Added prompt scan summary and backend tests. (#294)
• Added prompt-scanner skill definition. (#256)
• Added model warmup, audit logging, and comprehensive documentation. (#253)
• Stabilized batch scanning and verdict logic with thread-safe model loading. (#253)
• Unified prompt scanner response to use "ask" instead of "block". (#341)
• Added prompt-scanner e2e test suite and Makefile target. (#352)

Code Scanner — Static code security analysis

• Added code scanner component with rule-based detection for obfuscation, permission abuse, and more. (#234)
• Integrated code scanner into cosh hook (with ask decision support) and openclaw plugin adapter. (#234)
• Added code scanner CLI entry, error codes, and unit tests. (#234)
• Fixed code scan bugs and added e2e test. (#342)

Skill Ledger — Skill integrity tracking and signing

• Added skill-ledger CLI with middleware integration for skill integrity verification. (#252)
• Added skill-ledger skill definition. (#266)
• Added skill-ledger cosh hook for PreToolUse and openclaw-plugin capability. (#292, #281)
• Improved skill-ledger CLI and cleaned up imports. (#284)
• Restructured skill-ledger config defaults and documentation. (#296)
• Aligned skill-ledger tool name and added path validation. (#317)
• Reworked skill-ledger status, output, and check signing. (#335)
• Skill-ledger hook hardening, e2e suite, and posture integration. (#339)
• Known limitation: skill directory resolution assumes dir name matches SKILL.md name field; see #381.

Security Middleware & Event System

• Added security middleware framework with unified CLI entry point and metrics integration. (#121, #220)
• Added sqldb writer & reader with query command at CLI interface for security event persistence. (#254)
• Fixed cross-process event loss in SecurityEventWriter. (#226)
• Applied corruption whitelist to stop false-positive DB rebuilds. (#338)
• Added e2e test and fixed bugs revealed during testing. (#330)

Linux Sandbox

• Added sandbox guard and failure handler hooks. (#362)

OpenClaw Integration

• Added hook plugin for openclaw with integrated security scanning capabilities. (#242)
• Added jq requires for openclaw hook package. (#370)

Cosh Extension Integration

• Integrated with new cosh extension API and added builtin commands. (#302)

Performance

• Lazy-load ML dependencies to speed up non-ML subcommands. (#318)

Toolchain & CI

• Migrated Python toolchain to uv package manager and pinned Python 3.11.6. (#227)
• Added sec-core RPM build CI and adapted nightly build pipeline. (#295)
• Initialized code format check CI with python-code-pretty. (#229)
• Added e2e test in RPM build CI. (#369)

Bug Fixes

• Preserved seharden wrapper defaults. (#236)
• Removed dynamic import at middleware router. (#277)
• Improved missing loongshield guidance. (#289)
• Fixed build errors. (#288)
• Removed openclaw hook examples and fixed documentation. (#282)

0.2.0

• Added Hardened skill signing pipeline and added .skill-meta layout. (#129)
• Added Cargo.lock to version control. (#149)
• Added make install-sandbox target. (#68)
• Fixed bubblewrap version compatibility for --argv0 option. (#112)
• Changed Refactor SKILL.md to executable protocol and align sub-skills. (#130)

Changelog

0.9.1

Features

• Add case containment lifecycle with policy handoff, no-gap replacement, dedicated API, and dashboard views.
• Add system audit protocol, event storage, dashboard, and extract audit service into a dedicated crate.
• Add ActPlane risk enforcement with enforcer service, hardened file controls, secure lifecycle, and risk enforcement dashboard.
• Rework optimization dashboard views and add detour-based cost waste analysis.
• Move agent health and interruptions to a dedicated dashboard page.

Fixes

• Extract cache tokens for OpenAI (prompt_tokens_details.cached_tokens) and DashScope (top-level cached_tokens) responses, and extract real user query from cosh-ng adapter prompt template.
• Capture Claude Code launched via absolute path or node wrapper.
• Skip agent_crash detection on clean exit and flush deferred GenAI events on agent exit.
• Skip message parse for non-LLM paths.
• Encrypt optimization config API key.
• Show known agent rules.
• Map cosh session temporary file writes. (#2080)

CI

• Pin eBPF build to clang 15 and use dedicated runner pools.

0.9.0

Features

• Add optimization analysis workspace, APIs, persistent analysis history, and dashboard pages for accuracy, performance, and cost reviews.
• Add Qoder trajectory collection, ATIF v1.7 export, batch analysis tooling, and subagent trajectory navigation with topology-style views.
• Add command-line discovery rules for CoshNG and normalize LLM event attribution with command-line context.
• Add six new interruption types and fallback capture for unparsable LLM HTTPS traffic.

Fixes

• Fix Anthropic SSE parsing, system prompt injection, and cache token accounting.
• Fix ATIF batch output to use the shared ATIF v1.7 schema and drop stale v1.6 paths.
• Fix optimization and trajectory collection edge cases, including stale conversation anchors and syscall tracepoint probe attach.
• Fix dashboard empty states, error banner wording, auth loopback handling, and session navigation behavior.
• Make raw HTTPS FFI output opt-in and skip duplicate SSE message parsing for OpenAI and Anthropic streams.

Changed

• Group optimization dimension analyses under per-target run roots and represent parallel LLM calls as ATIF subagent trajectories.
• Slim and gate default SLS output so trace content is not uploaded unless explicitly enabled.

0.8.1

Fixes

• Replace lock().unwrap() with poison-safe unwrap_or_else for mutex recovery.
• Correct SSL library attribution from aws-lc/BoringSSL to OpenSSL 3.x.
• Add Claude process name to BoringSSL classification.
• Preserve user config on schema migration instead of overwriting.
• Don't auto-overwrite invalid JSON configs; record process pid not thread tid in ns pid helper.
• Downgrade high-frequency event logs from debug to trace to reduce noise.

Tests

• Expand unit tests for handlers, interruption store, and token store.
• Add poison-recovery tests for mutex unwrap_or_else changes.

0.8.0

Features

• Add dashboard token-based authentication with file-only auth config.
• Add LAN/public IP address display and Chinese output in dashboard CLI.
• Add ECS security group guide and metadata integration to dashboard.
• Add conversation grader API and dashboard controls.
• Add COSH_SESSION_ID export for per-run session correlation.
• Auto-upgrade stale configs via schema_version.

Fixes

• Fix Codex SSL capture and SSE token extraction.
• Fix false interruption signals.
• Persist idle streams and tool results to avoid snapshot loss.
• Detect SSE stream errors explicitly.
• Restrict /health, /metrics, and server auth to localhost/file-only config.
• Remove hf-hub git fork from default build dependency.
• Fix IMDSv2 token fetching, probe deadlines, and ECS metadata deduplication.
• Fix RPM build to copy agentsight.json into source tarball.
• Address clippy single_match, nested if-let, and architecture boundary issues.

Tests

• Add dashboard mock HTTP and unit tests for coverage gate.
• Add build_output and public_address tests.
• Mark probe tests as #[ignore] for CI ECS runners.

0.7.1

Fixes

• Improve severity labels and agent sidebar UX.
• Show all verdicts in the summary command.
• Sync component.toml version with package version.

0.7.0

Features

• Add Codex CLI adaptation with three-tier SSL probe attach (symbol table → byte pattern → offset table) and cross-chunk SSE continuation buffer.
• Add security observability dashboard and server proxy for agent threat visibility.
• Add memory optimization with bounded event buffers, feature flags (features.*) and configurable runtime limits (runtime_limits.*).
• Add container_id to AgentsightLLMData for container-level attribution.
• Derive session_id from process environment variables and request metadata instead of message content.
• Add call_kind classification (chat / completion / embedding / tool_use) to GenAI semantic events.
• Add --exclude filter to agentsight audit CLI for noise reduction, and show non-streaming LLM calls in audit output.
• Add unified agentsight summary command for one-shot status overview.
• Enhance token savings page with baseline comparison, strategy breakdown, line-level diff highlighting and optimization tips.
• Upload skill metrics via SLS Logtail exporter.
• Improve agent health UX: role badges (P1/P2), TTL-based cleanup, process-ancestry grouping, and Session ID help tooltip.
• Filter client processes from health API to reduce dashboard noise.
• Add anolisa component contract for RPM lifecycle integration.

Fixes

• Fix sslsniff BPF verifier rejection on kernel 5.15 and add BPF load tests.
• Fix traced_processes BPF map leak causing uprobe attach failure after long runtime.
• Prevent duplicate uprobe Links by retaining inodes in traced_files on detach.
• Decode compressed (zstd/brotli) SSE streams so Claude Code and similar agents are fully captured.
• Harden compressed SSE decode against partial chunk boundaries.
• Extract token usage from non-streaming and HTTP/2 responses.
• Fix namespace PID usage in udpdns and tcpsniff probes.
• Strip /proc/{pid}/root prefix for uprobe attach in containerized environments.
• Implement tiered SSL and tcpsniff ring buffer reservations to reduce dropped events.
• Clamp before mask in filewrite/udpdns BPF probes; cap stdout payload to MAX-1.
• Change cgroup gate to OR semantics and add trace_cgroup FFI interface.
• Tighten SSE truncation detection and write pending row for deferred GenAI calls.
• Respect dynamic sysom path in SLS exporter mode selection; replace removed sysom_logtail_path with logtail_path filter.
• Validate ring buffer size is power-of-two at startup.
• Wire feature flags and runtime limits to actual runtime code paths.

Refactoring

• Split genai/builder.rs into 4 focused modules and genai.rs into 5 submodules.
• Bundle shared BPF maps into SharedMaps for reduced duplication.
• Extract background threads module with stop-signal support.
• Replace remaining unwrap() calls with if-let / ? patterns.

CI & Quality

• Add fmt, clippy, unit test coverage, and architecture boundary check CI gates.
• Add clippy.toml + cargo-deny for lint and supply-chain auditing.
• Add architecture boundary check script (check-arch-boundary.py).
• Add scoped AGENTS.md for FFI, unified orchestrator, and storage modules.
• Define Footprint Ladder for code surface growth control.
• Add agentsight-code-review and pr-body develop-skills.

0.6.1

• Add real-time agent_crash detection in trace mode.
• Add OOM crash detection.
• Add cgroup-level event filtering with v1/v2 compatibility.
• Support QwenCode skill discovery via per-user home scanning.
• Support SLS Logtail activation reversible via dynamic path.
• Support bridging ilogtail SLS_LOG_PATH into config via token-collector switch.
• Default traceEnabled to false to drop conversation content from SLS by default.
• Drop gen_ai.system_instructions from SLS uploads when traceEnabled=false.
• Refactor session_id and conversation_id derivation from response_id instead of message content.
• Fix CJK deadloop detection, kill() error check, and SIGKILL escalation.
• Fix SQLite read/write contention via VACUUM optimization.
• Fix rpm-build.sh agentsight build failures.
• Fix allow log path re-init on repeated new+start.

0.6.0

• Add deadloop detection and auto-kill mechanism for runaway agent processes.
• Add retry storm detection and /metrics interruption counters.
• Add BPF-layer HTTP protocol filter and wildcard capture (*) for unknown IP/port targets.
• Add client-side hybrid encryption for sensitive message fields.
• Add traceEnabled configuration toggle with SLS upload layer enforcement.
• Add HTTP domain rules resolved to tcpsniff BPF map via DNS.
• Add default DashScope HTTPS rule and anolisa_release module.
• Add FFI interface for tcp_targets and input_delta config.
• Add CO-RE compatibility to UDP DNS probe for kernel 6.0+.
• Support runtime SLS logtail path via config hot-reload.
• Expand interruption types and add logtail export.
• Restructure config to https/http rules.
• Refactor query stats.db by tool_use_id and unify savings display.
• Refactor load encryption public key from agentsight.json.
• Fix decode HPACK Huffman headers.
• Fix BoringSSL probe attachment, FFI event delivery, and chunked-body panic.
• Fix preserve initial SSE chunk in event-stream responses.
• Fix c_char / BPF comm portability (i8 vs u8).
• Remove dead code and deprecated APIs.

0.5.0

• Add Claude Code support including SSL probe attach for BoringSSL, Anthropic SSE thinking/tool_use content blocks, and message.id-based session correlation.
• Add tcpsniff probe for plain HTTP traffic capture with configurable IP/port filtering (disabled by default with empty tcp_targets).
• Add User-Agent based agent detection with comm fallback for simplified agent matching.
• Add UDP DNS probe for agent discovery (replacing TLS SNI probe) with QNAME parsing moved to userspace.
• Add TLS SNI probe module and refactor discovery to config-driven rules.
• Add connection scanner for pre-established LLM API connections.
• Add tools field to AgentsightLLMData FFI struct, passed through as raw JSON.
• Add container PID namespace support in BPF traced process filtering and event emission.
• Add agent matching rules and reduce BPF ring buffer to 32MB.
• Add uid field to SLS logs with OnceLock cache and startup validation.
• Support profile-based installs.
• Fix duration_ns calculation in LLM data.
• Fix SSL probe cleanup of stale inodes on process exit.
• Fix BPF verifier -E2BIG issues by removing nested #pragma unroll in udpdns.bpf.c and masking payload_len on older kernels.
• Fix skill extraction for Hermes agent architecture.
• Fix Node.js process.title change handling in OpenClaw matcher.

0.4.0

• Add HTTP/1.1 request body reassembly for fragmented SSL writes.
• Add skill metrics analysis with cosh filesystem-based discovery.
• Add SLS upload and Logtail file exporter for GenAI events.
• Add hermes agent matcher for LLM process discovery.
• Detect uv Python static OpenSSL in SSL sniffer.
• Remove AK/SK-based SLS direct upload, keep Logtail file export.

0.3.1

• Fix simplify agent_crash detection and fix multi-process dedup. (#411)
• Fix use SqliteConfig for audit CLI db path. (#399)
• Fix hide Cosh from agent health UI and remove keepalive support. (#401)
• Fix API endpoint table in AGENTS.md. (#397)

0.3.0

• Add interruption detection system with drain mechanism and dashboard integration. (#315)
• Add token savings page and API endpoint for optimization visualization. (#310)
• Add compounded token savings and request count tracking. (#320)
• Add C FFI API with cbindgen header generation. (#306)
• Add filewatch and filewrite eBPF probes for file access monitoring. (#308, #309)
• Support SysOM AK/SK GenAI capture for cosh. (#305)
• Use LLM API response_id as trace_id and add conversation_id field. (#304)
• Resolve session_id from agent's own session via ResponseSessionMapper. (#303)
• Fix interruption CLI and align conversation_id naming. (#318)
• Fix cosh session_id recognition by supporting snake_case response_id. (#307)
• Fix wrong tool call id in token savings compounding. (#316, #317)
• Fix standardize call_id, add tool_call_ids column. (#319)
• Fix session_id and response_id mapping in genai builder and storage. (#321)
• Fix token savings display in conversation list. (#322)
• Fix cache agent name by pid for dead process resolution. (#358)
• Fix remove custom db path and use default paths. (#359)
• Support nightly docker image build in CI. (#302)

0.2.2

• Support starting backend-server for dashboard with AgentSight service.
• Fix dashboard frontend dynamic width for multiple display-size.

0.2.1

• Add /usr/lib/copilot-shell path to CoshMatcher for agent discovery. (#190)
• Add 200MB size limit for genai_events.db to prevent unbounded growth. (#211)
• Remove /api/stats endpoint returning incorrect data. (#197)
• Extract audit from HttpRecord and filter non-LLM calls. (#196)
• Always show comparison data when --compare flag is used in token queries. (#194)
• Fix incorrect discover command in README documentation. (#191)
• Remove breakdown command and keep token consumption commented. (#193)
• Replace deprecated MemoryLimit with MemoryMax in systemd service file. (#181)

0.2.0

• AgentSight Dashboard web UI with real-time monitoring interface. (#74)
• Agent health monitoring with offline alerting and hung process dashboard restart. (#158)
• One-click navigation from dashboard to ATIF trace analysis page. (#116)
• /metrics endpoint to expose standard Prometheus-format data. (#134)
• Support for HTTP 2.0 protocol. (#147)
• Support to build RPM package. (#166)

Changelog

All notable changes to ANOLISA will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.2.19] - 2026-08-10

Fixed

• Raw installs that provision system dependencies now map resolver-provided rpm and deb package-family hints directly to the matching package manager backend. Minimal supported hosts no longer report an unsupported package base merely because the optional which command is absent, while distro-specific hints remain compatible (#2314).
• anolisa --json osbase sandbox list and anolisa --json register status now use the standard success envelope with ok, schema_version, and command metadata and nest business fields under data. Scripts can parse these legacy commands the same way as other JSON surfaces (#2319).
• OpenClaw adapters now honor OPENCLAW_STATE_DIR with OpenClaw-compatible whitespace, tilde, and absolute-path handling, keeping plugins, skills, receipts, status, and disable operations on the configured state. Re-enabling safely migrates resources recorded under the legacy fallback, preserves the old receipt when cleanup must be retried, and previews the migration during --dry-run. If an older receipt used an OPENCLAW_HOME that is no longer present in the environment, temporarily restore it before migration or cleanup (#2337).

[0.2.18] - 2026-08-06

Changed

• Telemetry upload now treats SLS_PROJECT_PREFIX as an SLS project prefix and appends the detected region, for example anolisa-cn-hangzhou. Deployments that set the legacy SLS_PROJECT must migrate to SLS_PROJECT_PREFIX so uploads reach their region-specific project (#2260).

Fixed

• Raw installs now stream only selected archive payloads through private, disk-backed staging instead of retaining uncompressed contents in memory. Large packages can install with bounded payload memory while preserving atomic placement, rollback, cleanup, and digest verification (#2250).
• anolisa status and anolisa doctor now hash ANOLISA-owned files up to 2 GiB and treat larger files as unchecked and degraded instead of failed. Intact components with large artifacts no longer appear damaged or trigger spurious repair, while recovery still fails closed when verification is required (#2271).
• Enabling a Codex adapter that declares hooks now discovers the installed plugin's hook identities and atomically persists their trusted hashes, so non-interactive codex exec sessions can run them. Missing hooks or overridden trust settings stop enablement with actionable diagnostics (#2281).

[0.2.17] - 2026-08-05

Added

• Raw installs can now render layout placeholders such as {bindir} and {datadir} inside declared text files before placement, so shared package templates follow the selected install scope and prefix. Integrity checks and repair use the rendered bytes (#2222).

Changed

• Raw repository resolution now prefers the generation-2 index when published and enforces each component's minimum CLI version. Incompatible entries fail with an anolisa update self hint instead of silently installing an older or malformed result, while generation-1 repositories remain compatible (#2222).
• RPM-backed adapter scan, status, and enable operations now use a declared package-owned resource root and report a missing or invalid root instead of falling back to stale raw files. Codex adapters that target an external RPM root record a trust anchor; disable them before downgrading to 0.2.16 (#2222).

Fixed

• Qoder native plugin bundles now use Qoder's own plugin lifecycle instead of being copied or rewritten as legacy hook bundles. Existing same-ID plugins across user and project scopes are protected, and unverified installs or removals retain a retryable receipt rather than claiming or deleting user state (#2221).

[0.2.16] - 2026-08-03

Added

• Successful anolisa update <component> and anolisa update all operations now report adapters whose resource bundles changed, with the exact anolisa adapter enable ... or anolisa adapter status ... follow-up command. JSON responses expose the same information through stable adapter_actions arrays (#2018).

Fixed

• Raw system-scope installs on Debian-family hosts no longer fail with rpm not found on PATH when both RPM tooling and an RPM database are absent. An existing or newly appearing RPM database still stops the raw install before files change (#2061).

[0.2.15] - 2026-07-30

Added

• Interactive anolisa install, anolisa install --all, and anolisa uninstall now display phase-based activity during long-running planning and execution. ANSI-capable terminals animate the current phase, while limited interactive terminals print static phase lines (#2036).

Changed

• Human-readable failures now use conventional error: and hint: labels without exposing machine codes. --json retains structured error codes, and exit statuses remain unchanged.
• Update notifications now quote the recommended sudo anolisa upgrade and anolisa update --check commands so their boundaries are clear.

[0.2.14] - 2026-07-29

Fixed

• anolisa status and anolisa doctor now detect Unix mode and Linux file capability drift for raw-managed files, including installations recorded by earlier releases, and recommend anolisa repair for recovery.
• anolisa repair now replays raw-managed components when only file metadata has drifted, restoring declared modes and confirmed capabilities. Failed updates restore only capabilities known to have been active before the operation, avoiding optional grants that never applied (#1987).

[0.2.13] - 2026-07-28

Added

• The @anolisa/cli npm package now supports macOS arm64 and selects the matching native binary during installation.
• Tokenless adapters now support Qwencode while keeping the Cosh extension independent from shared hook assets.

Fixed

• Raw installs now refuse to provision a system package reserved by another pending RPM install and direct the user to anolisa repair, preventing components from claiming or later removing each other's dependencies.
• cosh-ng RPM installations now retain the cosh-ng component identity. Unambiguous legacy records and recovery journals stored as cosh are repaired so lifecycle commands target the correct component.
• Failed raw updates and repairs now restore file permissions and capabilities during rollback, keeping restored binaries executable.
• Enabling the Tokenless Qoder adapter now resolves shared hook paths in the cached plugin, preventing matching tool calls from failing because of broken hook commands.

[0.2.12] - 2026-07-27

Changed

• Commands that act on an installed component now report an absent target as NOT_INSTALLED instead of INVALID_ARGUMENT, so a caller can tell "there was nothing to act on" from "the invocation was wrong" without parsing the error message. The code reports state absence only, and does not indicate whether the name was valid. Affects uninstall, update, repair, forget, restart, and adapter; the exit code stays 2 (#1915).

Fixed

• Adapter status now ignores empty or incomplete stale source directories and reports missing bundles as degraded; raw uninstalls prune empty directories so another installation scope cannot be shadowed (#1850).
• Raw install dry-runs now validate component conflicts before execution, keeping preview results aligned with real installs. Repositories without lightweight sidecar metadata warn that conflict validation was skipped (#1898).

[0.2.11] - 2026-07-24

Added

• Raw anolisa install --version now installs the exact published component version.
• Raw anolisa install --version output now reports requested and resolved versions, artifact URL, and source repository.

Changed

• Raw anolisa install --version now lists published alternatives when the requested version is unavailable.

Fixed

• Raw anolisa install --version no longer installs another version when the requested version is unavailable.
• Raw component uninstalls with many files now complete faster and write substantially less data.
• Recovery now preserves installed state when operation recovery data is missing or corrupted.

[0.2.10] - 2026-07-23

Added

• anolisa telemetry now lets administrators enable or disable data collection.
• anolisa telemetry now lets administrators link or unlink named reporting.
• anolisa telemetry status now reports collection and named-reporting states in text or JSON.
• Adapter enable and disable commands now display component-provided follow-up notices.
• Adapter JSON output now includes structured component-provided notices.
• anolisa install --version JSON output now includes requested and resolved versions, source repository, and exact RPM.

Changed

• Fresh ANOLISA RPM installations now enable anonymous telemetry by default.
• RPM installation output now explains how to disable telemetry.
• Enabled telemetry now resumes automatically after restarts on supported hosts.
• anolisa register now warns that the command is deprecated.
• anolisa register now enables telemetry without prompting.
• anolisa register status now directs users to anolisa telemetry status.
• anolisa unregister now disables telemetry while preserving local logs.
• anolisa install --version now selects the exact host-compatible RPM matching the requested version.
• anolisa install --dry-run --version now validates availability and displays the resolved RPM details.
• Adapter dry-runs now preview component-provided notices without changing the host.
• Adapter quiet output now suppresses component-provided notices.

Fixed

• anolisa register now prevents duplicate uploads from earlier telemetry configurations.
• anolisa unregister no longer leaves earlier telemetry configurations reporting.
• anolisa install --version no longer changes the host when the requested RPM is unavailable or incompatible.
• anolisa install --version no longer records success when a different RPM version is installed.
• anolisa repair now rejects interrupted RPM installs whose installed version differs from the original request.
• anolisa repair now reports when an interrupted RPM install's architecture cannot be verified.
• anolisa adapter disable now shows saved follow-up notices even when component files are unavailable.
• Adapter notices can no longer inject terminal formatting into human-readable output.

[0.2.9] - 2026-07-22

Added

• anolisa update all now updates every tracked raw and RPM component while leaving the CLI unchanged.
• anolisa repair now restores damaged raw installations from their recorded versions.
• anolisa repair now supports user-scope installations without root privileges.
• anolisa repair now recovers interrupted install, update, adopt, uninstall, and batch operations.
• anolisa repair now reinstalls missing managed RPM packages.
• anolisa status now reports unclassified legacy records as needs-attention with scope-aware repair and forget guidance.
• anolisa status and anolisa doctor now run health checks from each installation's saved component manifest.
• User-mode adapter commands can now target visible system installations.
• anolisa repair can now restore unclassified legacy records from installed packages or intact files.
• anolisa forget can now remove unclassified legacy records without touching installed files or packages.

Changed

• anolisa install now refuses unmanaged system RPMs and directs users to anolisa adopt.
• anolisa install now succeeds without changes when the component is already tracked.
• anolisa adopt now makes existing RPMs updatable while keeping package removal opt-in.
• anolisa adopt now succeeds without changes for already adopted packages.
• anolisa update now requires observed-only RPMs to be adopted first.
• anolisa install --all now applies new RPM packages in one package transaction.
• anolisa upgrade now applies planned RPM updates in one package transaction.
• anolisa upgrade now applies planned RPM installs in one package transaction.
• anolisa list and anolisa status now show separate user and system rows for shadowed components.
• anolisa list now labels tracked installations as owned, managed, adopted, or observed.
• anolisa --install-mode user install can now create a user installation beside a visible system installation.
• Lifecycle mutations now remain within the selected scope, including package aliases.
• The first modifying command now upgrades legacy state and preserves installed.toml.v4.bak.
• Newer state formats now produce an error instead of appearing empty.
• install-anolisa.sh now leaves distribution index retrieval to the CLI, keeping mirror data current.
• install-anolisa.sh now stages only OS-base manifests because component manifests are fetched when needed.
• install-anolisa.sh --strict now validates only binary and manifest bundle checksums.
• ANOLISA_INDEX_URL and ANOLISA_INDEX_SHA256 no longer affect install-anolisa.sh.
• Lifecycle JSON output now includes explicit plans across install, adopt, update, repair, and uninstall.
• Uninstall JSON output now uses one schema for raw and RPM components, including package removal and plans.
• anolisa uninstall --dry-run now reports missing components as errors instead of empty successful plans.
• anolisa forget and anolisa restart now stop while an earlier component operation needs recovery.
• anolisa doctor now reports incomplete operations even without an active component record.

Fixed

• RPM-managed components no longer fail status or doctor because of raw-install health checks.
• RPM component updates now refresh saved component manifests before reporting success.
• Incomplete RPM manifest refreshes now appear in anolisa logs --severity warn.
• Interrupted RPM updates now remain repairable instead of appearing successful with stale settings.
• anolisa doctor no longer recommends lifecycle commands when recovery data is unreadable or ambiguous.
• anolisa doctor no longer duplicates recovery findings across components sharing one state location.
• anolisa doctor --help now states that --fix remains unavailable.
• Batch RPM failures now preserve repairable state for packages that changed.
• Component aliases no longer redirect lifecycle changes into a different installation scope.
• Health checks for user services now use the correct service manager across installation scopes.
• Failed batch RPM operations now retry unaffected components individually.

[0.2.8] - 2026-07-21

Added

• anolisa adapter enable now supports --allow-unsafe-plugin-install for explicitly authorized OpenClaw plugin installation.
• OpenClaw adapter settings can now target specific OpenClaw versions.

Changed

• anolisa adapter enable now checks OpenClaw compatibility before making changes.
• anolisa adapter enable now verifies OpenClaw plugins are loaded before reporting success.
• When OpenClaw blocks an unsafe plugin, ANOLISA now shows the reported findings.
• When supported, OpenClaw safety errors now suggest retrying with explicit unsafe authorization.

Fixed

• Failed OpenClaw setting updates can now be retried without losing track of affected settings.
• Re-enabling an OpenClaw adapter no longer loses track of settings applied by an earlier successful enable.
• anolisa adapter disable now warns when OpenClaw settings may remain after an uncertain update.

[0.2.7] - 2026-07-18

Added

• anolisa adapter now manages Qwen Code extensions through the qwen CLI for Qwen Code 0.17 and newer.

Changed

• anolisa upgrade and anolisa repair now explain component manifest reconciliation in human and JSON output.

Fixed

• anolisa upgrade now refreshes component manifests after RPM package upgrades.
• anolisa upgrade now reconciles same-version RPM component manifest changes.
• anolisa repair now refreshes stale component manifests from the installed RPM.
• Failed component manifest refreshes now keep RPM components repairable and report the affected component.

[0.2.6] - 2026-07-16

Fixed

• anolisa status no longer reports healthy RPM-managed components as failed.

[0.2.5] - 2026-07-14

Added

• anolisa repair now recovers interrupted fresh RPM installs after the package has been installed.
• anolisa update --check now reports RPM components whose saved state requires reconciliation.

Changed

• Install, adopt, and upgrade commands now require interrupted RPM installs to be repaired before continuing.

Fixed

• Concurrent RPM installs now fail safely instead of overwriting another operation's component state.
• Reinstalling a missing ANOLISA-managed RPM now preserves the component's settings and history.
• anolisa uninstall --dry-run --json now includes dry_run: true and omits removal phases for components that are not installed.
• anolisa upgrade now refreshes saved RPM versions and package details after upgrades.
• anolisa upgrade now reconciles older RPM records that lack package details.

[0.2.4] - 2026-07-13

Added

• anolisa update --check now shows progress while checking for updates in interactive terminals.
• anolisa upgrade now shows progress while planning and applying upgrades in interactive terminals.

Fixed

• Raw component installs and updates now choose installable archives even when binary releases are also listed.

[0.2.3] - 2026-07-12

Changed

• Package installation and removal progress now uses stderr, keeping command output safe for redirection.

Fixed

• ANOLISA commands now exit cleanly when a downstream pipeline closes standard output early.
• ANOLISA commands now report standard output write failures instead of silently succeeding.

[0.2.2] - 2026-07-09

Added

• anolisa update --check now reports RPM upgrade opportunities without changing state.
• anolisa update --check --motd now prints a short login-friendly upgrade summary.
• anolisa upgrade now applies RPM image upgrades for RPM-managed toolchains.
• anolisa upgrade now installs missing default components from the selected target profile.
• anolisa adapter scan now marks enabled receipts with missing sources as orphaned.
• anolisa adapter status now reports missing adapter sources as degraded receipts.

Changed

• anolisa list now shows component scope for visible user and system records.
• anolisa status now shows scope, mutability, shadowing, and state path metadata.
• anolisa doctor now includes readable system components in user-mode diagnostics.
• anolisa doctor now suggests system-mode commands for read-only system records.
• anolisa update --check now uses the latest target profile when --target is omitted.
• anolisa update --check --motd now points users to sudo anolisa upgrade when action is needed.

Fixed

• anolisa uninstall, forget, and update now reject read-only system targets with system-mode guidance.
• anolisa upgrade now reports unresolved target defaults as check errors.
• anolisa upgrade now warns when refreshed RPM details are unavailable after an upgrade.

[0.2.1] - 2026-07-08

Added

• anolisa adapter enable now supports Tokenless adapters for cosh, Codex, and Claude Code.
• anolisa adapter enable now supports Tokenless adapters for Qoder.

Changed

• Claude Code adapters now use per-component marketplaces to avoid affecting other ANOLISA plugins.
• anolisa adapter enable now rejects invalid framework and adapter_type combinations before changing settings.

Fixed

• Codex adapters now work when component resources come from packaged data directories.
• Qoder adapter enable now keeps malformed settings.json unchanged instead of replacing it.
• Qoder adapter disable now removes only hook entries previously added by ANOLISA.
• Qoder adapters now prefer stable qodercli releases over matching prereleases.

[0.2.0] - 2026-07-07

Added

• Raw components can now declare conflicts to block incompatible raw installs.

Fixed

• anolisa install now rejects raw component conflicts before changing the host.
• anolisa install --dry-run now reports raw component conflicts instead of showing an invalid plan.

[0.1.20] - 2026-07-03

Added

• ANOLISA can now be distributed as @anolisa/cli with Linux x64 and arm64 binaries.
• repo.toml now enables the npm backend for component distribution.

Changed

• anolisa list now shows local state, ownership, and next action for each component.
• anolisa list --json now includes RPM package, version, architecture, and source repository details.

Fixed

• RPM installs and updates now keep system repositories available for dependencies.
• Adapter commands now distinguish missing component manifests from invalid manifests.

[0.1.19] - 2026-07-02

Fixed

• anolisa adapter disable --dry-run now previews cleanup without removing adapter receipts or resources.
• Read-only commands now use downloaded repo config when saving repo.toml fails.
• Component commands now accept package aliases consistently when targeting installed components.
• Ambiguous package aliases no longer choose an arbitrary installed component.
• Unknown component names now report no match without querying packages.

[0.1.18] - 2026-07-01

Added

• anolisa install now auto-installs missing system packages for raw components in system mode.
• anolisa install --dry-run now labels unresolved dependencies as auto-install or manual.
• anolisa install now reports packages auto-installed during raw component installs.
• anolisa status --verbose now shows packages auto-installed for each component.

Changed

• Commands that need repo access now download and validate repo.toml on first use.
• Repo config dry-runs now fetch and validate without writing repo.toml.
• RPM install and update now use only the repo.toml RPM repository.
• User-mode raw installs now report missing dependencies with install commands before changing files.
• Failed raw installs now list any auto-installed packages left on the system.
• anolisa update self no longer fetches repo config before checking CLI updates.

Fixed

• anolisa list --installed now includes adopted RPM components.
• anolisa list now shows adopted, failed, and disabled component statuses.
• Adapter commands now prefer resources from the datadir that supplied the component contract.
• RPM installs now fail before dnf when [backends.rpm] is missing.
• RPM updates now explain missing [backends.rpm] instead of using host repositories.

[0.1.17] - 2026-06-30

Added

• Repository components.toml can now define component names, package aliases, and raw/RPM package mappings.
• anolisa list --installed now filters installed components.

Changed

• anolisa list and install --all now read components from components.toml instead of catalog.json.
• anolisa list now shows NAME, SUMMARY, BACKENDS, and STATUS.
• anolisa list --enabled is now a hidden alias for --installed.
• ANOLISA_CATALOG_URL no longer changes list sources; configure repo.toml instead.
• anolisa install, status, adopt, and repair now resolve RPM package aliases from components.toml.
• anolisa status now suggests sudo anolisa adopt <component> for untracked RPM components.

Fixed

• anolisa status <RPM package> now reports the canonical component row when an alias is installed.
• anolisa repair <RPM package> now refreshes the canonical component row when an alias is used.
• Non-root anolisa osbase mutations now reach the system helper instead of failing install-mode checks.
• Commands now reject root --install-mode user before writing ambiguous user-mode state.
• System-mode write commands now fail before changes when sudo is missing.
• Existing installs with managed symlinks no longer show false symlink integrity failures after upgrade.
• anolisa status now reports referent_mismatch when managed symlinks point elsewhere.

[0.1.16] - 2026-06-29

Added

• anolisa osbase sandbox install runc now installs runc, containerd, Docker, and Docker client.
• anolisa osbase sandbox install now enables services declared by sandbox scenarios.
• anolisa osbase sandbox install now runs scenario verification commands after installation.
• anolisa osbase sandbox install now records sandbox scenarios in installed.toml.
• anolisa osbase sandbox install now reports optional scenario packages as hints.
• rund, firecracker, and gvisor sandbox scenarios now define post-install checks.
• anolisa adapter enable now supports adapter_type = "skill_bundle" for OpenClaw and Hermes skills.
• The RPM package now installs default repo.toml to /etc/anolisa/repo.toml.
• ANOLISA telemetry setup now installs log rotation for ops .jsonl files.

Changed

• anolisa osbase sandbox install --dry-run now shows preflight, package, service, verify, and state phases.
• anolisa osbase sandbox install runc now requires Linux kernel 4.18 or newer.
• anolisa osbase sandbox install now reports verification failures as warnings when other phases succeed.
• repo.toml now points RPM installs to the agentic-os repository path.
• anolisa update self --json now reports apply mode, RPM package, and RPM version observations.
• anolisa adapter status now treats skill bundles as healthy without plugin registration.
• anolisa adapter enable now rejects skill bundles that declare framework config entries.

Fixed

• RPM-backed commands now use the component name as the default package name.
• anolisa update self now delegates RPM-owned CLI updates to dnf.
• Non-root sandbox installs now show package, service, verify, and state phases.
• Telemetry setup now runs the ilogtail installer with bash-compatible script handling.
• anolisa adapter disable now cleans skill bundles without plugin unregister errors.

[0.1.15] - 2026-06-25

Added

• anolisa doctor now reports component health, dependency status, and suggested fixes.
• Raw components can now declare runtime dependencies for install and update preflight checks.
• anolisa install --dry-run now previews runtime dependency status for raw components.

Changed

• anolisa install and update <component> now refuse raw components with missing runtime dependencies before changing files.
• anolisa restart <component> now restarts service units shipped by RPM-backed components.
• anolisa restart <component> now shows guidance for RPM-backed template services instead of failing.

Fixed

• anolisa adapter enable now expands {datadir} from the package that provided the adapter metadata.
• After anolisa uninstall or forget, adapter commands no longer see stale component metadata.

[0.1.14] - 2026-06-24

Added

• Raw components can now place systemd unit files with {unitdir}.
• Raw components can now place user service unit files with {userunitdir}.
• User-mode anolisa install now activates declared user-scope services.

Changed

• User-mode anolisa install now resolves %u service templates to the current user.
• System-mode anolisa install now preserves %u user service templates for later per-user activation.
• anolisa uninstall now reloads systemd after removing declared service unit files.
• anolisa restart <component> now restarts user-scope services from user-mode installs.

Fixed

• anolisa install now starts freshly installed service units without a manual systemd reload.
• anolisa uninstall now deactivates user-scope services from user-mode installs.
• anolisa adapter enable now finds {datadir} skills from the package directory that provides the adapter.

[0.1.13] - 2026-06-23

Added

• anolisa adapter enable now supports Hermes plugins.
• anolisa adapter enable now installs declared OpenClaw skills.
• anolisa adapter enable now applies declared OpenClaw config values.
• anolisa install now starts declared services for raw components.
• anolisa install now applies declared file capabilities for raw components.
• anolisa install now runs declared hooks for raw components.
• anolisa update <component> now restarts declared services for raw components.
• anolisa update <component> now reapplies declared file capabilities for raw components.
• anolisa uninstall now runs declared hooks for raw components.
• anolisa uninstall now disables declared services after stopping them.

Changed

• anolisa adapter scan now honors declared adapter resource locations.
• anolisa adapter enable now reads package-installed adapter resources.
• anolisa install --dry-run now previews declared capabilities for raw components.
• anolisa register status now reports the latest registration after repeated changes.
• Cancelled anolisa register and unregister prompts now exit successfully.

Fixed

• anolisa adapter status now detects OpenClaw plugins from wrapped table output.
• anolisa adapter status now ignores bundled Hermes plugins during checks.
• anolisa adapter commands now find metadata shipped by RPM-installed components.
• anolisa register status now reports sysom console registrations as active.

[0.1.12] - 2026-06-22

Added

• anolisa update <component> can update raw-managed components from the raw backend.
• anolisa osbase sandbox list shows scenarios from sandbox.toml.
• anolisa osbase sandbox uninstall <scenario> can remove packages for a sandbox scenario.
• anolisa system setup can install the helper service for non-root osbase commands.
• anolisa system status can show helper health, version, uptime, and last operation.
• anolisa system teardown can remove the helper service and sandbox config.
• anolisa env --json includes distro identity fields.

Changed

• anolisa osbase sandbox install <scenario> now installs scenarios defined in sandbox.toml.
• Omitting --install-mode now selects system for root and user otherwise.
• anolisa update <component> --dry-run now lists raw backend candidate versions.

Fixed

• Legacy yum backend names in repo.toml and --backend now resolve to rpm.
• Raw components installed with --package now update from the same package name.
• anolisa update <component> now refuses raw updates that would downgrade a component.
• anolisa update <component> now refuses raw updates when versions cannot be safely compared.

[0.1.11] - 2026-06-18

Added

• anolisa adopt <component> can track a pre-installed system RPM without installing it.
• anolisa repair <component> can refresh RPM component state after package details change.
• anolisa forget <component> can stop tracking a component without removing packages or files.

Changed

• anolisa status <component> now reports drifted RPM components when system package details change.
• anolisa uninstall now keeps observed system RPMs unless --remove-system-package is used.
• anolisa install now preserves adapter package resources when adopting RPM components.

[0.1.10] - 2026-06-17

Added

• anolisa install --backend rpm can install missing RPM components through dnf and track them as managed.
• anolisa install can adopt matching pre-installed system RPMs without downloading a raw package.
• anolisa update <component> can update RPM-managed and RPM-observed components through dnf.
• anolisa status now shows package, version, architecture, and source repo for RPM-backed components.
• anolisa status <component> now reports matching untracked system RPMs as observed.

Changed

• anolisa update runtime <component> is now anolisa update <component>; self and all stay subcommands.
• repo.toml now uses [backends.rpm] instead of [backends.yum].
• anolisa install --all now lists adopted RPM components in the batch summary.

Fixed

• anolisa install --all now prints the reason for each failed component in human output.
• anolisa install now refuses automatic RPM detection when rpm or dnf is missing, with a --backend raw hint.
• anolisa install no longer replaces a raw install if another install finishes first.

[0.1.9] - 2026-06-16

Added

• anolisa install --all can install every available component from the catalog.
• anolisa install --all --fail-fast can stop after the first failed component.
• anolisa install --all --json returns one batch summary with per-component results.
• anolisa status now shows adapter summaries for installed components.

Changed

• installed.toml now distinguishes ANOLISA-managed packages from observed system RPMs.

[0.1.8] - 2026-06-15

Added

• anolisa adapter enable can now register installed adapters with OpenClaw.
• anolisa adapter disable can now remove OpenClaw adapter registrations.
• anolisa adapter status can now report OpenClaw adapter health.
• anolisa adapter scan can now show installed adapter resources.

Changed

• anolisa install now places adapter resources needed by later enablement.
• anolisa uninstall now blocks components that still have enabled adapters.

[0.1.7] - 2026-06-13

Changed

• User-mode library paths now resolve to ~/.local/lib/anolisa; other directories continue to follow XDG_* overrides.

Fixed

• anolisa install no longer requires a local catalog entry before downloading from the remote repository.
• anolisa install --dry-run can preview files and services without downloading the full package.

[0.1.6] - 2026-06-12

Added

• anolisa osbase sandbox install gvisor now supports standalone, containerd, and substrate deployments. (#851)
• anolisa list can derive the component catalog from repo.toml configuration. (#854)

Changed

• Replaced the legacy "capability" model with a unified component lifecycle; old state auto-migrates on next write. (#876)

Fixed

• anolisa list --enabled now correctly shows installed components instead of an empty list. (#872)
• anolisa list no longer requires a separate local catalog file when repo.toml is configured. (#854)

[0.1.5] - 2026-06-11

Added

• anolisa list reads from a remote or local component catalog and returns structured JSON. (#850)
• anolisa install <component> downloads, verifies, and installs components from the remote repository. (#852)
• anolisa uninstall supports the new component model while preserving legacy fallback. (#852)

Changed

• Simplified CLI help around list, install, uninstall, status, doctor, logs, restart, update. (#850)

Fixed

• anolisa list returns an empty list with a config hint when no catalog is configured. (#850)
• Failed installs now automatically roll back partially-written files. (#852)

[0.1.4] - 2026-06-10

Added

• anolisa adapter scan detects available framework integrations. (#808)
• anolisa adapter install downloads verified packages and registers adapters with the target framework.
• anolisa adapter remove safely removes only ANOLISA-managed files, with dry-run and JSON preview support.
• anolisa adapter install tokenless openclaw wires up the tokenless adapter via the OpenClaw CLI.
• anolisa enable fetches component metadata from the remote repository, with offline fallback.
• anolisa status now includes component health check results.

Changed

• Renamed subscription commands to top-level anolisa register / unregister.

Fixed

• Adapter install/remove failures now roll back or preserve state for retry.

[0.1.3] - 2026-06-09

Added

• anolisa --help now groups commands by category (everyday vs. management).
• list command shows its ls alias in help output.
• anolisa update self prints a changelog link on success.

Changed

• Corrected package license metadata to Apache-2.0.

[0.1.2] - 2026-06-08

Added

• anolisa bug generates a local diagnostic report with environment info and recent error logs.
• anolisa self update added as an alias for anolisa update self.

Fixed

• Restored the bug report issue template.

[0.1.1] - 2026-06-07

Added

• anolisa osbase sandbox install provisions sandbox environments (firecracker and e2b backends).
• anolisa register / unregister manages data-upload consent with 30-day deferral.
• anolisa enable can configure log upload (ilogtail) with automatic region detection.
• anolisa update self downloads and applies CLI updates with integrity verification and rollback.
• Real dnf/apt package manager backends replacing placeholder stubs.
• GitHub Actions CI for the anolisa workspace.

Fixed

• Install script uses portable bash expansion instead of sed.

[0.1.0] - 2026-06-04

Initial alpha release of the ANOLISA CLI.

Added

• CLI commands: env, list, status, logs, enable, disable, uninstall, restart, update, info, doctor.
• Environment detection: OS, arch, kernel, distro, container runtime, user identity (graceful degradation).
• Component lifecycle engine with preview-then-execute, integrity checks, and audit logging.
• Configuration-driven feature gates for shipping new capabilities without code changes.
• Declarative TOML component manifests with multi-architecture support.
• install-anolisa.sh installer with three modes (local, checkout, URL), checksum verification, and --dry-run.
• End-to-end smoke tests for agent-observability and token-optimization.

Capabilities shipped

Known limitations

• Real-execute paths are Linux-only (darwin hosts can --dry-run only).
• No signature verification or rpm/deb backend yet.
• update command returns NOT_IMPLEMENTED.

Changelog

All notable changes to ANOLISA Blaze will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.3.0] - 2026-07-22

Added

• Generic StorageProvider trait with pluggable backend architecture.
• FileStorageProvider: default file-based storage backend for development and standard deployments.
• [storage] config section: provider, pool_size, prefork, flush_interval fields with backward-compatible defaults.
• GET /v1/health now includes storage_pool status (ready/capacity/pending).
• BackendSpawner trait extended with restore, pause, resume, create_snapshot methods (default unsupported, enabling future snapshot workflows).

[0.2.1] - 2026-07-21

Changed

• Rebrand: Component renamed from Anvil to Blaze. Binary: blazed, config path: /etc/anolisa/blaze/, state: /var/lib/blaze/.
• Firecracker vCPU configuration now validated against upper bound (1–32).

Added

• Component registered in project manifests (root README, AGENTS.md, PR template).
• VM resource configuration fallback chain documented in README.

[0.2.0] - 2026-06-30

Added

• FirecrackerSpawner: Firecracker microVM backend, daemon auto-detects and selects strongest isolation at startup.
• TCP remote API: configurable [listen].http_addr enables TCP listener (port 14159) for platform calls.
• Prioritized backend selection: build_spawner() auto-selects by firecracker → linux-sandbox → mock priority.
• Storage section: [storage].images_dir unifies vmlinux/rootfs lookup path.
• Packaging skeleton: dist/anvil.service (systemd unit) + anvil.spec (RPM) + tmpfiles-anvil.conf.
• [backends] config section for direct backend binary path mapping.

[0.1.3] - 2026-06-24

Changed

• Sandbox processes now run with full namespace isolation (PID, network, filesystem).

[0.1.2] - 2026-06-22

Added

• Sandbox processes are now managed by the daemon: auto-spawn on create, auto-kill on destroy.
• Daemon gracefully degrades when backend binary is unavailable (useful for dev environments).

[0.1.1] - 2026-06-20

Added

• Policy validation rejects unsafe configurations before sandbox starts.
• Safe coordination with osbase sandbox uninstall (prevents removing in-use backends).

[0.1.0] - 2026-06-18

Initial scaffold of ANOLISA Anvil per-host sandbox daemon.

Added

• Create, list, inspect, checkpoint (state-only), reset, and destroy sandboxes via HTTP API.
• Policy-driven backend selection: assign workload class → get the right sandbox type automatically.
• Warm pool: pre-created sandboxes ready for instant allocation, configurable min/target/max.
• Template sharing: multiple sandboxes share one base memory image, reducing per-instance cost.
• Prometheus metrics endpoint for monitoring.

Changelog

2.8.0

• Added COSH_SESSION_ID export for subprocess and MCP correlation. (#1491)
• Fixed hook process tree termination on timeout and cancellation. (#1585)
• Updated docs to centralize user guides and add docs lint CI. (#1586)
• Fixed cosh-switch to reuse compatible cosh-ng authentication. (#1951)

2.7.0

• Added /ktuner command with consent-gated, opt-in first-run check and trusted-path resolver. (#1279)
• Added loading indicator when selecting an auth provider. (#1389)
• Added COSH_SESSION_ID export for agentsight per-run correlation. (#1383)
• Fixed security intents to map to hook commands. (#1438)
• Fixed cosh-switch post-switch guidance for clarity. (#1424)
• Fixed shell mode to add actionable error guidance for exit code 127. (#1319)
• Updated docs to rename __CN.md to __zh.md, fix cross-refs, and add missing READMEs. (#1335)

2.6.1

• Added npm packaging support for CLI and cosh. (#1307)
• Added multi-hook toggles support. (#1206)
• Fixed tips banner to stay visible after initial login. (#1308)
• Fixed Ctrl+O to prioritize error details over compact mode. (#1202)
• Fixed system-profile BINDIR to follow PREFIX. (#1193)
• Fixed AfterModel hook non-blocking notifications not surfacing. (#1182)
• Updated component docs to migrate into user-guide and developer-guide. (#1295)
• Added copilot-shell zh/en user and developer docs. (#1236)
• Fixed CONTRIBUTING.md file mode from symlink to regular file. (65601f06)

2.6.0

• Added multi-hook enable and disable support to /hooks. (#1200)
• Added cosh-ng compatibility with cosh-switch. (#1169)
• Added instance_id to SysOM API request params. (#1160)
• Added anolisa component contract. (#1128)
• Added SLS JSONL session telemetry with expanded metrics. (#1057)
• Added authenticated models display in /model dialog. (#1030)
• Added kitty csi-u keys support with sequence timeout management. (#552)
• Added large paste placeholder and fixed placeholder id reset on esc cancel. (#312)
• Fixed SLS log write to skip when file does not exist or is not writable. (#1101)
• Fixed useless sandbox guard and failure handler hooks by removing them. (#979)
• Fixed missing keyboard shortcut hints in footer status bar. (#921)
• Fixed response language and model identity rules. (#920)
• Fixed sub-model refusal detection and byteLength display. (#895)
• Fixed webfetch sub-model output validation to avoid silent refusals. (#895)
• Fixed thinking output to be distinguished from user input with prefix and color. (#894)
• Fixed custom model configuration to be preserved. (#887)
• Fixed partial message finalization on API error. (#801)
• Fixed API error reporting in all output formats, not only text. (#801)
• Improved escape key handling by unifying it in appcontainer. (#437)

2.5.0

• Fixed missing esc hint in tool confirmation footer status bar (#732)
• Fixed invisible cursor in provider/auth config inputs (#683)

2.4.1

• Fixed HookSystemMessage rendering as info and resolved Content/Thought duplication (#636)
• Fixed prompt ids to remain monotonic after shell remount (#628)

2.4.0

• Added DashScope Token Plan provider entry to the OpenAI-compatible auth dialog. (#598)
• Added UserPromptSubmit and PostToolUse hook reason surfacing in the UI. (#545)
• Added run_id field to HookInput for per-run event correlation. (#482)
• Fixed UserPromptSubmit hook decision merging to enforce safety priority over allow. (#597)
• Fixed missing tool_use_id in PreToolUse hook input. (#559)
• Fixed memory hooks lock takeover with atomic rename and async IO. (#550)
• Fixed auto-memory workspace cleanup wiping user-added directories. (#548)
• Fixed auto-memory session hook missing read_file events due to wrong arg key. (#547)
• Fixed run_id ordering by setting it before UserPromptSubmit hook fires. (#537)
• Fixed UserPromptSubmit hook firing on tool-result and Stop continuations. (#534)
• Updated installer to support multiple install profiles. (#541)

2.3.0

• BREAKING Removed qwen-oauth authentication support. (#455)
• Added auto memory background extraction system. (#465)
• Added full shell command display in hook-ask and exec confirm dialogs. (#452)
• Added esc key to cancel running slash commands. (#290)
• Fixed JavaScript heap out of memory during long sessions. (#462)
• Fixed missing allow decision reason in UI when systemMessage is absent. (#435)
• Improved test coverage with standalone tests for ExecCommandPreview. (#460)
• Updated hook docs to clarify difference between systemMessage and reason. (#436)

2.2.1

• Fixed initial chat being blocked during skill/subagent first-load discovery. (#418)
• Fixed missing tool_use_id in PostToolUse hook event payload. (#414)
• Fixed missing skill_context in PreToolUse hook input for resolved skill path. (#409)
• Fixed missing auto-completion for /statusline subcommands. (#408)
• Fixed unavailable agents appearing in the key sharing prompt. (#394)
• Fixed bash option not being restored after canceling from the provider screen. (#393)
• Fixed hook systemMessages to be concatenated with a [name] prefix for clarity. (#387)

2.2.0

• Added ask decision support for UserPromptSubmit hook. (#328)
• Added new command for Clawhub CLI. (#313)
• Added interactive Skills TUI Panel with enable/disable support. (#311)
• Added variable substitution and display control for extension TOML commands. (#291)
• Added immediate hook activation on extension install/uninstall. (#283)
• Added ask decision support for PreToolUse hooks. (#276)
• Added configurable status bar. (#251)
• Added /export command for session history. (#245)
• Fixed API key validation to skip non-Dashscope providers. (#337)
• Fixed PreToolUse ask dialog by unifying it to info type with diff preview. (#345)
• Fixed memory leak in memory management. (#309)
• Fixed extension lifecycle reliability. (#298)
• Fixed hook registry sync on extension enable/disable. (#298)
• Fixed interface crash caused by leftBottomContent of Box nested in Text in Footer. (#293)
• Fixed /hooks install command by removing it and adding default help. (#287)
• Fixed extension examples installation and package configuration. (#271)

2.1.0

• Added startup bash entry and simplified manual auth dialog. (#217)
• Added async fzf-based tab completion optimization. (#214)
• Fixed OpenAI API key and model validation via /models endpoint on auth. (#243)
• Fixed API key retention when navigating to apiKey field in auth dialog. (#241)
• Fixed node-pty native binary bundling for both linux architectures. (#232)
• Fixed stream redaction by replacing integer offset with committed text reference. (#210)
• Fixed missing fields in hook system. (#188)

2.0.4

• Added STS authentication support via ECS RAM role. (#161)
• Added BeforeModel, AfterModel, and BeforeToolSelection hooks. (#154)
• Added sandbox usage summary on session exit. (#137)
• Added Tab-completion for ! shell mode. (#131)
• Fixed config-dir source unification and prevented ~/.copilot creation on startup. (#171)
• Fixed /bug command crash in headless environment. (#175)
• Fixed undefined metrics.sandbox in StatsDisplay. (#171)
• Supplement /hooks install step to post-installation guide. (#142)
• Supplement hooks documentation (index, reference, writing-hooks). (#142)

2.0.3

• Migrated config directory from ~/.copilot to ~/.copilot-shell. (#78)
• Added API key detection from configured agents with user approval on bootstrap. (#127)
• Added support for configuring multiple custom model providers. (task#80737766)
• Added global API endpoint support for Dashscope. (#133)
• Added custom skill paths support via settings.json. (#128)
• Added support for loading skills from extension directories with cosh-extension.json compatibility. (#54)
• Added /bug command for submitting bug reports. (#122)
• Added sandbox-guard install command with bypass approval flow. (#125)
• Added secret redaction for model output and tool results. (#100)
• Added extensible feature tip banner for first-launch guidance. (#113)
• Added built-in /dir cd command for in-session directory navigation. (#19)
• Added session renaming command. (task#80737766)
• Added nvm-aware Node.js detection in cosh wrapper script. (#72)
• Added system-level install via Makefile with FHS-compliant directory layout. (#72)
• Fixed 24-item limit on @ file completion menu. (#92)
• Fixed TUI flicker on Qwen OAuth page in limited-height terminals. (#76)
• Fixed left-arrow key not wrapping from line start to previous line end. (#53)
• Fixed irrelevant info display in /model command. (#85)
• Fixed credentials encryption support in settings.json. (#90)
• Fixed test failure when running as root user. (#29)
• Fixed pre-commit hook working directory for lint-staged. (#90)
• Configured Husky hooks and documented pre-commit setup. (#65)

2.0.1

• Renamed OpenAI authentication label to "BaiLian (OpenAI Compatible)" for clarity.
• Fixed login shell stdin drain to prevent unwanted input echo.
• Removed ripgrep unavailable warning message.

2.0.0

• Synced upstream qwen-code to v0.9.0 and rebranded to Copilot Shell.
• Bumped version directly to 2.0.0 (skipping 1.x, which was used by a previous OS Copilot release).
• Integrated Skill-OS online remote skill discovery with priority-based fallback (Project > User > Extension > Remote).
• Added /skills remote and /skills cache clear commands for remote skill management.
• Added /bash interactive shell mode
• Added -c argument support for inline bash commands.
• Added PTY mode for sudo command support.
• Added hooks system with PreToolUse event for intercepting tool calls before execution.
• Added new model provider named Aliyun
• Added nested startup detection warning banner.
• Added system-wide skill path (/usr/share) support.
• Removed original Gemini sandbox.
• Fixed skill frontmatter parsing for YAML special characters (|, &, >).
• Fixed login escaped character echo issue in ECS workbench.
• Fixed Linux headless environment browser open failure when auth with Qwen OAuth.
• Fixed Qwen OAuth authentication, replay, and UI rendering issues.
• Fixed exception handling when adding workspace directories.
• Fixed user query start with unix path being misidentified as command.
• Fixed API key display explicitly.
• Fixed Chinese i18n for /resume command.
• Improved ? hint visibility — hidden while user is typing.
• Miscellaneous UI, branding, CI, and build improvements.

Changelog

All notable changes to the cosh-ng project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.16.0] — Unreleased

[0.15.0] — 2026-08-09

Fixed

• Restore hint cursor after inline hints in shell (#2172)
• Support ID_LIKE fallback for OS distribution detection (#2200)
• List hook commands in /help output (#2208)
• Skip audit logs for service lifecycle actions (#2213)
• Support macOS-specific file reads in core (#2220)
• Serialize handoff state to prevent race conditions (#2226)
• Normalize apt search glob patterns (#2227)
• Recover context budget after compaction in core (#2244)
• Deduplicate hook notices in shell (#2259)

[0.14.0] — 2026-08-04

Added

• /status, /about, and /stats slash commands for runtime introspection (#1778)
• /mcp slash command for MCP server management (#1949)
• /session list --all to enumerate sessions across workspaces (#2139)
• DashScope prompt cache support to reduce token cost (#2046)
• cached_tokens observability for cache-hit diagnostics (#2075)
• Dynamic max_tokens by model in the OpenAI provider (#2165)
• Advertise roots capability in MCP client initialization (#2007)
• Hook tools and environment support in core (#1894)
• Surface tool-argument status and cap retries across core and shell (#1925)
• Auto-execute fully readonly compound commands in shell (#1959)
• Extend capped runs across core and shell (#2035)
• Improved auth menu across core and shell (#2062)
• Bound agent handoff input-waits in shell (#2168)

Changed

• Terminal-agnostic multi-line prompt entry in shell (#1947)

Fixed

• Shell handoff and hooks: preserve LLM input, drop stale handoff text, resume handoff fallback within a provider session, redact handoff evidence, close secret-redacted handoffs via one-time claim token, converge Han NL input ownership, route sensitive NL to agent, and run project hooks for send-to-shell (#1955, #2010, #2055, #2074, #2130, #2137, #2151, #2154)
• Approval lifecycle: guarantee terminal state with lifecycle ledger and last-resort timeout, rearm auth input, surface sandbox-bypass approval in trust mode, and reject zero idle timeout (#1934, #1939, #1968, #2116)
• Auth flows: step /auth back on ESC, list /auth in /help, and hint /auth on noauth startup (#1891, #1906, #2166)
• Slash command and prompt input: prevent slash echo duplication on intercept, let Up recall slash commands, intercept slash-bearing NL prompts, support soft newline in NL prompts, keep card submit type-ahead, normalize CSI-u backspace, and key ghost ownership by route (#1868, #1899, #1911, #1922, #1942, #1993, #2167)
• Shell rendering: stop extdebug leak into prompt hooks, highlight code-block syntax, reply in user language, compact skills list, and disable implicit pagers (#1849, #1904, #1910, #1921, #1998)
• Command risk and safety: assess all compound-command segments for risk, gate irrecoverable system-control commands, and classify interpreter risk (#1905, #2081, #2119)
• File IO hardening: reject placeholder writes, make file writes atomic, bound and confine read tools, restore blocking before drop-write, and treat fd-dup redirect as non-write (#1918, #2069, #2120, #2121, #2124, #2127)
• Shell recovery and drift: prevent recovery storms and use zsh preexec $3 for drift (#2072, #2073)
• Audit logging: show hook context (#2082)
• Core runtime: preserve tool arguments, align compaction, show real session prompt, fail closed on emit error, and make truncation UTF-8-safe (#1844, #1847, #2003, #2005, #2118)
• Types, wire, and packaging: fix wire errors, drop cross-workspace dev-dep, align RPM identity, align bundle health checks, and add base-dir hint in skill tool (#1514, #1933, #1937, #1984, #2140)

[0.13.0] — 2026-07-26

Added

• Interactive session recovery via /session, /resume, and the --resume launch option (#1546, #1592)
• Workspace-scoped session persistence with schema versioning and legacy-session migration (#1546, #1592)
• MCP tool support for extensible agent capabilities (#1530)
• Contextual shell insight interactions (#1537)
• Secret redaction across core and shell layers (#1555)
• Diagnostic bundle export via cosh doctor (#1576, #1597)
• Extension platform in core and shell (#1583)
• Personalized prompt recommendations (#1606)
• Session compaction to manage persistence growth (#1668)
• PostToolUse response replacement and hook adaptation (#1669)
• Gated startup suggestions (#1671)
• Audit logging across core and shell (#1679)
• Improved session UX with slash command refinements and sysom /auth shortcut (#1726, #1813)
• Route unresolved natural-language input to Agent (#1742)
• Cancel active agent runs with ESC (#1761)
• Turn-scope batch approval consent (#1825)

Changed

• Revert persisted credential encryption (#1748)
• Align task scope documentation (#1445)
• Stabilize core and shell test gates (#1699)
• Speed up raw CLI tests and fake stream pacing (#1797)
• Track cosh-shell test inventory at 2469 (#1827)

Fixed

• Session command parsing, signal exits, slash argument handling, and prompt ghost ESC (#1632, #1634, #1636, #1663, #1724, #1843)
• Agent question interaction, suggestion controls, recommendation scopes, and tab redraw (#1725, #1741, #1749, #1758, #1821)
• Approval card layout, blocked-title alignment, and empty enter handling (#1786, #1788, #1838)
• Auth and trust hardening: validate providers, harden auth, preserve trust blocks, encrypt credentials, and expand paths (#1627, #1673, #1701, #1722, #1777, #1784, #1791, #1809, #1816, #1841)
• Audit logging fixes: kill trees, split compound commands, redact secrets, scope claims, and preserve export path (#1611, #1613, #1635, #1765, #1772, #1840, #1842)
• Core runtime stability: JSONL validation, tool selection errors, streamed state, ai-like tables, revision clock, free-text clearing, layout gates, and SysOM terminator (#1599, #1661, #1689, #1730, #1731, #1799, #1800, #1803, #1839)
• Platform and CLI correctness: honor dry-run, handle skipped checkpoints, allow search patterns, fix package dry-run/search results, respect cargo config, sync Bash HISTFILE, validate workspace paths, route --help to stdout, add skill arg checks, warn on redacted writes, skip DEBUG trap, restore utility tools, stop BASHOPTS extdebug leak, handle null redirection, keep provider handoffs alive, update DashScope URL, raw action relay watchdog, restore startup health row, hide receipt audit ref, and update test inventory baseline (#1426, #1440, #1633, #1637, #1642, #1646, #1672, #1675, #1676, #1710, #1719, #1733, #1783, #1787, #1790, #1795, #1808, #1812, #1818, #1820, #1845)

[0.12.0] — 2026-07-12

Added

• Move authentication ownership into cosh-core with isolated config layers (f028ad90)

Changed

• Consolidate logging under a unified runtime module (db86b3dd)
• Migrate component docs into user-guide/developer-guide and add cosh-ng docs (317d3f26, adf63ac2)
• Rename *_CN.md docs to *_zh.md and fix cross-references (82f8dab4)

Fixed

• Honor svc dry-run across platform and cli (4c593050)
• Preserve manual aliyun fallback and legacy STS auth (924dd76b, ee1dd179)
• Protect auth provider edits; prioritize aliyun auth option (f0c97efa, 904655fb)
• Bound host-executed shell preview (a6da7301)
• Route noninteractive cosh launcher calls; support raw command passthrough (ecb56739, 1490eb3c)
• Bind startup prompt and agent request context (14d6336f, 25d9d28f)
• Own prompt boundary in shell (#1310)
• Avoid UTF-8 split in loop detection (ef7f5147)
• Remove provider-visible skill hints; guide diagnostic skill use (a6024873, 7f695178)
• Drop redundant format borrow; satisfy clippy diagnostics (5e14a686, 063217f1)
• Stabilize CI, raw-cli, PTY, and service tests (d573796d, 3563a5ab, 0fb34ea6, fc28da5f, ad138d45, 65421d25, 5b17b892, 3e43ba6e, 707bc3c0)

[0.11.0] — 2026-06-28

Added

• Aliyun authentication provider with ECS auto-detection, STS credentials, and QR code flow
• SysOM Aliyun provider with ACS3 signing for LLM API access
• Per-turn SLS JSONL logging for observability
• SysOM request source identification headers
• Structured tracing logging system across all crates
• Sandbox bypass approval flow on PostToolUseFailure hook events
• Startup health scan for environment diagnostics
• Extension/hook/skill enable/disable commands (/extensions, /hooks, /skills)
• Unified component state management module
• Dedicated HOOK approval panel with simplified UI
• UserPromptSubmit hook with Ask approval enforcement
• Shell evidence read admission control in cosh-core
• Tool activity rendering in cosh-shell
• cosh-switch hint in startup banner for toggling between cosh-ng and copilot-shell

Changed

• BREAKING: Rename CLI binary from cosh to cosh-cli; remove dispatch_core
• RPM spec: install cosh-cli binary, /usr/bin/cosh launcher, cosh-switch script, Conflicts: copilot-shell
• Replace eprintln with structured tracing macros
• Unify hook decision aggregation with fold_decision
• Update workspace repository URL to github.com/alibaba/anolisa

Fixed

• Auth ECS flow and panel overlap on phase transitions
• Auth QR code rendered without ANSI escape codes
• Use SysomProvider for aliyun after auth success
• Align hook input fields and AfterModel/wrap_tool_response with copilot-shell protocol
• tool_result dedup guard and visibility
• Restore prompt before shell handoff
• Suppress duplicate evidence reads
• Reduce failed-command auto analysis noise
• Skill existence check and harden approval matching
• Resolve clippy warnings across cosh-core and cosh-shell

[0.10.0] — 2026-06-23

Added

• Shell evidence protocol for capturing and replaying command execution context
• Shell evidence control tool in cosh-core for evidence lifecycle management
• Hook protocol aligned with copilot-shell for zero-change extension support
• Per-hook decision propagation through notification protocol
• Hook warnings rendered with per-hook decision color-coding in cosh-shell

Changed

• Share agent error display text across cosh-shell modules

Tests

• Cover shell evidence raw CLI flows

[0.9.0] — 2026-06-22

Added

• Hook notifications integrated into approval panel with ⚠ warning display
• Hook ask decisions enforce user approval even in Trust/Auto modes
• Extended hook system with tool_use_id association and new event types
• Registry protocol for /extensions /skills /hooks slash commands

Fixed

• Show Registry group in /help output

Changed

• Remove dead skill management code

[0.8.0] — 2026-06-18

Changed

• Rename cosh-tui crate and binary to cosh-core across the entire workspace
• Update adapter system: CoshTuiAdapter → CoshCoreAdapter, AdapterKind::CoshTui → CoshCore
• Update environment variable COSH_TUI_PATH → COSH_CORE_PATH
• Update RPM spec, documentation, and all test fixtures

Fixed

• Neutralize agent status text in streaming cards
• Align streaming card widths in cosh-shell

[0.7.0] — 2026-06-17

Added

• Extension discovery and loading module with cosh-extension.json manifest support
• Extension hooks integrated into startup lifecycle
• Skill module with multi-level loading (built-in, user, project) and hot-reload
• SkillManager integrated into tool registry and startup
• Available skills injected into system prompt for LLM discovery

Fixed

• Infinite loop in expand_env_vars when environment variable is undefined
• Warn on unsupported extension hook events (PostToolUseFailure, BeforeModel, AfterModel) instead of silently discarding
• Align extension hooks format with copilot-shell nested group structure
• Remove unused args parameter from skill tool schema to avoid misleading LLM
• Show question free text answers in cosh-shell
• Harden foreground shell handoffs
• Share copilot shell config path and keep legacy config fallback

Changed

• Normalize cosh-shell config keys
• Standardize cosh-shell code and test organization
• Move user state under copilot shell scope

[0.6.0] — 2026-06-16

Added

• P0 hook system with 5 lifecycle events (on_session_start, on_turn_start, on_turn_end, on_tool_call, on_session_end) in cosh-tui
• Shell approval classification and hook origin tracking in cosh-shell
• Migrate current cosh shell into monorepo workspace

Fixed

• Address approval review findings in cosh-shell
• Harden shell evidence continuation to prevent dropped context
• Normalize tool call streaming protocol in cosh-tui
• Fix passthrough for subcommands in cosh-shell

[0.5.0] — 2026-06-15

Added

• CoshTuiAdapter persistent process mode (spawn once, reuse across agent runs, auto-restart on death)
• ask_user round-trip through control protocol (agent can ask inline questions routed to TUI)

Changed

• Split cosh-tui main into cli/headless/interactive modules
• Rename binary from cosh-tui-core back to cosh-tui

[0.4.1] — 2026-06-15

Added

• settings.json → config.toml auto-migration with AES-256-GCM encrypted API key decryption
• JSONL protocol and tool approval integration tests

Fixed

• Prepend precmd in PROMPT_COMMAND to capture real exit code (Alibaba Cloud Linux /etc/bashrc issue)

[0.4.0] — 2026-06-15

Added

• JSONL wire protocol (InputMessage / OutputMessage) for cosh-shell ↔ cosh-tui communication
• Provider abstraction with OpenAI-compatible streaming (DashScope, OpenAI, DeepSeek, Generic profiles)
• Tool execution framework with 7 built-in tools (shell, read_file, write_file, edit, grep, todo, skill) and approval control
• Context window management, message truncation, loop detection, conversation compression
• Lifecycle hooks framework
• CoshCore agent loop engine
• TOML-based multi-provider config with environment variable expansion

Changed

• BREAKING: Binary interface from ratatui interactive TUI to JSONL stdin/stdout backend
• BREAKING: Config format from settings.json to config.toml
• Rewrite session store with single-file JSON persistence

Removed

• Legacy ratatui-based TUI code (app, commands, llm, logger, theme, tools, ui modules)

[0.3.0] — 2026-06-15

Added

• cosh-shell crate — PTY-based AI-augmented shell host with OSC marker protocol
• Claude, Qwen, Fake AI adapters with streaming support
• Inline rendering engine (approval, question, recommendation, activity panels)
• Governance layer with approval modes
• Terminal recovery via signal handlers (SIGTERM/SIGHUP/SIGQUIT) and panic hook
• Exit code classification with 8 categories (Smart/Auto/Manual analysis modes)
• Tool display engine with per-tool-type parsing and ANSI color categories
• Hook engine with built-in hooks (FailedCommandHook, TestFailureHook) and skill routing
• External hook loading from ~/.config/cosh/hooks/ with subprocess execution
• Native shell compatibility (rcfile loading, PS1, history, login shell detection)
• Context window with sliding window (max commands, max age, token budget)
• Prompt intent optimization (do → Bash tool, know → prose)
• Natural language intercept with visual feedback
• InputClassifier conservative mode for native mode
• Analysis throttle (30s cooldown, max 3 consecutive)
• Consultation card rendering with keyboard capture
• Control protocol for tool approval round-trips
• Startup banner with gradient ASCII art logo
• /mode and /hooks slash commands
• Architecture documentation

Fixed

• Native mode input rendering with powerlevel10k dual-line prompts
• Slash/NL intercept via buffered-then-judge strategy in native mode
• Zsh preexec intercept for command_not_found
• CandidateRedraw line clearing for CJK input and backspace
• Suppress cosh-osc$ prompt leak in native mode
• Tool display label matching in bash tool executor
• Wide character placeholder cell handling in buffer extraction

Changed

• Unified workspace version (0.3.0) for all crates (cosh-types, cosh-platform, cosh-cli, cosh-shell, cosh-tui)

[0.2.0] - 2026-05-16

Hardening + audit-subsystem release. Workspace versions bumped to 0.2.0 together with the release profile and lockfile commit.

Added

• audit subsystem with PEP/PDP/log split: cosh audit check / cosh audit log for command-safety gating and per-session retrieval.
• Workspace release profile (opt-level = 3, lto = true, strip = true, codegen-units = 1), committed Cargo.lock, workspace-level dependency pinning, and native CA cert support.
• Command timeouts, input validation, and panic-safe JSON output across cosh-cli and cosh-platform so a panic still emits a CoshResponse envelope on stderr instead of an empty exit.
• forbid(unsafe_code) on cosh-cli / cosh-platform, plus svc list --state filter validation against an allow-list.
• pkg search cross-references installed status so results show which matches are already installed.
• ResponseMeta.warning field for non-fatal warnings; audit responses are explicitly marked as stub via this field.
• LLM tool surface expansion in cosh-tui: pkg / svc / checkpoint wrapper tools, plus svc enable / svc disable --dry-run.
• Timeouts + exponential-backoff retries on LLM and external command tools in cosh-tui; 60 s shell-tool timeout.

Changed

• TUI /help aligned with the full command set; title bar version and markdown prefix stripping corrected.
• Clippy warnings resolved across the workspace; dead-code allowances dropped; test code aligned with production lint level.
• Build warnings eliminated and version detection improved across cosh-tui / cosh-platform.

Fixed

• Shell safety check tokenized to close tab / newline / redirect / chain bypasses; substring matching on raw command strings replaced with whitespace (incl. \t / \n / \r) tokenization and metacharacter rejection (; | & > < $ ` ( ) { }) — is_safe_command in crates/cosh-tui/src/tools/shell.rs.
• Forbidden tool calls are now blocked even under Yolo approval mode.
• cosh-cli wrapper tool output is bounded so a chatty subcommand cannot blow the LLM context window.
• Tool-call IDs synthesized via a process-wide counter to guarantee uniqueness across the agentic loop.
• settings.json and session files written atomically with 0600 permissions.
• Runtime bounds enforced for the agentic loop, history, config, and tool messages; scrollback bounded with UTF-8-safe truncation.
• Panic hook installed in the TUI; history navigation recovered after panic.
• ws-ckpt IPC response size bounded to 64 MiB.
• Nonexistent systemd services detected via LoadState=not-found instead of misclassifying them as "inactive".

Security

• Audit-stub recoverable / hint semantics surface clearly to agents via the standard CoshError envelope.
• Atomic-rename + 0600 perms on credential-bearing files.

[0.1.0] - 2026-05-10

Initial public-shaped release after renaming the workspace from agos-core to cosh-ng and adding the interactive TUI crate.

Added

• 4-crate workspace: cosh-types, cosh-platform, cosh-cli, cosh-tui with strict dependency direction cosh-cli / cosh-tui → cosh-platform → cosh-types.
• cosh CLI binary with dual-mode dispatch: cosh (no args) execs into cosh-tui, cosh <subsystem> <action> returns structured JSON.
• Cross-distro pkg subsystem: install / remove / search / list routed across dnf / apt-get (apt-cache for search) / zypper based on Distro::detect() reading /etc/os-release.
• svc subsystem over systemctl: status / start / stop / restart / enable / disable / list, with uptime and corrected column mapping in list.
• checkpoint subsystem talking to the ws-ckpt daemon over Unix-socket IPC; bincode wire format with 4-byte LE length prefix and explicit protocol versioning + error handling. Commands: init / create / list / restore / recover / delete / diff / cleanup / status.
• cosh-tui interactive TUI on ratatui + crossterm: slash-command system with auto-complete, session management, theming, custom border set, echo-on-submit.
• Agentic loop with cosh-cli wrapper tools in cosh-tui, bringing pkg / svc / checkpoint tooling to the LLM (initially shipped as cosh-tui v0.4.0).
• LLM chat integration with config-driven providers and UI surfacing.
• Unified settings.json V2 config consolidating prior scattered config files.
• AES-256-GCM decryption for encrypted credentials.
• macOS detection + Homebrew backend in cosh-platform, with unit tests.
• Unified JSON envelope CoshResponse<T> with ok / data / error / meta, classified CoshError carrying recoverable and hint for agent retry decisions.
• Integration tests for pkg and checkpoint CLI commands.

Changed

• Workspace renamed from agos-core (with agos-types / agos-platform / agos-cli) to cosh-ng (with cosh-* crates); agos-cli and agos-platform removed in the same commit.
• cosh-tui checkpoint tooling adapted to the new daemon protocol.

Fixed

• cosh-cli stdout validated as JSON before forwarding to the LLM, preventing parser confusion on malformed bytes.

[pre-0.1.0] - 2026-05-03 → 2026-05-08

Pre-rename agos-core foundation.

Added

• Initial 2-crate workspace agos-types + agos-platform.
• agos-cli cross-distro CLI prototype with pkg, svc, checkpoint, audit command shapes.
• MVP v2 CLI Gateway architecture document and bilingual (English / Chinese) usage guide.

Changelog

All notable changes to ktuner are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial kernel-tuning engine: check/tune/fix/why/rollback commands evaluate 207 rules and output structured JSON tuning recommendations.

Changelog

0.6.2

• Added the ktuner skill for deterministic kernel diagnosis, tuning, and rollback. (#1278)
• Removed legacy OpenClaw and Hermes adapter scripts from source and RPM installs. (#1172)
• Updated anolisa-guide with authenticated Skill Ledger recovery and tamper detection. (#2185)

0.6.1

• Rewrote sysom-diagnosis skill and removed legacy CLI. (#1241)
• Fixed OpenClaw gateway write scope verification in install-openclaw skill. (#1205)

0.6.0

• Added anolisa component contract (component.toml, Makefile, RPM spec). (#1159)
• Added OpenClaw bootstrap guidance to install-openclaw skill. (#1051)
• Added model endpoint preflight before gateway startup in install-openclaw skill. (#1031)
• Added static knowledge base update script for anolisa-guide skill. (#1010)
• Added anolisa-guide skill. (#849)
• Fixed Aliyun mirror fallback for uv and qwenpaw install. (#968)
• Fixed dashscope proxy URL to new Anthropic endpoint in install-claude-code skill. (#858)
• Renamed copaw to qwenpaw across os-skills. (#968)

0.5.0

• Added anolisa-register skill. (#829)

0.4.0

• Added auto-install tokenless plugin support for agent install skills. (#731)
• Added OpenClaw dependency precheck. (#719)
• Improved OpenClaw non-interactive setup. (#687)
• Added Hermes adapter runner. (#617)
• Added standalone ANOLISA adapter entry. (#549)
• Fixed OpenClaw state dir handling normalization. (#641)
• Improved Makefile install paths and contract. (#541)

0.3.0

• Added hermes-agent-install skill. (#353)
• Added clawhub-skill-mng skill with npm install support and YAML description matching. (#315)
• Fixed AgentSight custom db path issue, using default paths instead. (#366)
• Fixed AgentSight token savings query support. (#355)
• Fixed AgentSight interruption CLI and aligned conversation_id naming. (#334)

0.2.2

• Support enable AgentSight dashboard in agentsight skill. (#222)

0.2.1

• Upgraded xlsx skill with MiniMax open-source implementation. (#218)
• Updated skill descriptions from "suitable for alinux4" to "rpm-base linux". (#182)

0.2

• Added humanizer, image-gen, pdf-reader, and xlsx skills. (#178)
• Added cosh-guide skill. (#23)
• Support net/io/load diagnostic capabilities to sysom-diagnosis skill. (#163)

Changelog

All notable changes to SkillFS are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.4.0] - 2026-07-24

Added

• Configurable read-time transforms now keep directive compilation enabled by default and add an opt-in OS adapter with bundled Ubuntu/Alinux rules and external catalog overrides (#1484).
• An authenticated live-source resolver and notify v2 protocol now give Skill Ledger canonical flat or Hermes skill identities, event kinds, and changed paths without exposing backing-root details (#1517).

Changed

• Agent-visible access checks now follow activated snapshot permissions while live-source permissions continue to govern writes (#1517).

Fixed

• SLS telemetry writers now honor /etc/anolisa/.telemetry_disabled dynamically and fail closed when the gate cannot be inspected (#1584).
• Hermes symlink boundaries, resolver paths, socket ownership, and peer authentication now fail closed across discovery, reads, and mutations (#1517).
• Control-socket prerequisite diagnostics now consistently include the public --control-socket flag name (#1739).

[0.3.4] - 2026-07-16

Fixed

• SLS ops logging now preserves exactly one command record when CLI output pipes close early and panic unwinds.

[0.3.3] - 2026-07-10

Added

• Hermes workspace layout compatibility. SkillFS now recognizes Hermes hub markers, preserves management paths, and exposes nested category/skill/SKILL.md skills alongside top-level skills.
• Nested Hermes skills now support activation state, installer lifecycle writes, notifications, audit attribution, fallback snapshots, and hidden visibility.

Fixed

• skillfs validate --json now includes source paths for warning and error entries so automation can locate invalid skills.
• FUSE teardown now bounds failed unmount cleanup and prevents leaked test mounts from affecting later sessions.

[0.3.2] - 2026-07-03

Fixed

• CLI SLS ops logging now records SkillFS mount and runtime operations.
• Runtime metrics now emit real-time deltas for SLS consumers.

[0.3.1] - 2026-07-03

Added

• Managed mount supervision can recover stale FUSE mounts and bound recovery retries during repeated starts.

Changed

• English and Chinese README guidance now covers managed mounts, in-place operation, security boundaries, and troubleshooting.

Fixed

• Post-publish grace reads fallback skill files from source paths after installers finish.
• skillfs validate now reports parse failures in the status summary.
• In-place authoring supports new skills and pending-install ownership changes.
• Managed stop and runtime-dir handling avoid stale ownership and unbounded recovery retries.
• Daemon-facing backing roots under PrivateTmp are rejected before mount startup.
• FUSE smoke cleanup handles leftover mounts and temporary paths more reliably.

[0.3.0] - 2026-06-26

Added

• Runtime security integration for agent skill directories. SkillFS can now consume activation decisions from .skill-meta/activation.json or the user.agent_sec.skill_ledger.activation xattr, then expose each skill as current, hidden, or a trusted fallback snapshot.
• File-change notification for external security daemons. With --activation-mode file, --notify-socket, --activation-events-log, and --activation-reload-mode poll, SkillFS reports skill mutations, reloads activation decisions, and keeps already-opened file handles pinned to their original target.
• Trusted control socket for activation writes. A daemon verified with SO_PEERCRED, executable identity, and start-time checks can update activation JSON or activation xattr through a bounded request API instead of writing .skill-meta through the agent-visible mount path.
• Installer compatibility for common skill installation flows. Staging directories, direct writes, quiet-timeout completion, and post-publish grace windows allow installers to finish writing a skill before SkillFS asks the security provider to scan and activate it.
• In-place mount support for security daemons. Ledger backing roots are bind mounted privately and validated at startup so scanners read the real source tree rather than the agent-facing FUSE view.
• Canonical skill identity based on the directory basename. Frontmatter name: remains display metadata and no longer changes the SkillFS store key or daemon-facing skill id.

Changed

• .skill-meta/** is hidden from ordinary agents and remains accessible only through trusted metadata paths or the control socket.
• Skill mutation notify uses ordinary filesystem event kinds, including create, write, rename, unlink, rmdir, and truncate events, instead of a separate install-complete protocol event.
• POSIX passthrough behavior was expanded for symlink, hardlink, FIFO, path length fallback, open-after-unlink, xattr, and inode consistency cases.

Fixed

• Prevented stale activation views by combining notify-triggered reload, polling, and activation watcher convergence.
• Hardened trusted-writer and trusted-peer checks against process reuse and executable replacement with start-time and file-identity validation.
• Avoided installer and daemon visibility bugs around hidden skills, fallback snapshots, staging paths, and backing-root propagation.

[0.2.0] - 2026-05-09

Added

• FUSE write passthrough for write, create, mkdir, rename, unlink, rmdir, and setattr(size) operations on skill directories.
• Background sync worker that reparses SKILL.md on write and upserts the entry back into SharedSkillStore.
• Immediate visibility for newly created skill directories: mkdir inserts a ParseStatus::Degraded placeholder, then the sync worker overwrites it with the real entry once SKILL.md is written.
• in-place mount mode that accesses the underlying source via /proc/self/fd/{n} to avoid the over-mount self-loop.
• Integration suite crates/skillfs-fuse/tests/write_guard_tests.rs covering both normal and in-place write paths.

Changed

• Directory name is now the authoritative store key. After rename, stale frontmatter name: no longer revives the old key.
• Read of SKILL.md still returns the compiled result; raw file is only used for writes and parsing.
• Architecture docs refactored into docs/specs/skillfs-spec.md, docs/specs/core-spec.md, docs/specs/fuse-spec.md.

Removed

• Workspace-related code paths and the unused workspace config support from skillfs-core (commit 6d604c7).
• Legacy ad-hoc test scripts (kept only scripts/build.sh and scripts/test.sh).

Fixed

• CLI tracing timestamps now use the local timezone instead of UTC.

[0.1.2] - 2026-04-29

Added

• Read-only mount write protection: mknod, symlink, link, and write callbacks all return EROFS.

Fixed

• Parser summary truncation now respects multi-byte character boundaries.

[0.1.1] - 2026-04-29

Added

• skillfs-mount agent skill under docs/skills/ to help users set up, mount, and unmount a SkillFS instance.

[0.1.0] - 2026-04-25

Added

• Initial release of the SkillFS workspace.
• skillfs-core: SKILL.md parser (with Ok / Degraded / Error status), in-memory SkillStore with flat and categorized directory layouts, skillfs-views.toml configuration, conditional compiler::compile, and environment probing (OS, commands, env vars).
• skillfs-fuse: read-only FUSE filesystem that exposes the configured default view at /skills, always-on virtual skill-discover, and compile-on-read for SKILL.md. Other files in a skill directory are passed through to the physical source.
• skillfs CLI: mount, classify, validate, list subcommands.

Changelog

All notable changes to Tokenless will be documented in this file.

Releases from 0.7.2 onward follow Keep a Changelog.

Unreleased

0.7.5 - 2026-08-10

Added

• OpenCode users can now enable Tokenless through a collision-safe local plugin that shares the existing readiness, rewrite, schema, and response-compression hooks (1233cfcf).

Changed

• The Qoder adapter now uses native plugin and hook conventions, replacing compressed tool output in place while preserving fail-open behavior (13817938).

Fixed

• Rewritten shell commands now use the resolved absolute rtk path, so they continue to work in agent environments with a restricted PATH (ae83f7d3).
• Qoder and OpenClaw hooks now preserve agent, session, and tool attribution across rewrite and proxy boundaries (#2158, 2f330656).
• Adapter installation now recognizes legacy /usr/local layouts, recommends RPM upgrade mode, and removes stale packaged user-manual files during upgrades (f7ce3878, ec25d516, 917f151e).

0.7.4 - 2026-07-31

Added

• Tokenless can now be installed from npm on Linux and macOS x64/arm64, including the tokenless, rtk, and toon binaries plus framework adapters (#1929).
• tokenless stats diff now explains estimated savings for records, sessions, and tool uses with text or JSON reports and bounded unified diffs (#1991).
• TOKENLESS_DATA_DIR now sets one trusted directory for both statistics and reversible-compression databases while preserving per-database overrides (#2038).

Fixed

• The Qwencode adapter now declares its delivered compress-toon capability, keeping adapter discovery consistent with its compression behavior (#1945).
• Hermes copy installations now resolve shared hook resources from trusted system, XDG, and user data paths with actionable diagnostics when no safe candidate exists (#2058).

0.7.3 - 2026-07-28

Added

• ANOLISA can now install Tokenless on macOS and enable Qwencode as an independent adapter (#1964).

Changed

• Adapter hooks now discover tokenless, rtk, and toon across user, /usr/local, RPM, and legacy installation layouts (#1957).
• Hook launchers now prefer resources from the active installation, preventing mixed versions when multiple Tokenless installations coexist (#1964).

Fixed

• Tool schema compression now reads the canonical Cosh and Cosh-NG request field, so schemas are compressed instead of silently passing through unchanged (#1894).
• Cosh-NG compression statistics are now attributed to cosh-ng when hook environment variables are present (#1894).
• Qoder plugin installation now expands cached hook paths, preventing invalid /rewrite_hook.py commands from blocking tool calls; the user manual includes recovery steps for affected upgrades (#1924).
• ANOLISA packages now include the shared hook resources required by Tokenless adapters (#1964).

0.7.2 - 2026-07-27

Added

• Tokenless now compresses Cosh-NG tool responses by replacing the original model-visible content (#1669).
• Tokenless now rewrites supported Cosh-NG shell commands for more compact output (#1669).

Changed

• Shell environment checks now report only recommended tools referenced by the current command (#1598).
• tokenless env-check --fix now installs required dependencies only, leaving optional recommendations untouched (#1598).
• Automatic dependency fixes now fail quickly with actionable authentication, network, or permission messages instead of prompting for sudo (#1598).
• Cosh-NG compression statistics are now recorded under the cosh-ng agent (#1669).
• Cosh-NG compression now excludes display-only content from model context (#1669).
• Cosh-NG runs with undetectable versions now keep original tool responses unchanged (#1669).
• Compression now leaves tool results unchanged when the compressed output is not smaller (#1674).
• Tokenless user manuals now live in the central ANOLISA guide instead of the RPM package (#1586).

Fixed

• Claude Code 2.1.121+ now replaces original tool results with compressed versions, preventing duplicate context (#1674, #1686).
• Older or undetectable Claude Code versions now pass tool results through unchanged instead of duplicating compressed context (#1674, #1686).
• Claude Code replacements now preserve built-in tool result formats, including empty fields (#1674, #1686).
• ANOLISA now recognizes the packaged Tokenless version correctly (#1587).

0.7.1

• fix RPM tarball to exclude generated .anolisa/component.toml, ensuring rpmbuild always regenerates the adapter contract from the authoritative .toml.in template — previously stale checked-in copies shipped outdated contracts missing claude-code, codex, and cosh adapter declarations (closes #1470)
• synchronize adapter contracts: declare every shipped driver (qoder, claude-code, codex, cosh, qwencode) in component.toml.in and add CI check (check-component-contract) to keep them in sync
• raise test coverage from 75% to 90%: ~170 new unit tests across all four crates covering compression edge cases, stash round-trip, schema migration, SLS writer, and CLI dispatch
• harden test isolation: replace unsafe env-var mutations with RAII TempDbGuard / EnvGuard to prevent tests from touching real ~/.tokenless state; enforce --test-threads=1 in Makefile (Rust 2024 set_var is unsafe)

0.7.0

• add MCP tokenless_retrieve stdio server (tokenless mcp serve) so MCP-connected agents can recover truncated payloads on demand — the MCP analogue of the tokenless retrieve CLI, closing the stash MCP gap vs Headroom CCR's headroom_retrieve
• complete reversible-compression (stash / CCR) coverage across the remaining lossy paths: ResponseCompressor string truncation, ResponseCompressor depth truncation, and SchemaCompressor description truncation are now stash-backed with <<tokenless:KEY>> markers; fit-check before stash prevents orphan entries; shared stash_suffix() helpers keep marker budget consistent
• add --no-stash / --stash-db flags to compress-schema (mirroring compress-response); dry-run (compression_on=false) skips the stash so markers never reach the LLM without a retrievable entry
• add lazy TTL purge to SqliteStore: expired rows are physically deleted before retrieve lookups so the stash db does not grow unbounded
• add actual-savings-rate display: StatsSummary::actual_savings_percent(session_total_tokens); format_summary() / format_summary_json() accept optional session total and emit an "Overall Savings vs Total Consumption" section plus new JSON fields (session_total_tokens, actual_savings_tokens, actual_savings_percent) — backward-compatible when absent
• add stash write/size counters to compression stats (record_compression_stats extended); retrieve-side hits/misses deferred pending a stats use case
• add qoder framework driver (qodercli install + settings.json merge/prune, AdapterOps::read_file, symlink-safe atomic write_file); gate qoder to adapter_type=plugin; fail closed on forged receipts and require all managed hooks
• raise test coverage from 59% to 75%: 100+ new unit tests plus 18 CLI integration tests across all four crates, test code moved to src/tests/ via include!() for cleaner separation
• add reversible-compression user manual (docs/stash-reversible-compression.md) plus README updates: architecture tree entry for tokenless-ccr, retrieve subsection documenting hash/marker input and --no-stash/--stash-db, scenario-mapping rewrite of the "Applicable Scenarios & Expected Effects" chapter
• rename tokenless docs *_CN.md to *_zh.md, add bidirectional bilingual links, create README.md + README_zh.md
• address adapter review findings: trust packaged datadir roots for Codex symlink targets, scope Claude Code marketplaces per component and fail closed, reject framework/adapter type mismatches before enable
• silence clippy warnings surfaced by rustc 1.94 stable in existing tests (field_reassign_with_default in tokenless-cli, bool_assert_comparison and default_constructed_unit_structs in tokenless-stats)

0.6.1

• bundle tool_categories.json into dist for npm installs
• use node: prefix, eliminate shell subprocess in openclaw plugin

0.6.0

• add absolute saved values + schema version to JSON output
• use import.meta.dirname instead of __dirname in openclaw plugin
• add qwencode adapter for Qwen Code extension
• fix rtk pytest 'No tests collected' regression
• add trusted FHS fallback paths for hook_utils import in codex scripts
• add SLS JSONL data collection with config toggle
• add tokenless RPM component contract (publishing metadata)
• add compression toggle with dry-run compare mode (TOKENLESS_COMPRESSION_ENABLED, stats summary --compare)
• enable SLS recording by default and document usage
• align compression mode serde/db form and dedup config load
• expand RPM component contract (bundle.entry + hermes)
• make SLS writer append-only and skip when log file absent
• prefer tool_call_id over internal tool_use_id for qwencode hooks
• bump vendored rtk to v0.43.0; rework pytest stderr-surfacing patch for the refactored runner; drop grep-fallback-fix (root cause fixed upstream) and preflight-skip-python (reversed upstream)
• sync toon-format to 0.5.0 in Makefile and spec (was stale at 0.4.6)

0.5.1

• add --json output to stats summary
• implement unified tool categorization and 3-layer compression strategy
• add rtk grep fallback pattern fix patch
• add rtk pytest error report patch

0.5.0

• add Hermes adapter runner
• drop TOON wrapper prefix and slim diagnostic tags
• unify rtk rewrite exit code 3 handling across adapters
• secure shell variable interpolation in env-fix and hooks
• add subprocess returncode checks and extract shared hook utilities
• secure resolveBinaryPath and improve binary cache invalidation
• use mktemp in tests and safe home expansion
• bound SchemaCompressor recursion to prevent stack overflow
• propagate env-fix subprocess failures instead of returning stdout
• anchor home lookup on getpwuid_r and trust-check candidate binaries
• harden env-fix install paths with uid trust check and divert stderr to log
• recover from poisoned mutex in stats recorder instead of failing
• add input size limit and validate db path
• reserve truncation marker length in response compressor
• rename openclaw plugin Name to Tokenless and ID to tokenless
• add qoder CLI adapter
• compress-schema on array input
• warn when compression is skipped
• stats command syntax
• add Claude Code adapter plugin
• error on TTY stdin instead of hang
• add codex adapter plugin
• fix compression pipeline output inflation, truncation and hook timeouts
• harden env-fix, version extraction, file trust, schema, permissions
• address review findings — trailing newline, chmod guard, rate-limited log, comment
• make env attribution reachable for skip-tools entries
• add selective-claw context engine plugin
• address review findings for selective-claw plugin
• remove invalid "2" dependency from selective-claw
• restore indentation in compress_response_hook.py
• harden hook exit-code handling + trust model consistency
• only warn on truly unexpected rtk exit codes
• dedup rewrite_hook, import from hook_utils

0.4.1

• fix version_ge 3-segment truncation in env_check.rs (compare all segments)
• add qoder, claude-code, codex adapter plugins and documentation
• sync manifest.json with template to include all six agents
• update README and user manuals for new agent integrations
• add pycache to root .gitignore
• update response-compression.md with all agent integration paths
• derive Makefile version from Cargo.toml, fix spec changelog weekday
• normalize adapter version numbers to 0.4.0
• derive adapter plugin versions from Cargo.toml instead of hardcoding

0.4.0

• correct 5 bugs in stats, naming, SQL, paths and permissions
• align FHS paths, restructure adapter dir, remove install.sh
• address code review findings across schema, env-check, hooks, and plugin
• add hermes agent plugin
• security hardening & critical algorithm correctness
• behavioral correctness & logic fixes
• dedup, dead code removal & cosmetic cleanup
• support staged installs
• support Debian/Ubuntu FHS paths and harden binary resolution
• build OpenClaw plugin to dist/index.js

0.3.2

• replace spoofable home-dir uid derivation with libc::getuid() syscall for trust chain integrity
• replace subprocess toon -e calls with in-process toon_format::encode_default() library call
• replace rtk/toon git submodules with crates.io deps and inline toon-format source
• hard-fail on rtk stats patch failure in justfile setup-rtk recipe
• unify compress-toon/compress-schema/compress-response error exit codes (all exit 2)
• remove 2>/dev/null || true from Makefile toon install (hard fail on missing binary)
• remove redundant #[source] attribute on thiserror variants that already have #[from]
• deduplicate Python hook FHS path constants into shared hook_utils module
• add libc to workspace dependencies for uid syscall
• add detailed rust >= 1.89 comment in spec.in explaining CI pin rationale

0.3.0

• add tool-ready 4-phase environment pre-check with cosh extension integration
• skip compression and stats when no token savings
• pass caller context to rtk stats via .rewrite-context file
• remove redundant cosh extension install/uninstall from install.sh
• convert cosh hooks to extension format per cosh dev guide
• skip zero compression and stats recording
• use isExecutable() and resolved paths in openclaw plugin
• resolve rtk/toon binary paths for RPM-installed plugins
• correct RPM install paths to align with install.sh expectations
• preserve tool result message structure in TOON encoding
• align install paths with FHS
• auto-record stats with real tool_use_id from hook payload
• restructure RPM dirs and remove auto plugin/hook installation

0.2.0

• add compression stats with auto-record from real data
• add TOON context compression support
• skip compression for skill and content-retrieval tools

0.1.0

• introduce tokenless into ANOLISA (#199)

Changelog

0.4.2

Features

• Added an telemetry gate to ops log writes (#1509)

Bug Fixes

• Fixed auto-recover orphan .pre-init-bak from interrupted init (#1601)

0.4.1

Features

• Added skip auto-checkpoint after rollback (#1263)

Bug Fixes

• Fixed workspace sync after config update (#1263)
• Fixed absolute path handling for ws-ckpt in crontab entries (#1263)
• Changed rollback -n offset, pass numAncestors as-is (#1263)

0.4.0

Breaking Changes

• BREAKING checkpoint -i/--id flag replaced by -s/--snapshot as primary; -i remains as hidden alias but may be removed in a future release (#1064)

Features

• Added plugin install/uninstall subcommand (#1005)
• Added component.toml for anolisa-cli adapter discovery (#1005)
• Added rollback preview support with --preview parameter (#1103)
• Added elapsed time display after each CLI operation (#1075)
• Added auto-generated snapshot ID when --snapshot is omitted (#1064)
• Added SLS ops log output for dashboard metrics (#1059)
• Added optional -t flag for diff to compare snapshot against current workspace (#848)
• Added rollback-by-ancestor-count and snapshot DAG tracking (#877)
• Added cron-based scheduled checkpoint snapshots (#819)

Bug Fixes

• Fixed --snapshot/-s as primary flag and aligned plugin flag handling (#1103, #1064)
• Fixed SKILL.md to sync with actual CLI/plugin implementation (#847)
• Fixed init and recover to guard against replaced workspace symlink (#860)
• Fixed init rsync by dropping --copy-unsafe-links (#873)

0.3.3

Features

• Added per-workspace policy override with hermes/openclaw plugin support (#721)
• Added /proc cwd occupant guard for init and rollback (#684)
• Added Hermes adapter runner script (#617)

Bug Fixes

• Fixed write lock contention and cwd guard deadlock in rollback (#721, #684)
• Fixed input validation for non-UTF-8 paths and path-traversal snapshot IDs (#695, #678)
• Fixed seccomp arch selection, workspace registry concurrency, and RPM packaging (#695, #684)

0.3.2

• Fixed openclaw uninstall to remove tool whitelist from config
• Fixed parent path refusal to apply as workspace-level rules for skill and openclaw plugin

0.3.1

• Fixed plugin workspace config registration and auto-loading
• Reject workspace paths that are hermes cwd itself or parent
• Fixed plugin tool to prefer explicit workspace parameter over config
• Fixed skill delete requiring --force flag
• Fixed daemon workspace path validation and fswatch fd leak
• Removed unused btrfs_ops.rs module

0.3.0

• Added openclaw plugin scaffolding for ws-ckpt
• Added hermes plugin scaffolding for ws-ckpt
• Made ws-ckpt skill agent-agnostic and prompted for workspace at invocation
• Followed make install contract for build-all integration
• Fixed bugs in list and diff sub-commands
• Made daemon stateful

0.2.0

• Added auto_cleanup feature and switch
• Unified config modification entry through the TOML file
• Added global CLI warning when any workspace>1000 snapshots or filesystem usage>90%
• Fixed backend detection and daemon state recovery logic
• Fixed image size configuration not taking effect after daemon restart
• Removed obsolete fs_warn_threshold_percent parameter
• Fixed config.toml to ship as a sample file

0.1.0

• Daemon with Unix Socket IPC and Bincode binary protocol.
• init / checkpoint / rollback / delete / list / diff / cleanup / status / config commands.
• Background scheduler: auto-cleanup, health check, orphan recovery.
• Multi-backend: btrfs-base / btrfs-loop / overlayfs with auto-detection.
• TOML config persistence with runtime hot-reload.
• systemd service with RPM packaging for Alinux 4.